The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Capture Clipboard Contents

JavaScript can be used to capture the contents of the clipboard. The following

proof-of-concept script will display an alert containing the current contents of

the clipboard:

Monitoring the clipboard periodically while a user works on other tasks

might result in all kinds of information being captured. For example, there are

some secure email applications that use the clipboard when encrypting and

decrypting messages, and do not clear its contents after use. (Note that Inter-

net Explorer 7 asks the user for permission before allowing clipboard contents

to be captured, to prevent this type of attack.)