I'm currently working on a security Proof Of Concept where I need to show the danger of opening an unknown PDF file. Internet says that many malwares use Javascript in PDF document (AcroJS) to download their malicious payload.
My PoC is based on a victim who will demonstrate data leak based on opening a PDF file. I only needs to send the filename over Internet (to begin).
I can write Javascript code which launch at document opening but the Net.HTTP.request function can only be used in trusted context.
So I don't see how to make a GET request to my listening "evil" website.
I read that sometimes hackers use vulnerabilities in Acrobat to do their bad, but many places talk about the native ability of AcroJS to permit GET request.
Is anyone knowing how to do a one way GET request (the answer of the server is not even interesting in this case).
Maybe is there a way to include a remote (non existent) picture so the PDF will make a GET request to the specified URL. Or something like this.
Thanks