FOCA Security: A Deep Dive into the Free Open Company Archiver

FOCA Security is a free tool developed by ElevenPaths, primarily used by security professionals and penetration testers to extract metadata from files. Its main purpose is to uncover hidden information within documents that can be valuable for reconnaissance during security assessments.

Key takeaways:

• FOCA is a free metadata extraction tool from ElevenPaths.
• It helps uncover hidden info like usernames, software versions, and network paths.
• Primarily used by penetration testers for reconnaissance.
• Supports common file types including Office docs, PDFs, and images.

What exactly is FOCA Security?

FOCA stands for "Fingerprinting Organizations with Collected Archives." It's a Windows-based application that automates the process of finding and analyzing metadata from various file types. Think of it as a digital magnifying glass for documents, revealing data you wouldn't normally see. This includes things like the author of a document, the software used to create it, the last modified date, and even server names or network paths.

Who is FOCA for?

FOCA is specifically for security researchers, ethical hackers, and penetration testers. If you're performing a security assessment on an organization, FOCA helps you gather crucial initial intelligence. It's not really a tool for the average user looking to clean up their personal files or for forensic analysis after a breach. Its focus is proactive information gathering.

What kind of information can FOCA reveal?

FOCA can extract a surprising amount of detail. For example, from a Microsoft Word document, it might pull the author's username, the company name, the version of Word used (e.g., Office 2016), and even the printer name. From a PDF, it could show the PDF creator software and its version. For image files like JPEGs, it often reveals EXIF data, which includes camera model, GPS coordinates (if enabled), and creation date. This information, while seemingly innocuous, can be pieced together to form a picture of an organization's internal infrastructure, employee names, and even potential software vulnerabilities.

Here's a breakdown of common data points:

How does FOCA work?

FOCA typically starts by scanning a target domain. It uses search engines like Google, Bing, and DuckDuckGo to find publicly available documents associated with that domain. It then downloads these documents. Once downloaded, FOCA parses each file, looking for metadata fields. It identifies common metadata structures within different file formats and extracts the relevant information. For instance, it knows where to look for "Author" in an Office document or "Creator" in a PDF. The tool then aggregates this data, allowing the user to view it in an organized interface.

Is FOCA still useful in 2024?

Yes, FOCA still holds value in 2024 for its specific use case. While security awareness has generally improved, and organizations are often more careful about what they publish, metadata leakage is still a real problem. Many older documents or those created by less security-aware employees can still contain valuable information. FOCA automates a tedious manual process, making it efficient for an initial reconnaissance phase. However, it's often used as part of a broader toolset, not as the sole method of information gathering.

What are the main drawbacks of using FOCA?

One of the primary drawbacks is that FOCA can be quite resource-intensive, especially when you're scanning a large domain with many documents. It needs to download and process each file, which can take a significant amount of time and consume bandwidth. Its interface, while functional, might also feel a bit dated compared to some newer, more modern security tools. Also, FOCA is a Windows-only application, which can be a limitation for users on other operating systems. Finally, the tool relies on publicly available documents, so if a target is very buttoned-up about what they publish, FOCA's effectiveness can be limited.

Are there alternatives to FOCA?

Yes, there are alternatives, though FOCA remains unique in its specific focus and free price point. Many general-purpose reconnaissance frameworks, like Maltego, can also integrate metadata extraction as part of their broader information gathering capabilities. Command-line tools like exiftool are excellent for extracting metadata from individual files, especially images, but they require more manual effort and scripting for bulk processing. Other commercial security platforms may include similar features but at a cost. For free, dedicated metadata extraction on Windows, FOCA is still a strong contender.

How to use FOCA safely and ethically.

If you are a legitimate security professional or ethical hacker, always ensure you have explicit, written permission from the organization before performing any FOCA scans or information gathering. Unauthorized scanning can have legal consequences. Limit your scope to publicly available information and avoid accessing or downloading anything that is not explicitly public. Use the tool responsibly and for its intended purpose of identifying potential security risks, not for malicious activities. Remember that the goal is to help secure systems, not to exploit them.

Photo by Yuriy Rzhemovskiy on Unsplash