I'm taking a CTF challenge on a web service. The goal is to gather the most information possible of a user. I have access to it's login and password, but password is expired and the account must be recovered by uploading a QR code to the website. No other file extensions besides JPEG are allowed for upload. Given that, I tried to generate a QR code with the provided login info, with no results. Please notice that my understanding on this matter is very bad. So I was wondering if exploiting a QR code would a good attack vector. But I'm starting to realize that might not be a practical/executable way. Am I going in the right direction?