← All tool guides

QRLJacking

Auto-generated by Q-Branch Armory audit on 2026-10-12.

Overview

QRLJacking — session hijacking attack vector targeting QR code based login

Classification

  • **Category:** Phishing attack tools
  • **Armory status:** Installed (source present: QRLJacking)
  • **Q-Branch check:** Ready — binary found in PATH
  • **Present on VPS3:** yes
  • **Installed flag:** yes
  • **Primary binary:** `cd`
  • **Binary in PATH:** yes
  • **Resolved path:** `/usr/local/bin/tengu-armory-qrljacking`

    • Prerequisites

  • docker
  • go
  • java
  • root
  • ruby
  • wifi

    • Install

    
git clone https://github.com/OWASP/QRLJacking.git
GECKO_VER=$(curl -s https://api.github.com/repos/mozilla/geckodriver/releases/latest | grep tag_name | cut -d '"' -f4) && wget -q https://github.com/mozilla/geckodriver/releases/download/$GECKO_VER/geckodriver-$GECKO_VER-linux64.tar.gz -O /tmp/geckodriver.tar.gz && tar -xzf /tmp/geckodriver.tar.gz -C /tmp && sudo mv /tmp/geckodriver /usr/local/bin/
cd QRLJacking && pip3 install --user -r QRLJacker/requirements.txt

    Run

    
cd /opt/tengu/tools/src/QRLJacking&& python3 QrlJacker.py

    Operator notes

  • Launch from the [Digital Armory](/pentest/armory/) — do not maintain parallel tool lists in Q-Branch.
  • If the Q-Branch check is not **Ready**, run install steps or update the HackingTool manifest before relying on this tool in an engagement.
  • For authorized TenguProtect red-team work only.

    • Reference

    https://github.com/OWASP/QRLJacking