Listen to this Post
Introduction
Deception‑based defense, particularly canary tokens, has become a silent nightmare for penetration testers and red teams. These tiny digital tripwires—embedded in documents, config files, or system registry—alert the blue team the moment an attacker so much as glances at them, instantly burning a covert operation. To fight back, two powerful open‑source scanners have emerged: CanaryHunter (a PowerShell‑based scanner for AWS, Kube, WireGuard, and MySQL dumps) and CanaryTokenScanner (a Python utility that surgically extracts tracking URLs from Office files and PDFs without triggering the alarm). This article dives deep into both tools, provides verified Linux/Windows command lines, and outlines a step‑by‑step methodology to integrate canary detection into your offensive security workflow.
Learning Objectives
- Identify canary tokens hidden in Microsoft Office files, PDFs, AWS configs, Kubernetes kubeconfigs, WireGuard VPN profiles, and MySQL database dumps.
- Operationalise CanaryHunter and CanaryTokenScanner via real‑world PowerShell and Python commands on both Windows and Linux environments.
- Implement network‑level countermeasures (firewall rules, egress filtering) to silently block outbound communication to known canary token domains and IP ranges.
You Should Know
- CanaryHunter – The All‑in‑One Token Detector for Docs, Configs, and Registry
CanaryHunter, developed by C0axx, is a PowerShell module that systematically scans for canary tokens in the most common places adversaries plant them. It currently supports detection in DOCX, XLSX, PDF (via PDFStreamDumper), Windows Registry, AWS configuration files, WireGuard configs, Kubernetes kubeconfigs, and MySQL dump files. The tool works by converting DOCX/XLSX files to ZIP archives, parsing their XML content for regex patterns that match canary token domains (e.g., canarytokens.com). For PDFs, it invokes an external tool to extract and analyse stream objects. Registry scanning focuses on the `SilentProcessExit` key where attackers often plant “sensitive command” canaries.
Step‑by‑step guide – scanning a DOCX file with CanaryHunter (Windows)
1. Import the module
PS C:> Import-Module .\CanaryHunter.psd1
2. Scan a Word document
PS C:> Invoke-DocxCheck -DocxPath "C:\path\to\suspicious.docx"
If a canary token is embedded, the tool prints the full callback URL:
Url Found: http://canarytokens.com/feedback/traffic/gwfrr71nre84bk5gobf3h96ms/index.html
- Scan an Excel file – similarly uses `Invoke-XlsxCheck`
PS C:> Invoke-XlsxCheck -XlsxPath "C:\path\to\financial.xlsx"
4. Scan the Windows Registry for process‑exit canaries
PS C:> Invoke-RegistryCheck
This looks for `SilentProcessExit` entries and parses the `Monitor Process` property. If a canary exists, you’ll see a PowerShell reverse DNS command (e.g., Resolve-DnsName -Name "$c.UN.$u.CMD.gwfrr71nre84bk5gobf3h96ms.canarytokens.com").
- Add a firewall rule to block outbound traffic to all known canary IPs
While not part of the script itself, the developer recommends adding a rule that drops outbound traffic to every known canary IP – a crude but effective egress filter. A sample `netsh` command on Windows:netsh advfirewall firewall add rule name="Block Canary IPs" dir=out action=block remoteip=192.0.2.0/24
(Replace the IP range with the actual canary token provider addresses; these can be gathered from public threat feeds.)
-
CanaryTokenScanner – Surgical Extraction of URLs from Office & PDF Files
CanaryTokenScanner by NeroTeam Security Labs is a Python script that reads Office files (docx, xlsx, pptx) and PDFs as ZIP archives in memory, extracts all URLs, and filters out known benign domains (e.g., schemas.openxmlformats.org, w3.org). The tool also decompresses Flate/Deflate streams inside PDFs, ensuring that no obfuscated canary token goes unnoticed. Because the script never executes the document’s macros or dynamic content, it safely inspects the file without triggering the canary.
Step‑by‑step guide – scanning a suspicious directory (Linux / Windows)
- Clone the repository and navigate to the script
git clone https://github.com/0xNslabs/CanaryTokenScanner cd CanaryTokenScanner
-
Run the scanner on a single file or entire folder
python3 CanaryTokenScanner.py /path/to/suspicious.docx
Or scan a whole directory:
python3 CanaryTokenScanner.py /home/user/downloads/
- Interpret the output – the script prints each discovered URL that is not on the ignore list. Example:
URL Found: http://canarytokens.com/images/tags/articles/gwfrr71nre84bk5gobf3h96ms/contact.php
-
Modify the ignore list – open the Python file and edit the `ignored_domains` array to add or remove domains. This customisation reduces false positives when scanning corporate documents that may legitimately contain links to internal or public services.
-
Automate scanning – integrate the script into a CI/CD pipeline or a pre‑execution hook for red team tools. For example, before automatically opening any Office attachment from a client, run:
python3 CanaryTokenScanner.py "$ATTACHMENT" || echo "ALERT: Canary token detected in $ATTACHNAME"
-
Blocking Canary Callback IPs at the Firewall (Egress Hardening)
Even the best scanning tool cannot guarantee 100% coverage. As a defence‑in‑depth measure, implement network‑level rules that prevent any process from reaching canary token servers. CanaryHunter’s creator explicitly recommends adding a firewall rule that drops outbound traffic to every known canary IP【post content】. While maintaining a perfect IP list is challenging, you can start with publicly resolved IPs of canarytokens.com, canarytokens.net, and thinkst.com.
Step‑by‑step – Linux iptables rule
Block all outbound traffic to a specific canary IP (example) sudo iptables -A OUTPUT -d 185.199.108.153 -j DROP Log blocked attempts for monitoring sudo iptables -A OUTPUT -d 185.199.108.153 -j LOG --log-prefix "CANARY_BLOCK: "
Windows (PowerShell as Admin)
New-NetFirewallRule -DisplayName "Block Canary IPs" -Direction Outbound -RemoteAddress 185.199.108.153 -Action Block
To scale this, use threat intelligence feeds that publish Canary token infrastructure (e.g., “canarytokens.com” resolved IPs). Combine with DNS sinkholing: add `0.0.0.0 canarytokens.com` to your `hosts` file to prevent any local resolution.
- Deep Dive – How CanaryTokenScanner Handles PDF Stream Decompression
Unlike simple grep searches, CanaryTokenScanner goes beyond raw byte scanning. It reads PDF files as binary streams, then processes Flate/Deflate encoded streams – a common obfuscation technique used to hide canary tokens. The script decompresses these streams in memory and applies the same regex search, effectively uncovering tokens that would otherwise remain invisible.
Behind the scenes – simplified Python logic
import zlib, re
with open("trapped.pdf", "rb") as f:
raw = f.read()
Find Flate-encoded streams (simplified)
decompressed = zlib.decompress(raw[raw.find(b"stream")+6:raw.find(b"endstream")])
if re.search(b"canarytokens\.com", decompressed):
print("[!] Canary token found in PDF stream")
For production, always use the full script, which recursively walks through all objects and handles multiple compression formats.
5. Hunting Registry Canaries – SilentProcessExit Explained
On Windows, attackers can plant a canary token that fires when a sensitive process (like net.exe) exits. The token is stored under:
`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit`
When that process terminates, the system executes a command (often a PowerShell reverse DNS lookup to a canary domain). CanaryHunter’s `Invoke-RegistryCheck` reads that registry key and decodes the command, revealing the hidden token.
Manual check without the script (reg query)
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\net.exe" /v "Monitor Process"
If a canary exists, you’ll see a long PowerShell one‑liner containing a canarytoken.com URL.
- API Security & Cloud Config Scanning – CanaryHunter’s Hidden Power
Beyond endpoint files, CanaryHunter scans structured cloud configuration files for embedded canary tokens. This is especially critical for red teams who exfiltrate AWS credentials, Kubernetes configs, or WireGuard VPN profiles – all common locations where defenders plant deception tokens.
- AWS configs – look for `aws_access_key_id` containing canary patterns.
- Kube configs – scan `kubeconfig` files for tokens that call back to
canarytokens.com. - WireGuard configs – check private keys and endpoints for hidden malicious URLs.
- MySQL dumps – parse `.sql` files for callback URLs.
Example – scanning a Kubernetes config
PS C:> Invoke-KubeCheck -KubePath "~/.kube/config"
The tool reports any suspicious URLs found inside the file. This helps red teams avoid accidentally exposing their presence by merely loading a kubeconfig that contains a canary.
- Hardening Offensive Pipelines – Integration with CI/CD and Automation
To operationalise these tools at scale, embed them into your red team automation framework.
GitHub Actions workflow (Linux runner)
- name: Scan uploaded artifacts for canaries run: | git clone https://github.com/0xNslabs/CanaryTokenScanner python3 CanaryTokenScanner/CanaryTokenScanner.py ./artifacts/ if [ $? -ne 0 ]; then exit 1; fi
PowerShell oneliner for incident response
Get-ChildItem -Recurse -Include .docx, .xlsx, .pdf | ForEach-Object { Invoke-DocxCheck -DocxPath $_.FullName }
By incorporating canary detection early, you prevent the scenario where a red team operator inadvertently burns an entire engagement by double‑clicking a booby‑trapped Excel sheet.
What Undercode Say
- Key Takeaway 1: Deception technology is no longer a passive defence; it actively burns attackers who lack pre‑execution scanning. Tools like CanaryHunter and CanaryTokenScanner level the playing field, allowing red teams to inspect traps without setting them off.
- Key Takeaway 2: A combination of file‑level scanning (PowerShell/Python) and network‑level egress filtering (firewall rules) provides a robust, layered counter‑measure. The tools described are free, open‑source, and immediately usable – there is no excuse for a red team to be caught by a simple document‑based canary anymore.
Analysis
While these tools are powerful, they are not silver bullets. Advanced defenders may embed tokens in binary‑only formats, use custom domains not matching known regex patterns, or leverage multiple layers of obfuscation. Moreover, firewall rules that block “all known IPs” require continuous maintenance. However, for the vast majority of canary tokens deployed on internal networks or via public services like canarytokens.org, CanaryHunter and CanaryTokenScanner provide an effective, low‑overhead counter‑measure. Red teams should integrate both tools into their standard operating procedures and keep their regex patterns updated as defenders adopt new deception infrastructure.
Prediction
As canary tokens become cheaper and easier to deploy (especially with services like Thinkst’s free tier and cloud‑native deception platforms), defenders will increasingly seed their environments with thousands of decoys. This will force red teams to invest in automated pre‑exploitation scanning as a mandatory step in every engagement. We predict the rise of “canary‑aware C2 frameworks” that integrate token detection before any file is opened, any config loaded, or any registry key read. Simultaneously, defenders will respond by embedding tokens in encrypted form or within compressed streams, triggering a cat‑and‑mouse race in binary analysis. Ultimately, the side that better automates the detection of deception – whether red or blue – will gain a decisive advantage in the silent war for network dominance.
▶️ Related Video (68% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Clintgibler Two – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
