metagoofil

Your team is hired to test a business named Matt’s Bait’n’ Tackle Shop (domain name mattsBTshop.com). A team member runs the following command:
metagoofil -d mattsBTshop.com -t doc,docx -l 50 -n 20 -f results.html
Which of the following best describes what the team member is attempting to do?
A.   Extracting metadata info from web pages in mattsBTshop.com, outputting results in Microsoft Word format
B.   Extracting metadata info from the results.html page in mattsBTshop.com, outputting results in Microsoft Word format
C.   Extracting metadata info from Microsoft Word documents found in mattsBTshop.com, outputting results in an HTML file
D.   Uploading results.html as a macro attachment to any Microsoft Word documents found in mattsBTshop.com



C. This is an example of a good tool knowledge and use. Metgoofil, per www.edge-security.com/metagoofil.php, “is an information gathering tool
designed for extracting metadata of public documents (.pdf, .doc, .xls, .ppt, .docx, .pptx, .xlsx) belonging to a target company. It performs a search in
Google to identify and download the documents to local disk and then will extract the metadata with different libraries like Hachoir, PdfMiner, and others.
With the results, it will generate a report with usernames, software versions and servers or machine names that will help Penetration testers in the
information gathering phase.”
In the syntax given, metagoofil will search mattsBTshop.com for up to 50 results (the -l switch determines the number of results) of any Microsoft Word
documents (in both doc and .docx format) it can find. It will then attempt to download the first 20 found (the -n switch handles that), and the -f switch will
send the results where you want (in this case, to an HTML file).
And just what will those results be? Well, that’s where the fun comes in. Remember, metagoofil tries to extract metadata from publicly available Microsoft
Word documents available on the site. You might find e-mail addresses, document paths, software versions, and even usernames in the results.


Metagoofil
Metagoofil is a tool that utilizes the Google search engine to get metadata from the documents available in the target domain. Currently, it supports the following document types:

Word documents (.docx, .doc)
Spreadsheet documents (.xlsx, .xls, .ods)
Presentation files (.pptx, .ppt, .odp)
PDF files (.pdf)
Metagoofil works by performing the following actions:

Searching for all of the preceding file types in the target domain using the Google search engine
Downloading all of the documents found and saving them to the local disk
Extracting the metadata from the downloaded documents
Saving the result in an HTML file
The metadata that can be found includes the following:

Usernames
Software versions
Server or machine names
This information can be used later on to help in the penetration testing phase. Metagoofil is not part of the standard Kali Linux v 2.0 distribution. To install, all you need to do is use the apt-get command:

    # apt-get install metagoofil
After the installer package has finished, you can access Metagoofil from the command line:

    # metagoofil
This will display simple usage instructions and an example on your screen. As an example of Metagoogil usage, we will collect all the DOC and PDF documents (-t, .doc, .pdf) from a target domain (-d hackthissite.org) and save them to a directory named test (-o test). We limit the search for each file type to 20 files (-l 20) and only download five files (-n 5). The report generated will be saved to test.html (-f test.html). We give the following command:

    # metagoofil -d example.com -l 20 -t doc,pdf -n 5 -f test.html -o test