Lecture Notes: Footprinting and Foca Tool

Overview

• Footprinting/Reconaissance: Technique to gather information about computer systems and their entities.
• Objective: Hackers collect information using various tools and technologies.

Foca Tool

• Purpose: Tool for finding metadata and hidden information in documents.
• Document Types Supported: Microsoft Office, OpenOffice, PDF files.
• Search Engines Used: Google, Bing, DuckDuckGo.

Downloading and Installing Foca

• Website: Can be downloaded from the Eleven Paths website.
• Open Source: Available at github.com/elevenpaths/Foca.
• Requirements:
  • Latest version requires SQL Server Express.
  • Preferred version requires .NET Framework 3.5 and is portable (no installation needed).
• Installation Steps:
  1. Download the zip file.
  2. Extract the zip.
  3. Navigate to the 'bin' folder.
  4. Run foca.exe file.

Using Foca

Creating a New Project

1. Click on the Project button (upper left corner).
2. Name the project, enter the website, choose save folder.
3. Click Create to initialize project.

Network Scan

1. Select Network node from tree.
2. Choose search types (Web, DNS, IP, Shodan, and Robtext)
3. Click Start to begin scan.

Metadata Collection

1. Select Metadata node from tree.
2. Choose document types, click Search All.
3. Right-click documents to download for metadata extraction.
4. Extract metadata by right-clicking downloaded documents.
5. View results under Metadata node in tree.

Practical Steps

1. Download Foca from Eleven Paths website.
2. Find previous version to avoid SQL Server requirement.
3. Read and accept EULA to download.
4. Create New Project and fill required fields.
5. Start Network Scan with valid dictionary (found in bin folder).
6. Collect and Extract Metadata from selected document types.
7. Analyze Metadata to find valuable information:
   • Document owners' usernames.
   • Operating system details.
   • Email addresses from metadata.

Note: Make sure to save project files for future reference and usage.