Scan .docx for canaries (not just footers :D). Based on https://github.com/n3tsurge/detect-canary/blob/main/detect-canary.py

canary-check.py

import os
import re
import sys
import zipfile
import glob
import logging
import argparse

def get_files(base_path=".", pattern="*.docx"):
    '''
    Use a base_path and a glob pattern to create a list
    of files we want to work on
    '''

    full_path = os.path.join(base_path,pattern)
    print(full_path)

    files = glob.glob(full_path)
    return files


if __name__ == "__main__":

    logging.basicConfig(
        format='%(asctime)s - %(levelname)s - %(message)s', level=logging.INFO)
    
    parser = argparse.ArgumentParser()
    parser.add_argument('--path', type=str, help="The base path where to search")
    parser.add_argument('--file', type=str, help="A single file to check")
    parser.add_argument('--search', type=str, help="The pattern to search for e.g. *.docx", default="*.docx")
    parser.add_argument('--full', action="store_true", help="Show all URLs")

    args = parser.parse_args()
    if not args.path:
        files = [args.file]
    else:
        files = get_files(args.path, args.search)

    logging.info("Found {} files".format(len(files)))
    for f in files:
        logging.info("Working on \"{}\"".format(f))
        with zipfile.ZipFile(f) as z:
            footers = [m for m in z.namelist()]
            for footer_file in footers:
                with z.open(footer_file) as footer:
                    try:
                        data = footer.read().decode()
                    except:
                        continue
                    urltag_re = r"<[^<>]+https?:\/\/[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}[-a-zA-Z0-9()@:%_\+.~#?&/=]*[^<>]+>"                            
                    for match in re.findall(urltag_re, data):
                        if args.full:
                            print(f, "->",match)
                        else:
                            if "external" in match.lower():
                                print(f, "->",match)