# XSS Exploitation Tool ## Description XSS Exploitation Tool (anciennement Keylogger.js) était au départ un simple keylogger en Javascript qui a évolué en outil d'exploitation de vulnérabilité XSS. La raison de son développement était que le framework d'exploitation Beef est détecté très régulièrement en entreprise par les Endpoint Detection & Response (EDR). Je voulais donc la possibilité de montrer facilement l'exploitation de telles vulnérabilités lors de restitutions des tests d'intrusions de façon plus sexy qu'un simple `alert('XSS')`. Le projet est disponible ici : [Github](https://github.com/Sharpforce/keylogger.js).
## Changelog **05/12/2025 :** Sortie de la version 0.8.0-alpha-1. ``` Added - Victim navigation visualization - HTTPS support for the server Removed - Commands (come back later in the form of WS calls) ``` Sortie de la version **0.8.0-alpha-1**, qui apporte principalement le mode *visualisation*, permettant d'afficher les actions de la victime, ainsi que la mise en place d'un serveur WS. Tout n'est pas encore fonctionnel, mais cela suffira pour des PoC ou des démonstrations, et des améliorations sont prévus. **Note :** le mode visualisation est largement inspiré du projet SHVE () **16/06/2025 :** Sortie de la version 0.7.1. ``` Fixed - Fixed encoding issue by replacing btoa with UTF-8 safe Base64 encoding to support emojis and non-ASCII characters ``` **27/01/2025 :** Sortie de la version 0.7.0. ``` Added - Implemented functionality to convert password fields into plain text in cloned DOM during screenshot generation - Pagination system and sortable columns to browsers list - Pagination system to the browser log journal Changed - Removed default logging from html2canvas Fixed - Resolved an issue where the same image was always displayed in the modal when viewing screenshots in the browser history ``` **06/12/2024 :** Sortie de la version 0.6.0. ``` Changed - The timezone of the date is now set according to the browser's local timezone - Screenshots are no longer stored as files but are now saved in the database and accessible through the "Logs" menu - Redesign of command modals - Improved/updated the demo page Fixed - Fixed the bug preventing the retrieval of local and session storage ``` **20/08/2024 :** Sortie de la version 0.5.0. ``` Changed - Sub-menu for Commands: Implemented a dedicated sub-menu for improved navigation and easier execution of commands - Sub-menu for History/Logs: Implemented a dedicated sub-menu for easier access to browser history logs Fixed - Date is now set to UTC ``` **26/10/2022 :** Sortie de la version 0.4.0. ``` Added - Global map of hoked browsers - Last seen online date Changed - Delete subheader and add connected count devices in header - Change array order of details browsers Fixed - Delete correctly all details about hooked browser when delete action - Typo client_id/browser_id to Id ``` **19/09/2022 :** Sortie de la version 0.3.1. ``` Changed - JQuery update to 3.6.1 - JQuery is now local script file Fixed - PHP warn when retrieve geoloc ``` **25/08/2022 :** Reprise du développement et sortie de la version 0.3.0. ```markup Added - Hooked Date when new client - Connected clients counter - source code of the hooked page - screenshot when hooked Changed - UI Redesign - Map is now countries map ``` **Old :** Le projet est en arrêt depuis mi-2020 maintenant. Il reste fonctionnel mais il y a encore beaucoup de travail à effectuer dessus. Je le reprendrai un jour, si je trouve la motivation ;). --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://sharpforce.gitbook.io/cybersecurity/mes-projets/xss-exploitation-tool.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.