loading
Loading content
loading
OSINT
Search the web for a domain's public files and extract their metadata.
overview
pymeta uses search engines to find documents published on a domain, downloads each hit, and reads the metadata baked into the file. Office documents and PDFs carry author names, software versions, and internal paths that publishers rarely strip, so mining them across a whole domain exposes usernames, the software an organization runs, and its naming conventions, all without touching the target's own servers.
It queries Google and Bing for a configurable set of file types, then downloads each result for parsing. Threads control how fast it pulls files, while jitter and a per-search timeout keep the search side polite, and proxy support with rotation from a proxy file spreads queries to dodge rate limits.
Reach for pymeta early in reconnaissance to seed username lists and software inventories from publicly leaked document metadata. It writes a folder of results and a CSV report you can hand to username or email OSINT nodes downstream.
source github.com/m8sec/pymeta
use cases
Extract author and creator fields from a domain's public files to build a username list for password spraying or social engineering.
Read the producing-application metadata across many documents to map which software and versions an organization runs.
Surface embedded paths and identifiers in file metadata to infer how the target names users, shares, and systems internally.
Feed the extracted usernames to maigret for account discovery and pair the run with infoga so the workflow builds a full identity map for the domain.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Target domain to search for public files. |
| file-types | STRING | --file-type | File types to search for and download (e.g. pdf,docx,xlsx). |
| search-engines | STRING | --search | Search engines to query (default google,bing). |
| max-results | STRING | -m | Maximum results per file-type search. |
| threads | STRING | -T | Max threads for file download (default 5). |
| jitter | STRING | -j | Jitter between requests in seconds (default 1). |
| proxy | STRING | --proxy | Proxy requests through a single IP:Port. |
| report-name | STRING | -f | Custom report filename (default pymeta_report.csv). |
Showing key inputs. pymeta exposes 10 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Target domain to search for public files. |
| file-types | STRING | --file-type | File types to search for and download (e.g. pdf,docx,xlsx). |
| search-engines | STRING | --search | Search engines to query (default google,bing). |
| max-results | STRING | -m | Maximum results per file-type search. |
| threads | STRING | -T | Max threads for file download (default 5). |
| timeout | STRING | -t | Max timeout per search in seconds (default 8). |
| jitter | STRING | -j | Jitter between requests in seconds (default 1). |
| proxy | STRING | --proxy | Proxy requests through a single IP:Port. |
| proxy-file | FILE | --proxy-file | Load proxies from a file and rotate through them. |
| report-name | STRING | -f | Custom report filename (default pymeta_report.csv). |
example
# find and parse public documents for a domain, then write a CSV reportpymeta -d example.com --file-type pdf,docx,xlsx -m 50 -T 8 -f example_metadata.csv[*] pymeta - searching google,bing for pdf,docx,xlsx on example.com[+] 46 files found, downloading with 8 threads Author Software Source File----------- --------------------------- --------------------------j.doe Microsoft Word 2016 q3-report.docxa.martin Adobe PDF Library 15.0 brochure.pdfit-admin LibreOffice 7.2 asset-inventory.xlsx [+] 46 files parsed | 12 users | 5 software versions -> example_metadata.csvguidance
Use pymeta in passive OSINT to mine a domain's public documents for usernames, software, and naming patterns without sending traffic to the target. For metadata of files you already hold, use a parser like pymeta's local counterparts; pymeta is the find-and-extract step.
Gathers email addresses from public sources. Pairs with pymeta's document-derived usernames for OSINT.
Hunts usernames across sites. Use it to pivot on the usernames pymeta extracts from documents.
Searches paste sites for leaked data. A complementary passive OSINT source to document metadata.
faq
related
Look up DNS records on DNSDumpster.
Look up a host on DNSDumpster.
Find lookalike domains adversaries use for typosquatting, phishing, and brand impersonation.
List all public repositories for valid GitHub usernames.
Look up the real IP of a host starting from its favicon and using Shodan.
Gather email account intelligence from public sources and check it against breach data.
A domain feeds pymeta, which downloads public files and extracts usernames from their metadata for maigret to pivot on before the intel lands as output.
Facts on this page come from the live Trickest tool library.