Word Doc Webbug Howto

By RSnake

I was messing around with remote JavaScript in mail clients one day and I happened on a vaguely interesting way to install a webbug inside Word documents that I haven't heard before. Here are the steps:

  • Create an HTML file with whatever text you want to send to the target in an editor like vim or pico where you can see everything (don't use Word, yet).
  • Close the document in the other editor.
  • Open the file with Microsoft Word (this will highly mess up your document in a non-visible way).
  • Close the document from Word.
  • Open the document again in your other editor so you can see what Word has done to it.
  • Look for the <meta section at the top.
  • Add in a line like the following, just below the <meta tags (use your own domain, of course):
  • Close the document in your other editor.
  • Rename the .html file to .doc
  • Open in Word.
  • Look at your server logs to see the webbug hitting that server location.

And there you have, it. You now have a functioning webbug in your .doc file that doesn't spawn images or other things that would be more obvious to even the casual observer. The other nice thing is that style sheets don't give errors when they fail. Of course you can do the same thing with 1x1 pixel images using something like the following:

I like the CSS method better, however, because it is lesser known and Word is less likely to modify that section of code upon editing it, for now. Just remember, if you edit the file in Word, you need to verifiy that your change was not overwritten (this is prett unlikely, but check anyway). Happy bugging!

Written in vim, W3C valid and UTF-8 encoded, for her pleasure.
All rights reserved, all wrongs observed.
© 2001-2015 RSnake