OWASP / QRLJacking

QRLJacking or Quick Response Code Login Jacking is a simple-but-nasty attack vector affecting all the applications that relays on “Login with QR code” feature as a secure way to login into accounts which aims for hijacking users session by attackers.
GNU General Public License v3.0
1.33k stars 619 forks source link

The XPath / change_identifier issue - question. #209

Closed davidkjackson92 closed 1 year ago

davidkjackson92 commented 1 year ago

Dear @LucaReggiannini

First, I want to say 'thanks' for making this project work.

You mentioned that your XPath is: /html/body/div[1]/div/div/div[4]/header/div[1]/div/img

@john-whick-13 says his XPath is: /html/body/div[1]/div/div/div[4]/header/div[1]/div/div/span

My XPath is the same as that of john-whick-13: /html/body/div[1]/div/div/div[4]/header/div[1]/div/div/span

So the difference is that the last element is either 'img' or 'span'. (So 'img' represents an image while 'span' is the inline equivalent of 'div' - so these two elements don't seem to be of the same type, in my opinion).

I edit the change_identifier in QRLJacker/core/modules/grabber/whatsapp.py and the QR code loads.

I don't know what OS john-whick-13 is using but I scanned the QR code with an iPhone 8 (so quite an old model).

John - what phone and OS are you using to scan the QR code?

Luca - I guess the potential issue is that different phones will have different XPaths so the change_identifier will have at least two options. Do you think that is the case?

Thanks!

LucaReggiannini commented 1 year ago

You are a genius :star2:! I can confirm that the web application is different depending on the operating system on which we have installed Whatsapp. I wouldn't have thought about it even in a thousand years (the solution wasn't obvious to me mainly because I don't have an iPhone and I hadn't seen the possibility of this test :sweat:). I did some tests on an iPhone SE2 and the Xpath is the same as yours.

So right now the XPath should be:

    change_identifier = '/html/body/div[1]/div/div/div[4]/header/div[1]/div'
                # Avatar image for Android: '/html/body/div[1]/div/div/div[4]/header/div[1]/div/img'
                # Avatar image for IOS:     '/html/body/div[1]/div/div/div[4]/header/div[1]/div/div/span'
                        # more precise:             '/html/body/div[1]/div/div/div[4]/header/div[1]/div/div/span/svg'
                # Common XPath:             '/html/body/div[1]/div/div/div[4]/header/div[1]/div'

I think /html/body/div[1]/div/div/div[4]/header/div[1]/div can be used: it can be found on the Chat Page only and is used for a part of the page that is in common between Android and iOS: Screenshot from 2023-04-18 18-58-44

Can you do some test with this new XPath? (right now for me it works for both iOS and Android) Is there another XPath that, at this point, in your opinion, fit best the role of "unique identifier"? Is there any other platform you are able to test right now?

Thanks for the help and the good observations!

davidkjackson92 commented 1 year ago

Thank you for the complement!

It does seem to be working now. Here is my change_identifier = '/html/body/div[1]/div/div/div[4]/header/div[1]/div'

This loads the QR code with the iPhone 8.

(I did run a Whatsapp .apk on my Kindle Fire but there is no option to "link a device" like on the iPhone so I can't test it on anything else I'm afraid).

davidkjackson92 commented 1 year ago

@john-whick-13 - are you able to test the modified change_identifier and report your OS and model?

LucaReggiannini commented 1 year ago

after scanning with android with default change_idintefier = '/html/body/div[1]/div/div/div[4]/header/div[1]/div/img'

not working , after changing it to my x_path it working fine

change_identifier =  '/html/body/div[1]/div/div/div[4]/header/div[1]/div/div/span'

Does it work with /html/body/div[1]/div/div/div[4]/header/div[1]/div too?