Document Metadata, The Silent Killer - PaulDotCom

More documents

Recommendations

Info

Office 2007 • Changed metadata storage format to XML • XML parsing with shell scripting is like herding cats • New document is just a ZIP archive • <strong>The</strong> best goodies for are typically located in docProps/core.xml • Wrote my first Perl script to extract author metadata http://www.pauldotcom.com/2007XMLextract.pl • Yes, the zip can be completed in Perl as well... unzip -e -j Testing<strong>Metadata</strong>2007.docx docProps/core.xml | perl ./2007XMLextract.pl core.xml | tr '[:space:]' '\n' | sort | uniq > 2007users.txt Wednesday, March 11, 2009
Custom user lists • So, lets take some word docs and pull out the user names and first and last names! • Tedious process? Script it! • What about Web? wget -r -l1 --no-parent -A.doc http://www.somewebsite.com | exiftool -r -a -u -Author - LastSavedBy * >users.txt |strings users.txt | cut -d":" -f2 | grep -v "\=" | grep -v "\image files read" | tr '[:space:]' '\n' | sort | uniq >cleanusers.txt • local disk? exiftool -r -a -u -Author -LastSavedBy * >users.txt |strings users.txt | cut -d":" -f2 | grep -v "\=" | grep -v "\image files read" | tr '[:space:]' '\n' | sort | uniq >cleanusers.txt Wednesday, March 11, 2009
Page 1 and 2: Metadata in Common Document Types !
Page 3 and 4: What I Learned • Processing 560,0
Page 5 and 6: Wednesday, March 11, 2009
Page 7 and 8: Wednesday, March 11, 2009 Word!
Page 9 and 10: Word! $ strings Test_Metadata_Docum
Page 11 and 12: Wednesday, March 11, 2009 Acrobatic
Page 13 and 14: Acrobatics! $ strings Test Metadata
Page 15 and 16: • So, what can we learn? Strings
Page 17 and 18: Too revealing? • How about the em
Page 19 and 20: Wednesday, March 11, 2009 Picture t
Page 21 and 22: Speaking of location • How about
Page 23 and 24: Adding GPS up • We now know: •
Page 25 and 26: A few scary examples • Eliot •
Page 27 and 28: Wednesday, March 11, 2009 Eliot, Ho
Page 29 and 30: Wednesday, March 11, 2009 Tina, Hom
Page 31 and 32: Wednesday, March 11, 2009 Taking it
Page 33 and 34: How do we know? • PGP Keysigning
Page 35 and 36: Direct e-mail example Delivered-To:
Page 37 and 38: OOO Subject: [Email Tips] The Keyma
Page 39 and 40: Too cool for tool • Sure, there
Page 41 and 42: Analyzing Word • Metagoofil • E
Page 47: Exiftool • It turns out that Exif
Page 51 and 52: My pwn SANS Paper InfoKey: Creator
Page 53 and 54: JPEG GPS Data • Google maps is yo
Page 55 and 56: Wednesday, March 11, 2009 Maltego D
Page 57 and 58: Wednesday, March 11, 2009 Document
Page 59 and 60: Wednesday, March 11, 2009 This is h
Page 61 and 62: How can this be used? • Determine
Page 65 and 66: Consider this... • Remember this
Page 67 and 68: Microshafted! • For prior to Offi
Page 69 and 70: PDF! • Acrobat Standard/Pro • G
Page 71 and 72: A note on cleanup... • Some infor
Page 73: EOF larry@pauldotcom.com http://www

Document Metadata, The Silent Killer - PaulDotCom

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?