MetaDetective cheatsheet

# Analyze a single file
metadetective -f report.pdf

# Analyze a directory
metadetective -d ./loot/

# Filter to specific file types only
metadetective -d ./loot/ -t pdf docx xlsx

# Ignore/exclude matching values (regex supported)
metadetective -d ./loot/ -i "admin" "anonymous" "unknown"

# Extract only specific metadata fields
metadetective -d ./loot/ --parse-only "Author" "Creator Tool" "GPS Position"

# Per-file view (all metadata shown per file)
metadetective -d ./loot/ --display all

# Deduplicated cross-file view (default - best for username harvest)
metadetective -d ./loot/ --display singular

# Compact output format
metadetective -d ./loot/ --format concise

# Decorated output format
metadetective -d ./loot/ --format formatted

# Scan target site: list discovered files, no download
metadetective --scraping --scan --url https://target.com/

# Filter by file extensions during scan
metadetective --scraping --scan --url https://target.com/ \
  --extensions pdf docx xlsx pptx

# Download discovered files
metadetective --scraping --url https://target.com/ \
  --download-dir ~/loot/

# Deep crawl: depth 2, 8 threads, 5 req/sec rate limit
metadetective --scraping --url https://target.com/ \
  --download-dir ~/loot/ --depth 2 --threads 8 --rate 5

# Follow links to external domains
metadetective --scraping --url https://target.com/ \
  --download-dir ~/loot/ --follow-extern

# 1. Passive document discovery via site scan
metadetective --scraping --scan --url https://target.com/

# 2. Download all exposed docs
metadetective --scraping --url https://target.com/ \
  --download-dir ~/loot/ --depth 2 --threads 8 --rate 3

# 3. Bulk metadata extraction (deduplicated)
metadetective -d ~/loot/ --display singular -e json

# 4. Parse usernames from JSON output
jq '.unique.Author[]' results.json | sort -u

# 5. Extract GPS from any images found
metadetective -d ~/loot/ --parse-only "GPS Position" "GPS Map Link"

# 6. Identify software stack from PDF Producer/Creator fields
metadetective -d ~/loot/ -t pdf --parse-only "Producer" "Creator Tool"

# 7. Map internal paths from Template and Hyperlinks
metadetective -d ~/loot/ --parse-only "Template" "Hyperlinks"

# 8. Cross-reference usernames against LinkedIn for confirmation
# 9. Use confirmed usernames for password spray / phishing pretexting

MetaDetective is the only tool that combines web crawling, metadata extraction, deduplication, GPS mapping, and structured export in a single command. For RAW camera formats or metadata removal, pair MetaDetective with ExifTool for full coverage.

#!/bin/bash
# Metadata OSINT: scrape target site, extract, report
TARGET="${1:-target.com}"
LOOT="/tmp/meta_osint_${TARGET}"
RESULTS="${LOOT}/results"

mkdir -p "${LOOT}/downloads" "${RESULTS}"

echo "[*] Phase 1: Crawling and downloading files from ${TARGET}..."
metadetective --scraping --url "https://${TARGET}/" \
  --extensions pdf docx xlsx pptx odt \
  --download-dir "${LOOT}/downloads" \
  --depth 3 --threads 8 --rate 3 --user-agent stealth --no-banner

echo "[*] Phase 2: Extracting metadata (deduplicated + JSON export)..."
metadetective -d "${LOOT}/downloads" \
  --display singular -e json -o "${RESULTS}" -c "${TARGET}" --no-banner

echo "[*] Phase 3: Summary statistics + timeline..."
metadetective -d "${LOOT}/downloads" --summary --timeline --no-banner

echo "[*] Phase 4: Parsing intelligence from JSON..."
echo ""
echo "=== USERNAMES ==="
jq -r '.unique.Author[]? // empty' "${RESULTS}/"*"${TARGET}"*.json 2>/dev/null | sort -u

echo ""
echo "=== SOFTWARE VERSIONS ==="
jq -r '.unique["Creator Tool"][]? // empty' "${RESULTS}/"*"${TARGET}"*.json 2>/dev/null | sort -u

echo ""
echo "=== GPS HITS ==="
jq -r '.unique["GPS Position"][]? // empty' "${RESULTS}/"*"${TARGET}"*.json 2>/dev/null

echo ""
echo "=== COMPANIES ==="
jq -r '.unique.Company[]? // empty' "${RESULTS}/"*"${TARGET}"*.json 2>/dev/null | sort -u

echo ""
echo "[+] Done. Results in ${RESULTS}/"
echo "[+] Open HTML report: ${RESULTS}/"*".html"

After exporting with -e json, use jq to extract actionable intelligence.

# All unique authors -> potential AD usernames for spray
jq -r '.unique.Author[]' results.json | sort -u

# All unique "Last Modified By" -> recently active employees
jq -r '.unique["Last Modified By"][]' results.json | sort -u

# Combine author + last modified -> full username list
jq -r '(.unique.Author[]?, .unique["Last Modified By"][]?) // empty' results.json | sort -u > usernames.txt

# Software fingerprinting -> identify tech stack
jq -r '(.unique["Creator Tool"][]?, .unique.Producer[]?, .unique.Software[]?) // empty' results.json | sort -u

# GPS positions -> physical locations
jq -r '.unique["GPS Position"][]' results.json

# GPS map links -> clickable Google Maps URLs
jq -r '.unique["GPS Map Link"][]' results.json

# Company names -> confirm org and subsidiaries
jq -r '.unique.Company[]' results.json | sort -u

# Internal paths -> UNC shares, intranet URLs
jq -r '(.unique.Template[]?, .unique.Hyperlinks[]?) // empty' results.json | grep -i '\\\\|//\|intranet\|internal'

# Count per field -> identify richest metadata sources
jq -r '.unique | to_entries[] | "\(.value | length)\t\(.key)"' results.json | sort -rn

# Generate users.txt for password spray (first.last format)
jq -r '.unique.Author[]' results.json | sort -u | \
  awk '{gsub(/ /,"."); print tolower($0)}' > spray_users.txt