Shows how to pull keystrokes captured by website clone tool from Cobalt Strike's data model. Go to View -> Script Console. Type: load /path/to/webkeystrokes.cna. Then type 'pull'. This will present the information to you.

webkeystrokes.cna

# convert comma separated keystroke values into a string.
sub toString {
	local('@temp');
	@temp = split(",", $1);
	shift(@temp);

	return join("", map({
		return chr(parseNumber($1, 16, 10)); 
	}, @temp));
}

# grab our keystrokes
command pull {
	local('$entry $site $ip $keystrokes $token $email $data');
	foreach $entry (data_query("weblog")) {
		if ($entry[0] eq "keylogger_hit") {
			($null, $site, $ip, $keystrokes, $token) = $entry;
			$email = tokenToEmail($token);
			$data  = toString($keystrokes);
			println("$site $[20]ip $[20]email $data");
		}
	}
}