Hack QR Code Through QRLJacking Attack

Hack QR Code Through QRLJacking Attack

QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on “Login with QR code” feature as a secure way to login into accounts. In a simple way, In a nutshell victim scans the attacker’s QR code results of session hijacking. This tool is launched by Information Security Researcher Mohamed Abdelbasset Elnouby from Seekurity Labs.

What are the requirements to achieve a successful QRLJacking attack?

QRLJacking attack consists of two sides:

• Server Side: A server side script is needed to serve and shape the final look to the victim.
• Client Side: Cloning the QR and pushing it to the phishing page.

Example: WhatsApp Web Application!

Server Setup (Attacker's hosting):

Upload "qrHandler.php" to your server, this php file is used to convert the base64 qr code string into a valid .JPG file

Now we have a valid generated QR image named "tmp.jpg" residing in the same root folder of your files and will be updated whenever that php file will be called, So we can put it anywhere "for example a fake WhatsApp page, a scam page with an offer related to WhatsApp, etc... depending on your creativity"

Now update the "phishing.html" file your prefered phishing page source code.

Client Side Setup (Attacker's browser):

1. Open your Firefox browser!
2. Write "about:config" in the url area, click the "i'll be careful, i promise" confirmation button.
3. Search for a preference named "security.csp.enable" and change it's value to "false" by double clicking it to allow performing an XHR Request over a different domain (We're not supporting leaving this preference disabled, you may do that while testing, but after that you should set the preference to its original state).
4. Instal Greasemonkey addon (https://addons.mozilla.org/en-US/firefox/addon/greasemonkey) and be sure that the module file "WhatsAppQRJackingModule.js" is loaded and already running!
5. Now We're Ready, Browse to our example "https://web.whatsapp.com" on your side, Wait for a WhatsApp session to be loaded, Greasemonkey should now inject our WhatsApp module file to catch and .
6. Send the direct link of the final phishing page to a victim "Once the QR scanned, Victim's session is yours now"