8

Is it possible for a website to have a javascript keylogger and also contain an iframe that goes to a "client" site.

  • Can the the JS log all key strokes done on the client site?
  • Can the (host) iframe be invisible or 0 x 0 in size?
  • Can the "client" site detect and bust the iframe?
7

You can embed a .js file using a Stored XSS to perform the remote keylogging. Using Ajax, it should be easy to do the remote logging. Have a look at the Javascript Keylogger here. http://code.google.com/p/javascript-keylogger

Setting the iframe width and height to zero answers the second question

<iframe src="attacker.com/log.php" width="0" height="0">

What you are asking in the 3rd question is frame busting. There are techniques to do that, https://www.owasp.org/index.php/Clickjacking#Defending_with_Frame_Breaking_Scripts

  • But frame busting is not reliable, if you have a XSS vulnerability, as you can, in IE8 and Chrome, use the XSS filter to destroy it. – Kao Oct 31 '12 at 8:51
  • For almost every mitigation whether on the OS level or the webapp level there is always a way to bypass when coupled with other vulnerabilities. – Omair . Nov 1 '12 at 9:14
  • My point was, don't think that because you're using this technique, you're home free, and don't have to care about XSS vulnerabilities. – Kao Nov 1 '12 at 9:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.