Toolkit demonstrating another approach of a QRLJacking (https://www.kitploit.com/search/label/QRLJacking) attack, allowing to perform remote account takeover, through sign-in QR code phishing. It consists of a browser extension used by the attacker to extract the sign-in QR code and a server application, which retrieves the sign-in QR codes to display them on the hosted phishing (https://www.kitploit.com/search/label/Phishing) pages. Watch the demo video: Read more about it on my blog: https://breakdev.org/evilqr-phishing
Configuration The parameters used by Evil QR are hardcoded (https://www.kitploit.com/search/label/Hardcoded) into extension and server source code, so it is important to change them to use custom values, before you build and deploy the toolkit. parameter description default value API_TOKEN API token used to authenticate with REST API endpoints (https://www.kitploit.com/search/label/Endpoints) hosted on the server 00000000-0000-0000-0000-000000000000 QRCODE_ID QR code ID used to bind the extracted QR code with the one displayed on the phishing page 11111111-1111-1111-1111-111111111111 BIND_ADDRESS IP address with port the HTTP server will be listening on 127.0.0.1:35000 API_URL External URL pointing to the server, where the phishing page will be hosted http://127.0.0.1:35000 (http://127.0.0.1:35000/) Here are all the places in the source code, where the values should be modified: server/core/config.go: server/templates/index.html: extension/background.js: Installation Extension You can load the extension in Chrome, through Load unpacked feature: https://developer.chrome.com/docs/extensions/mv3/getstarted/development-basics/#load-unpacked Once the extension is installed, make sure to pin its icon in Chrome's extension toolbar, so that the icon is always visible. Server Make sure you have Go installed (https://go.dev/doc/install) version at least 1.20. To build go to /server directory (https://www.kitploit.com/search/label/Directory) and run the command: Windows: build_run.bat
Linux: chmod 700 build.sh
./build.sh
Built server binaries will be placed in the ./build/ directory. Usage Run the server by running the built server binary: ./server/build/evilqr-server Open any of the supported websites in your Chrome browser, with installed Evil QR extension: https://discord.com/login
https://web.telegram.org/k/
https://whatsapp.com
https://store.steampowered.com/login/
https://accounts.binance.com/en/login
https://www.tiktok.com/login
Make sure the sign-in QR code is visible and click the Evil QR extension icon in the toolbar. If the QR code is recognized, the icon should light up with colors. Open the server's phishing page URL: http://127.0.0.1:35000 (default) License Evil QR is made by Kuba Gretzky (@mrgretzky (https://twitter.com/mrgretzky)) and it's released under MIT license.
Download Evilqr (https://github.com/kgretzky/evilqr)
Configuration The parameters used by Evil QR are hardcoded (https://www.kitploit.com/search/label/Hardcoded) into extension and server source code, so it is important to change them to use custom values, before you build and deploy the toolkit. parameter description default value API_TOKEN API token used to authenticate with REST API endpoints (https://www.kitploit.com/search/label/Endpoints) hosted on the server 00000000-0000-0000-0000-000000000000 QRCODE_ID QR code ID used to bind the extracted QR code with the one displayed on the phishing page 11111111-1111-1111-1111-111111111111 BIND_ADDRESS IP address with port the HTTP server will be listening on 127.0.0.1:35000 API_URL External URL pointing to the server, where the phishing page will be hosted http://127.0.0.1:35000 (http://127.0.0.1:35000/) Here are all the places in the source code, where the values should be modified: server/core/config.go: server/templates/index.html: extension/background.js: Installation Extension You can load the extension in Chrome, through Load unpacked feature: https://developer.chrome.com/docs/extensions/mv3/getstarted/development-basics/#load-unpacked Once the extension is installed, make sure to pin its icon in Chrome's extension toolbar, so that the icon is always visible. Server Make sure you have Go installed (https://go.dev/doc/install) version at least 1.20. To build go to /server directory (https://www.kitploit.com/search/label/Directory) and run the command: Windows: build_run.bat
Linux: chmod 700 build.sh
./build.sh
Built server binaries will be placed in the ./build/ directory. Usage Run the server by running the built server binary: ./server/build/evilqr-server Open any of the supported websites in your Chrome browser, with installed Evil QR extension: https://discord.com/login
https://web.telegram.org/k/
https://whatsapp.com
https://store.steampowered.com/login/
https://accounts.binance.com/en/login
https://www.tiktok.com/login
Make sure the sign-in QR code is visible and click the Evil QR extension icon in the toolbar. If the QR code is recognized, the icon should light up with colors. Open the server's phishing page URL: http://127.0.0.1:35000 (default) License Evil QR is made by Kuba Gretzky (@mrgretzky (https://twitter.com/mrgretzky)) and it's released under MIT license.
Download Evilqr (https://github.com/kgretzky/evilqr)
Beginner’s Guide to Basic Linux Commands
Linux is a powerful and versatile operating system. For those new to Linux, understanding its commands is essential for effective…Continue reading on Medium »
Read more...
Linux is a powerful and versatile operating system. For those new to Linux, understanding its commands is essential for effective…Continue reading on Medium »
Read more...
Medium
Beginner’s Guide to Basic Linux Commands
Linux is a powerful and versatile operating system. For those new to Linux, understanding its commands is essential for effective…
Types of Authentication Vulnerability in Web Applications
Understanding Authentication Vulnerabilities | KarthikeContinue reading on Medium »
Read more...
Understanding Authentication Vulnerabilities | KarthikeContinue reading on Medium »
Read more...
Medium
Types of Authentication Vulnerability in Web Applications
Understanding Authentication Vulnerabilities | Karthike
Auto Nuclei Updater
NucleiUpdater is an Automation Tool that Update Nuclei with Single Command on terminal as nucleiupdate.Continue reading on Medium »
Read more...
NucleiUpdater is an Automation Tool that Update Nuclei with Single Command on terminal as nucleiupdate.Continue reading on Medium »
Read more...
Medium
Auto Nuclei Updater
NucleiUpdater is an Automation Tool that Update Nuclei with Single Command on terminal as nucleiupdate.
Best Evilginx Resources for Phishing
https://www.reddit.com/r/redteamsec/comments/15z4387/best_evilginx_resources_for_phishing/
<!-- SC_OFF -->I found these resources very useful for learning reverse proxy phishing with Evilginx 3.0 https://www.simplerhacking.com/evilginx-course https://research.aurainfosec.io/pentest/hook-line-and-phishlet/ https://academy.breakdev.org/evilginx-mastery <!-- SC_ON --> submitted by /u/Fun_Grade_596 (https://www.reddit.com/user/Fun_Grade_596)
[link] (https://www.reddit.com/r/redteamsec/comments/15z4387/best_evilginx_resources_for_phishing/) [comments] (https://www.reddit.com/r/redteamsec/comments/15z4387/best_evilginx_resources_for_phishing/)
https://www.reddit.com/r/redteamsec/comments/15z4387/best_evilginx_resources_for_phishing/
<!-- SC_OFF -->I found these resources very useful for learning reverse proxy phishing with Evilginx 3.0 https://www.simplerhacking.com/evilginx-course https://research.aurainfosec.io/pentest/hook-line-and-phishlet/ https://academy.breakdev.org/evilginx-mastery <!-- SC_ON --> submitted by /u/Fun_Grade_596 (https://www.reddit.com/user/Fun_Grade_596)
[link] (https://www.reddit.com/r/redteamsec/comments/15z4387/best_evilginx_resources_for_phishing/) [comments] (https://www.reddit.com/r/redteamsec/comments/15z4387/best_evilginx_resources_for_phishing/)
Danger: Generative AI Fuels Extremism | Deeplab.com
https://www.reddit.com/r/redteamsec/comments/15z45fa/danger_generative_ai_fuels_extremism_deeplabcom/
submitted by /u/RemarkableDatas (https://www.reddit.com/user/RemarkableDatas)
[link] (https://deeplab.com/security/3235-danger-generative-ai-fuels-extremism) [comments] (https://www.reddit.com/r/redteamsec/comments/15z45fa/danger_generative_ai_fuels_extremism_deeplabcom/)
https://www.reddit.com/r/redteamsec/comments/15z45fa/danger_generative_ai_fuels_extremism_deeplabcom/
submitted by /u/RemarkableDatas (https://www.reddit.com/user/RemarkableDatas)
[link] (https://deeplab.com/security/3235-danger-generative-ai-fuels-extremism) [comments] (https://www.reddit.com/r/redteamsec/comments/15z45fa/danger_generative_ai_fuels_extremism_deeplabcom/)
Clients Asking To Change PenTest Report
https://www.reddit.com/r/redteamsec/comments/15z72l4/clients_asking_to_change_pentest_report/
<!-- SC_OFF -->How does your company react when clients try to ask to modify a penetration test report? Specifically trying to make it look less bad for them, does your company give in to their demands or do they hold firm and back up their original findings? FYI The client that triggered this question openly admitted that they would like to change aspects of the report because it would look bad when reviewed by other management or leadership at their company. <!-- SC_ON --> submitted by /u/edreatingmonkey (https://www.reddit.com/user/edreatingmonkey)
[link] (https://www.reddit.com/r/redteamsec/comments/15z72l4/clients_asking_to_change_pentest_report/) [comments] (https://www.reddit.com/r/redteamsec/comments/15z72l4/clients_asking_to_change_pentest_report/)
https://www.reddit.com/r/redteamsec/comments/15z72l4/clients_asking_to_change_pentest_report/
<!-- SC_OFF -->How does your company react when clients try to ask to modify a penetration test report? Specifically trying to make it look less bad for them, does your company give in to their demands or do they hold firm and back up their original findings? FYI The client that triggered this question openly admitted that they would like to change aspects of the report because it would look bad when reviewed by other management or leadership at their company. <!-- SC_ON --> submitted by /u/edreatingmonkey (https://www.reddit.com/user/edreatingmonkey)
[link] (https://www.reddit.com/r/redteamsec/comments/15z72l4/clients_asking_to_change_pentest_report/) [comments] (https://www.reddit.com/r/redteamsec/comments/15z72l4/clients_asking_to_change_pentest_report/)
Beginner’s Guide to Basic Linux Commands
https://securitylit.medium.com/beginners-guide-to-basic-linux-commands-92e9f453a08e?source=rss------bug_bounty-5
https://securitylit.medium.com/beginners-guide-to-basic-linux-commands-92e9f453a08e?source=rss------bug_bounty-5
Linux is a powerful and versatile operating system. For those new to Linux, understanding its commands is essential for effective…Continue reading on Medium » (https://securitylit.medium.com/beginners-guide-to-basic-linux-commands-92e9f453a08e?source=rss------bug_bounty-5)
Types of Authentication Vulnerability in Web Applications
https://cyberw1ng.medium.com/types-of-authentication-vulnerability-in-web-applications-d4cac27750de?source=rss------bug_bounty-5
https://cyberw1ng.medium.com/types-of-authentication-vulnerability-in-web-applications-d4cac27750de?source=rss------bug_bounty-5
Understanding Authentication Vulnerabilities | KarthikeContinue reading on Medium » (https://cyberw1ng.medium.com/types-of-authentication-vulnerability-in-web-applications-d4cac27750de?source=rss------bug_bounty-5)
NucleiUpdater is an Automation Tool that Update Nuclei with Single Command on terminal as nucleiupdate.Continue reading on Medium » (https://medium.com/@pushkrajdhuri07/auto-nuclei-updater-d491b3daa74d?source=rss------bug_bounty-5)
Adobe Announces Researcher Hall of Fame Initiative for Security Researchers
https://blog.developer.adobe.com/adobe-announces-researcher-hall-of-fame-initiative-for-security-researchers-5e677286dbd6?source=rss------bug_bounty-5
https://blog.developer.adobe.com/adobe-announces-researcher-hall-of-fame-initiative-for-security-researchers-5e677286dbd6?source=rss------bug_bounty-5
By Daniel Ventura, Manager of Product Security Incident Response Team (PSIRT)Continue reading on Adobe Tech Blog » (https://blog.developer.adobe.com/adobe-announces-researcher-hall-of-fame-initiative-for-security-researchers-5e677286dbd6?source=rss------bug_bounty-5)