metagoofil is a Linux-native metadata extraction tool, often described as FOCA’s command-line counterpart for Kali Linux. It searches for publicly indexed documents (PDF, DOC, XLS, PPT, and their modern equivalents) hosted on a specified target domain using search engine dorking, downloads them locally, and then extracts embedded metadata such as author names, software versions, and creation dates using underlying libraries like ExifTool and Hachoir. Metagoofil is a longstanding staple in the OSINT/recon phase for building username lists and fingerprinting an organization’s software environment purely from publicly available documents.
Installation
# Kali/Debian (pre-installed, or reinstall)
sudo apt update && sudo apt install metagoofil -y
# From source (any Linux distro with Python 3)
git clone https://github.com/opsdisk/metagoofil.git
cd metagoofil
pip3 install -r requirements.txt --break-system-packages
python3 metagoofil.py --help
Verify installation:
metagoofil --help
Syntax
metagoofil -d DOMAIN -t FILETYPES [OPTIONS]
Command-Line Options
| Flag | Description |
|---|---|
-d, --domain DOMAIN | Target domain to search for documents |
-t, --filetype TYPES | Comma-separated list of file extensions to search for (pdf,doc,xls,ppt,docx,xlsx,pptx,odp,ods) |
-l, --limit NUM | Maximum number of results to search for per file type |
-n, --download-limit NUM | Maximum number of files to actually download |
-o, --output DIR | Directory to save downloaded files into |
-w, --without-download | Only list discovered document URLs without downloading them |
-s, --search-engine ENGINE | Search engine to use for document discovery (e.g., google, bing) |
-r, --report FILE | Save an HTML report of results |
-v, --verbose | Enable verbose logging output |
Basic Usage
metagoofil -d example.com -t pdf,docx -l 50 -n 20 -o downloads -r report.html
Expected output:
[*] Searching for pdf files on example.com
[+] Found 12 pdf files
[*] Searching for docx files on example.com
[+] Found 7 docx files
[*] Downloading 19 files to ./downloads
[*] Extracting metadata...
[+] Report saved to report.html
Practical Examples
Example 1 — Search only (no downloading) for PDF files
metagoofil -d example.com -t pdf -l 30 -w
[*] Searching for pdf files on example.com
https://example.com/files/annual-report.pdf
https://example.com/whitepapers/security-overview.pdf
Example 2 — Download and analyze DOCX and XLSX files
metagoofil -d example.com -t docx,xlsx -l 20 -n 10 -o docs
[+] Found 10 docx/xlsx files
[*] Downloading to ./docs
[+] Downloaded: employee-handbook.docx
[+] Downloaded: budget-2026.xlsx
Example 3 — Full scan with HTML report generation
metagoofil -d example.com -t pdf,doc,docx,xls,xlsx -l 100 -n 50 -o results -r example_report.html
[*] Processing 50 documents...
[+] Report saved: example_report.html
Example 4 — Extracting just author metadata after download
metagoofil -d example.com -t pdf -l 20 -n 20 -o pdfs
grep -A2 "Author" pdfs/*.pdf 2>/dev/null
Author: J. Martinez
Author: A. Thompson
Example 5 — Searching using Bing instead of Google
metagoofil -d example.com -t pdf -s bing -l 30 -w
[*] Searching bing for pdf files on example.com
https://example.com/reports/q3-financials.pdf
Example 6 — Extracting usernames pattern from downloaded documents (manual post-processing)
for f in downloads/*.docx; do
exiftool "$f" | grep -i "Last Modified By"
done
Last Modified By: r.johnson
Last Modified By: k.lee
Example 7 — Limiting output for a quick initial pass
metagoofil -d example.com -t pdf -l 10 -n 5 -o quick_check
[*] Found 5 pdf files
[*] Downloaded 5 files to ./quick_check
Common Use Cases
- Building a candidate list of internal usernames (from document “Author”/”Last Modified By” metadata) for password-spraying or phishing-simulation preparation.
- Fingerprinting the software/OS versions used across an organization based on document creator metadata (e.g., detecting old, potentially vulnerable Office versions).
- Discovering sensitive documents (financial reports, internal handbooks, technical whitepapers) unintentionally exposed via search engine indexing.
- Supplementing theHarvester and FOCA-style investigations with a fully Linux command-line-native workflow suitable for automation and scripting.
Automation with Bash
Full metadata-harvesting pipeline with username extraction:
#!/bin/bash
# metagoofil_pipeline.sh
DOMAIN=$1
OUTDIR="metagoofil_${DOMAIN}"
mkdir -p "$OUTDIR"
metagoofil -d "$DOMAIN" -t pdf,doc,docx,xls,xlsx,ppt,pptx \
-l 100 -n 50 -o "$OUTDIR" -r "${OUTDIR}/report.html"
echo "[*] Extracting authors/usernames from downloaded documents..."
for f in "$OUTDIR"/*; do
exiftool "$f" 2>/dev/null | grep -iE "Author|Last Modified By|Creator"
done | sort -u > "${OUTDIR}/discovered_usernames.txt"
echo "[+] Candidate usernames saved to ${OUTDIR}/discovered_usernames.txt"
Batch scan multiple domains:
#!/bin/bash
while IFS= read -r domain; do
echo "[*] Processing $domain"
metagoofil -d "$domain" -t pdf,docx -l 50 -n 20 -o "results_${domain}" -r "results_${domain}/report.html"
done < domains.txt
Tips and Best Practices
- Focus on legacy file formats (
.doc,.xls,.ppt) in addition to their modern XML-based equivalents (.docx,.xlsx,.pptx) — older formats historically leak more metadata such as full internal file paths. - Always pair discovered usernames with theHarvester’s employee-name results to confirm a consistent naming convention (e.g.,
firstinitial.lastname) before using them operationally. - Use
-w(without-download) first to quickly gauge how many documents exist before committing to a full download-and-analyze pass, especially for large organizations. - Store output in an organized per-target directory structure (
-o) to keep long-running or multi-target engagements manageable. - Combine with
exiftooldirectly for deeper metadata parsing beyond what Metagoofil’s built-in report provides — ExifTool exposes additional fields Metagoofil’s summary may omit.
Troubleshooting
| Problem | Cause | Fix |
|---|---|---|
[-] Search engine returned no results | Search engine is throttling/blocking automated scraping | Try -s bing as an alternative to Google, or reduce -l and wait before retrying |
| Downloaded files fail to open/parse | File is corrupted, password-protected, or not actually the claimed file type | Manually verify a sample with file filename and exiftool filename |
| Report HTML file is empty or missing sections | No metadata found in any downloaded documents (well-scrubbed documents) | This is a valid finding (good target OPSEC), not a tool error |
| Extremely slow document downloads | Target server rate-limiting or slow connection | Reduce -n (download limit) and add delays between runs |
ModuleNotFoundError running from source | Missing Python dependencies | Run pip3 install -r requirements.txt --break-system-packages |
References
- Official GitHub repository (maintained fork): https://github.com/opsdisk/metagoofil
- Kali Linux tool page: https://www.kali.org/tools/metagoofil/
- ExifTool documentation (used for deeper metadata parsing): https://exiftool.org/
