Hacking QR Codes with QRGen to Attack Scanning Devices [Tutorial]

[@eakerz5642]

NullByte hacked his own body and has rewritten the eye lubrication code: saving energy wasted on blinking.

[@Hari2897]

You are blinking in sync with him, so u don't notice when he blinks , he hacked your eyes so that when he blinks , his users also blink

[@lionelmuskwe]

eakerz Now that’s a genius joke

[@samueltulach]

I can't unsee it now lol

[@adityaranjan1909]

😆😆😆

[@drobgyn5615]

LOL

[@h0nus390]

I'm happy you're liking my tool lmao

[@jackrendor]

Lmao

[@h0nus390]

@@jackrendor pure wua sei ahahahahahaha non farmk rispondere da gatto ahahaj

[@jackrendor]

Sto commento dovrebbe arricare fino in cima :')

[@h0nus390]

@@jackrendor fach you biach

[@cillianmaccarthaigh641]

@H0nus How could you implement this tool in real life? I love it so far!

[@a3oaar]

Can you put a donate link so we can support you when ever we can .

[@NullByteWHT]

We are working on it but our channel is currently demonetized. You can read more about our issues here: bit.ly/2HmZnNA

[@JF-di5el]

Null Byte I really want to donate you

[@Jelajah_Tutorial99]

@@NullByteWHT the infosec community says this policy is broken, because it’s seeing viable educational content also being removed. same with me my video get removed if that youtube force forwading again I will change the Line

[@xspy5846]

@@NullByteWHT U should create a patreon page :)

[@pr0d1gyvisions74]

@@NullByteWHT Make a CoinPayments account and accept crypto for donations.

[@wolf-war-master]

Imagine posting a qr code arround the city that links you to a virus, it would be insane

[@NullByteWHT]

Chinese cities already have QR codes plastered everywhere thanks to Alipay and WeChat. Just sayin'.

[@ChillerDragon]

Similar to the usb version but cheeper,

[@error-un3fo]

that would make a very good hacking game based on qr codes that link you to the next code until you reach a download that can be a virus(fake for funzies) or some sort of reward in game.

[@theilluminatimember8896]

This has been done already

[@gravypadruski462]

Make a poster! Scan the qr code get 1 free beer xd

[@ChillerDragon]

It’s nice that you always troubleshoot and point out fixes for problems you had in the video. But you could also fix it for everybody and just do a pullrequest since all those tools are open source. Especially if it is just a typo in the readme.

[@blakryptonite1]

QR codes have always been a security concern. Some phones (I think iphone as well, but not sure) can autolaunch a URL, leading to downloading an actual payload.

[@malwaretestingfan]

I'd imagine how it could go: - Misleading QR code is being scanned, social enginnering will do the work. - QR code lands to a page. Or the page is the scam and a fake form that steals data, or the page contains a exploit that runs code on the affected machine.

[@blakryptonite1]

it just has to go to a random page with a script running

[@prajwalr3985]

sir can u pls tell what is the use of this qr codes generate

[@5imbah]

I think something free on facebook.... when you scan you just get taken to a phishing page. Login, forward the session to facebook and then ask them to sign up for something so they just think it was bullshit. Meanwhile you've got and email and a password..... a lot of people use the same credentials on other sites ....amazon, banking, runescape etc...

[@aty4282]

@@5imbahbest R U N E S C A P E S C A M

[@bbaovanc]

“This one’s trying to etc into the password directory.” WHAT? It said cat /etc/passwd which would display the contents of the file ‘passwd’ in /etc/ on screen. Passwd is not a directory.

[@JNCressey]

And would 'etc' even make sense as a verb?

[@elielvidel]

systems generate that directory ..........like chinese software companys

[@fjorge8536]

Arch Linux user here - I agree what the actual hell is this video? /etc/passwd just has things like your home directory and default login shell ooh scary someone's about to get grocery discounts by finding out my linux username :flushed:

[@Sophon96]

True, this stuff in the video just screams script kiddie. :rofl:

[@Trekeyus]

Since it is written in python you can generate codes on Android phone via termux and then show the payload QRcode via any image viewer.

[@Rexsisodia]

what script for when i scan QR code then directely jump to website ..????

[@emptydarkhouse183]

Can u gen a green p qr code?

[@TechDark]

Imagine doing this to bitcoin atm's

[@4fortyfour]

Then you get all the bitcoins from the atm

[@aty4282]

How to get rich/in jail 101 lmao

[@4fortyfour]

@@aty4282 true

[@aty4282]

@CheeseBall anything done right will grant you success, especially in theese situations. At least in my country, theese noobs exploded atms with a gas tank while they had a classical face mask lmao and guess what, they are still free *insert risitas laugh*

[@meh6722]

We know you're on AT&T with the magical 5GE lol

[@kneesnap1041]

Noticed the same thing haha

[@daqa9420]

You should have named your channel : ZeroBlindByte

[@brianfreund1]

At 5:02 shouldn't that be the wordlist defined there as wordlist.txt rather than requirements.txt?

[@Алексей-о9б4г]

Here in Russia there was an attempt to attack camcorders on the roads, using combinations to exploit vulnerability sql injections, changing car numbers with malicious characters. It can also work on cameras installed on parking. I found a photo for an example from Poland ( spbvoditel.ru/mm/items/2010/4/1/0004/camera.jpg ).

[@selfiebridge6222]

I saw it! I saw it! I saw you blinking one time😅 somebody give me nobel 😂

[@rp479]

Selfie Bridge Mr. Nobel has passed away and you can’t have him

[@selfiebridge6222]

@@rp479 but i can get the prize instead, can't i?😆

[@dewasembiring7286]

i don't understand, shouldn't the command is ..... -w wordlist.txt not -w requirements.txt?

[@WhileyisaEskiboy]

It annoys me so much that you don't have more subs! Been here for a long time now as you know think it was about 20k subs when we last spoke, your content is superb and yet still you're quality and extremely detailed content is still not getting the recognition you deserve! Your amazing keep it up and thank you for everything you do xxx

[@TRADE_OM]

You should see him now!

[@MrRandsauce]

if you don't have a system in place to first detect the environment and then pick a known working payload, this is like the bruteforce of qr codes where you get auto-banned the second the person at the til looks at the screen. But definitely a start in bulletproofing your own setup.

[@tboyrock2]

how do the commands on the side of the qr codes u scanned work ??

[@Doshvari]

This attack on application. in fact ineject some string to application

[@hopehowdoyoufeel]

Imagine someone actually using QRCodes for Locks lmao

[@the6thcenth878]

yo ill pay to make me a covid qr passport that works

[@drewg2676]

Same. My country is getting tyrannical

[@piercetkwong]

wordlist.txt or requirements.txt?

[@swessels]

I've been wondering for years now if someone could perform a SQL Injection using QR codes in a store. Imagine having a QR code on your iPhone display and having the in store price-check scanner scan it, only to have the embedded SQL Injection change the price for the item in the database. I'm sure that's illegal and I've never more than worried about it. I hope that the merchant's software folks have protected their scanner software inputs the same way you would protect other database access software.

[@stoptryingtogetmetoregiste8418]

You're correct, I'm absolutely convinced that systems handling actual money have the best tech and security on their end. That reminds me to finally send that tip to my bank to upgrade all their ATM from windows XP the bluescreens are getting annoying.

[@FarazKhan-yy4er]

kODY! Your my favorite person on KZbin since i start watching your videos i wanna thank you again and again for the education your providing us i can't thank you enough brother because your the best we've ever got and believe me no one can take your place.

[@hritishkumar3871]

One word to describe your channel "Awesome!!"

[@waheedakhalid8120]

Bdhdnxhx

[@BrandonHadley-kw5jr]

So in the state that I live in we have gas stations that have slot machines you can put money into and gamble. If you win and choose to "cash out" you simply hit the "cash out" button on the machine that you are playing and it prints a ticket with a QR code and you take it to the "prize redemption" machine that scans the QR code on the ticket that your machine printed and voila it spits out the amount you cashed out. Would there possibly be a way to manipulate the QR scanner into thinking that it scanned a winning ticket and to dispense money?

[@ahadulislam7185]

I didn't see any use case

[@RichardBuckerCodes]

WOW imagine printing QR codes on stickers and just pasting it all over times square.

[@Yorak404]

at school 😎😎🤡😄

[@fivedice]

Great video as always! Also: do you know if it is possible to find someone if you have their google voice number?

[@is300_Paul]

?

[@digimoy1017]

wishing you have a video for pen testing using android phone... thanks I'm waiting...

[@utkarshsatyaprakash4383]

installl termux on android and follow all the steps that u follow in this video . Most tools work just fine in termux as they have pre-built support for termux. if it doesnt ping the author of tools/script and ask him to upload a support patch for termux. peace.

[@prankerganster3985]

Do this to a McDonald’s hahaha

[@ElGhadraouiTaha]

Hello NullByte, I'm impressed by ur videos and thankful for you. i have a question for you please !!! i have a second laptoup to test my pentesting tools (RAT...) , so i was wondering if these tests would do any damage on my second laptoup !!! answer please.

[@jurajchladny1952]

Depends what do you want to exploit. I recommend using vbox or something. Unless you manage to execute something that deletes all your files then you should be just fine as long as you know what are you doing.

[@ElGhadraouiTaha]

@@jurajchladny1952 Thank you my friend so much

[@brunolopes7311]

I wonder if there is a program that acecpts two or more words or symbols and then create a wordlist with all possible combinations with them. thanks

[@NullByteWHT]

Yes there is! Check out our video on The Mentalist: kzbin.info/www/bejne/ZmKQdZawZs15rZo

[@sandeepvk]

Can I do all this in my Mac ? Or Should I get Virtual Box and run Linux in it ?

[@coffeeklutz9318]

NullByte reminds me of Kevin Rose from the TechTV days

[@NullByteWHT]

Nice, I don't think I've heard that one before.

[@definesigint2823]

Caveat emptor: Some of the domains in the exploit list (apparently from payloadbox) are currently inhabited by squatters. Nasty trap potential there.

[@NullByteWHT]

Yeah that's a good point!

[@JNCressey]

> generate malicious barcodes > they link to domains out of your control Sound like it works as intended 😁

[@muritisaude112]

Hi how can I change the link of these qr codes without the app I made them? Because I didn't see it was a free test:(

[@franciscolucarini8761]

Which Mac do you use?

[@franciscolucarini8761]

Plz bro answer me

[@twistedsocal]

dude, Macs come in so many different varieties lol, macbook, MacBook air and MacBook pro, that's about it now isn't it. Pick one, configure it to your hearts content and call it a day. It's a Mac so config ie spec out is where they differ and even then just by speed and battery life. lok

[@franciscolucarini8761]

@@twistedsocal u which one u prefer?

[@twistedsocal]

@@franciscolucarini8761 I prefer not a Mac, not that I have an issue with them, just that I am a PC guy and since Macs now use the same hardware ie...no more proprietary CPU stuff like they used to before switching over to Intel, I don't see the value in going Mac over anything else. If I were to buy one I guess I would get the MacBook pro, I would config it with at minimum 32 gig of memory, a core I7 unless they offered better and 1 or if available 2 Nvme SSD. pick up a thunderbolt 3 dock, all the little dongles to connect everything from USB c or tb3 to everything else and go from there. That is just me though.

[@franciscolucarini8761]

@@twistedsocal thank you so much

[@milliconsolutions5377]

Running this on a Samsung tablet with Termux. Pretty dang cool.

[@jonathancsoy]

My neighbor's WiFi has not password...it is completely open. What kind of attack would you recommend to make some tests?

[@shekhar81]

man from an open wifi you can get heaven loads of knowledge about whats goin on in their network ....you can see what they are browsing to what the pictures they are seeing and even inject malicious code into their browsers and a lot more ..... possibilities are endless :)

[@jonathancsoy]

So what tool recommend for do it?

[@shekhar81]

@@jonathancsoy you can try Wireshark , Cain and Abel , ettercap , driftnet ....and there are many more but these are basic and pretty simple to use

[@tysk5729]

hello null bite im a bit of a script kiddie that absolutely loves your videos! i love it when you make a video of something thats usefull in real life could you please make a video on how to spoof my cars blackbox preferbly in a bit of a polemon go kind of way where i can decite where my cars myself ? this would make my life a ton easier and cheaper

[@tanvirsingh6015]

Please make videos on mobile too.hacking with phone

[@philwoodgreene6683]

Thank you so much for another absolutely excellent video

[@robinroby88]

Can you pls re-upload the social media page spoofing..

[@x86tejeda]

Hi, a question, what's the mame of the app you use in the video yo scan QR codes? Thank you.

[@meirknapp]

What's the app you're using on Android?

[@s.n.d.e2025]

Your having to scan you ticket on a vaccine passport with a QR code reader apparently??? Just though

[@wanyama737]

How about in windows?

[@dropcake]

Another great video -- really love your tutorials.

[@brandonproductions2575]

Great video like always, is it possible if you could make some more videos about making scripts or pre-made scripts for a rubber ducky by any chance? Thank you

[@cadeathtv]

Im confuse, vulnerability of the Device or Application?

[@neelgohel335]

But how that code executes? The QR scanners generally returns a string to copy..no executions made..then how those codes execute implicit?

[@mofassil_noor_alif]

I'm a big fan of yours... 😍

[@solace6717]

Get a room....

[@ghoul5529]

Why you are not uploading videos Its been a month

[@zodindev3860]

Maybe he's born with it maybe it's amphetamiiiines

[@HemantSingh-vi4eg]

Sir please tell me I was using my WiFi and suddenly connection disconnected and on going to device manager it says windows is still setting up the class configuration for this device! (Code 56)

[@OwO-.]

Step 1. Delete Windows. Step 2. Install Windows.

[@scientist100]

Did you copy the jesters technique or not as sophisticated yet?

[@ramananaik358]

Sir... I'm indian...I want to learn Hacking...Can u teach me...plzzz

[@gravypadruski462]

Ask ur local boys for help! Indians are already good at it

[@BilalHassan-wm5ev]

Please video on CVE-2019-2107

[@owotuna]

Looks pretty scary...

[@Jeroennijhuis]

Why not try to teach people some programming languages like bash and python or maybe even C . Because you’ve done enough script reviews maybe it’s time to change some things up , so people will actually be able to make scripts on their own.

[@RaveTsukii]

Mh are you a human i mean you don't blink .-.

[@geoffreyzziwambazza7862]

Ok what is your secret on not blinking?

[@mrdiamond64]

Is there a payload shows a picture and under it text. I want it to show my yt profile picture and my KZbin channel name

[@dominicswinton4739]

this is interesting, especially considering I was thinking about putting a QR code in my final artwork for my last year in highschool. I was originally planning on just making a page that grabs some data and then redirects to a simple website that just displays a poem or something for "conceptual depth" and then just as a final fuck you to the school system they give me marks for hacking them. but this seems like it would be way more fun even though I doubt it would do much to a phone as demonstrated in the video

[@codingfinance6080]

You alright kid?

[@dominicswinton4739]

@@codingfinance6080 nah cunts fucked

[@Alan_Jacob]

Shows 1 view with 21 likes and 3 comments xD

[@twistedsocal]

145 views 2 min later

[@burnthechurch2423]

Libtard trash. Trump 2020

[@rohitzeiq7260]

What is the laptop ur using sir?

[@Yorak404]

How do u save the words list idk what to press

[@xristoss.2037]

He looks like Sheldon from "the big bang theory"😂

[@utkarshsatyaprakash4383]

blink sometimes bro , my mother gets shit scared when she sees me watching your videos .

[@TheAnalystradioprogram]

This is end. These new rules have channels running scared. They produce less and less content. I enjoyed this channel while it lasted.

[@StarsManny]

Video starts at 0:30

[@Hdtjdjbszh]

Basically SnowCrash for phones

[@lamarrotabil5504]

Can you make a video on ARP Spoofing/ARP Poisoning

[@nickelhacksz4793]

yah

[@shekhar81]

@lamarr there are already endless videos on this topic see em

[@haizi7179]

Oh my God I've been talking about this for like the past 3 years thank you so much

[@Smartpatternacademy]

Hey man ilove your videos ❤ but today i wanna Ask you One question. Can i hack Ussd code for sim cards

[@Robonova]

How do you get the passwords

[@saurrav3801]

Bro where r u ........new SIM vulnerability is here......

[@jesse_dickson]

So I recently downloaded kali as a dual boot with my windows 10. all good first run through. Now when I do apt update I get no pubkey error. Can you help?

[@utkarshsatyaprakash4383]

dont worry about that . try using this command : sudo apt-get update && sudo apt-get upgrade sudo apt-get --fix-missing upgrade sudo apt-get update && sudo apt-get upgrade this should fix the issue , if it doesnt , dont worry too much . Public Key is mostly used by people working on .net frameworks. it wont affect u in anyway.

[@xM0nsterFr3ak]

i had the idea to put funny images in it, but i dont think it is possible to display it without having a link to a website with that image

[@bignig123]

is there something like this but with nfc?

[@RavinderSingh-nq7lu]

Can u help me sir 😭😭😭 We received your information If we still find that you're not old enough to be on Facebook, your account will remain disabled. This is because your account doesn't follow our Terms of Service. We're always looking out for the security of people on Facebook, so until then you can't use your account.

[@poojabhandari6659]

Can you please make a video on injecting keylogger on a victim device without physical access

[@lem0ndadedcorner994]

Hmmm dude why not put a warning into the start of the video saying this is for. Education purpose only You must do it to avoid any legal risks

[@amnaashraf2512]

Plz tell if qr code of contact numbers is hacked what to do to protect my data plzzz

[@furkan2161]

Wait can i do a QR code which looks for the connected WIFI code in the Phone?

[@Yash_J]

He is real kind of a hacker... Don't believe me? Check his eye ..... You could never see him blink

[@slacortes2975]

NEED HELP! I need to change the link of 3 qr codes, because I did it on the QR Code Generator website and didn't know it was a test for 14 days. If that's not possible I would like the app hacked or cracked QR Code Generator because I need the paid version and I don't have the value. :^(

[@carloscontreras-rq3ms]

So sick that's all money null byte much respects to u all

[@skreet7251]

Hacking nasa has been a child hood dream of mines just saying

[@yasyasmarangoz3577]

Is this possible with barcodes?

[@supremehiro]

Sir my kali wifi is not show how i fix it

[@vaibhavgavas4691]

Request to Null Bytes for making a video on Configuring and installation (OWASP Modsecurity CSR) on parrot os...🙋‍♂️

[@TheAnalystradioprogram]

Kody please check in. We are all worried. Are you ok?

[@smartashiq6931]

Hi team .... Is it possible to retrieve the 10 % (damaged) blurred QR code?

[@aestheticbeast3288]

But what can we do after generating these payloads. I mean other than checking what it contains. LIKE HOW WE CAN USE THEM TO ACCESS THE SCANNING DEVICE. *ASKING OUT OF CURIOSITY*

[@aballa-l4q]

Hello sir can you please send post a video of downloading kali Linux and setup plz I tried to watch your previous videos but it didn’t work so plz make a new video 🙏🙏🙏🙏🙏🙏

[@YoutubeShorties69]

Hey i can help you with that...Text me on Instagram -> qesharaku

[@MKVD]

Just don't install Kali

[@sbubble5332]

Keep getting distracted to follow from such magnetic energy, or attraction! ;P

[@VH-eq2ci]

I have damaged a Lild scanner. But they just restarting it I think. It was a few years ago.

[@VH-eq2ci]

@@wiktorn4268 ah yes :D

[@ani-zxk]

ok I can confirm this repo doesn't work on mac os