metagoofilgithub.com
CLI that uses Google dorks to find public documents (pdf, doc, xls, ppt) on a target domain and downloads them for metadata analysis.
domainfile / docdetails
tools / foca
FOCA
Windows tool that finds documents published on a domain, downloads them and extracts metadata such as usernames, software, printers and internal paths.
freeactiveossdesktop
opsec warning
This tool is active: it interacts directly with the target's infrastructure or may otherwise reveal your interest to the target. Use a research environment and weigh the risk before running it.
similar tools
ExifToolexiftool.org
The reference command-line tool for reading, writing and stripping metadata (EXIF, IPTC, XMP, GPS, maker notes) in images, video, audio and documents. Supports hundreds of formats.
imagevideofile / docdetails
VirusTotalvirustotal.com
Scans files, URLs, domains and IPs against 70+ engines. The relations graph shows passive DNS, communicating files, subdomains and historical WHOIS.
file / docurldomainip / asndetails
AlienVault OTXotx.alienvault.com
LevelBlue (formerly AT&T) Open Threat Exchange. Community threat pulses, passive DNS and indicator lookups for IPs, domains, hashes and URLs.
ip / asndomainfile / docurldetails
ThreatFoxthreatfox.abuse.ch
abuse.ch database of malware IOCs (C2 IPs, domains, URLs, hashes) tagged by malware family, free to search and export.
ip / asndomainurlfile / docdetails
URLhausurlhaus.abuse.ch
abuse.ch database of URLs used for malware distribution, searchable by URL, host, hash or tag, with downloadable feeds.
urldomainip / asnfile / docdetails