<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-document-intelligence
description: >-
  Extract intelligence from publicly available documents including PDFs,
  Office files, and presentations through metadata analysis, content
  extraction, and hidden data discovery.
domain: cybersecurity
subdomain: osint-recon
tags:
  - document-intelligence
  - metadata-extraction
  - pdf-analysis
  - foca
  - hidden-data
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  FOCA, ExifTool, pdfinfo, metagoofil, Apache Tika, pdf-parser,
  oletools, python-docx, python-pptx.
metadata:
  mitre-attack:
    - "T1589.001"  # Gather Victim Identity Information: Credentials
    - "T1589.003"  # Gather Victim Identity Information: Employee Names
    - "T1592.004"  # Gather Victim Host Information: Client Configurations
    - "T1593.002"  # Search Open Websites/Domains: Search Engines
---

# Performing Document Intelligence

## Overview

Document intelligence extracts actionable information from publicly accessible
documents. Organizations publish PDFs, Office files, and presentations
containing embedded metadata — author names, software versions, internal paths,
printer names, email addresses, and revision history. Google dorking locates
these documents; metadata extraction tools reveal the hidden intelligence.
This supports employee profiling, technology stack identification, and
internal network path discovery.

## Prerequisites

- ExifTool for universal metadata extraction
- metagoofil for automated document harvesting
- Apache Tika for content extraction
- oletools for Office document analysis
- pdftools (pdf-parser, pdfid) for PDF analysis
- Python 3.10+ with `PyPDF2`, `python-docx`, `python-pptx`

```bash
sudo apt install libimage-exiftool-perl poppler-utils -y
pip install metagoofil oletools PyPDF2 python-docx python-pptx tika
pip install pdfid pdf-parser
```

## Quick Reference

| Task | Command |
|------|---------|
| Harvest docs | `metagoofil -d target.com -t pdf,doc,xls,ppt -l 100 -o docs/` |
| EXIF metadata | `exiftool -json document.pdf \| jq '.[0]'` |
| PDF info | `pdfinfo document.pdf` |
| PDF strings | `pdf-parser -s /Author document.pdf` |
| Office meta | `python3 -c "import oletools.olemeta; oletools.olemeta.main(['file.doc'])"` |
| Google dork | `site:target.com filetype:pdf OR filetype:docx OR filetype:xlsx` |
| Tika extract | `java -jar tika-app.jar -m document.pdf` |
| Batch extract | `exiftool -r -json -Author -Creator -Producer -Software ./docs/` |

## Workflow

### Step 1: Document Harvesting

```bash
# metagoofil — automated document discovery and download
metagoofil -d target.com -t pdf,doc,docx,xls,xlsx,ppt,pptx \
  -l 200 -n 50 -o ./harvested_docs/

# Google dorking for specific document types
# site:target.com filetype:pdf
# site:target.com filetype:docx "confidential"
# site:target.com filetype:xlsx "password" OR "internal"

# Download specific documents
wget -r -l1 -A "*.pdf,*.docx,*.xlsx,*.pptx" https://target.com/resources/
```

### Step 2: Metadata Extraction

```bash
# ExifTool — comprehensive metadata from all document types
exiftool -json -g ./harvested_docs/*.pdf | jq '.[] | {
  FileName, Author, Creator, Producer, CreateDate,
  ModifyDate, Company, Keywords, Subject
}'

# Batch extraction with specific fields
exiftool -r -csv -Author -Creator -Producer -Software -Company \
  -CreateDate -ModifyDate ./harvested_docs/ > metadata.csv

# PDF-specific metadata
pdfinfo document.pdf
pdf-parser -s /Author -s /Creator -s /Producer document.pdf
```

### Step 3: Hidden Data Discovery

```bash
# Extract embedded objects from PDFs
pdf-parser --object 1 --filter document.pdf
pdfextract document.pdf

# Office document embedded data
olevba document.docm  # Extract VBA macros
oleobj document.docx   # Extract embedded objects

# Extract internal paths and usernames from Office XML
unzip -p document.docx docProps/core.xml | xmllint --format -
unzip -p document.docx docProps/app.xml | xmllint --format -

# Hidden text and comments
python3 -c "
from docx import Document
doc = Document('document.docx')
for p in doc.paragraphs:
    for run in p.runs:
        if run.font.hidden:
            print(f'Hidden: {run.text}')
for comment in doc.part.element.findall('.//{http://schemas.openxmlformats.org/wordprocessingml/2006/main}comment'):
    print(f'Comment: {comment.text}')
"
```

### Step 4: Intelligence Correlation

```bash
# Extract unique authors and software
exiftool -r -json ./harvested_docs/ | jq '[.[].Author // empty] | unique'
exiftool -r -json ./harvested_docs/ | jq '[.[].Creator // empty] | unique'

# Map internal paths
exiftool -r -json ./harvested_docs/ | \
  jq '[.[].Subject // empty, .[].Keywords // empty] | unique' | \
  grep -iE '\\\\|/users/|C:\\|/home/'
```

### Step 5: Generate Intelligence Report

```bash
node agent.js --domain target.com --dir ./harvested_docs/ --full --output doc_intel.json
```

## Detection Opportunities

- Document downloading creates web server access logs
- metagoofil generates distinctive crawler patterns
- Google dorking leaves search engine query traces
- Bulk PDF downloads from a single IP may trigger rate limiting

## Verification

- [ ] Documents harvested from target domain and subdomains
- [ ] Metadata extracted: authors, software, creation dates
- [ ] Internal file paths and network names identified
- [ ] Employee names correlated with other OSINT sources
- [ ] Software versions mapped for vulnerability research
- [ ] Hidden data (macros, comments, embedded objects) analyzed

## References

- [ExifTool](https://exiftool.org/)
- [metagoofil](https://github.com/opsdisk/metagoofil)
- [oletools](https://github.com/decalage2/oletools)
- [pdf-parser](https://github.com/DidierStevens/DidierStevensSuite)
- [Apache Tika](https://tika.apache.org/)
- [python-docx](https://python-docx.readthedocs.io/)

---
v1.0 | Validated: 2026-03-17
