penetration testing project demonstrating keystroke logging through WebSocket-based data exfiltration and XSS vulnerabilities.
This project is strictly for educational and authorized penetration testing purposes only. Unauthorized use of this tool to capture keystrokes without explicit consent is illegal. Use only in controlled lab environments with proper authorization. The authors assume no liability for misuse.
This is a proof of concept that demonstrates how keystroke logging attacks work. It consists of a Go backend server that listens for WebSocket connections, and a JavaScript payload that captures keystrokes and transmits them to the server. The vulnerable HTML page shows how attackers can inject malicious scripts through XSS.
Running the server with Go:
go run main.go [flags]
Flags: -ip string WebSocket listener IP (default "127.0.0.1") -port string WebSocket listener port (default "8080") -output string Output directory for log files (default "./logs") -origin string Allowed origin for WebSocket connections (default "*")
- Start the server: go run main.go
- Open sample/vulnerable.html in your browser
- Enter the payload URL: http://127.0.0.1:8080/k.js
- Click "Load Plugin"
- Type something, keystrokes are logged to logs/ directory
main.go Go backend server with WebSocket handler public/k.js JavaScript payload for keystroke capture sample/vulnerable.html XSS vulnerable test page go.mod Go module dependencies
Support for HTTPS connections Dynamic WebSocket payload script generation