OWASP / QRLJacking

QRLJacking or Quick Response Code Login Jacking is a simple-but-nasty attack vector affecting all the applications that relays on “Login with QR code” feature as a secure way to login into accounts which aims for hijacking users session by attackers.
GNU General Public License v3.0
1.33k stars 619 forks source link

QR code not loading #200

Open rockstar0050 opened 1 year ago

rockstar0050 commented 1 year ago

Hi I am getting below logs and the QR code is not loading. Could anyone please help me.

QrlJacker Module(grabber/whatsapp) > run [+] Using the default useragent [+] Running a thread to keep the QR image [whatsapp] [+] Waiting for sessions on whatsapp [+] Running a thread to detect Idle once it happens then click the QR reload button [whatsapp] [+] Initializing webserver... [whatsapp] 
QrlJacker Module(grabber/whatsapp) > ---------------------------------------- Exception occurred during processing of request from ('127.0.0.1', 43532) Traceback (most recent call last): File "/usr/lib/python3.10/http/server.py", line 727, in send_head f = open(path, 'rb') FileNotFoundError: [Errno 2] No such file or directory: '/home/rockstar005 Downloads/QRLJacking/QRLJacker/core/www/whatsapp/tmp.png' 
During handling of the above exception, another exception occurred: 
Traceback (most recent call last): File "/usr/lib/python3.10/socketserver.py", line 316, in _handle_request_noblock self.process_request(request, client_address) File "/usr/lib/python3.10/socketserver.py", line 347, in process_request self.finish_request(request, client_address) File "/usr/lib/python3.10/socketserver.py", line 360, in finish_request self.RequestHandlerClass(request, client_address, self) File "/home/rockstar005/Downloads/QRLJacking/QRLJacker/core module_utils.py", line 27, in init super().init(*args, directory=serve_dir, *kwargs) File "/usr/lib/python3.10/http/server.py", line 668, in init super().init(args, **kwargs) File "/usr/lib/python3.10/socketserver.py", line 747, in init self.handle() File "/usr/lib/python3.10/http/server.py", line 433, in handle self.handle_one_request() File "/usr/lib/python3.10/http/server.py", line 421, in handle_one_request method() File "/usr/lib/python3.10/http/server.py", line 672, in do_GET f = self.send_head() File "/usr/lib/python3.10/http/server.py", line 729, in send_head self.send_error(HTTPStatus.NOT_FOUND, "File not found")File "/usr/lib/python3.10/http/server.py", line 488, in send_error self.wfile.write(body) File "/usr/lib/python3.10/socketserver.py", line 826, in write self._sock.sendall(b) BrokenPipeError: [Errno 32] Broken pipe



QrlJacker Module(grabber/whatsapp) >

vinniepie commented 1 year ago

IMG_20230202_140953.jpg

Same here...

husshuss179 commented 1 year ago

same here

did u find a solution?

IMG_20230202_140953.jpg

Same here...

rockstar0050 commented 1 year ago

Not Yet

vinniepie commented 1 year ago

I Will try it on my other laptop. I have this problem with kali x86 My other laptop is x64 based. I wil try it there... For now i have no solution :/

When i use Debug Firefox wil automatic open. But with debug disabled it wil not open Firefox I don't understand the problem of this program

vinniepie commented 1 year ago

same here

did u find a solution?

IMG_20230202_140953.jpg

Same here...

IMG_20230204_120851.jpg

Geckodrivers are updated yesterday. Try to Install the update, en try to run again (:

husshuss179 commented 1 year ago

same here did u find a solution?

IMG_20230202_140953.jpg Same here...

IMG_20230204_120851.jpg

Geckodrivers are updated yesterday. Try to Install the update, en try to run again (:

im travelling at the moment and i dont have my laptop can you try it ? tell me if it worked.

vinniepie commented 1 year ago

same here did u find a solution?

IMG_20230202_140953.jpg Same here...

IMG_20230204_120851.jpg

Geckodrivers are updated yesterday. Try to Install the update, en try to run again (:

im travelling at the moment and i dont have my laptop can you try it ? tell me if it worked.

Same issue on x64 version of Kali Linux. I'm now trying it with Ubuntu.

rockstar0054 commented 1 year ago

any update guys.

LucaReggiannini commented 1 year ago

I think that the code is outdated. I see 2 problems:

  1. the xpath for the images on Whatsapp page seems changed: file "QRLJacker/core/modules/grabber/whatsapp.py" must be updated

  2. the code uses method "Screenshot" in "QRLJacking/QRLJacker/core/module_utils.py" to get the screenshot of the entire page. Later it uses xpath to find QR Code location/size and uses this information to crop the QR from the screenshot. The problem is that the method "Screenshot" throws an error: 'WebDriver' object has no attribute 'find_elements_by_xpath'. This error should be caused by the fact that "find_elements_by_xpath" is deprecated in newer version of Selenium (see https://github.com/SeleniumHQ/selenium/blob/a4995e2c096239b42c373f26498a6c9bb4f2b3e7/py/CHANGES) so we need to consider another method (maybe ".find_element", see https://selenium-python.readthedocs.io/locating-elements.html)

I don't know if there is anything else to be fixed at the moment.

I don't know if this project is dead: is there anyone who want to fix this?

Edit: working on it

LucaReggiannini commented 1 year ago

Found and fixed other problems that prevents the program from working correctly. I'm going to update my forked repo in a couple of days and submit a pull request

vinniepie commented 1 year ago

Very nice 😄👌

On Mon, 10 Apr 2023, 13:02 LucaReggiannini @.***> wrote:

Found and fixed other problems that prevents the program from working correctly. I'm going to update my forked repo in a couple of days and submit a pull request

— Reply to this email directly, view it on GitHub https://github.com/OWASP/QRLJacking/issues/200#issuecomment-1501681310, or unsubscribe https://github.com/notifications/unsubscribe-auth/AUNIJ6ASYGJORHKBA35RNYLXAPSDTANCNFSM6AAAAAAUPQGIWI . You are receiving this because you commented.Message ID: @.***>

SymbianSyMoh commented 1 year ago

Hello @LucaReggiannini, Sorry for not replying back in time, I would like to thank you a lot for your efforts, once you make the PR and everything goes well please reach out to me to add you as a maintainer because most of the maintainers are so busy in the meantime.

LucaReggiannini commented 1 year ago

Hello everybody. Working on: https://github.com/LucaReggiannini/QRLJacking Seems like QRLJacker is working again. Tested on:

kali@kali:~/Downloads/QRLJacking/QRLJacker$ uname -a && python --version
Linux kali 6.1.0-kali5-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.12-1kali2 (2023-02-23) x86_64 GNU/Linux
Python 3.11.2

This specific issue was about Whatsapp so i actually tested/fixed the code for the Whatsapp grabber. Before submitting the pull request ~i will try the code on a Windows machine~. Meanwhile feel free to see/test the changes. Any criticism is welcome.

Edit: sorry i was tricked by the OS check message

elif os.name=="nt":
    error("The framework is designed to work on linux or windows only! Sorry for that :)")

Fixed this typo. I actually tested the code on MacOS Monterey and fixed some other bug.
The problem now is that i can't fully test the framework on MacOS because Firefox is not displaying the QRCode on Whatsapp Web page: i think i miss hardware acceleration because the system is installed on a virtual machine (tried Homebrew and native App without any luck).
I will make the pull request in hope that someone with a Macintosh can test the changes.

LucaReggiannini commented 1 year ago

Update done. The problem should be solved: can you recheck guys?

@SymbianSyMoh Thanks for the merge. If you want I can help keep the project up to date

bernarrdgnazou commented 4 months ago

Module(grabber/whatsapp) > run [+] Using the default useragent [+] Running a thread to keep the QR image [whatsapp] [+] Waiting for sessions on whatsapp [+] Running a thread to detect Idle once it happens then click the QR reload button [whatsapp] [+] Initializing webserver... [whatsapp]

QrlJacker Module(grabber/whatsapp) > Exception in thread Webserver manager thread: Traceback (most recent call last): File "/usr/lib/python3.11/threading.py", line 1038, in _bootstrap_inner self.run() File "/usr/lib/python3.11/threading.py", line 975, in run self._target(*self._args, **self._kwargs) File "/home/artemix/Hacking_tools/QRLJacking/QRLJacker/core/browser.py", line 198, in serve_module webserver.start_serving(host) File "/home/artemix/Hacking_tools/QRLJacking/QRLJacker/core/module_utils.py", line 33, in start_serving self.httpd = ReusableTCPServer( (host, self.port), MyHandler) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/socketserver.py", line 456, in init self.server_bind() File "/usr/lib/python3.11/socketserver.py", line 472, in server_bind self.socket.bind(self.server_address) OSError: [Errno 98] Address already in use

krlabs commented 1 month ago

Problem still actual.

arjeeeen commented 2 weeks ago

Hello everybody. Working on: https://github.com/LucaReggiannini/QRLJacking Seems like QRLJacker is working again. Tested on:

kali@kali:~/Downloads/QRLJacking/QRLJacker$ uname -a && python --version
Linux kali 6.1.0-kali5-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.12-1kali2 (2023-02-23) x86_64 GNU/Linux
Python 3.11.2

This specific issue was about Whatsapp so i actually tested/fixed the code for the Whatsapp grabber. Before submitting the pull request ~i will try the code on a Windows machine~. Meanwhile feel free to see/test the changes. Any criticism is welcome.

Edit: sorry i was tricked by the OS check message

elif os.name=="nt":
    error("The framework is designed to work on linux or windows only! Sorry for that :)")

Fixed this typo. I actually tested the code on MacOS Monterey and fixed some other bug. The problem now is that i can't fully test the framework on MacOS because Firefox is not displaying the QRCode on Whatsapp Web page: i think i miss hardware acceleration because the system is installed on a virtual machine (tried Homebrew and native App without any luck). I will make the pull request in hope that someone with a Macintosh can test the changes.

Ciao Luca, hai risolto definitivamente? Perchè purtroppo il problema persiste

rizwanreshi081 commented 1 week ago

qr QR code not generating, can anyone tell me what seems to be the problem.