xspy

xspy is designed to snoop on X server displays, capturing keystrokes from remote or local X-Windows servers. This tool is useful in penetration testing scenarios where an attacker gains access to an X session or display to monitor user input in real-time.

The tool opens a specified display, such as :0.0, and begins sniffing keystrokes, logging them as they occur. It demonstrates output like captured commands such as 'id' and 'whoami', showing its capability to intercept sensitive terminal activity.

Use cases include assessing the security of X11 environments, demonstrating risks of exposed X servers, and educational purposes in cybersecurity training on display protocol vulnerabilities.

xspy connects to an X server display (e.g., :0.0) and sniffs keystrokes by intercepting X11 protocol events. It monitors input events on the specified display, capturing and displaying keypresses in real-time, such as those from terminal commands. The tool relies on libx11-6 for X11 interactions and operates by snooping the display connection without requiring additional privileges beyond display access.