messypup Posted October 1, 2021 Share Posted October 1, 2021 For my purpose we need to capture of keystrokes over a couple weeks with accurate timestamps (to within a few seconds). The "Keystroke stream history" is exactly what I need. But I can't find anyway to download it? Is there a way to extract/download the keystroke stream? How long is it kept for? Does it get rotated / truncated? I am assuming the stream is stored in the c2.db file but I don't know what format that is in. I made a guess at sqlite but that doesn't seem to be correct. Link to comment Share on other sites More sharing options...
messypup Posted October 13, 2021 Author Share Posted October 13, 2021 For anyone striking the same issue I hacked around it by grabbing the authorization header from my browser once logged into my c2 web interface, and then passing that hit http://<c2-host>/api/sites/1/devices/2/keystrokes/history. That gives you a JSON dump of the history. I'm not sure when (if?) it rolls over but it's currently up to 6000 entries in there and hasn't purged any of the earlier ones yet. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.