Metagoofil

An automated metadata extraction tool to recover hidden information from public documents

PDF/DOC/XLS

File types

Auto

Download & Extract

HTML

Detailed reports

What is Metagoofil?

A powerful Python tool for passive reconnaissance

Automation

Automatic downloads through Google Search

Extraction

Automatic EXIF, Office and PDF metadata

Mapping

Identify employees and infrastructure

Reports

Link list and CSV export of metadata

Key features

Advanced capabilities for passive reconnaissance

Automatic download

Automatically finds and downloads every public document of a target domain through search engines.

Auto-Discovery

Google SearchMulti-formatBatch

Metadata extraction

Downloaded files are then analyzed with ExifTool: authors, software, dates, Office and PDF properties.

Deep Analysis

EXIFOfficePDF

User mapping

Identifies usernames, authors and document creators to map an organization's staff.

User Mapping

AuthorsEmployeesPatterns

Infrastructure discovery

Reveals network paths, server names, printers and internal IT infrastructure through metadata.

Infrastructure

ServersPathsNetwork

Exporting results

The URLs found can be saved to a file, and metadata exported to CSV with ExifTool.

Reporting

LinksCSVSpreadsheet

Advanced filtering

Filter by file type, result limit, search depth and specific domains.

Customizable

FiltersLimitsTargeting

Extracted metadata types

Information automatically recovered from documents

Author & creator

Author and creator names, last modified by, organization

Full nameEmailOrganisationDepartment

Dates & Timestamps

Creation, modification, print and last-save dates

CreatedModifiedPrintedSaved

Software & versions

Applications used, versions, operating system

MS OfficeAdobeOpenOfficeOS Version

IT infrastructure

Network paths, server names, printers, shares

\\server\sharePrinter namesNetwork paths

Document properties

Title, subject, keywords, comments, category

TitleSubjectKeywordsComments

Hidden information

Revisions, annotations, partially deleted metadata

Track changesCommentsHidden data

Supported file formats

Document types analyzed by Metagoofil

Documents Office

DOC/DOCX

Microsoft Word documents with full properties

XLS/XLSX

Excel spreadsheets with authors and history

PPT/PPTX

PowerPoint presentations with metadata

PDF documents

PDF

PDF documents with XMP metadata and properties

PDF/A

Archival PDFs with extended metadata

OpenOffice/LibreOffice

ODT

OpenDocument text documents

ODS

OpenDocument spreadsheets

ODP

OpenDocument presentations

Other formats

RTF

Rich Text Format with metadata

TXT

Text files with system properties

Practical use cases

Real-world Metagoofil scenarios

Company reconnaissance

Mapping staff and IT infrastructure

2-4h

Duration

50-200 docs

Documents

Facile

Difficulty

Detailed workflow

Document collection

metagoofil -d target.com -t pdf,doc,xls

Metadata extraction

Automatic property analysis

Author mapping

List of employees and departments

IT infrastructure

Servers, printers, network paths

Synthesis

CSV export and consolidated report

Pattern analysis

Naming conventions and structure

Security assessment

Audit of sensitive information leaks

1-2h

Duration

30-100 docs

Documents

Moyen

Difficulty

Detailed workflow

Domain scan

Search for exposed public documents

Leak identification

Detect sensitive information

Path analysis

Reveal the internal architecture

Outdated software

Detect unpatched versions

Risk documentation

List of vulnerabilities found

Recommandations

Remediation measures

OSINT investigation

Investigating a target organization

3-6h

Duration

100-500 docs

Documents

Advanced

Difficulty

Detailed workflow

Large-scale collection

Download every document type

Data correlation

Cross-reference the information

Timeline

Build the timeline

Organigramme

Rebuild the hierarchy

Technologies

The organization's technical stack

OSINT report

Complete intelligence summary

Command examples

Practical commands for different scenarios

Finding documents

metagoofil -d example.com -t pdf

Lists the URLs of indexed PDFs for the domain, without downloading anything

PDFBasic

metagoofil -d example.com -t doc,docx,xls,xlsx,ppt,pptx

Searches for Office documents, old and new formats

OfficeMulti-format

metagoofil -d example.com -t pdf -l 200

Looks at up to 200 search results per file type

LimitSearch

Downloading

metagoofil -d example.com -t pdf,docx -n 50 -w -o downloads

-w enables downloading; -n caps it at 50 files per type, saved to downloads/

DownloadOutput

metagoofil -d example.com -t pdf -f links.txt

Saves the URLs found to a file so you can review or archive them

LinksExport

metagoofil -d example.com -t pdf -e 60 -u -w -o downloads

-e sets the delay between searches (seconds), -u uses a random User-Agent for downloads

DelayStealth

Metadata extraction (ExifTool)

exiftool -r -Author -Creator -Producer -LastModifiedBy downloads/

Shows the authors, software and last editors of each file

ExifToolAuthors

exiftool -r -s3 -Author -LastModifiedBy downloads/ | sort -u

De-duplicated list of names found: the basis for mapping staff

UsersDedup

exiftool -r -csv -Author -Creator -Producer -CreateDate -ModifyDate downloads/ > metadata.csv

Exports the metadata to CSV for analysis in a spreadsheet

CSVReport

Analysis & cross-checking

exiftool -r -Producer -Creator downloads/ | sort | uniq -c | sort -rn

Counts the software and versions used: handy to spot outdated versions

SoftwareStats

exiftool -r -a downloads/ | grep "\\\\"

Finds metadata fields containing UNC paths (\\server\share)

InfrastructurePaths

exiftool -r -if '$CreateDate ge "2024"' -Author -CreateDate downloads/

Filters recent documents to focus on current staff

FilterDates

Best practices

Recommendations for optimal, lawful use

Do

Limit requests
Use delays to avoid Google rate limiting
Check authorizations
Make sure you are authorized to perform reconnaissance
Analyze the extracted metadata
Sort authors, software and paths in a spreadsheet
Correlate the data
Cross-check with other OSINT sources for validation
Document sources
Keep track of URLs and collection dates
Generate wordlists
Build user lists for authorized testing

Avoid

Unauthorized scans
Never scan without explicit authorization
Excessive requests
Avoid overloading search engines
Ignoring false positives
Always check that information is valid
Disclosing the data
Never publish sensitive information you find
Ignoring the law
Comply with GDPR and privacy laws
Malicious use
Never use it for phishing or attacks

Installation

Metagoofil installation guide

With apt (Kali Linux)

sudo apt install metagoofil libimage-exiftool-perl

Packages maintained in the Kali repositories (Metagoofil + ExifTool)

From GitHub (development version)

git clone https://github.com/opsdisk/metagoofil.gitcd metagoofilpip3 install -r requirements.txt

Required dependencies

Python 3.6 or later
yagooglesearch (Google queries)
Requests (HTTP requests)
ExifTool (metadata extraction)

Checking the installation

metagoofil -h

Should display Metagoofil's help

Legal and ethical considerations

Metagoofil is a powerful tool that can reveal sensitive information about an organization. It must always be used within a legal and ethical framework, with prior authorization.