[which infusion to keylog passwords, besides sslstripping]

You could always try using Evil Portal and Portal Auth to clone a page, inject your own code, and display that page to the target. After they send their credentials to you, you redirect them to the actual page they wanted. It takes a little more effort than just clicking a button, though.

Hi,

this is the case when the users are using web browsers. What about when they use social networks mobile apps on their smartphone? can't keylog/sniff that, right?

regards