Hack Like a Pro: How to Extract Metadata from Websites Using FOCA for Windows « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!My preference forLinuxas a hacking platform iswell documented, and I have even created aseries of tutorialsto train new hackers. Without being proficient in Linux, you can't really call yourself a hacker.Every once in while, though, a hacking tool comes out for Windows that makes me stand up and take notice. For instance, Cain and Abel is an excellent tool forpassword crackingandMitM attacksand is only available on the Windows platform. I could name a few others, but only Havij, the excellent SQL injection tool, comes immediately to mind.FOCA was released in 2009 and is now in version three. Although a Linux version is included inKali, it is outdated. Let's download the latest Windows version and use it here to perform somereconnaissance.Good Reconnaissance Is CriticalFOCA is an excellent website reconnaissance tool with lots of interesting features and capabilities. Remember, before attacking any website or domain, it is critical to gather as much information as possible. From this information, you can determine the attack that is most likely to work against that site or network.In this tutorial, we will looking at FOCA's ability to find, download, and retrieve files from websites with the file's metadata.This metadata can give us insight into such information as the users (could be critical in cracking passwords), operating system (exploits are OS-specific), email addresses (possibly forsocial engineering), the software used (once again, exploits are OS-, and more and more often, application-specific), and if we are really lucky, passwords.Step 1: Downlaod FOCA for WindowsFirst, let's downloadFOCA Free 3.0 for Windows.Step 2: Choose Where You Save ResultsWhen you install FOCA, you will greeted with a screen like that below. The first task we need to do is to start a new project and then tell FOCA where we want to save our results.Click on image to enlarge.I created a new directory atc:\focaand will save all my results there. Of course, you can save your results wherever is convenient for you, or use the default temp directory.Step 3: Create a ProjectIn this tutorial, I will be starting with a project named after the information security training company, SANS, which is located atsans.org, and I will be saving my results toc:\foca.Click on image to enlarge.Step 4: Getting the MetadataOnce I create my project, I can go to the object explorer to the far left and selectMetadata. This enables us to pull the metadata from the files on the website that contain metadata. Files such as .pdf, .doc, .xls, etc. all contain metadata that could be useful in your hack of your target.When you select metadata, you will pull up a screen like that below. In our case here, we will be searching sans.org for .doc files, so the syntax to be placed in the search window is:site:sans.org filetype:docThis will search the entire sans.org website, looking for .doc files. When I hit theSearchbutton next to the window, it will begin to search and find all the .doc files at sans.org.Click on image to enlarge.Of course, if you were searching for .pdf files or other filetypes, you would put in that filetype. You can also search for multiple filetypes by listing them after filetype, such as:site:sans.org filetype:pdf,doc,xlsStep 5: Download the FilesOnce FOCA is done retrieving a list of all the .doc files, we can then right-click on any file and download the file to our hard drive, download all the files, or analyze the metadata. I chose to download all the .doc files I found at sans.org.Click on image to enlarge.Step 6: Collect & Analyze the MetadataNow that we have downloaded all the .doc files, I chose to analyze all the metadata in them. Microsoft's Office files collect significant amounts of data as they are being created and edited that we can then extract.When we expand the Metadata folder in the object explorer, you can see that we have 156 .doc files and 2 .docx files.Click on image to enlarge.The Types of Metadata CollectedJust beneath the Metadata documents folder is another folder titled,Metadata Summary. We can click on it and it reveals the type of metadata is has collected from the files. This metadata is broken into eight (8) categories:UsersFoldersPrintersSoftwareEmailsOperating SystemsPasswordsServersLet's take a look atUsersfirst. When we click on users, we can see that FOCA has collected the names of every user that worked on those files.Click on image to enlarge.When we click onSoftware, we can see the various editions of Microsoft Office that has been used, including five (5) users that created their documents with Office '97 (hmm...wonder if there are any Office '97 vulnerabilities still out there?).Click on image to enlarge.We can also look for email addresses that are embedded in the documents as displayed below. Obviously, these folks are making themselves available to asocial engineering attack.Click on image to enlarge.We can also gather printer, folder, passwords, and servers from this metadata depending upon the documents we recover. All of this information can then be used to determine what is the best attack against this organization/website.In future tutorials, we will continue to explore the capabilities of FOCA, so keep coming back, my greenhorn hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHow To:Obtain Valuable Data from Images Using Exif ExtractorsHack Like a Pro:How Windows Can Be a Hacking Platform, Pt. 1 (Exploit Pack)Hacking macOS:How to Hide Payloads Inside Photo MetadataHow To:Completely Remove Your Hidden Personal Information from Digital PhotosHow To:Hack Lets You Fully Activate a Bootleg Copy of Windows 8 Pro for FreeHow To:Capture Unauthorized Users Trying to Bypass Your Windows 8 Lock ScreenHow To:Detect Misconfigurations in 'Anonymous' Dark Web Sites with OnionScanHow To:Change File Metadata (Access/Modification Date)Hack Like a Pro:How to Hack Facebook (Facebook Password Extractor)Hack Like a Pro:The Hacker MethodologyHow To:Create metadata subscriptions in Final Cut ServerHow To:How Anyone (Even Pirates) Can Get Windows 10 for Free—LegallyNews:What to Expect from Null Byte in 2015How To:Get Windows Media Center for Free on Windows 8 ProHack Like a Pro:How to Find Website Vulnerabilities Using WiktoHow To:Download High-Res Album Artwork & Detailed ID3 Tags for Your Android's MP3 LibraryHow To:Scrub the EXIF Data from Photos on Your Android Phone Before Sharing ThemHow To:Remap the Soli Motion Sense Gestures on Your Pixel 4 — No Root NeededHow To:Change This Privacy Setting Before You Share Any Pictures on Google PhotosHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 12 (Windows Prefetch Files)How To:Edit metadata in ApertureHow To:Stop Your iPhone Photos from Broadcasting Your Location to OthersHack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)News:Finding Hidden Metadata in Images (Oh, the Possibilities)How To:How Hackers Take Your Encrypted Passwords & Crack ThemHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:Build Your Own "Pogo Mo Thoin" to Flash Any Xbox 360 DVD Drive for Under $5How To:Make Your Videos Sound AWESOMEHow To:Hack Wireless Router Passwords & Networks Using HydraHow To:Stream Media to a PS3 or Xbox 360 from Mac & Linux ComputersHow To:The Official Google+ Insider's Guide IndexHow To:Hack Together an Accelerometer-Aware Mobile Website by Accessing Motion Sensors in JavaScriptHow to Hack Your Game Saves:A Basic Guide to Hex EditingHow To:Use Wireshark to Steal Your Own Local PasswordsHow To:Find metadata in Word docs and jpegs supporting Exif