KeyLover

Something More Than a Keylogger (:

An educational keystroke demo built for the GDSC security workshop. It shows how remote keystroke capture works over a plain TCP socket, so the room can understand - and then defend against - it.

• server(victim).pyw - runs on the machine being monitored. Binds 0.0.0.0:4444, waits for one observer at a time, then streams every keystroke to them. After a disconnect it accepts the next observer, so a whole class can take turns without restarting.
• client(attacker).py - connects to the victim's host/port and writes the incoming keystrokes to log.txt live, with a timestamp on every chunk and a session header when you connect.
• detect.py - the defender side: probes a host's ports and flags anything listening that could be a KeyLover-style logger.

Setup

pip install -r requirements.txt

Demo

1. Start the monitor on the target machine:

   python "server(victim).pyw"

2. From the observer machine, run:

   python "client(attacker).py" --host 192.168.1.20

   No flags = interactive prompts. Options: --host, --port (default 4444), --log (default log.txt), --attempts (connect retries).
3. Type; keystrokes stream into log.txt on the observer machine. Each key has [HH:MM:SS] and non-text keys appear as #BACKSPACE# / #ENTER#-style markers.
4. When an observer disconnects, the victim server is ready for the next one. Ctrl+C on the victim shuts it down.

On Windows .pyw runs without a console window. For a visible console while developing, rename the file to .py.

Defenders corner - spotting it

Any copy of this tool is easy to find; that lack of stealth is the point.

1. Port scan the suspicious host:

   python detect.py 192.168.1.20            # probes 4444
   python detect.py --ports 4444,8080 192.168.1.20
   python detect.py --ports 1-1024 192.168.1.20

2. Confirm an open listener on the machine itself: netstat -tanp | grep 4444.
3. Check running processes for python holding a server(victim)-style script: ps aux | grep -i keylover.

Troubleshooting

• "port 4444 busy" - a previous instance is still bound. Wait a few seconds or change the port in both files.
• "no response from the victim" - wrong IP, or the monitor isn't running. Both machines must reach each other on port 4444 (same LAN, no firewall block). Test with nc -zv <host> 4444.
• Log shows empty lines - that's space/enter keys; they're kept to show where words break.

Use responsibly

This is demonstration software for security education. Run it only on machines you own or in a supervised lab with explicit permission. It is not stealthy by design: no persistence, no hiding, no auto-start, no encryption.