FOCA short for Fingerprinting Organizations with collected archives is a tool that disclose metadata and hidden information in scanned documents. These documents are may be available on web pages, and can be downloaded and analyzed with FOCA.
These documents and searched by using these three primary search engines: Google, Bing, and DuckDuckGo. The results we get from these three search engine can be amounts as lots of documents.
FOCA can analyze a wide range of documents, including Adobe InDesign or SVG files in addition to the more popular Microsoft Office, Open Office, and PDF formats.
In order to extract the EXIF data from graphic files, it is also possible to add local files, and even before downloading the file, a thorough examination of the data obtained from the URL is carried out.
How to Install FOCA in Windows OS
1. first you need to download the latest version of FOCA application from its GitHub page. [click here]
2. Download the latest version zip file and extract it anywhere in the PC.
3. Now you need to download MySQL express edition server 2019. It is very important for running the application in local machine.
4. Server link [click here] After downloading open the application and select basic and install it. Now it will start downloading the required files for installation as shown in the screenshot below
5. after it is done close the installation box and go to extracted FOCA folder and run the application
6. Application will be started as shown in the screenshot below
How to use It for information gathering
1. First we need to create new project in it by clicking on project on top left and then new project
2. Enter the project name as per your need (here, for me- project of testfire.net)
3. Now in the domain field enter the website domain in the field (here, www.testfire.net)
4. In the field of alternative domains you can leave it empty or put any subdomain if it is available.
5. In this field (folder where to save document) you can choose the folder where you want to save the result of your scan for changing the folder click on the folder search icon and choose the folder
6. Leave the rest field as it default and if you want any notes then enter it or else leave it empty
7. All the pre-configurations are done now click on the create button for creating the project.
8. Now your project windows will appear then select the all three search engines for extracting information of the targeted domain, and in the extension section select all extension or as you required for getting the file from the domain. (here, selecting all domains and extensions)
9. After selection of all the thing then click on the search all button for executing the application query, and then you will get the results after the scan completed.
10. For viewing any file information stored in the subdomains then right-click on that URL and click Links -> Open in Browser
11. the extracted file from the domain b using FOCA appears on the web browser, as shown in the screenshot
12. Now go back to the FOCA application and see the left panel then click on the network node and other nodes in the section for seeing other network and services in the domain.
13. Now click on the domain node and then click on the Google crawling for getting the domain obtained through scanning along with their severity as low, medium, or high is displayed, as shown in the screenshot.
Using this information, attackers can further find vulnerabilities in the target domain and exploit them to launch web application attacks.
Now, expand the Document Analysis node; further expand the Metadata Summary node. Here, information regarding users, folders, printers, software, etc. is displayed.
Note: The domain we used does not have information associated with metadata summary.
This concludes the demonstration of gathering useful information about the target organization using the FOCA tool.
If you have any queries regarding the above content, or you want to update anything in the content, then contact us with your queries. You can directly post your question in the group.
Connect with us on these platforms
