FOCA Explained: Metadata OSINT and Document Scanning for PenTest+

FOCA — Fingerprinting Organizations with Collected Archives — is an OSINT tool that finds documents published on a target's websites, downloads them, and extracts the metadata hidden inside. It is a reconnaissance tool, and what it reveals about most organizations is uncomfortable.

Every document an organization publishes carries metadata nobody looked at. FOCA collects it at scale and assembles it into a map of the internal network and the people on it.

What It Does, Step by Step

  1. Search. FOCA queries search engines for documents on a target domain, using operators equivalent to site:target.com filetype:pdf across many file types.
  2. Download. It retrieves every document it finds — PDFs, Word, Excel, PowerPoint, OpenOffice formats, and more.
  3. Extract. It parses each file's metadata.
  4. Correlate. This is the valuable part. It aggregates findings across hundreds of documents to build a picture no single file would reveal.

What Comes Out

  • Usernames. Document author fields contain real account names. A few dozen documents yields a username list and, more usefully, the organization's naming convention — jsmith, john.smith, smithj. That convention is what turns a LinkedIn employee list into a password-spraying target list.
  • Internal paths. Saved file paths reveal server names, share names and folder structures — \\FS01\Finance\Budgets\ tells an attacker a server name and a share worth reaching.
  • Software versions. The application and version that created each document, which points directly at known vulnerabilities and at what the standard build looks like.
  • Printer and device names from print metadata.
  • Operating systems, inferred from creator strings.
  • Email addresses embedded in properties.
  • Deleted content in some formats — tracked changes, comments and earlier revisions that the author believed were gone.

Put together, that is an internal network diagram, a user list, a software inventory and a naming convention, assembled entirely from public files without sending a single packet to the target's network. That last point is why it matters: FOCA reconnaissance is completely passive and generates nothing for the target to detect.

Where It Fits in Reconnaissance

Penetration testing distinguishes passive from active reconnaissance. Passive means gathering information without interacting with the target's systems — search engines, public records, social media, and document metadata. Active means touching them: port scanning, banner grabbing, vulnerability scanning.

FOCA is firmly passive, which is why it comes first in an engagement. It is also why it is difficult to defend against detection-wise — there is nothing to detect. The only defense is not publishing the metadata in the first place.

Related tools worth knowing by name: Metagoofil does much the same job from the command line; exiftool reads and strips metadata from individual files; theHarvester collects email addresses and subdomains; Maltego visualizes relationships between collected data; Shodan indexes internet-facing devices; and Recon-ng is a broader OSINT framework.

Defending Against It

The fix is straightforward and almost universally neglected: strip metadata before publishing.

  • Make it part of the publishing workflow, not an individual's responsibility. Automated sanitization on the web server or CMS is the only version that survives contact with reality.
  • Use the built-in tools. Microsoft Office has Document Inspector; Windows has "Remove Properties and Personal Information" in a file's Properties dialog; exiftool handles bulk removal.
  • Publish as PDF with metadata cleared, rather than in the original editable format.
  • Audit what is already out there. Run FOCA against your own domain — that is a legitimate and revealing exercise, and it is usually the thing that convinces management.
  • Avoid real usernames in document properties by setting a generic author at the template level.
  • Remember images too. The same problem applies to EXIF data in photographs, which carries location rather than usernames.

PenTest+ (PT0-003) Exam Tips

  • FOCA is a passive reconnaissance and metadata analysis tool. Know what the acronym stands for.
  • Passive versus active reconnaissance — FOCA is passive and undetectable by the target.
  • Metadata yields usernames, internal paths, software versions and naming conventions.
  • The naming convention is the prize, because it converts public employee names into valid account names.
  • Know the neighbouring tools: Metagoofil, exiftool, theHarvester, Maltego, Shodan, Recon-ng.
  • Reconnaissance comes first in the engagement methodology, before scanning and exploitation.

Security+ and CySA+ Angles

Security+ (SY0-701) treats metadata exposure as an information disclosure and data leakage issue, and OSINT as a reconnaissance technique attackers use against you. Sanitizing published documents is the control.

CySA+ (CS0-004) approaches it from attack surface management — knowing what your organization exposes publicly is part of knowing what you have to defend, and periodic OSINT self-assessment belongs in a mature programme.

Key Takeaways

  • FOCA extracts metadata from an organization's published documents and correlates it at scale.
  • It reveals usernames, internal server paths, software versions and printer names.
  • The username naming convention is the most valuable output, because it enables credential attacks.
  • It is entirely passive — the target cannot detect it.
  • The defense is stripping metadata before publishing, automated as part of the workflow.
  • Run it against your own domain to see what you are already giving away.

Comments

Post a Comment