HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
anko
xkbcat
C2016–2024
anko / xkbcat

xkbcat

simple sudoless X11 keylogger

Explore on GitHubRead Hacker News discussions
3Distinct people
5Mentions
0Explicit recommenders
121GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

simple sudoless X11 keylogger

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year5 dated mentions

Observed mentions: 2016-05-16 12:25:11 UTC to 2024-10-29 10:24:59 UTC.

0122016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20162017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC101
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC000
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC101
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC000
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC000
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC000
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC202
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101

What Hacker News says

5 sources
orangeboats·Oct 29, 2024
> Yes, X11 programs can maliciously keylog each other, but this just isn't a thing that actually happens. A simple search leads me to this: https://github.com/anko/xkbcat There isn't a real attack using it yet, only because attacking Desktop Linux is a really unprofitable endeavor (considering the marketshare, the ROI must be very low). > To actually be safe while installing and running malicious applications you need extensive sandboxing FWIW, X11 is unsandboxable unless you run a second X server on top of your current server [0]. Which is fine, but you need to consider that most, if not all sandboxing solutions on Linux that "newbs" use, like Flatpak, do not employ such technique when running sandboxed X11 applications. The "security by default" behavior of Wayland limits the possible attack surface a lot, without requiring the end user
Read the rest
to understand all the nitty details involved. [0]: https://wiki.archlinux.org/title/Bubblewrap#Sandboxing_X11
In Improving Xwayland window resizing
an_ko·Dec 24, 2023
Yes, approximately. In X11 at least, the hardware codes are called keycodes, and the human readable names are called keysyms. Example of the XkbKeycodeToKeysym function in use: https://github.com/anko/xkbcat/blob/8abc3402cb679027a3bd0313... Keysyms don't necessarily strictly match "key location"; keyboards are allowed to output whatever codes they want for whatever key they want (see e.g. QMK firmware; often used in custom keyboards to do complex conditional key remapping), but they're in practice relatively consistent between common keys on most keyboards, and consistent on the same keyboard even if you switch keyboard layouts in software, unless you have some custom keyboard firmware which functionality is stateful.
In Generals.io – Capture enemy generals to defeat them
orangeboats·Nov 29, 2023
>I don't know a single person that has ever fallen victim to a virus or malware on linux, and I've been using it almost exclusively for the past 20 years. If it was a threat vector, it clearly wasn't a very big issue. So: no true Linux user succumbs to malware and no true Scotsman puts sugar on his porridge. Putting that aside, it doesn't take much effort to find an example of X11 keylogger that requires zero superuser privilege and zero explicit permission granting by the user. Here, the first result from DDGing "x11 keylogger": https://github.com/anko/xkbcat It is hard to believe this has not occurred in the wild. If such attack really hasn't occurred before in the Linux world, I would rather use the unpopularity of Linux desktop as my justification.
In Red Hat Enterprise Linux 10 Plans for Wayland and Xorg Server
mockingbirdy·Aug 29, 2018
> Failing all that, you can probably just extract the extension into the Chrome profile folder and on next restart it'll pick it up. No, this would be a security hazard. All the mentioned ways require admin privileges or even group policy privileges. I'm doing it without any permissions. Chrome hardened the process to protect their users. They're doing the best they can, but the Win-APIs are too powerful and there is no sandbox (like those for Mac) in place. Officially, all ways (registry keys, files, ...) require admin privileges for a very good reason. See http://www.chromium.org/administrators/pre-installed-extensi... for an overview of the official methods. > SandboxIE doesn't run on macOS or Linux. Mac has its own sandbox and Linux offers SELinux and I was talking about a security vulnerability I have written for Windows specifically
Read the rest
, that's why I gave the tip for Sandboxie. > Perhaps you could drop a couple of them, so I get a ballpark idea of which direction you're going in with that. > I would be extremely interested to hear some of the ways you'd particularly go about attacking Linux, which I use everyday. Sorry, I can't talk about this specific attack in detail because this vulnerability can't be fixed. It's conceptually fairly simple and <400 LoC and I'm sure you can find it on your own if you're determined. For Linux and security: If you're not constantly monitoring your running processes and bash scripts, privilege escalation and others can be easily pulled off (e.g. simply aliasing sudo). As an example, it's extremely simple to extract all stored passwords from Chrome and others [1]. That's the reason I prefer to use separate password managers (most of them protect their address space), although you can easily hack them as well. That's the reason I prefer encrypted virtual drives - it's unconventional and most tools don't cover it so the hacker has to search for them manually. Security is mainly making it more difficult to find the stuff, it's nearly impossible to hide it completely (otherwise the user wouldn't be able to access it, too). It's a big field, so I don't really know what what you're interested in. You can find exploits on https://www.exploit-db.com and look for things that are interesting for you. For most of the pwnage, you don't need any exploits (except the chain of remote exploits to get in). As soon as you're in, you can do anything without any problems - getting root user, keylogging [2] (very easy for X11), injecting shared libraries (especially easy on Linux with LD_LIBRARY_PATH) and other stuff. I would recommend sandboxing tools, network- and host-based IDS/IPS, a good firewall which also analyzes behavior patterns and a healthy amount of paranoia. Many AV systems are mainly security risks themselves and add a false sense of security, it's extremely easy to bypass them and their sandbox-analyzers. [1]: https://securityxploded.com/googlechromesecrets.php [2]: https://github.com/anko/xkbcat
In Zero-Day Vulnerability in Microsoft Windows Leaked on Twitter

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.