FOCA - Fingerprinting Organisations with Collected Archives

Footprinting, also known as reconnaissance, is the technique used for gathering information about computer systems and the entities they belong to. To get this information, a hacker might use various tools and technologies. Phoca fingerprinting organizations with collected archives is a tool used mainly to find metadata and hidden information in the documents it scans. These documents may be on web pages and can be downloaded and analyzed with phoca. It is capable of analyzing a wide variety of documents, with the most common being Microsoft Office, OpenOffice, or PDF files. These documents are searched for three possible search engines Google, Bing, and DuckDuckGo. Here's how you can download and install Phoca. You can download Phoca from the 11 paths website that is seen on this slide. Phoca is open source. You can download all the sources as well as the executable binary from github.com. Slash 11 paths. Slash Phoca to work with Phoca. Start a new project using project button on the upper left corner. Give the project a name and to the website and choose the folder to save the results to. When you finish filling the fields, click the create button to create a new project. After creating a new Phoca project, we can start a network scan from the tree at the left side, select network node. Now select the search types. The search types listed on the panel are. Web search. You can choose whether Google or Bing NN search dictionary search to perform DNS search using a dictionary. IP Bing to serve the domain names hosted on the same IP address, Shodan and Robtex queries, and click the start button to start the scan. Now we can collect some documents published by the target domain to collect their metadata from the tree. At the left side, select metadata node. You're supposed to see a panel similar to the one which is seen on the slide. Select the document types you want to collect, and click the Search All button to start the document search You can see the documents found under metadata node of the tree. You should download the documents to be able to extract the metadata. Right click the documents you want to download from the menu, select download. Now you can extract the metadata of the downloaded documents. You can understand if a document is downloaded from the download column of the table. Select the documents that you want to collect the metadata Rlhs. Right click and select Extract Metadata from the menu. You'll see the results under the metadata node of the tree. Now you got to remember before using Foca, this version does require SQL Server Express installed on our computer. So does that mean. Yeah. First we need to install the SQL server. Open up your browser. Go to SQL server download page and download the express version. That's all we need. All right. We'll just do the basic insulation, which. Yeah. Accept the terms. Choose the insulation location and follow the instructions. Just install it. It's going to take a little while. So what we're going to do we're going to use Foca in windows. So then we'll just go to the releases page on GitHub. And download the zip file and extract it. So let's have a look at the Foca interface. And let's just try it out. Yeah. So first we'll need to create a project. Now in this test we're going to scan Sasuke. And before we see Foca in action, we're going to need to configure the Foca options. So you'll need to just google the custom search API key. Now to get the search API key, there is documentation on the 11 paths GitHub wiki page, so you can learn your custom key search and configure your options. Don't worry, I'll wait for you. Now we can start a new scan. Select the network node from the tree. Select the search types on the dictionary search panel. You have to choose a valid dictionary. The default path is probably not valid. You can find a valid dictionary inside the DNS dictionary folder, which is under the bin folder where you found the Foca exec file. Click the start button to start the scan and let the scan continue for a couple of minutes. Let's collect the documents from the target website and extract their metadata. Select the metadata node from the tree. Select the document types you're interested in and click Search All button to find the documents. Let the search continue for a couple of minutes. Select the documents that you want to collect the metadata. Right click and select download. Select the downloaded documents. Right click and select Extract Metadata at this time. Look at the nodes under the metadata node of the tree, and you will see the metadata extracted from other downloaded documents. You can examine the metadata of each document one by one, or you can find valuable data summarized under the Metadata summary node. Usernames of the owners of the documents. Operating system where the document is created. Email addresses collected from the metadata of the documents, and more.