FOCAgithub.com
Windows tool that finds documents published on a domain, downloads them and extracts metadata such as usernames, software, printers and internal paths.
domainfile / docdetails
tools / metagoofil
metagoofil
CLI that uses Google dorks to find public documents (pdf, doc, xls, ppt) on a target domain and downloads them for metadata analysis.
freeactiveosscli
field note
Pipe the downloaded files into ExifTool to pull author names and internal usernames, which often follow the company's email format.
opsec warning
This tool is active: it interacts directly with the target's infrastructure or may otherwise reveal your interest to the target. Use a research environment and weigh the risk before running it.
similar tools
ExifToolexiftool.org
The reference command-line tool for reading, writing and stripping metadata (EXIF, IPTC, XMP, GPS, maker notes) in images, video, audio and documents. Supports hundreds of formats.
imagevideofile / docdetails
VirusTotalvirustotal.com
Scans files, URLs, domains and IPs against 70+ engines. The relations graph shows passive DNS, communicating files, subdomains and historical WHOIS.
file / docurldomainip / asndetails
AlienVault OTXotx.alienvault.com
LevelBlue (formerly AT&T) Open Threat Exchange. Community threat pulses, passive DNS and indicator lookups for IPs, domains, hashes and URLs.
ip / asndomainfile / docurldetails
ThreatFoxthreatfox.abuse.ch
abuse.ch database of malware IOCs (C2 IPs, domains, URLs, hashes) tagged by malware family, free to search and export.
ip / asndomainurlfile / docdetails
URLhausurlhaus.abuse.ch
abuse.ch database of URLs used for malware distribution, searchable by URL, host, hash or tag, with downloadable feeds.
urldomainip / asnfile / docdetails