Bugging Microsoft Files: Part 1 – Docx Files using Microsoft Word
If you’re familiar with ADHD and Web Word Bugs, you likely already know the method to create web tracking software using .html files renamed as .doc files. This works, but you also likely know that it makes it difficult to use existing documents, especially if you want to update the documents in the future. In this post I’m going to share a method that works with native .docx files. It can be used with a new document or an existing one. I thought this would be good timing considering Jordan recently mentioned the risks of opening Office documents in his post.
The instructions below were made with Microsoft Word 2013 for Windows.
- Open an existing document or create a new one. Place the cursor where you want to insert the tracker. You can place it anywhere, but I recommend using the header or footer as it is less likely to be accidentally changed if inserting fake content in the document later on.
- Choose the Insert Menu.
- Choose Quick Parts.
- Choose Field.
This will open a dialog window where you can choose a field.
- Choose IncludePicture.
- Type the address for your tracking bug. You should come up with a unique name for this document so when it is opened later you can tell which document it was. The address should be similar to http://DOMAIN/index.php?id=ID&type=img but you need to replace DOMAIN and ID with your own values.
- Check the box labeled: Data not stored with document. This tells Word to request the image every time the document is opened.
- Choose OK.
You can resize the image by selecting it and dragging the corner down.
Smaller Image Not Loaded
By making it as small as possible, it is barely noticeable.
Smallest Image Not Loaded
Save the file and close Word.
In my next posts I will cover weaponizing .xlsx files and removing metadata from Office files afterwards.
References:
Ready to learn more?
Level up your skills with affordable classes from Antisyphon!
Available live/virtual and on-demand
Lemuel
November 9, 2016 @ 8:03 am
On the website used to harvest information, you could create a function which extracts the data, but returns an image. Then in the document call your function with the ID. That way, the image will actually load and be less suspicious
Ethan
November 9, 2016 @ 3:17 pm
Great suggestion Lemuel! I neglected to mention this in the post but this style of bugging works great with the Web Bug Server used in ADHD and it does exactly what you suggest.
https://adhdproject.github.io/#!Tools/WebBugServer.md
https://bitbucket.org/ethanr/webbugserver/src