How Are QR Codes Hacked? SQL Injections 

Who scanned all the QR codes? What's your fav? Drop the meme

wouldn't the devs be able to use parametrized queries or validate user input? can't they compare only the id and get the price from the db? and can't the qr codes be encrypted?

Input sanitization? This video makes no sense.

Also prices come from the database, as they may change, the qr code doesn't need to change nor should it contain the price, no database designer would include the price in the qr code allowing an attacker to change the price or even change the behavior. Its programming madness. no one would be so stupid to allow this.

My understanding is a qr code is used as a simple id code for a product, nothing else. As it is used to just identify just one item from a list of valid products from your database, if any other code including sql injection is attempted it would not work as your system simply will not use it, it just is looking for the product id and that is it. It would be stupid to design or allow a qr code to include sql code, to change critical database behavior, if it is attempted, it should be ignored, or come up with an invalid code error.

Well idea is cool but almost all stores use bar code not qr codes

what is this video??? this does not make sense in at least shopping scenario, and likely for others. Why take QR payment for example? items in the stores are coded in standardized barcode, with only what item that is supposed to be, price data is in the POS system that asks for the price to DB. there is no way malicious actor can change price with QR code. also payment processors know these risks, so the payment authoriztion QR has 2 types. one where customer scan the store code and send the amount, which requires customer to show how much they send (apps prompt to show it to clerk) or the opposite, the store scans for your barcode with your UserID, again, not a QR, then the store system asks for the processing for said amount, the result will show up on customer's device. also if there are funny businesses, the payment will just error out like credit card gets rejected. don't get me wrong, SQL injection can be still possible if the system were configured in such a way so QR contains value that shouldn't be altered. But that kind of configuration needs to be configured per-store, per-item basis. so normal POS system with compatibility with payment processor is pretty safe from these kind of attacks. it will like I said, will reject the payment or error out. I think you are out of touch, and there were several mistakes in the vide. at least 5. Your videos are usually very good but not this one.

Always wear white gloves to type steathly on the keyboard guys ...

That is definitely one good quality video that got me sticked to the screen wondering how. I m a programmer and still I haven't heard of that before

Well done taking the time with the QR thumbnail

People who scanned that thumbnail QR 👇

Excellent video, I hope to recommend more!

Interesting, thanks!

me trying to scan all Qr codes showed in the video 💀

Thank you

The hacker hacked the keyboard 😂

bro thinks we're living in 2010, grocery stores aren't that stupid bud, everybody sanitizes their sql queries or uses some olm nowadays...

Love the channel - keep it up!

Nice, free food for everyone 🙂

I find that QR codes are typically just things like URLs or user names/ids/addresses; such as the case with COVID-19 vaccination QR codes. Seems a lot harder to hack the typical sort of uses like that. In theory injection could still be done, but only if there was no sanitation, and typical cases like URL accessers ("browsers") and apps that use user ids or what-not all have sanitation in them already, not required for the users/businesses to ever set up.

As presented, this seems hypothetical. Are there examples of people changing prices or taking down a store? The risk/reward for cheap bananas seems skewed towards not attacking.

Dude, your video are usually great, but you are out of touch here. 100%.

Everything that comes from the user could potentially be dangerous, never trust the user is they way to go here. Also you said you wont be doing a tutorial on this and then continue to make a tutorial

I never saw a shop using QR codes for it's prices, every store uses good old bar codes with and EAN/UPC code and the encoding capacity of these codes are far to short for a SQL injection. Moreover any professional developer sanitizes any external input, long gone are the days of script kiddies developing retail solutions.

This video is fiction! Check out systems don't work that way! The price can't be changed by the QR code because the price is stored in the database which the scanning terminals only have read only access. Forget SQL injection because the data is always sanitised. At best, all you will get are errors if you dare scan a dodgy QR code and hopefully, it will trigger a store alarm in a secure environment! 😊 Also some cool self check out systems also have a scale to measure the total weight of items you checked out to ensure the weight corresponds with the weight of the items saved in the database. Forget about it.

Interesting, Only if the cashier gets suspicious that a guy buys a TV for 0.01

Your video had me on the edge of my seat, like waiting for a breath of fresh air! Your content is truly the pinnacle of excellence, and I always find myself eagerly anticipating each new release.

"An sql query is an entire language" ... What? ima head out. No one has been susceptible to sql injection in years, unless you have edit rights to a database, you aren't changing a thing in the database and QR codes are single data points well outside the perimeter of injecting sql. They are almost always a url nowadays. You won't have table names, credentials to get into any database or anything because no one does this with QR codes, and no decent company will be this dumb on this many levels. This video is clearly fearmongering piggybacking disinformation in order to plug a business. That's an unsub from me.

Awesome video sir

Sumsub next year completes 10 years for sumsub company 🎉

And what about barcodes?

Can you do the same with barcodes?

Sincerely I never seen a such dumb way to set prices in Italy... On the barcode there are only IDs and not prices... 😂

cool

Acc live for these

Pretty sure flippers have screens... at least mine does

at that point just dont scan anything and steal it

I think I got enough information to replicate that trick

_"Ignorance is strength"_ - 1984, a dystopian novel. There are many ignorant.. Their desire for shopping, convenience and personal security will enslave us all

This is one of the best tech channels if not the best on yt tbh. Highly underated. Watched about 5 videos so far. All top quality and deserve millions of views. Keep creating these amazing videos ❤

this is too advanced for regular ppl

Is is more over great hack, which is Quishing attack

If a programmer creates this code, he should no more be one, because that’s basic sense to not trust user input

Not first

Who will scan an "unsafe" QR code made by unknown person ?!!!???

I'm first

200 times less . . really? I never got beyond 100 and you guys are brainy tech folks? LOL

I become a ethical hacker. I started learning python, please help me 😊

This is neat, but way over my head.

I didn’t even know it was possible!

too technical

Can hack Al

Hi sir want learn hacking please help me

im pretty sure you can inject python code through the format strings