Questions tagged [pdf]

Portable Document Format (PDF) is an open standard for electronic document exchange maintained by the International Organization for Standardization (ISO). Questions can be about PDF specific malware or protections.

Filter by
Sorted by
Tagged with
0
votes
0answers
72 views

John the ripper - “no password hashes loaded ” for pdf

I'm trying to decrypt a pdf that I no longer have the password for. When I use JohnTheRipper, it can't seem to load any password hashes. Basically, this is what I run. └─$ perl pdf2john.pl /home/...
0
votes
2answers
109 views

Can converting a virus-infected webpage to PDF format still contain viruses [closed]

So I know that PDF files can contain viruses themselves if they are target specifically for that purpose. However, my question for here is this: If a webpage that has some malicious scripts or a virus ...
0
votes
2answers
103 views

Foxit Reader - disable JavaScript / Safely read PDF

Today I disabled JavaScript in my Foxit Reader settings because I hope to gain better security against malware embedded in PDF books I read. As some sort of simple check I tried to open a PDF with ...
0
votes
1answer
136 views

Is converting malicious PDF to JPG than backwards via web services is good method to obtain safe PDF?

I've downloaded a book but by default its considered malicious by me. I though of converting that PDF to JPG here: https://smallpdf.com/pl/pdf-do-jpg Than backwards: https://smallpdf.com/pl/jpg-to-pdf ...
0
votes
0answers
34 views

How to pipe ObjStm from PDFid into pdf-parser?

I'm looking at a PDF with /ObjStm count of 766. I'm trying to unpack a few of those to see what it's doing. Didier Stevens blog talks about piping an ObjStm into pdf-parser but I can't see how to do ...
0
votes
0answers
44 views

Javascript PDF Brute Forcing

I am trying to learn PDF Brute forcing with javascript. I've read about encryption algorithm of PDF 1.4 documentation here https://www.adobe.com/content/dam/acom/en/devnet/pdf/pdf_reference_archive/...
0
votes
2answers
107 views

Is it impossible to have a PDF file execute a command without abusing any exploits?

We are running a purple team which includes attempting to run a malicious PDF on the target system. The targeted user is well aware of the exercise so there is no concerns about an AV picking the ...
1
vote
0answers
62 views

Is the most secure way of viewing an infected pdf file through a cloud pdf reader like xodo using a pdf uploaded to Google Drive?

Is the most secure way of viewing an infected pdf file through a cloud pdf reader like xodo using a pdf uploaded to Google Drive? I have a work laptop and I currently work for a small startup that had ...
1
vote
1answer
528 views

Unable to get John the Ripper to crack PDF password

I am new to Kali Linux and JTR but am playing around trying to crack a PDF file. I set the PDF Password to test so it's a known password on my own file. For whatever reason JTR appears to finish ...
2
votes
1answer
89 views

How can a pdf file have two passwords?

I receive emails from my bank with password protected PDF files, and they provide two passwords - either xxxx or yyyy. How is this possible?
2
votes
2answers
1k views

Gmail warns about encrypted PDF file

I recently received a PDF file that, when attached to a gmail message, causes a warning to be displayed as follows: Encrypted attachment warning – Be careful with this attachment. This message ...
3
votes
1answer
203 views

Can a PDF embed a tracking image?

I know that PDFs can contain embedded images and Javascript. Can a PDF contain something that tracks you? For instance, can it contain a remote image that, when the PDF is opened, will fetch that ...
2
votes
1answer
148 views

Why do PDFs contain password hashes?

Reading this question about extracting PDF password hashes to feed into john the ripper has me wondering why password hashes are in a PDF in the first place? Shouldn't it be using the supplied ...
0
votes
0answers
35 views

How to make PDF-file post data on load? [duplicate]

I've been trying to create a .pdf file via msfconsole that would open cmd on a windows device and curl POST data to a server. I've previously checked this link and found the following: se exploit/...
0
votes
0answers
39 views

John the Ripper [duplicate]

I've already cracked a PDF with pdf2john but it doesn't show the password. What could be the problem? (The password isn't blank.)
0
votes
0answers
342 views

Android 10 downloaded suspicious files without my permission

This is my first question on this forum so please let me know if I need to clarify anything. My Android 10 Pixel 2 just downloaded 2 files without my permission today, both named something to the ...
15
votes
8answers
2k views

Document security - how to find who's leaked a confidential document?

I am legally obliged to distribute a document (probably by email, probably saved as MS word, or a PDF) to several hundred recipients. The recipients are legally obliged to keep it confidential. ...
1
vote
1answer
85 views

PDF User Password always give access to the Owner Password, even when encrypted with AES-128

I've been messing around with qpdf, and noticed something that seems huge: that a document's Owner Password is essentially useless, as it can be easily unset, and therefore that only the User Password ...
2
votes
1answer
69 views

PDF Server Side 2020

I have been gathering information on handling PDF files for web applications. Much of my research has been on displaying the files to the user. What I want to learn here is how to properly handle the ...
1
vote
0answers
58 views

PDF Documents - Browser View 2020

I posted a question yesterday about PDF files in a browser that can be found here. There you can find more information about dealing with PDF documents in browser. My question here is how each ...
3
votes
1answer
243 views

PDF Documents in Browser 2020

I have a project where I would like to allow a user to view a document (PDF) in their browser by clicking on a link or thumbnail of the file. They would be able to download said file. Ive just begun ...
0
votes
0answers
30 views

Can flattened pdf documents contain viruses? [duplicate]

While I came to this site from researching whether inactive (or flattened) PDF documents could contain viruses and have come across this link in this site, it does not answer my question. I need to ...
6
votes
1answer
109 views

Printing document on usb drive with confidential information on multi user computer

I have a pdf file with confidential information on a usb flash drive. This document needs to be printed on a multi user Ubuntu system. I want to prevent other users from seeing the content of the ...
3
votes
1answer
2k views

How can we embed an exe containing a payload into a pdf file [closed]

I have created an exe with a payload which gives me a meterpreter session. But I need to embed this exe into a pdf. Upon opening the pdf the exe ideally should get executed. Is there any way to do ...
0
votes
0answers
68 views

Safest way to open PDFs on Android and iOS?

I was checking out Qubes' way of creating safe PDFs, but unless you use Qubes as a daily driver (and use DispVMs to open PDFs) it's still not viable to just use it to create image-based PDFs if you ...
1
vote
1answer
189 views

How likely are Evince, XReader or Adobe Reader with scripts disabled, to be exploited by a malicious file?

PDFs are very commonly found on the web, and I carefully either view them on the browsers, or use readers without the capability to run the scripts that may come with them (shitty design choice) like ...
5
votes
1answer
119 views

Could PDF's `/Filespec` type allow for remote file access?

I've read the PDF 1.7 spec 7.11.1 (okay, not all the spec, but a part of it), and I've seen that you have what Adobe calls /Filespec type objects. As far as I get it, this means that a PDF can make a ...
0
votes
1answer
143 views

Risks of allowing users to upload PDF and XML files to be stored/retrieved from a DB (ASPNET MVC 5)

I'm modifying an ASPNET MVC 5 web site and a requirement is to allow users to upload an XML and PDF file. The XML file will be used to layout text on the PDF based on variables coming from within the ...
4
votes
1answer
414 views

Can the conversion of a malicious PDF to image be exploitable?

Let's say I want to allow to the customer's of my website to upload PDF documents. What would be more safe to do: Convert the PDF to image using a library and store it in my file server as an image? ...
-2
votes
1answer
166 views

Reason for fake academic pdf files found on sites like Google Scholar? [closed]

Using my web-browser, I clicked a link on Google Scholar that led to a fake paper (in .pdf format). The pdf contained many keywords and phrases related to the research topic, possibly for search ...
3
votes
2answers
580 views

Hash value changes after first opening a file

Is it possible or normal that the hash value of a file changes just after the first opening/execution of it? I used sha256sum function within Ubuntu terminal to check the hash values before and after ...
1
vote
1answer
1k views

Some digitally signed pdfs shown as verified in the pdf viewers while others are not [closed]

I have two pdf documents: 1 - My class 10 marksheet issued by the CISCE that I downloaded through digilocker. 2 - My Domicile certificate issued and downloaded from the aaplesarkar website. Both ...
2
votes
1answer
357 views

Is it safe to view local pdf files in a browser?

When receiving a pdf file by e-mail, the question is how to open it. Browsers are normally quite secure, don't support all pdf features (an advantage in this case) and the viewer/conversion might ...
3
votes
0answers
63 views

Burst and rebuild pdf to discard eventual embedded malware

This question deals with how to scan, while i am curious if my acrobat reader DC is compromised but in an isolated container and i pull out the pdf. Is it safe to disassemble the pdf by pdftk burst .. ...
2
votes
0answers
647 views

What is the difference between PKCS#7 and CADES, PADES and XADES?

I am newbie in PKI. For signing a pdf documents we are free to consider each pkcs#7 format or PADES format. If I have some misunderstandings, please turn it on for me.
2
votes
1answer
14k views

PDF UrlMal-inf[Trj] Virus

When I create PDF file from my particular DOCX file, it gets infected with the virus. But if I create a new DOCX file and create PDF from that, it doesn't get infected with the virus. I have tried ...
-1
votes
1answer
51 views

Does making a pdf searchable make it more vulnerable? [closed]

I would like to know if making a pdf 'searchable' somehow make it less secure?
0
votes
0answers
27 views

How secure is pdf password protection? [duplicate]

I'm assuming PDF password protection uses encryption. How secure are the methods used? Can it be easily cracked or is it more in line with modern GPG encryption in terms of strength?
3
votes
1answer
2k views

Send GET request from a PDF file

I'm currently working on a security Proof Of Concept where I need to show the danger of opening an unknown PDF file. Internet says that many malwares use Javascript in PDF document (AcroJS) to ...
1
vote
0answers
45 views

What source formats are affected by ImageMagick's vulnaribility caused by Ghostscript?

According to https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/ ImageMagick's convertion to PDF of arbitrary (user-submitted) documents should not be used because of Ghostscript's ...
4
votes
2answers
3k views

Malicious PDF file upload

I have a web server for my customers to upload their PDF files. I have also an IDS/IPS with Anti-Malware license that is between the user and the web server and blocks malicious PDF files from ...
3
votes
1answer
2k views

PDF and embedded JavaScript

We have completed a vulnerability and a penetration test. One feature of our application allows for documents to be uploaded, and we allow for PDF documents. Prior to a document being accepted we ...
1
vote
2answers
7k views

Is this a safe way to open a PDF file? [duplicate]

I have recieved an email with a pdf file whose content I want, but I'm not exactly sure what the source of it is. In gmail, I have two options: "Download" and "Save to Drive". I'm assuming it means ...
3
votes
1answer
98 views

What is the industry standard practice for saving a potentially (likely) malicious PDF for analysis?

I've received an email with an attached PDF which has many signs of being a malicious attachment. Lacking the time and resources to analyze it at the moment, I'd like to store it for later use, and ...
1
vote
1answer
115 views

How useful is PDF signing in real world usage?

Background senario: So we had a problem where our system (Alice's shiny widgets) generated a PDF with a quote amount for 10 widgets. Someone (Eve) took the PDF, altered it to increase the price by 20%,...
2
votes
0answers
164 views

HTML Form to PDF vulnerabilities

I have a form where the user inputs data. On the back end, I'm taking some of that data and embedding it into a PDF using ActiveReports. I then display it back to the user and save a copy on our ...
2
votes
0answers
84 views

Which (FOSS) tools (on Linux) support displaying or verifying digital signatures [closed]

So far I have been unable to find any tools on Linux (preferably FOSS) which will display a digital signature when viewing a PDF file and possibly also allow verification of the validity of that ...
2
votes
1answer
172 views

How can I detect and reject potentially unsafe pdf uploads

We develop a web app that will start accepting pdf uploads, which will be stored and distributed to other users. Pdfs seem remarkably unsafe still. How can I scan and reject any pdf that does ...
1
vote
1answer
144 views

pdfid analyzing / disarming documents causing infection?

If you analyze or disarm a potential unsafe pdf file using pdfid , will it infect the machine while doing it? Is it the same with peepdf?
4
votes
1answer
499 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...