FOCA
Fingerprinting Organizations with Collected Archives - advanced metadata analysis and passive reconnaissance
What is FOCA?
A professional passive reconnaissance tool developed by ElevenPaths
Metadata Expert
Deep extraction of advanced metadata
Fingerprinting
Precise infrastructure identification
Network Discovery
Automatic network and DNS mapping
Visual Reports
Detailed graphical reports and exports
Key features
Advanced fingerprinting and reconnaissance capabilities
Metadata Analysis
Full metadata extraction from Office documents, PDFs, images and other files to reveal hidden information.
Network Fingerprinting
Discover internal network infrastructure: servers, domains, machine names and IT architecture.
User Discovery
Identify users, employees and document authors, and map the org chart.
Vulnerability Detection
Analyze software versions to detect known vulnerabilities and outdated components.
DNS & Geolocation
DNS resolution, geographic mapping of servers and analysis of their distribution.
Advanced Reporting
Detailed report generation with charts, statistics and exports in several formats.
Analysis modules
Reconnaissance and fingerprinting modules
Metadata Extraction
Automatic metadata extraction from every file
DNS Analysis
DNS resolution, subdomains and record analysis
Network Mapping
Network infrastructure mapping and asset discovery
Technology Stack
Identify the technologies, frameworks and versions in use
Geolocation
Geographic location through EXIF GPS and IP geolocation
Email Discovery
Extract email addresses and communication patterns
Analyzed file formats
Document types supported by FOCA
Microsoft Office
PDF documents
Images & media
OpenOffice & others
Practical use cases
Real-world FOCA scenarios
Pentest reconnaissance
Passive information gathering before a penetration test
Detailed workflow
Create a project
New FOCA project with the target domain
Search documents
Automatic Google search for files
Download & analyze
Download files and extract metadata
User mapping
Map employees and emails
Infrastructure
Discover servers and the internal network
Vulnerability scan
Detect vulnerable versions
Corporate intelligence
Business intelligence and organizational mapping
Detailed workflow
Document collection
Large-scale collection of public documents
Metadata correlation
Correlate the metadata found
Org structure
Rebuild the org chart
Technology audit
Audit the technologies in use
Timeline analysis
Chronological document analysis
Report generation
Full intelligence report
Security audit
Assess the exposure of sensitive information
Detailed workflow
Baseline scan
Initial domain scan
Sensitive data
Identify exposed sensitive data
Network exposure
Analyze network exposure
User awareness
Assess employee awareness
Risk assessment
Assess the identified risks
Remediation plan
Remediation plan and recommendations
Step-by-step guide
The complete FOCA analysis workflow
Initial setup
1. Create a new project
File → New Project → enter the target domain
example.com2. Configure sources
Select search engines (Google, Bing)
Google Search API3. Set file extensions
Choose file types: pdf, doc, xls, ppt
All document typesSearch & download
1. Run the search
Search → All → wait for the scan to finish
Automated search2. Download files
Download → Download All Documents
Batch download3. Check results
Review the list of downloaded files
Review downloadsMetadata analysis
1. Extract metadata
Metadata → Extract All Metadata
Full extraction2. Analyze users
Users → View all discovered users
User mapping3. Analyze servers
Servers → View network infrastructure
InfrastructureExport & reports
1. Generate a report
Report → Generate Complete Report
HTML/PDF report2. Export data
Export → CSV/XML format
Data export3. Save the project
File → Save Project
Save analysisBest practices
Recommendations for optimal FOCA use
Do
- Get authorizationAlways get written permission before any analysis
- Save projectsSave your FOCA projects regularly
- Work methodicallyFollow a structured, repeatable workflow
- Cross-check sourcesValidate results with other OSINT tools
- Generate reportsCreate detailed reports for documentation
- Keep FOCA up to dateUse the latest version to get new modules
Avoid
- Unauthorized scansNever analyze without explicit permission
- Overloading search enginesRespect Google Search API limits
- Ignoring false positivesManually check critical results
- Neglecting confidentialityProtect sensitive data you find
- Ignoring contextAlways analyze within the bigger picture
- Disclosing resultsNever publish without authorization
Installation
FOCA installation guide for Windows
System requirements
- Windows 7, 8, 10 or 11 (64-bit recommended)
- .NET Framework 4.7.1 and SQL Server (Express edition is enough)
- 4 GB RAM minimum (8 GB recommended)
- Active internet connection
Download
Download from the official GitHub repository:
https://github.com/ElevenPaths/FOCABinaries available under the repository’s Releases tab
Installation
- Extract the downloaded ZIP archive
- Open the FOCA folder
- Run FOCA.exe as administrator
- Accept the UAC prompt if asked
Google API configuration
To use Google search, configure an API key:
- Create a project in Google Cloud Console
- Enable the Custom Search API
- Generate an API key
- Configure it in FOCA: Options → Search Engines
Legal and ethical warning
FOCA is a powerful fingerprinting and reconnaissance tool that can reveal highly sensitive information about an organization. It must always be used lawfully, ethically and with prior authorization.
Legitimate uses:
- Pentesting with a contract and written authorization
- Security audits of your own organization
- Academic research and cybersecurity training
- Bug bounty programs within an authorized scope
Resources and documentation
Useful links to go further
Ready to fingerprint organizations?
Discover other OSINT tools and sharpen your passive reconnaissance techniques
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.