All language subtitles for 2. Canary tokens

Update the video we're going to be taking a look at Canary tokens now, if you're not familiar with

Canary tokens, a Canary token is essentially a token that when a target triggers it, it's going to

alert us and it's going to give us some basic information on them.

It'll tell us things like their IP address, what type of browser they're using and what type of operating

system they're using, what time they open it, things like that.

For the most part, and there's a few caveats to that that we're going to be going over now.

There's several places where you can generate Canary tokens.

Personally, I use Canary tokens dot org, and this is also a little bit different than what I normally

do usually when I do an investigation.

It's pretty much I don't directly Iraq with the target, but there are exceptions to this.

Things like If we're being the place I'm working at, if we're being spear fished, I might generate

a canary token to try to figure out who it is, especially if they're using a C email address where

you can't really get the information from.

So Google is a good example of that.

I'm not a huge fan of Google for the most part, but I have to admit some of their security is pretty

good for at least the end user point of view against other people.

Now, the problem with Gmail for ocean investigators is you can't just take the email header from a

Gmail user and feed it in and take a look at where they are location wise.

If you take a look at the at the header of an email from a Gmail user.

The IP address is going to go back to Google, which again, for the end user, that's that's great.

It's good security for ocean investigation.

It makes a little bit harder for us to figure out who that person is, and that's where Canary tokens

could kind of come in handy.

And so let's let's dive in.

Let's take a look at this.

So again, I'm a HTP is calling for a forward slash canary tokens.

Org Forward Slash generate and get this.

This one is free.

So what you want to do is you click here, you can select your token.

As you see, there's a bunch of different tokens here.

There is a web bug URL token, so when you URLs visit, it is going to alert us Diaz DSN tokens.

They'll learn as when the host name is requested.

Unique email address alerts when IM when an email sent to a unique address.

Custom images so we could actually take an image.

And when the person clicks on the image, it's going to alert us.

Likewise, we can make word documents, PDF documents, windows folder notes files from Window Folder.

It's browsed on it.

Windows Explorer Kazmi axes or deals clone websites learn US money websites cloned, which is great

for if you have your own site.

You can set up that and you can find if someone's clone your site for whatever reason.

SQL Server, a QR code voice in a whiskey's, are being used fast redirects, slow redirects, so there's

a lot of options here that we could use.

Now I'm going to show you a couple of different different ways to do this.

So the first one to do is let's choose a web bug image.

So if we click here.

It's going to ask us for which email address we're going to use to receive these alerts, so I'm going

to choose DHS.

It to ProtonMail dot com in it here, this is where you put your notes, so when it gets triggered,

these are the notes that they're going to pop up on the information sheet.

No, I do recommend you put a good amount of notes in there.

That way, you really, you know, if the person triggers it, you know, a couple of weeks from now

or a month from now, you'll know you'll remember what it is.

So I like to do is I like to put down whoever my target is.

So in this case, I'm just going to let you dummy.

Demo and then I like to put down what the trigger was, I'm going to do web.

Image.

Embedded in the email.

And that's exactly what we're going to do, we're going to embed this image in an email.

You don't have to do this.

You could actually put it on if you have a website you put on your web site or you could put it in a

forum somewhere.

And when people start clicking and alert you.

But for this example, I just want to show you how you can actually embed this into an email.

OK, so I think that's enough information for that.

And in here, you're going to select whatever the images.

So pigeon gif jpeg.

OK, so we're going to click this and I'm going to just choose an image here.

We're going to choose this one here.

OK.

And I'm.

When you're all ready, you're going to click this green button here and create my canary token.

OK, so pretty quick.

Here's where our image is going to sit.

HTTPS Canary tokens dot com for static.

Blah blah blah submit.

OK, so you want to mess that?

So again, this is a web image if you send someone this link, if they're little bit savvy, they're

going to see Canary tokens are come and either they're going to know what it is or they're probably

going to look it up.

What a canary token is, and you're going to spook them off.

So this is kind of how you can get around that.

So I have my email up here, and I'm going to go in here.

And I'm going to click this insert photo and this is for Gmail.

Other email services, you could probably use the same system, so click here.

And instead of choosing the photo, I am going to go to web address URL here, OK, and we're going

to paste our you URL in here.

OK.

And there's our image I don't always have, but what I do is ethical somewhere.

Click Insert.

OK.

And there's our image, so I'm going to just send it back to DG as.

Actually, Jacinta herself, dispo games and gmail.com put on test, and I'm going to send this off

now.

The important thing is when you do this, when you upload that image into the your message, you're

going to get one alert because Google is going to trigger that when you first click on it.

So you click this.

OK.

And we're click here.

And here we go.

So if I go on my email here, I could see my Canary token was triggered.

OK.

And I'm going to go down here, and here's our information IP address.

The Channel HTP, the time the kangaroo token I.D. Here's our token reminder you dummy demo web image

embedded in email.

Token type web image Here's our source IP.

Again, this is in this.

I could be accurate because.

This is coming through a Gmail address, and that's going to be the main problem with Gmail and also

Yahoo may be a problem for some other email, depending how they do it.

But it is when you do trigger it through those, it is going to give you the information from that provider.

So either Yahoo or Google Microsoft will actually tell you who that person is.

You will actually give you that person's IP address and their computer type, their browser, proper

browser type.

So again, it depends on what who the email provider is, but you can see here there's some great information

here.

Again, if you're not Google or Yahoo email.

But, you know, again, this could show how how this could be incredibly useful.

No, the other thing is this trigger, I like this trigger because when the person opens, email is

going to trigger automatically.

It's not going to be situations where you have to, you know, hold the person who was the email and

then hope they run the document again.

They open the email is going to automatically trigger the payload.

But on the other side, again, if it's Google or Yahoo and potentially some other email accounts,

that's not going to work right?

So what do you do in that situation or if you want to deliver a different payload, say you want to

put this on a USB drive, you want to drop it somewhere and you're pretty sure someone's going to pick

it up and run it, or you just want an email attachment or you want to put a honeypot out in your site.

Say a word document says payroll, and you're hoping they're going to click on it and execute it and

get that information.

So again, we're going to go back here to Canary Tokens dot org for a slice generate.

Let me go back here and we're a selector token.

We could do a word document, a PDF or whatnot.

These are great.

This actually could generate a real PDF or a word document.

Certainly, the word document I'm going to do is.

Those sent to and I'm going to put down you dummy word doc demo, and I'm going to create my token.

OK.

So again, pretty quick, we could download our word file.

OK.

Paul, download it now this we could actually change the name to whatever you want.

It's not going to break the Canary token, so I'm just to put down payroll.

OK.

Matter of fact, we could actually open this again when we open, it is going to trigger the Canary

token.

And we could actually edit the word document however we want.

We could put

photos, we could put text in there.

You could actually make it look like actual payroll file.

So when they click on it, it will trigger it will give the information out to you.

So again, this is canary tokens and different ways they could use it to for eurozone investigation.

Thank you for watching, and I'll see you in the next video.