{"repo":"jonaslejon/malicious-pdf","free":true,"listed":false,"github":"https://github.com/jonaslejon/malicious-pdf","clone":"git clone https://github.com/jonaslejon/malicious-pdf.git","description":"💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh","language":"Python","stars":4131,"topics":["penetrationtesting","pentesting","pentesting-tools","penetration-testing","penetration-test","pdf-generation","pdf","bugbounty","bugbounty-tool","python"],"license":"BSD-2-Clause","category":"security-tools","readme_excerpt":"Malicious PDF Generator ☠️ Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh Used for penetration testing, bug bounty hunting, and/or red-teaming etc. I created this tool because I needed a tool to generate a bunch of PDF files with various links. Educational and professional purposes only. Usage Output will be written to the output/ directory as: test1.pdf, test2.pdf, test3.pdf etc. Options Example with obfuscation: Maximum obfuscation (Level 4 wraps JS payloads in a base64 decoder stub so the original API calls never appear as literal substrings): Purpose - Test web pages/services accepting PDF files - Test security products - Test PDF readers - Test PDF converters - Test server-side PDF processing libraries (PDFBox, iText, etc.) - Test PDF static analysis tools — staged JS payloads (form-field /V , base64 decoder) defeat naïve /JS regex scanners - Bug bounty hunting — useful for finding SSRF, XXE, blind callbacks, and NTLM leaks in file upload endpoints, PDF-to-image converters, and document processing pipelines on programs that accept PDF input Credits - Insecure features in PDFs - Burp Suite UploadScanner - Bad-Pdf - A Curious Exploration of Malicious PDF Documents - \"Portable Document Flaws 101\" talk at Black Hat USA 2020 - Adobe Reader - PDF callback via XSLT stylesheet in XFA - Foxit PDF R","default_branch":null,"files":null,"tree":[],"storefront":"/r/jonaslejon","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/jonaslejon/malicious-pdf/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}