GithubHelp home page GithubHelp logo

l9sk / qrljacking Goto Github PK

View Code? Open in Web Editor NEW

This project forked from owasp/qrljacking

0.0 1.0 0.0 2.59 MB

QRLJacking or Quick Response Code Login Jacking is a simple-but-nasty attack vector affecting all the applications that relays on “Login with QR code” feature as a secure way to login into accounts which aims for hijacking users session by attackers.

License: MIT License

Python 73.33% JavaScript 17.11% HTML 4.97% PHP 4.59%

qrljacking's Introduction

QRLJacking - A New Social Engineering Attack Vector

Find documentation in our Wiki.

What is QRLJacking?

QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” feature as a secure way to login into accounts. In a nutshell, the victim scans the attacker’s QR code which results in session hijacking.

What are the requirements to achieve a successful QRLJacking attack?

The QRLJacking attack consists of two sides:

  1. Server Side: A server side script is needed to serve and shape the final look to the victim.
  2. Client Side: Cloning the QR Code and pushing it to the phishing page.

Our example will be: The WhatsApp Web Application!

Server Setup (Attacker's hosting):

  1. Upload "qrHandler.php" to your server. This php file is used to convert the base64 QR Code string into a valid .JPG file.

    Now you have a valid, generated, QR image named "tmp.jpg" residing in the same root folder as your files which will be updated whenever that php file is called, so we can put it anywhere. For example: a fake WhatsApp page, a scam page with an offer related to WhatsApp, etc. Depending on your creativity.

  2. Now update the "phishing.html" file with your prefered phishing page source code.

Exploitation, Client Side Setup (Attacker's browser):

Manually:

  1. Open your Firefox browser.
  2. Write "about:config" in the url area, click the "I'll be careful, I promise" confirmation button.
  3. Search for a preference named "security.csp.enable" and change its value to "false" by double clicking it to allow performing an XHR Request from a different domain (we're not supporting leaving this preference disabled, you may do that while testing, but after that you should set the preference to its original state).
  4. Install the Greasemonkey add-on (https://addons.mozilla.org/en-US/firefox/addon/greasemonkey) and be sure that the module file "WhatsAppQRJackingModule.js" is loaded and already running.
  5. Now we're ready. Browse to our example "https://web.whatsapp.com" on your side and wait for a WhatsApp session to be loaded. Greasemonkey should now inject our WhatsApp module file to catch.
  6. Send the direct link of the final phishing page to a victim.

Once the QR Code is scanned, the victim's session is yours.

Automatically:

Using QRLJacker - QRLJacking Exploitation Framework

Demo Video:

Attacking WhatsApp Web Application and performing a MITM attack to inject a bogus ad including WhatsApp QR Code. Demo Video

Technical Paper

The technical paper clarifying everything about the QRLJacking attack vector can be found directly via our Wiki.

Vulnerable Web Applications and Services

There are a lot of well-known web applications and services which were vulnerable to this attack until the date we wrote this paper. Here are some examples (that we have reported) including, but not limited to:

Chat Applications:

WhatsApp, WeChat, Line, Weibo, QQ Instant Messaging

Mailing Services:

QQ Mail (Personal and Business Corporate), Yandex Mail

eCommerce:

Alibaba, Aliexpress, Taobao, Tmall, 1688.com, Alimama, Taobao Trips

Online Banking:

AliPay, Yandex Money, TenPay

Passport Services “Critical”:

Yandex Passport (Yandex Mail, Yandex Money, Yandex Maps, Yandex Videos, etc...)

Mobile Management Software:

AirDroid

Other Services:

MyDigiPass, Zapper & Zapper WordPress Login by QR Code plugin, Trustly App, Yelophone, Alibaba Yunos

Author

Mohamed Abdelbasset Elnouby (@SymbianSyMoh)

Information Security Researcher

Seekurity Labs

[email protected]

Acknowledgements

I would like to personally thank the talented people who helped shape the QRLJacking attack and got it out into the light. (List in no particular order)

Thanks to:

qrljacking's People

Contributors

symbiansymoh avatar d4vinci avatar shawkyz avatar yipalber avatar aethmos avatar kamalawasthi avatar fiberghost avatar ksheps avatar akashfoss avatar sameersingh7 avatar

Watchers

James Cloos avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.