How should the sentence "He said who are you" be punctuated?

He said who are you.

He said ,"Who are you?"

He said, who are you?

He said "who are you?"

When reporting direct speech, quotation marks are used.
The question mark goes inside the quotes because it's part of the quoted question.
A comma separates the reporting verb ("He said") from the direct quote.