exifray

Exifray

Exifray is a Go tool that discovers publicly accessible files on a target domain, extracts their metadata on-the-fly (without saving files to disk), and surfaces interesting findings — usernames, emails, GPS coordinates, internal paths, software versions, printer names, serial numbers, and more.

Current version: 1.0.0

Table of Contents

• How It Works
• Discovery Sources
• What It Detects
• Supported File Types
• Installation
• Usage
• Options
• Examples
• Configuration
• Author
• License

How It Works

1. Discovery — Queries multiple sources (passive archives, search engines, web scraping) to find file URLs associated with the target domain.
2. Deduplication — Merges results from all sources, removes duplicates, and filters by file extension.
3. Metadata Extraction — Downloads each file, extracts metadata in memory (EXIF, PDF info, OOXML/ODF properties, XMP, HTTP headers), and discards the file. Nothing is saved to disk.
4. Analysis — Scans extracted metadata for interesting findings: usernames, email addresses, GPS coordinates, internal paths, software versions, printer models, serial numbers, and internal URLs.
5. Output — Presents deduplicated findings grouped by category, with optional JSON output and file export.

Discovery Sources

What It Detects

Supported File Types

XMP metadata is also extracted from any file type that embeds it.

Installation

go install github.com/mmarting/exifray@latest

Usage

exifray -h

Options

Examples

Scan a domain (free sources only, no API keys needed):

exifray -d example.com

JSON output to file:

exifray -d example.com --json -o results.json

Scan multiple domains from a file:

exifray -l domains.txt -w 50

Use specific sources only:

exifray -d example.com --sources wayback,scrape,sitemap

Custom file extensions:

exifray -d example.com -e pdf,docx,xlsx

Silent mode for automation — outputs findings one per line:

exifray -q -d example.com

Show source file URLs alongside findings:

exifray -d example.com --show-urls

Use a proxy:

exifray -d example.com --proxy socks5://127.0.0.1:9050

Rate-limit requests:

exifray -d example.com --rate-limit 5

Piping into exifray

Reads domains from stdin when piped, one per line:

subfinder -d example.com -silent | exifray

cat domains.txt | exifray --json

Piping exifray output

# Extract only usernames
exifray -q -d target.com | grep "^\[Users\]" | cut -d' ' -f2-

# JSON + jq
exifray -d target.com --json | jq '.findings[] | select(.category == "GPS")'

Configuration

On first run, exifray creates $HOME/.exifray.conf with this template:

# Exifray config file — API keys for optional sources
# Free sources (wayback, commoncrawl, otx, urlscan, scrape, sitemap,
# hackertarget, crtsh, threatminer, rapiddns) work without any keys.

# VirusTotal — URL discovery via domain endpoint (free: 500 lookups/day)
vt_api_key=""

# URLScan.io — search API (optional, raises rate limits)
urlscan_api_key=""

# AlienVault OTX — URL list (optional, raises rate limits)
otx_api_key=""

# Google Custom Search — file-type dorking (requires API key + Custom Search Engine ID)
# Get API key: https://console.cloud.google.com/apis/credentials
# Create CSE: https://programmablesearchengine.google.com/
google_api_key=""
google_cx=""

Author

Martin Martin

• Website
• LinkedIn
• GitHub

License

Distributed under the GPL v3 License.