Hacking

QRL jacking

Quick Response Code Login Jacking (also known as QRL Jacking) is a social engineering attack by which the attacker can hijack the session, affecting all applications that depends on the "Login with QR code" feature as a secure way to login into their respective accounts. In simpler words, the attacker's QR code is scanned by victim which results in session hijacking.

For example: by using the QRL Jacking tool, the attacker can create a phishing page of the WhatsApp web's QR Code. When the victim scans this QR Code from his/her device, the generated authentication token is then sent to the attacker's server. The attacker then verifies the authentication token from the WhatsApp web website; he can then see the victim's messages.

Earn two pentesting certifications at once!

Enroll in one boot camp to earn both your Certified Ethical Hacker (CEH) and CompTIA PenTest+ certifications — backed with an Exam Pass Guarantee.

View Pricing

How QRL jacking works

1. The attacker generates a QR session and clones the Login QR code into a phishing website. Then the well-crafted phishing page with a valid and updated QR code is ready to be sent to the victim.
2. After that, the attacker sends the phishing page to the victim by using his social engineering skills.
3. Victim will scan the QR Code with a specific device.
4. The attacker gains control of the victim's account.
5. The victim's data is exchanged with the attacker's session.

Installation

On Windows

After downloading the Framework and Python:

1. cd QrlJacking-Framework
2. pip install -r requirements.txt
3. python .py

On Ubuntu or Kali Linux

1. git clone https://github.com/OWASP/QRLJacking
2. cd QrlJacking-Framework
3. pip install -r requirements.txt
4. python .py

On OSX

1. git clone https://github.com/OWASP/QRLJacking
2. cd Qrl Jacking-Framework
3. sudo easy_install pip
4. sudo pip install -r requirements.txt
5. python .py

Requirements to achieve a successful QRL jacking

The QRL Jacking consists of two sides:

1. Server Side: A server-side script is needed to serve and shape the final look to the victim.
2. Client Side: Cloning the QR Code and pushing it to the phishing page.

QRL-jacking WhatsApp

Let's take an example from one of the most popular apps of today: WhatsApp.

We all know that WhatsApp uses end-to-end encryption, but it can still be hacked by using this attack method. Let's see walk through how an attacker can gain access to a target's WhatsApp account:

STEP 1

Install the QRL-jacking tool in your Kali machine (you can use Github to clone it), as shown below:

STEP 2

Once the downloading is done, now you will have to install the QRL-jacking tool. As you can see in the figure given below, go to the directory where it has been downloaded. You will have to do two things:

1. Install the requoirements.txt file using the command pip install (if it's not installed on your machine, you install it by using apt-get install pip).
2. You will have to give permission to the executable Python file which is there in the framework directory (use command "chmod 777 'Filename' ").

NOTE: You may get an error if you do not use –r switch, so make sure you use it while installing.

STEP 3

Here comes the interesting part. Once you have downloaded and installed the QRL jacker, run the .py file in the framework directory. Below is the result you will get after running it. As you can see, not only WhatsApp but also other web applications are vulnerable to QRL jacking — applications like mailing services, passport services and online banking.

As we are using the example of WhatsApp, which is a chat application, we will enter 1 as our choice.

STEP 4

When you enter 1, you will be shown a list which contains three chat apps. We will again enter 1 as our choice, because here we're using the example of WhatsApp.

Then we will have to enter a port number to listen on our server. Here you can enter any port number, but 1337 is the default port to listen, so we will enter the same.

STEP 5

Once you have entered the port number to listen to, you will see that the website has opened in your browser contains a QR code. Here comes the social engineering part: you have to lure a victim via email or whatever service you choose. Once the victim scans this QR code, you will get the chat window of the victim's WhatsApp in your browser itself.

One more thing: you can see that below in the picture, there is an option to stay signed in. You can also use that for persistent connection.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Sources

QRL Jacking, OWASP