Pages: [1]

Author Topic: Javascript browser keylogger  (Read 1239 times)

0 Members and 1 Guest are viewing this topic.

Offline DukeSe

  • NULL
  • Posts: 3
  • Cookies: -6
    • View Profile
Javascript browser keylogger
« on: June 17, 2014, 10:41:28 am »
I just wondered if anyone can take a look at this simple javascript code and tell me if could be used as a browser keylogger, by running the script on the target's browser without his/her consent! The problem is how the contents of  variable 'sen' could be recieved by the attacker?
Code: [Select]
<html>
<head>
<title>
notepad
</title>
<script>
sen="";
function display(eve) {
if (eve.keycode) key=eve.keycode;
else key=eve.which;
k=String.fromCharCode(key);
sen=sen+k;
}
</script>
</head>
<body onKeyPress="display(event)">
</body>
</html>
« Last Edit: June 17, 2014, 10:54:46 am by Kulverstukas »
Report to moderator   Logged

Offline LsD

  • Serf
  • *
  • Posts: 40
  • Cookies: 3
  • Hasta La Victoria Siempre!
    • View Profile
Re: Javascript browser keylogger
« Reply #1 on: June 17, 2014, 07:28:30 pm »
Where is this logging the keystrokes?
Report to moderator   Logged

Quote from: Architect on June 26, 2014, 10:46:00 am
This is obviously a troll thread. If not, then you're inconceivably autistic if you think you can even begin to do this.

Offline DukeSe

  • NULL
  • Posts: 3
  • Cookies: -6
    • View Profile
Re: Javascript browser keylogger
« Reply #2 on: June 17, 2014, 09:03:07 pm »
If i am right 'Sen' variable stores the keystrokes!
Report to moderator   Logged

Offline InfosecFurry

  • /dev/null
  • *
  • Posts: 8
  • Cookies: 0
  • fuzzer.c
    • View Profile
Re: Javascript browser keylogger
« Reply #3 on: June 17, 2014, 09:15:27 pm »
Storing data in a variable is all fine and well, but it's not logging anything. Logging -> writing to persistent storage (on disk, shm, sqlite db in RAM, sending it over a network, etc)

Also, this will only log what is being typed within the context of a browser window and has no bearing on what users type in other applications.
Report to moderator   Logged
There are no pentesters in fox-holes

Offline DukeSe

  • NULL
  • Posts: 3
  • Cookies: -6
    • View Profile
Re: Javascript browser keylogger
« Reply #4 on: June 17, 2014, 09:59:53 pm »
Thnx fr that man, I misundrstd that code!
Report to moderator   Logged

Offline m0l0ko

  • Peasant
  • *
  • Posts: 129
  • Cookies: -4
    • View Profile
Re: Javascript browser keylogger
« Reply #5 on: July 05, 2014, 09:00:50 pm »
Quote from: InfosecFurry on June 17, 2014, 09:15:27 pm
Storing data in a variable is all fine and well, but it's not logging anything. Logging -> writing to persistent storage (on disk, shm, sqlite db in RAM, sending it over a network, etc)

Also, this will only log what is being typed within the context of a browser window and has no bearing on what users type in other applications.


Context of a browser window if run in an iframe, context of the browser if installed as a user script. As for storing data, I can think of a way to do that but I don't wanna be arming script kiddies with knowledge that will help them invade peoples privacy (not saying the OP is, but skiddies may come across the thread) so I'll just say this: AJAX same-domain-policy only prohibits receiving data. Doesn't block the request itself.
« Last Edit: July 05, 2014, 09:45:32 pm by m0l0ko »
Report to moderator   Logged
Pages: [1]