Current code is no longer compatible with new Selenium releases

OWASP / QRLJacking

QRLJacking or Quick Response Code Login Jacking is a simple-but-nasty attack vector affecting all the applications that relays on “Login with QR code” feature as a secure way to login into accounts which aims for hijacking users session by attackers.

GNU General Public License v3.0

1.33k stars 619 forks source link

Current code is no longer compatible with new Selenium releases #225

Open LucaReggiannini opened 8 months ago

LucaReggiannini commented 8 months ago

Seems like Selenium 4.10 changed a lot of code from previous versions. Take a look at: https://github.com/SeleniumHQ/selenium/commit/9f5801c82fb3be3d5850707c46c3f8176e3ccd8e

The result is that QRLJaker is no longer working (again). The only think i can suggest at the moment is:

downgrade your Selenium version pip install "selenium<=4.9.0"
please look careful at the install instructions: https://github.com/OWASP/QRLJacking/blob/master/QRLJacker/README.md
be sure to download the right version of Geckodriver for your architecture (run uname -a command): https://github.com/mozilla/geckodriver/releases

For now, following the previous instruction, QRLJacker should work fine (i just tested it on various machines).

I will try my best to update QRLJaker again and make it compatible with newer versions of Selenium. I think it will take some time to address the problem because is not easy and I'm quite busy at the moment.

soh23 commented 6 months ago

hi, i am following your instructions it is not working please tell us its solution

dr1408 commented 5 months ago

I hope they will do update and fix and make it work for termux too

soh23 commented 5 months ago

I can not fix it.please fix it

On Sun, Jan 14, 2024, 2:28 AM dr1408 @.***> wrote:

I hope they will do update and fix and make it work for termux too

— Reply to this email directly, view it on GitHub https://github.com/OWASP/QRLJacking/issues/225#issuecomment-1890773302, or unsubscribe https://github.com/notifications/unsubscribe-auth/BFEVZ6D2CV33BMZILQEG65DYOL4AVAVCNFSM6AAAAAA6C2EZRGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOJQG43TGMZQGI . You are receiving this because you commented.Message ID: @.***>

dr1408 commented 5 months ago

Anyone had a fix for termux i have problem with executable path i changed it by nano browser.py To /data/data/com.termux/files/usr/bin/geckodriver

still give me the same error what is the correct executable path in termux .. im using selenium 4.9.0 gecko 0.33 firefox 121.0.1

dr1408 commented 5 months ago

<mgrabber/whatsapp) > run [+] Using the default useragent Exception: init() got an unexpected keyword argument 'executable_path' Trackback: Traceback (most recent call last): File "/data/data/com.termux/files/home/QRLJacking/QRLJacker/core/browser.py", line 76, in new_session new_headless[module_name]["Controller"] = Firefox(profile, executable_path="/data/data/com.termux/files/usr/bin/geckodriver", capabilities=caps)#options=self.opts) # Inserting the browser object TypeError: init() got an unexpected keyword argument 'executable_path' [!] Couldn't open Firefox! Check the installation instructions again!

dr1408 commented 5 months ago

And this is the geckodriver log

1705350330518 geckodriver INFO Listening on 127.0.0.1:53439 1705350331031 mozrunner::runner INFO Running command: MOZ_CRASHREPORTER="1" MOZ_CRASHREPORTER_NO_REPORT="1" MOZ_CRAS> Error: no DISPLAY environment variable specified

Git-Utkarsh commented 3 months ago

This Program is dead as modern applications are not allowing javascript's QR manipulation

Well if your major goal is to perform QRL jacking You can use this https://github.com/swagkarna/EvilJack It Uses Python's Optical Recognition to Capture QR codes of website and host it using flask ...😊 Hope you find it useful