OSINT
Pull usernames from a domain's public file metadata
Find a domain's public files via search engines and extract their metadata.
overview
What pymeta does
pymeta sits early in passive OSINT: feed a domain, get authors, software, and paths from indexed Office and PDF documents.
Reach for it when you need usernames or a software inventory without touching the target. Search engines locate the files; pymeta downloads and parses them.
Inputs center on -d and --file-type; --search picks google or bing. Hand extracted usernames to maigret, or pair with infoga for email OSINT.
source github.com/m8sec/pymeta
use cases
Where pymeta fits
Harvest usernames from documents
Extract author and creator fields from a domain's public files to build a username list for password spraying or social engineering.
Inventory software and versions
Read the producing-application metadata across many documents to map which software and versions an organization runs.
Learn internal naming conventions
Surface embedded paths and identifiers in file metadata to infer how the target names users, shares, and systems internally.
Seed a downstream OSINT pipeline
Feed the extracted usernames to maigret for account discovery and pair the run with infoga so the workflow builds a full identity map for the domain.
reference
pymeta inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Target domain to search for public files. |
| file-types | STRING | --file-type | File types to search for and download (e.g. pdf,docx,xlsx). |
| search-engines | STRING | --search | Search engines to query (default google,bing). |
| max-results | STRING | -m | Maximum results per file-type search. |
| threads | STRING | -T | Max threads for file download (default 5). |
| jitter | STRING | -j | Jitter between requests in seconds (default 1). |
| proxy | STRING | --proxy | Proxy requests through a single IP:Port. |
| report-name | STRING | -f | Custom report filename (default pymeta_report.csv). |
Showing key inputs. pymeta exposes 10 inputs in total.
Full flag reference (10 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Target domain to search for public files. |
| file-types | STRING | --file-type | File types to search for and download (e.g. pdf,docx,xlsx). |
| search-engines | STRING | --search | Search engines to query (default google,bing). |
| max-results | STRING | -m | Maximum results per file-type search. |
| threads | STRING | -T | Max threads for file download (default 5). |
| timeout | STRING | -t | Max timeout per search in seconds (default 8). |
| jitter | STRING | -j | Jitter between requests in seconds (default 1). |
| proxy | STRING | --proxy | Proxy requests through a single IP:Port. |
| proxy-file | FILE | --proxy-file | Load proxies from a file and rotate through them. |
| report-name | STRING | -f | Custom report filename (default pymeta_report.csv). |
example
Run pymeta
# find and parse public documents for a domain, then write a CSV reportpymeta -d example.com --file-type pdf,docx,xlsx -m 50 -T 8 -f example_metadata.csv[*] pymeta - searching google,bing for pdf,docx,xlsx on example.com[+] 46 files found, downloading with 8 threads Author Software Source File----------- --------------------------- --------------------------j.doe Microsoft Word 2016 q3-report.docxa.martin Adobe PDF Library 15.0 brochure.pdfit-admin LibreOffice 7.2 asset-inventory.xlsx [+] 46 files parsed | 12 users | 5 software versions -> example_metadata.csvguidance
Choosing pymeta
Use pymeta when a domain has public Office or PDF files you want mined for author and software fields without sending traffic to the target. For files you already hold, use a local metadata parser; pymeta is the find-and-extract step.
infoga
Gathers email addresses from public sources. Pair with pymeta usernames for broader OSINT.
maigret
Hunts usernames across sites. Pivot on names pymeta pulls from document metadata.
pastos
Searches paste sites for leaked data. Another passive OSINT source beside document metadata.
faq
pymeta questions
related
More OSINT tools
dnsdumpster-dns-lookup
Passive DNS records from DNSDumpster.
dnstwist
Generate lookalike domains and flag registered typosquats.
favup
Look up the real IP of a host from its favicon via Shodan.
Infoga
Email OSINT from public sources, with optional breach checks.
maigret
Username search that collects accounts and profile data into one dossier.
socialscan
Check whether emails and usernames are available, taken, or invalid.
Run pymeta yourself
A domain feeds pymeta, which downloads public files and extracts usernames from their metadata for maigret to pivot on before the intel lands as output.
Facts on this page come from the live Trickest tool library.