FOCA (Fingerprinting Organizations with Collected Archives) is a metadata-extraction and document-analysis tool originally developed by Informática 64 (Chema Alonso’s team) for Windows. FOCA automates the process of searching for publicly available documents (PDF, DOCX, XLSX, PPTX, and older Office formats) on a target domain via search engines, then downloads and parses their embedded metadata — author names, software versions, internal usernames, printer paths, and even internal server names/IP addresses that can leak through document properties. It also performs analysis to fingerprint the client’s network topology based on patterns found across many documents.
Installation
FOCA is a Windows-only .NET application and is not natively available on Kali Linux. It is typically run on a Windows VM/host alongside a Kali-based penetration testing setup, or via Wine on Linux (with limited compatibility).
# On Windows:
# 1. Download the FOCA installer from the official GitHub releases page:
# https://github.com/ElevenPaths/FOCA/releases
# 2. Run the installer (requires .NET Framework, prompted automatically if missing)
# 3. Launch FOCA.exe
# On Kali Linux via Wine (unofficial, limited support):
sudo apt update && sudo apt install wine -y
wine FOCA_Installer.exe
For a native Linux/Kali workflow, most practitioners use metagoofil (covered in section 2.16) as FOCA’s functional equivalent, since it performs similar metadata extraction directly on Linux.
Syntax
FOCA is a GUI-driven Windows application; there is no traditional command-line syntax for its core workflow. The general operational flow is:
- File → New Project — enter the target domain name and a project folder location.
- Search tab — select search engines (Google, Bing, DuckDuckGo) and document types to search for.
- Click Search All to discover publicly indexed documents on the target domain.
- Select discovered documents and click Download to retrieve them locally.
- Right-click downloaded documents → Extract All Metadata to parse embedded metadata.
- Use the Network, Users, Software, and Folders tabs to review aggregated findings across all analyzed documents.
Command-Line Options
FOCA does not expose a standard CLI, but its GUI panels function as configuration “options”:
| GUI Panel/Option | Description |
|---|---|
| Search Engines panel | Toggle Google, Bing, DuckDuckGo as document discovery sources |
| Document Type filters | Select which file types to search for: pdf, doc/docx, xls/xlsx, ppt/pptx, odt |
| Download options | Configure proxy settings and download throttling for bulk document retrieval |
| Metadata Extraction | Extract Author, Company, Software Version, Creation/Modification dates, and embedded paths |
| Network tab | Aggregates discovered internal hostnames, IPs, and domain names found across all metadata |
| Users tab | Aggregates discovered usernames found in document “Author”/”Last Saved By” metadata fields |
| Software tab | Aggregates discovered software names/versions used to create documents (fingerprinting client OS/Office versions) |
| DNS Search / DNS Snooping | Built-in DNS enumeration module (similar to dnsrecon) |
| PDF Analysis | Additional deep parsing specific to PDF metadata and embedded objects |
Basic Usage
- Launch FOCA and create a new project targeting
example.com. - In the Search tab, enable Google and Bing, select “PDF” and “DOCX” file types, and click Search All.
Expected result (GUI file list view):
Project: example.com
Discovered Documents:
https://example.com/files/annual-report-2025.pdf
https://example.com/hr/employee-handbook.docx
https://example.com/finance/budget-2026.xlsx
- Select all documents → Download → then Extract All Metadata.
Practical Examples
Example 1 — Basic document discovery via Google
- Project target:
example.com - Search Engines enabled: Google
- File types: PDF only
- Result: FOCA lists all PDF URLs indexed by Google under
site:example.com filetype:pdf, populated automatically in the results panel.
Example 2 — Multi-engine search across PDF, DOCX, and XLSX
- Enable Google, Bing, and DuckDuckGo simultaneously.
- Select PDF, DOCX, XLSX as target file types.
- Result: a consolidated, deduplicated list of documents found across all three search engines.
Example 3 — Bulk downloading discovered documents
- Right-click all discovered documents in the results list → Download.
- Result: FOCA downloads each file into the local project folder for offline metadata parsing.
Example 4 — Extracting metadata from a downloaded PDF
- Right-click a downloaded PDF → Extract Metadata.
- Result panel shows:
File: annual-report-2025.pdf
Author: J.Smith
Creator Software: Microsoft Word 2019
Creation Date: 2025-11-02
Last Modified By: j.smith@example.com
Example 5 — Aggregating discovered usernames across many documents
- After extracting metadata from 20+ documents, open the Users tab.
- Result: FOCA compiles a deduplicated list of all “Author”/”Last Saved By” values discovered, often revealing a pattern like
firstname.lastnameused across the organization — valuable for guessing email/username formats.
Example 6 — Fingerprinting internal network paths from metadata
- Open the Network tab after processing multiple documents.
- Result: FOCA surfaces internal server names, shared drive paths (e.g.,
\\FILESERVER01\shared\), and sometimes internal IP addresses embedded in document metadata (common in older Office document formats and certain PDF exports).
Example 7 — Software fingerprinting across the organization
- Open the Software tab.
- Result: FOCA lists software/versions used to produce discovered documents (e.g., “Microsoft Office 2016”, “Adobe Acrobat Pro DC 2020”), useful for identifying outdated/vulnerable software potentially still in use internally.
Common Use Cases
- Discovering sensitive metadata embedded in publicly accessible documents (author names, internal usernames, software versions, and — in older formats — internal network paths).
- Building a list of likely internal usernames/email address patterns for password-spraying or phishing campaign preparation (with proper authorization).
- Fingerprinting an organization’s internal software stack (Office suite versions, OS hints) to identify potentially outdated/vulnerable software.
- Mapping internal network topology hints (server names, shared drive paths) leaked through legacy document metadata.
- Supporting a broader information-gathering report section on “document metadata exposure” for a client penetration test deliverable.
Automation with Bash
Since FOCA itself is GUI/Windows-only, Linux-based automation typically wraps around exporting its results or replicating its core function using command-line tools. A common Linux-native workflow uses exiftool alongside document-discovery via search dorking:
#!/bin/bash
# foca_alt_metadata.sh - Linux alternative metadata extraction workflow
# (companion to FOCA when working from a Kali host)
DOMAIN=$1
mkdir -p foca_docs
echo "[*] Search manually via: site:$DOMAIN filetype:pdf OR filetype:docx OR filetype:xlsx"
echo "[*] After manually downloading files into ./foca_docs/, run:"
for file in foca_docs/*; do
echo "=== $file ==="
exiftool "$file" | grep -iE "Author|Creator|Last Modified By|Software"
done
Exporting FOCA’s own project results (via its built-in “Export” feature to XML/CSV) can then be parsed further with bash:
#!/bin/bash
# Parse an exported FOCA project XML for unique authors
grep -oP '(?<=<Author>).*?(?=</Author>)' foca_export.xml | sort -u
Tips and Best Practices
- Run FOCA from a dedicated Windows VM within your penetration testing lab environment rather than attempting unreliable Wine compatibility on Kali — many features (especially network fingerprinting) depend on Windows-specific libraries.
- Always cross-reference usernames discovered in metadata against actual employee names found via LinkedIn/theHarvester to confirm naming-convention patterns before using them in a password-spray or phishing simulation.
- Focus especially on older document formats (
.doc,.xls,.pptrather than theirx-suffixed successors) — legacy OLE-based formats tend to leak significantly more metadata (full file paths, printer names) than modern XML-based Office formats. - Combine FOCA’s findings with Metagoofil (its Linux-native counterpart) for engagements run primarily from Kali, using FOCA only when deeper GUI-based analysis or its network-fingerprinting features are specifically needed.
- Always get explicit authorization before bulk-downloading documents from a target site — while the documents are publicly accessible, automated bulk scraping can still trigger the target’s WAF/rate-limiting defenses.
Troubleshooting
| Problem | Cause | Fix |
|---|---|---|
| FOCA fails to launch on Windows | Missing .NET Framework dependency | Install the required .NET Framework version prompted by the installer |
| No documents found during search | Search engine API/scraping blocked, or target has no indexed documents of the selected type | Try alternate search engines within FOCA; manually verify with a browser search using site: and filetype: operators |
| Metadata extraction shows empty/blank fields | Document was scrubbed of metadata before publishing (e.g., via “Document Inspector” in Office, or PDF sanitization) | This indicates good target OPSEC; note it as a positive finding in the report rather than a tool failure |
| Wine compatibility issues on Kali | FOCA relies on Windows-specific APIs not fully supported by Wine | Run FOCA on an actual Windows VM instead of relying on Wine |
| Network tab shows no internal hostnames/IPs | Target’s documents were created with modern Office formats that don’t embed such metadata by default | Expected for organizations using up-to-date Office 365; rely more on other recon tools for network mapping |
References
- Official FOCA GitHub repository: https://github.com/ElevenPaths/FOCA
- ElevenPaths (Telefónica) security tools page: https://github.com/ElevenPaths
- OWASP metadata testing guidance: https://owasp.org/www-project-web-security-testing-guide/
