Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible for a website to have a javascript keylogger and also contain an iframe that goes to a "client" site.

  • Can the the JS log all key strokes done on the client site?
  • Can the (host) iframe be invisible or 0 x 0 in size?
  • Can the "client" site detect and bust the iframe?
share|improve this question
up vote 7 down vote accepted

You can embed a .js file using a Stored XSS to perform the remote keylogging. Using Ajax, it should be easy to do the remote logging. Have a look at the Javascript Keylogger here.

Setting the iframe width and height to zero answers the second question

<iframe src="" width="0" height="0">

What you are asking in the 3rd question is frame busting. There are techniques to do that,

share|improve this answer
But frame busting is not reliable, if you have a XSS vulnerability, as you can, in IE8 and Chrome, use the XSS filter to destroy it. – Kao Oct 31 '12 at 8:51
For almost every mitigation whether on the OS level or the webapp level there is always a way to bypass when coupled with other vulnerabilities. – Omair . Nov 1 '12 at 9:14
My point was, don't think that because you're using this technique, you're home free, and don't have to care about XSS vulnerabilities. – Kao Nov 1 '12 at 9:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.