![QRL Jacking Vulnerablity In WHATS APP 2018 [Session Hijacking]](https://cdn.blogarama.com/images/posts_thumbs_site_id/12866/1286604-924900244.jpg "QRL Jacking Vulnerablity In WHATS APP 2018 [Session Hijacking]")
HACK ANY WHATS APP ACCOUNT--FULL TUTORIAL 2018
-+-+-ASK ANY QUESTION HERE+-+-+-
INSTAGRAM---https://www.instagram.com/faizann_ali/
Subscribe to my channel
https://www.youtube.com/channel/UCeJU...
*****************DISCLAIMER:THIS VIDEO IS JUST FOR EDUCATIONAL PURPOSE ONLY.CONTENT OF THE VIDEO DOESN'T BELONGS TO ANY ILLEGAL ACTIVITY THE MAIN AIM OF THE VIDEO IS TO EDUCATE PEOPLE ABOUT INTERNET SECURITY.****************
AYOOO WHAT UP HACKVINERS FAIZAN BACK HERE WITH A NEW VIDEO IN THIS VIDEO I WILL SHOW YOU QRL-JACKING VLNERABILITY IN WAHATS APP..
IN THIS VIDEO I AM MAKING A PHISHING PAGE THAT HAS QRL-CODE IN BUIT IF THE VICTIM SCANS THE QRL A CODE HIS ACCOUNT WILL BE GET HACKKED ND YOU CAN SEE WHAT HE IS DOOING ON THE HIS/HER WHATS APP ACCOUNT.
THE SCRIPT I AM SHOWING YOU CAN EASILY RE-WRITE THAT SCRIPT AND CAN CHANGE IT TO A GOOD SCRIPT!! (LOL:GOOD SCRIPT)
WATCH FULL VIDEO FOR PRACRICAL
WHAT IS QRL JACKING?? OWASP VULNERABILITY
QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” feature as a secure way to login into accounts. In a nutshell, the victim scans the attacker’s QR code which results in session hijacking.
What are the requirements to achieve a successful QRLJacking attack?
The QRLJacking attack consists of two sides:
Server Side: A server side script is needed to serve and shape the final look to the victim.
Client Side: Cloning the QR Code and pushing it to the phishing page.
Our example will be: The WhatsApp Web Application!
Server Setup (Attacker's hosting):
Upload "qrHandler.php" to your server. This php file is used to convert the base64 QR Code string into a valid .JPG file.
Now you have a valid, generated, QR image named "tmp.jpg" residing in the same root folder as your files which will be updated whenever that php file is called, so we can put it anywhere. For example: a fake WhatsApp page, a scam page with an offer related to WhatsApp, etc. Depending on your creativity.
Now update the "phishing.html" file with your prefered phishing page source code.
Exploitation, Client Side Setup (Attacker's browser):
Manually:
Open your Firefox browser.
Write "about:config" in the url area, click the "I'll be careful, I promise" confirmation button.
Search for a preference named "security.csp.enable" and change its value to "false" by double clicking it to allow performing an XHR Request from a different domain (we're not supporting leaving this preference disabled, you may do that while testing, but after that you should set the preference to its original state).
Install the Greasemonkey add-on (https://addons.mozilla.org/en-US/fire...) and be sure that the module file "WhatsAppQRJackingModule.js" is loaded and already running.
Now we're ready. Browse to our example "https://web.whatsapp.com" on your side and wait for a WhatsApp session to be loaded. Greasemonkey should now inject our WhatsApp module file to catch.
Send the direct link of the final phishing page to a victim.
Once the QR Code is scanned, the victim's session is yours.
Automatically:
Using QRLJacker - QRLJacking Exploitation Framework
Demo Video:
Attacking WhatsApp Web Application and performing a MITM attack to inject a bogus ad including WhatsApp QR Code. Demo Video
Technical Paper
The technical paper clarifying everything about the QRLJacking attack vector can be found directly via our Wiki.
Vulnerable Web Applications and Services
There are a lot of well-known web applications and services which were vulnerable to this attack until the date we wrote this paper. Here are some examples (that we have reported) including, but not limited to:
Chat Applications:
WhatsApp, WeChat, Line, Weibo, QQ Instant Messaging
Mailing Services:
QQ Mail (Personal and Business Corporate), Yandex Mail
eCommerce:
Alibaba, Aliexpress, Taobao, Tmall, 1688.com, Alimama, Taobao Trips
Online Banking:
AliPay, Yandex Money, TenPay
Passport Services “Critical”:
Yandex Passport (Yandex Mail, Yandex Money, Yandex Maps, Yandex Videos, etc...)
Mobile Management Software:
AirDroid
Other Services:
MyDigiPass, Zapper & Zapper WordPress Login by QR Code plugin, Trustly App, Yelophone, Alibaba Yunos
COMMENT
LIKE
SHARE
AND
SUBSCRIBE
OTHER TAGS:-
qrljacking termux,qrljacking github,whatsapp,whatsapp web,whatsapp sniffer,session hijacking,session hijacking in hindi,whatsapp web qr code
