> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/input-capture.md).

# Input Capture

**ATT\&CK ID:** [T1056](https://attack.mitre.org/techniques/T1056/)

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).

The table below shows only results that are pertinent to Windows.

| ID                                                          | Name                                                                     |
| ----------------------------------------------------------- | ------------------------------------------------------------------------ |
| [T1056.001](https://attack.mitre.org/techniques/T1056/001/) | [Keylogging](https://attack.mitre.org/techniques/T1056/001/)             |
| [T1056.002](https://attack.mitre.org/techniques/T1056/002/) | [GUI Input Capture](https://attack.mitre.org/techniques/T1056/002/)      |
| [T1056.003](https://attack.mitre.org/techniques/T1056/003/) | [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003/)     |
| [T1056.004](https://attack.mitre.org/techniques/T1056/004/) | [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/) |

## **Index**

{% content-ref url="/pages/aiZfdrUg4TFkfL0DdFoq" %}
[Keylogging](/pentest-everything/everything/everything-active-directory/input-capture/keylogging.md)
{% endcontent-ref %}