PS -- I see in the comments that `qrencode -t` would work just as well. That works great, but may still need some tweaking to be full-width characters and "monospace" to copy-paste into an email (or Sans font). Might be a worth a KZread Short 🤪

@darkshoxx

2 ай бұрын

There's always someone in the comments who has a faster/shorter solution 😆 This way round is the better story though 👍

@MrPrzescieradlo

2 ай бұрын

​@@darkshoxx There's also -m for setting the margin, which I found while writing the folowing (lil' optimisation for finding the margins): For finding the min and max, you could stop at the first black pixel you hit, as it will always be the top-left corner, and then loop from the [width, height] back to zero to find the right-bottom corner. This skips looping through the whole QR Couldn't stop myself when I saw the full-image scanning Edit: for block-size, from the top-left corner that we found, we can go diagonally until we find a white pixel. That means we're inside the 'marker' outer border = we're in block 2,2 Sorry for editing, I write as I watch

@pixl_xip

2 ай бұрын

You could use an empty braille character as a space. "⠀" U2800 I saw this in a video where the person made Flappy Bird as small as possible, using braille as the pixels. I can't find that video, though :(

@materialoperator

2 ай бұрын

GPT says the same

@youtubecom3474

Ай бұрын

Excellent video as always, sir! Would you consider doing a walk-through of my teams CTF for DC32?

You know if you're using an Android phone, the camera app will scan QR codes without needing an app with ads. At least my Pixel does. Google Lens is tied into the camera app so if I just open the camera and hold it up, Lens recognizes there's a QR in the viewfinder and gives me the link. Edit: note to self - finish the video before commenting.

@paulstelian97

2 ай бұрын

And on iOS you also have QR code scanning in the camera app.

@sodiboo

2 ай бұрын

It depends on the specific vendor. On some camera apps, it is not available (but on most it is). On LineageOS, it is a separate tab.

@OpenKeith

2 ай бұрын

There's also Binary Eye, which is a FOSS app that can scan all sorts of barcode types, not just QR codes

The company I work for did do the office 356 QR code email to see how many employees would fall for the scam. props for the Ciso team

I like how your Hello World QR code looks like someone dancing and removing their hat right in the middle

@Linuxfy

2 ай бұрын

lol you right

@jamess3159

2 ай бұрын

Everyone's looks like that. Aren't you coding along?

@ZeroAlpha1173

2 ай бұрын

I rewound the video to see this and it’s amazing. Thanks for your comment! 😊

@vaibhav3852

2 ай бұрын

Ha n1

Random thought... You can use Excel to display a QR code... in a variety of ways. An easy way is to use conditional formatting to shade the appropriate cells, and make the column width the same as the height. Pretty sure I did that for a CTF last year. Python is way cooler though! :-)

The blank space in unicode should be U+00A0 (the infamous ALT+255) I wonder, for the sake of making it smaller, if we could use those half-blocks (upper-half and lower-half) together with the full block and the empty block, to sort of generate a QR code that's 4 times as small and has the same pixels :) I guess all we'd need would be to add an extra row at the end if the number of rows is odd, and then parse the rows 2 by 2, to compose each block.

@tutacat

2 ай бұрын

Yes, the qrencode tool does exactly this with it's utf8 output format

@JohnDlugosz

2 ай бұрын

No, the non-breaking space is exactly the same size as the normal ' ' character.

@TheTrainWatch

2 ай бұрын

I was thinking the same on using the half blocks.

@IlliaZhdanov

2 ай бұрын

why not the zero width non-joiner?

@IlliaZhdanov

2 ай бұрын

\u200c

I think a braille empty character could have worked as a spacer in this case. Not really sure if it is the exact same width as any of the blocks off the top of my head, but could also possibly work with one of the different width blocks regardless.

@darkshoxx

2 ай бұрын

my thoughts exactly

@TheRealMangoDev

2 ай бұрын

ye that “invisible” one

@aidan7913

2 ай бұрын

or since its an email, literally just changing the font color to white and use the same character, just in white

@darkshoxx

2 ай бұрын

@@aidan7913 Nof if the recipient uses dark mode

@aidan7913

2 ай бұрын

@@darkshoxx usually you can send an email with custom styling that isn't overwritten by the email client. dark mode doesn't matter if you set some html element to have a background color

Try the "Figure Space" (U+2007). But it depends on the font. There is a whole selection of spaces in different widths called -per-Em Space. The best thing to do is use the same character in different colors.

This code is brilliant. You rock man, did you come up with this algorithm yourself? Good stuff!

Beautiful. Amazing idea, easily understandable solution. For empty characters I recommend U+2800 which is the empty Braille character. The Braille characters are often used for pixel art in things like twitch chat, and that one “⠀” should have the right size no matter which font.

@alek002

2 ай бұрын

Cool

I was not getting the concept of "plaintext QR" at first. AWESOME idea! 😆

15:35 (-ish) you could combine lines 40-43 into a one-liner: row.append(int(middle_pixel_value because int(True) == 1 and int(False) == 0 maybe less readable, but might run a tiny bit faster

An alternate (and slightly faster) way to determine block size is to march along the diagonal from the first black pixel to the first white along x=y from the top left corner as per qr spec that will be your first "block".The top left positioning marker will always be 1 block thin.

Shoot, even the ASCII table has block characters. I used them regularly in the '90s to create DOS UIs.

@icantcomeupwithnames469

2 ай бұрын

ASCII does not, you're probably thinking of CP437.

@DerMarkus1982

2 ай бұрын

@@icantcomeupwithnames469 Ah, the infamous " MODE CON CODEPAGE PREPARE=(437, C:\DOS\EGA.CPI) MODE CON CODEPAGE SELECT=437 " (Whoops, I never got *that Emoji-selector* before ! Was that a Windows Update, or is Win+[Period] hijacked by YT?)

That really isn't a bad idea for a phishing campaign at all John. Nice job man.

Gnome switched to Loupe image viewer. Also `qrencode -t UTF8` will do that for you. Lol, always RTM But someone seeing an ASCII QR code will be more wary, maybe.

That was awesome, Loved the video!

Beautiful t-shirt John

hi John i need your advice: what's the important concepts i have to focus on it in network for a beginner hacker

That's Qr code so cute i like this video thank you SM ❤😂

Audio slightly off?

@MrJasonDEX

2 ай бұрын

I generally thought it was cos I had earphones on but less it not me 😅

@ak0904

2 ай бұрын

seems like it

I remember I wrote a bash script(just some loops with ImageMagick inside) that would translate an image to morse code based on the black and white pixels. I thought this could also be done with a QR image, when instead of dot/dash, just set it to a binary 0 or 1. Then later just replace the 0s with the White Square and the 1s with a Black Square and put a newline at the Nth character

I like the sound of this one !

This is actually really smart!

Since you mentioned qrencode, is the python script any different from what "qrencode -t utf8" does?

@shamringo7438

2 ай бұрын

Nothing really I think he’s just padding the video because this whole python section is totally obsolete. I guess probably it won’t align well with some mail clients maybe

@tutacat

2 ай бұрын

@@shamringo7438 He didn't RFM

Please John may you tell us your keyboard brand/model? That looks so nice and the sound as well. That would be so appreciated! Love the content as always

you could've used a blank braille pattern (u2800) as a replacement for the spaces

10:19 How did that not crash?!? When I tried indexing like pixels[x,y] instead of pixels[x][y] it crashed with a TypeError telling me list indices must be integers or slices, not tuples.

11:56 that’s when you know you program in js too much

@Jelte_Dijkmans

2 ай бұрын

or C or C++ or C# or quite literally most programming languages

Great video

A different approach to distributing QR Codes that's perhaps less spearphish-y would be printing out a bunch of stickers with a malicious QR Code and putting them up around town. Bonus points for getting some buddies to print some in other towns too.

You have uniform white space baked into the quadrants/halves in the very unicode table you've shown in the video.

Neat! Fun stuff. This is how lots of image to ASCII app thinguies work btw. xD Turn image file into a matrix of numbers, replace numbers with ASCII characters of choice, print it out. For the QR Code phishing though... can't e-mail administrators just drop all e-mail that comes with this set of ASCII characters that can be used to reproduce QR codes though? Really asking, I dunno how much filtering you can really do. Can't really do it with a filter that only excludes images from e-mail, but if you have full access to text, probably, right?

Just curious, why not just do `$ qrencode -t UTF8 --casesensitive --8bit "$URL"` (replace var URL or string such as "hello world") from BASH?

You probably could have saved yourself a lot of time with qrencode’s -t flag that allows outputting to various text-based formats 😉

Isn't UTF (anything) encoded email against the RFC for the various email protocols?

@mollthecoder

2 ай бұрын

Doubt it, because that would mean you'd only be able to email in English.

I believe vertical tabs should be used instead of newlines in the qr code in order to get rid of the gap between each line

Wouldn't the "em space" work or would plain text render it as a normal space

I think you could use the quadrant characters to make the code 4 times smaller and better fit on screens.

That's genius

Haha "no one matter, nothing cares" This man can communicate to code like none of us can but struggles to communicate with his fellow beings

Estaria bueno algo de android reverse tcp. 😂😂 exelente video

What a time to be alive

@darkshoxx

2 ай бұрын

I spot a dear fellow scholar 😄

Blocking QR codes is incredibly challenging. This is like asking admins to "block any email with an image of a chair"....except even worse w/ QR codes because you actually need to extract what the QR code is doing and where it sends you, analyze that, and then block or forward the message. So, "find anything that looks like a 'chair' in the email, extract the color of the chair and then only allow green chairs to be sent, block all other chairs". Way harder than people think.

@johnlockie

2 ай бұрын

And keep in mind there are more ways to display QR besides ASCII (and of course PNG/JPG, etc.). You can do this in CSS, HTML tables, SVG, Excel (yes paint the cells and form a qr code in an EXCEL document that would almost certainly bypass ALL MTA security). Vector Markup Language is yet another potential method....

@dealloc

2 ай бұрын

It's really not hard to detect QR codes... this is literally how QR code scanners work; detect the QR code and decode it-that's the whole point of barcodes in general; to be easily machine-readable in many different conditions. A QR code just contains plain text so you can interpret the content however you want. It's not at all comparable with detecting chairs in an image. And if you think detecting non-image variants of QR codes would be hard, think again; simply render the email/content into an image (i.e. via. a browser) and perform the detection... like any scanner does; and it won't be slow either, even with a low-end CPU.

@capability-snob

2 ай бұрын

Corporate environments often just block all images by default from external senders. You can enable them on a per-sender basis.

@johnlockie

2 ай бұрын

@@capability-snob you’re trolling right? LOL

@capability-snob

2 ай бұрын

​@@johnlockieI work in a company of >5000 information workers. I'm in an app dev team; so I'd make different decisions to IT, but our outlook 365 instance blocks images by default. I've seen worse. In one branch of state government, we couldn't even _receive_ emails from outside addresses without first getting ourselves added to a special list. Imagine the fun of discovering that one for the first time.

Menus at restaurants are mostly phising 😊😊😊

Isn’t there a cmd tool to make QR codes ?

Cool!

Instead of nested loops with if/else logic inside it, you should just use `map`. Say what you mean: replacing two values with two strings should be stated directly, not explained how to do it in elaborate detail.

Wow is this in the wild, Or did you come up with this ?

The reason for the black boxes us for you not check the whole image

Python supports UTF8 in strings...

QR codes has its uses but the problem is how do I verify that I'm using the correct QR code . The next thing is how do we inform the users what is a safe QR code ? The words "O its safe it's from iIT they used QR codes for wifi so this must be safe"

how long the QR works ? ,forever whitout payment ?

@Lumina9306

2 ай бұрын

a QR is just generated once and costs nothing, it works forever :)

Money and can't return me how to return this

2:48 I was expecting a "plz sub"

damn thats crazy

Ah the nice audio sync

I never scan any qr codes to begin with or open links sent in email or by sms, I know some are propably safe but better safe than sorry

Hi

Luckily for us, only 18k people saw it

Couldn’t you use the Square Emojis as black and white, if they would have the perfect size. (⬜️⬛️)

Hi have you heard of Occupy Theweb John? Just wondering if you do know him...

@wennefer5426

2 ай бұрын

if not... he should

@matteovalentino4890

2 ай бұрын

Brother what

@professional.hacker.

2 ай бұрын

@@matteovalentino4890 what what???

"no-one matters and nothing cares" 💀

DING!😁

Sir I have lost my 8 lack yesterday plz help me out plzzz

i found a bug in this video 😂

@GratuityMedia

2 ай бұрын

😈

@nixoncode

2 ай бұрын

i don't think he offers bug bounty

@Safvanviber-xm3pn

2 ай бұрын

@@nixoncode its like self xss bro nit in the scope 🙂😹

U+3000

Sir some people cheat with my

nothing is freee dear sir there is a hiddden ajenda

i just pissed on my wall

This was confusing. I thought I'd learn something about the inner workings of qr codes and how attackers use them for exploitation. Instead we built a janky qrcode image parser. Like why? Every Python qrcode library will give you the raw qrcode, no need for conversion or pixel scaling. Some even create UTF8 character arrays or ASCII art output, which would have achieved the exact same thing, ready to use. Instead of "Hackers Can Phish with PLAINTEXT QR Codes" this was mostly "How to read an image using PIL and look at each pixels color value".

@YoutubeWatcher264

2 ай бұрын

Same here. Didn't get the point of the script. Was waiting for the hack thing.

@TheBBoyQ

2 ай бұрын

Thought I was the only one who noticed that...

@YoutubeWatcher264

2 ай бұрын

@@TheBBoyQ Clickbait titles youtubers make.

○

People can create say a phishing website and generate a qr code for that and scam the ppl right???🤔

More malware hahahahahahhaha

ok am i pinned?

First🎉

QR codes are not a threat at all. It's the embedded URL links like any other links that could lead to a page that has a threat on it. So QR codes themselves are not dangerous to scan. The title is misleading.

you didn’t know this?? 😂