Of course this has some practical limits: if this is stored XSS then your full JS payload may not fit in the database if there is a small character limit. Also, it increases the odds of accidentally running into another WAF rule. Still, if you can keep your script short it is worth a try. Personally I wouldn't bother with a keylogger, I'd just go for full cookie stealing:
If you're lucky this will sneak past their WAF. Another more flexible option might be something like:
Note that I haven't tested either of these thoroughly. However, the general principles still apply. You still run the risk of something in your payload triggering their WAF (for instance, they may block all requests that contain the word
eval, making the second example useless), so you aren't home free yet. Sometimes finding a payload that works against a WAF is an art more than anything else. Finding an actual execution point though is an important first step.