omg, this is super cool...
who the hell did they get that data?
oriettaxx•43m ago
Summary from the About page:
Title: Built: Second City Citation — A Live Chicago Parking Ticket Tracker - Zayyan Faizal
Second City Citation is a project that tracks Chicago parking tickets by reverse-engineering the city's public payment and verification web portals.
The city's parking payment API was found to be insecure, as it fails to verify hCaptcha tokens on the backend, rendering the UI-based security ineffective.
Accessing the city's internal ticket data requires an authorization token obtained through a secondary security endpoint, which revealed poor implementation of RESTful standards.
Parking violation images provided by the city contain metadata, such as officer IDs and exact locations, which can be extracted using OCR technology.
Ticket distribution patterns are inconsistent because enforcement officers frequently skip ticket IDs during shifts, breaks, or when moving between zones.
Ticket ID allocation is not strictly sequential, as the API returns 422 errors when boundaries of assigned ticket blocks are reached.
The developer successfully mapped ticket data by using intelligent scanning algorithms that group active tickets into bands based on ID proximity and recency.
The project utilizes an automated scanner that manages hot, warm, and cold exploration intervals to identify and track new ticket ranges efficiently.
To manage infrastructure costs, the project was deployed on a self-hosted server using Debian and Coolify, secured by Cloudflare Tunnels and Access.
Despite the city attempting to block the server's IP and adding CAPTCHAs to image viewers, the developer maintains the tracker by bypassing these security measures.
oriettaxx•48m ago
oriettaxx•43m ago
Title: Built: Second City Citation — A Live Chicago Parking Ticket Tracker - Zayyan Faizal
Second City Citation is a project that tracks Chicago parking tickets by reverse-engineering the city's public payment and verification web portals. The city's parking payment API was found to be insecure, as it fails to verify hCaptcha tokens on the backend, rendering the UI-based security ineffective. Accessing the city's internal ticket data requires an authorization token obtained through a secondary security endpoint, which revealed poor implementation of RESTful standards. Parking violation images provided by the city contain metadata, such as officer IDs and exact locations, which can be extracted using OCR technology. Ticket distribution patterns are inconsistent because enforcement officers frequently skip ticket IDs during shifts, breaks, or when moving between zones. Ticket ID allocation is not strictly sequential, as the API returns 422 errors when boundaries of assigned ticket blocks are reached. The developer successfully mapped ticket data by using intelligent scanning algorithms that group active tickets into bands based on ID proximity and recency. The project utilizes an automated scanner that manages hot, warm, and cold exploration intervals to identify and track new ticket ranges efficiently. To manage infrastructure costs, the project was deployed on a self-hosted server using Debian and Coolify, secured by Cloudflare Tunnels and Access. Despite the city attempting to block the server's IP and adding CAPTCHAs to image viewers, the developer maintains the tracker by bypassing these security measures.