"I love Canarytokens"

2022-05-05 20:39:34

New token Manage this token What is this and why should I care? Documentation Your Web token is active! Copy this URL to your clipboard and use as you wish: ↻ Remember, it gets triggered whenever someone requests the URL. If the URL is requested as an image (e.g. ) then a 1x1 image is served. If the URL is surfed in a browser than a blank page is served with fingerprinting Javascript. Ideas for use: In an email with a juicy subject line. Embedded in documents. Inserted into canary webpages that are only found through brute-force. This URL is just an example. Apart from the hostname and the actual token (the random string), you can change all other parts of the URL. Your Fast Redirect token is active! Copy this URL to your clipboard and use as you wish: ↻ The token is similar to the Web token, however, when the link is loaded the view will be immediately redirected to the specified redirect URL. Ideas for use: Replace links with these to capture user information before user is redirected to where they want to go. Embedded in documents. Inserted into canary webpages that are only found through brute-force. This URL is just an example. Apart from the hostname and the actual token (the random string), you can change all other parts of the URL. Your Slow Redirect token is active! Copy this URL to your clipboard and use as you wish: ↻ The token is similar to the Fast Redirect token, however, when the link is loaded the user's browser / browser plugin information is captured. Ideas for use: Replace links with these to capture user information before user is redirected to where they want to go. Embedded in documents. Inserted into canary webpages that are only found through brute-force. This URL is just an example. Apart from the hostname and the actual token (the random string), you can change all other parts of the URL. Your DNS token is active! Copy this hostname to your clipboard and use as you wish: Remember, it gets triggered whenever someone performs a DNS lookup of the hostname. The source IP address shown in the alert is the DNS server, not the end user. Ideas for use: Include in a PTR entry for dark IP space of your internal network. Quick way to determine if someone is walking your internal DNS without configuring DNS logging and monitoring. Leave in a .bash_history, or .ssh/config, or ~/servers.txt Use as a extremely simple bridge between a detection and notification action. Many possibilities, here's one that tails a logfile and triggers the token when someone logs in: tail -f /var/log/auth.log | awk '/Accepted publickey for/ { system("host k5198sfh3cw64rhdpm29oo4ga.canarytokens.com") }' Use as the domain part of an email address. Your Email address token is active! Here is a unique email address: Remember, it gets triggered whenever someone sends an email to the address. Ideas for use: In a database with a USERS table, drop a fake record in there with this email address. If it gets triggered you know someone has accessed your data. Your MS Word token is active! Download your MS Word file You'll get an alert whenever this document is opened in Microsoft Office, on Windows or Mac OS. You can rename the document without affecting its operation. Ideas for use: Drop the file on a Windows network share. Leave the file on a web server in an inaccessible directory, to detect webserver breaches. Attach to an email with a tempting Subject line. Your MS Excel token is active! Download your MS Excel file You'll get an alert whenever this document is opened in Microsoft Office, on Windows or Mac OS. You can rename the document without affecting its operation. Ideas for use: Drop the file on a Windows network share. Leave the file on a web server in an inaccessible directory, to detect webserver breaches. Attach to an email with a tempting Subject line. Your PDF token is active! Download your PDF file You'll get an alert whenever this document is opened with Acrobat Reader, regardless of the user's security preferences in Reader. You can rename the document without affecting its operation. Ideas for use: Drop the file on a Windows network share. Leave the file on a web server in an inaccessible directory, to detect webserver breaches. Attach to an email with a tempting Subject line. Your Windows Folder token is active! Download your Zip file Unzip this file in a folder, and get notified when someone browses the folder in Windows Explorer. It will even trigger if someone is browsing the folder via a network share! The alert will include the network domain and username of the browsing user, if present. Ideas for use: Unzip the file on a juicely named Windows network share. Unzip the file on your CEO's laptop on a folder on their Desktop. Your Signed Executable token is active! Save this file and deploy on Windows machines: Remember, this token is triggered whenever the binary file is executed. For EXEs, this means direct execution and for DLLs, it means they were loaded. Ideas for use: Decide on a few default binaries commonly used by attackers, and token them. Your Cloned Website token is active! Use this Javascript to detect when someone has cloned a webpage. Place this Javascript on the page you wish to protect: When someone clones your site, they'll include the Javascript. When the Javascript is run it checks whether the domain is expected. If not, it fires the token and you get an alert. Ideas for use: Run the script through an obfuscator to make it harder to pick up. Deploy on the login pages of your sensitive sites, such as OWA or tender systems. Your SQL Server token is active! The next step is to copy the SQL snippet below and run in your SQL Server database. --create a stored proc that'll ping canarytokens CREATE proc ping_canarytoken AS BEGIN declare @username varchar(max), @base64 varchar(max), @tokendomain varchar(128), @unc varchar(128), @size int, @done int, @random varchar(3); --setup the variables set @tokendomain = ''; set @size = 128; set @done = 0; set @random = cast(round(rand()*100,0) as varchar(2)); set @random = concat(@random, '.'); set @username = SUSER_SNAME(); --loop runs until the UNC path is 128 chars or less while @done