For example: by using the QRL Jacking tool, the attacker can create a phishing page of the WhatsApp web’s QR Code. When the victim scans this QR Code from his/her device, the generated authentication token is then sent to the attacker’s server. The attacker then verifies the authentication token from the WhatsApp web website; he can then see the victim’s messages.
How QRL jacking works
The attacker generates a QR session and clones the Login QR code into a phishing website. Then the well-crafted phishing page with a valid and updated QR code is ready to be sent to the victim. After that, the attacker sends the phishing page to the victim by using his social engineering skills. Victim will scan the QR Code with a specific device. The attacker gains control of the victim’s account. The victim’s data is exchanged with the attacker’s session.
Installation
On Windows
After downloading the Framework and Python:
cd QrlJacking-Framework pip install -r requirements.txt python .py
On Ubuntu or Kali Linux
git clone https://github.com/OWASP/QRLJacking cd QrlJacking-Framework pip install -r requirements.txt python .py
On OSX
git clone https://github.com/OWASP/QRLJacking cd Qrl Jacking-Framework sudo easy_install pip sudo pip install -r requirements.txt python .py
Requirements to achieve a successful QRL jacking
The QRL Jacking consists of two sides:
Server Side: A server-side script is needed to serve and shape the final look to the victim. Client Side: Cloning the QR Code and pushing it to the phishing page.
QRL-jacking WhatsApp
Let’s take an example from one of the most popular apps of today: WhatsApp. We all know that WhatsApp uses end-to-end encryption, but it can still be hacked by using this attack method. Let’s see walk through how an attacker can gain access to a target’s WhatsApp account:
STEP 1
Install the QRL-jacking tool in your Kali machine (you can use Github to clone it), as shown below:
STEP 2
Once the downloading is done, now you will have to install the QRL-jacking tool. As you can see in the figure given below, go to the directory where it has been downloaded. You will have to do two things:
Install the requoirements.txt file using the command pip install (if it’s not installed on your machine, you install it by using apt-get install pip). You will have to give permission to the executable Python file which is there in the framework directory (use command “chmod 777 ‘Filename’ “).
NOTE: You may get an error if you do not use –r switch, so make sure you use it while installing.
STEP 3
Here comes the interesting part. Once you have downloaded and installed the QRL jacker, run the .py file in the framework directory. Below is the result you will get after running it. As you can see, not only WhatsApp but also other web applications are vulnerable to QRL jacking — applications like mailing services, passport services and online banking. As we are using the example of WhatsApp, which is a chat application, we will enter 1 as our choice.
STEP 4
When you enter 1, you will be shown a list which contains three chat apps. We will again enter 1 as our choice, because here we’re using the example of WhatsApp. Then we will have to enter a port number to listen on our server. Here you can enter any port number, but 1337 is the default port to listen, so we will enter the same.
STEP 5
Once you have entered the port number to listen to, you will see that the website has opened in your browser contains a QR code. Here comes the social engineering part: you have to lure a victim via email or whatever service you choose. Once the victim scans this QR code, you will get the chat window of the victim’s WhatsApp in your browser itself. One more thing: you can see that below in the picture, there is an option to stay signed in. You can also use that for persistent connection.
Sources
QRL Jacking, OWASP
