A penetration tester is performing OSINT against a target organization. They want to identify publicly available documents, such as PDFs or Word files, that might contain sensitive information like internal usernames, email addresses, or network diagrams. Which reconnaissance technique focuses on extracting metadata from such files found on public websites?
- AWHOIS lookup
- BDNS brute-forcing
- CMetadata extraction from public documents
- DCertificate Transparency (CT) log analysis
Show answer & explanationAnswer & explanation
Correct answer: C. Metadata extraction from public documents
Metadata extraction from public documents involves downloading publicly accessible files (e.g., PDFs, DOCX, XLSX) and using tools to parse their embedded metadata. This metadata can often contain sensitive information like author names (potential usernames), creation dates, software used, or even comments, inadvertently revealing internal details.
Why the other options are wrong
- A. WHOIS lookup provides domain registration information, not document metadata.
- B. DNS brute-forcing enumerates DNS records and subdomains, not the content or metadata of public documents.
- D. CT log analysis reveals issued SSL/TLS certificates and associated domains/subdomains, not document content or metadata.
Metadata Extraction (OSINT)
A passive OSINT technique involving the analysis of embedded data (metadata) within publicly available files (e.g., PDFs, Word documents, images). This metadata can include author names, creation dates, software versions, comments, or geographic coordinates, potentially revealing sensitive information about an organization or individuals.
- Targets publicly available files (PDF, DOCX, XLSX, JPG, etc.).
- Extracts embedded data like author, creation date, software.
- Can reveal usernames, email addresses, internal system info.
- Tools like ExifTool or FOCA are used for this purpose.
Memory trick: Metadata is the hidden story behind the document's cover.