If you've integrated Telebirr in Laravel or PHP before, you've probably seen this error: 60200099 Verify the sign field failed At first it looks simple. Then you spend hours debugging: RSA padding parameter ordering webhook…

Sichere Programmierung dev.to 10.06.2026, 12:25 Uhr 3 Min. Lesezeit Finanzwesen & Banking

↗ Quelle (dev.to)

Reagiere als Erste:r — dein Feedback zählt!

If you've integrated Telebirr in Laravel or PHP before, you've probably seen this error:

60200099 Verify the sign field failed

At first it looks simple.

Then you spend hours debugging:

RSA padding

parameter ordering

webhook verification

H5 signing rules

PEM formatting

sandbox vs production differences

…and nothing works consistently.

After dealing with these problems repeatedly, I decided to build a production-focused Telebirr PHP & Laravel SDK that handles the interoperability issues automatically.

GitHub Repository

https://github.com/OgBek/Telebirr-laravel-package-sdk

The Biggest Problem Wasn't the API

The actual API calls are easy.

The hard part was making signatures work reliably across:

sandbox

production

different PHP environments

Laravel request handling

H5 redirect signing

I found that many integration examples online:

signed the wrong fields

used inconsistent sorting

mixed RSA-PSS and PKCS1

ignored replay protection

failed in production even when sandbox worked

One Tiny Mistake Breaks Everything

For example, Telebirr H5 signing only expects these fields:

appid

merch_code

nonce_str

prepay_id

timestamp

If you accidentally include fields like:

version

trade_type

redirect_url

inside the signed payload, you'll randomly get signature failures.

That single issue alone wasted a ridiculous amount of debugging time.

What the SDK Handles

The package now automatically handles:

RSA-PSS signing

Optional PKCS1 support

Deterministic recursive sorting

Webhook verification

Replay attack protection

Timestamp validation

Smart PEM key loading

Laravel integration

Vanilla PHP compatibility

Installation

composer require bekambeyene/telebirr

Publish the config:

php artisan vendor:publish --tag="telebirr-config"

Example Laravel Usage

Create an H5 payment:

$paymentUrl = Telebirr::createOrder(

    'Premium Subscription',

    250.00,

    'ORDER-' . uniqid()

);



return redirect()->away($paymentUrl);

Webhook verification:

$payload = Telebirr::handleWebhook($request);

The SDK automatically validates:

signatures

timestamps

nonce replay attempts

One Unexpected Issue: PEM Keys

A surprisingly annoying issue was .env key formatting.

Some developers:

store raw keys

use base64

use file paths

accidentally break multiline formatting

The SDK now supports:

TELEBIRR_PRIVATE_KEY="file:///var/www/keys/private_key.pem"

as well as raw/base64 formats automatically.

Production vs Sandbox Is Different

One thing I learned quickly:

Sandbox success does NOT guarantee production success.

Production Telebirr environments tend to be stricter about:

padding modes

timestamps

payload ordering

signature consistency

So the package focuses heavily on deterministic behavior.

Security Features

The SDK includes:

replay attack detection

timestamp expiration validation

strict webhook verification

deterministic canonicalization

configurable RSA padding

Why I Open Sourced It

There aren't many well-maintained open source Telebirr integrations focused on Laravel and production interoperability.

I wanted to build something developers could actually rely on instead of repeatedly debugging cryptographic edge cases.

Repository

https://github.com/OgBek/Telebirr-laravel-package-sdk

Feedback, issues, and contributions are welcome.

Tags

laravel php opensource payments ethiopia sdk

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - I Built an Open Source Telebirr SDK for Laravel After Fighting Signature Failures for Days
id: 1af5a59d-d8f2-4f22-b458-89802bf82e8b
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "I Built an Open Source Telebir" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("I Built an Open Source Telebirr SDK for ")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*I Built an Open Source Telebirr SDK for *"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "I Built an Open Source Telebirr SDK for "
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

„MAKEIT – Security Day“ in Gelsenkirchen: Digitale Souveränität und KI im Fokus

IT Security Nachrichten

NÄCHSTER BEITRAG 1 Min

Signal and Mullvad warn about the UK’s plans to scan people’s phones

IT Security NachrichtenWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich I Built an Open Source Telebirr SDK for .... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')