Recently I got hold of a new device for my homelab, namely a keylogger, which I picked up last month. While the purchase experience was not super smooth, it redeemed itself once I got to testing it out in my lab environment at home.
First I bought a regular USB-only model from Amazon, which works like a USB-cord extender. It is an anonymously looking black USB device with a receptacle to plug configuration.
It immediately powers on when it is connected to the computer and it captures the keystrokes from the keyboard attached to it. It saves the data to a file on the USB and it can store a certain amount of data. To access the logfile you press the secret key combination KBS for a little while, this makes the storage visible in the explorer.
Sometimes things doesn't turn out the way you want and it seemed like the vendor sent me the 16 mb version instead of the 16 gb version, so I returned it.
But I still wanted to add this type of device to my toolbox, so I got an AirDrive Keylogger Pro instead. The difference is basically that you can connect to it with wifi.
This means that it sits between my keyboard and my computer, but it also generates a wifi network. If I connect to the network and browse to a certain IP address I can start configure the device, such as changing wifi name, password, read the log and even set up an email service.
However, I have not tried the email function yet, but the wifi function worked really well. In the future I will test it together with my tablet or phone or something as well I think and see what it can pick up, and also run Zenmap against it, to see what ports are showing up.
All in all, it is a fun device, but it is important that you use it responsibly and only in your own lab environment. A physical keylogger such as the ones in this article, are not really detected by the system, but you instead notice them if you follow the cable to the computer, or if you notice a strange public wifi, that shouldn't be there.