ToolWar | Information Security (InfoSec) Tools: PDF

PeePDF (PDF Analysis, Forensics, Creation and Modification) :: Tools

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdfssXOHi8T0g4PNVG2niVEqC8bGVS2bQv8_wc0aLv8WDhBJ6Qf4HmwrkQoJlcQQtkcpLkUrvaJT9SEivG30mCR9_7y4Shf87TpVzinYYtGUbSzmXiSqszzlHsUI0d9T1VuVnq7P5KubfM/s1600/PeePDF.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="PeePDF Analysis" border="0" height="400" loading="lazy" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdfssXOHi8T0g4PNVG2niVEqC8bGVS2bQv8_wc0aLv8WDhBJ6Qf4HmwrkQoJlcQQtkcpLkUrvaJT9SEivG30mCR9_7y4Shf87TpVzinYYtGUbSzmXiSqszzlHsUI0d9T1VuVnq7P5KubfM/s1600-rw/PeePDF.jpg" title="PeePDF Analysis" width="400" /></a></div>
<b>PeePDF</b> is a <b>Python tool to explore PDF files</b> in  order to find out if the file can be harmful or not. The aim of this <a href="http://www.toolwar.com/search/label/Tools" target="_blank"> tool</a> is to provide all the necessary components that a <a href="http://www.toolwar.com/search/label/Security" target="_blank">security</a>  researcher could need in a <a href="http://www.toolwar.com/search/label/PDF" target="_blank">PDF analysis</a> without using 3 or 4 tools to  make all the tasks. With peepdf it's possible to see all the objects in  the document showing the suspicious elements, supports all the most used  filters and encodings, it can parse different versions of a file,  object streams and encrypted files. With the installation of PyV8 and Pylibemu it provides <b>Javascript and shellcode <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analysis</a></b> wrappers too. Apart of this it's able to create new PDF files and to modify/obfuscate existent ones. </div>
<div style="text-align: justify;">
<br />
The main functionalities of peepdf are the following: </div>
<div style="text-align: justify;">
<h3>
<b> Analysis: </b></h3>
</div>
<ul style="text-align: justify;">
<li> Decodings: hexadecimal, octal, name objects </li>
<li> More used filters </li>
<li> References in objects and where an object is referenced </li>
<li> Strings search (including streams) </li>
<li> Physical structure (offsets) </li>
<li> Logical tree structure </li>
<li> Metadata </li>
<li> Modifications between versions (changelog) </li>
<li> Compressed objects (object streams) </li>
<li> Analysis and modification of Javascript (PyV8): unescape, replace, join </li>
<li> Shellcode analysis (Libemu python wrapper, pylibemu) </li>
<li> Variables (set command) </li>
<li> Extraction of old versions of the document </li>
<li> Easy extraction of objects, Javascript code, shellcodes (>, >>, $>, $>>) </li>
<li> Checking hashes on <a href="http://www.toolwar.com/2013/12/virustotal-analyze-files-and-urls-tools.html" target="_blank"><b>VirusTotal</b></a> </li>
</ul>
<div style="text-align: justify;">
<b> Creation/Modification: </b></div>
<ul style="text-align: justify;">
<li> Basic PDF creation </li>
<li> Creation of PDF with Javascript executed wen the document is opened </li>
<li> Creation of object streams to compress objects </li>
<li> Embedded PDFs </li>
<li> Strings and names obfuscation </li>
<li> Malformed PDF output: without endobj, garbage in the header, bad header... </li>
<li> Filters modification </li>
<li> Objects modification </li>
</ul>
<div style="text-align: justify;">
<b> Execution modes: </b></div>
<ul style="text-align: justify;">
<li> Simple command line execution </li>
<li> <b>Powerful interactive console</b> (colorized or not) </li>
<li> Batch mode </li>
</ul>
<div style="text-align: justify;">
<b> TODO: </b></div>
<ul style="text-align: justify;">
<li> Embedded PDFs analysis </li>
<li> Improving automatic Javascript analysis </li>
<li> GUI </li>
</ul>
<h3>
Tutorials :: </h3>
<b>PeePDF Installation :: </b><a href="http://code.google.com/p/peepdf/wiki/Installation" target="_blank">Click Here</a><b><a href="http://code.google.com/p/peepdf/wiki/Installation" target="_blank"> </a></b><br />
<b>PeePDF Execution :: </b><a href="http://code.google.com/p/peepdf/wiki/Execution" target="_blank">Click Here</a><br />
<b>PeePDF Commands ::  </b><a href="http://code.google.com/p/peepdf/wiki/Commands" target="_blank">Click Here</a><br />
<b>PDF Forensics and Analysis eBook</b> :: <a href="https://www.amazon.com/dp/B00LSF1TU6" target="_blank">Click Here</a> <br />
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/T1GcheLaY5M?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
<h3>
Download ::</h3>
<b>Linux | Windows :: </b><a href="http://peepdf.googlecode.com/files/peepdf_0.2-BlackHatVegas.zip" target="_blank">peepdf v0.2</a> (.zip)<b> | </b><a href="http://peepdf.googlecode.com/files/peepdf_0.2-BlackHatVegas.tar.gz" target="_blank">peepdf v0.2</a> (.tar.gz)
<b> </b><br />
<b>Source Website ::</b> <a href="http://code.google.com/p/peepdf/">http://code.google.com/p/peepdf/</a>

PeePDF (PDF Analysis, Forensics, Creation and Modification) :: Tools

PeePDF is a Python tool to explore PDF files in order to find out if the file can be harmful or not. The aim of this tool is to provide all the necessary components that a security researcher coul…

PDFMiner (PDF Parser and Analyzer) :: Tools

<div class="separator" style="clear: both; text-align: center;">
<img alt="PDF Analyzer Logo" border="0" height="320" loading="lazy" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMCjJJbO6cbhxU25HoYQQ8ON_84A1pWFiyQLa-JFIozC6ngptY0JwR3i0kmDfGHn30rDY8c8i1AKJlt85WCyQGkQ1xtKs733iaogmoBtlkajjWUsAMFPoLlIFMdiiDWpacJze0pKS8trfk/s320-rw/PDF+Analyzer+logo.png" title="PDF Analyzer Logo" width="320" /></div>
<div style="text-align: justify;">
<b>PDFMiner </b>is a tool for <i>extracting information from PDF documents.</i>
Unlike other <b>PDF-</b>related tools, it focuses entirely on getting 
and<i> <a href="http://www.toolwar.com/search/label/Analysis" target="_blank">analyzing</a> text data</i>. <b>PDFMiner </b>allows one to obtain
the exact location of text in a page, as well as 
other information such as fonts or lines.
It includes a PDF converter that can transform <a href="http://www.toolwar.com/search/label/PDF" target="_blank">PDF</a> files
into other text formats (such as HTML). It has an extensible
PDF parser that can be used for other purposes than text analysis.

</div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
Features</h3>
<ul style="text-align: justify;">
<li> Written entirely in Python. (for version 2.4 or newer)
</li>
<li> Parse, analyze, and convert PDF documents.
</li>
<li> PDF-1.7 specification support. (well, almost)
</li>
<li> CJK <a href="http://www.toolwar.com/search/label/Language" target="_blank">languages</a> and vertical writing scripts support.
</li>
<li> Various font types (Type1, TrueType, Type3, and CID) support.
</li>
<li> Basic encryption (RC4) support.
</li>
<li> PDF to HTML conversion (with a sample converter web app).
</li>
<li> Outline (TOC) extraction.
</li>
<li> Tagged contents extraction.
</li>
<li> Reconstruct the original layout by grouping text chunks.
</li>
</ul>
<div style="text-align: justify;">
<b>PDFMiner</b> is about 20 times slower than 
other C/C++-based counterparts such as XPdf. </div>
<div style="text-align: justify;">
<br /></div>
<h3 style="text-align: justify;">
Tutorials ::</h3>
<h4>
How to Install</h4>
<ol>
<li> Install <a href="http://www.toolwar.com/search/label/Python" target="_blank">Python</a> 2.4 or newer.
     (<b>Python 3 is not supported.</b>)
</li>
<li> Download the PDFMiner source.
</li>
<li> Unpack it.
</li>
<li> Run <code>setup.py</code> to install:<br />
<blockquote>
<pre><span style="font-family: "Courier New",Courier,monospace;"># <b>python setup.py install</b></span>
</pre>
</blockquote>
</li>
<li> Do the following test:<br />
<blockquote>
<pre><span style="font-family: "Courier New",Courier,monospace;">$ <b>pdf2txt.py samples/simple1.pdf</b>
Hello
World
Hello
World
H e l l o
W o r l d
H e l l o
W o r l d</span>
</pre>
</blockquote>
</li>
<li> Done!
</li>
</ol>
<div style="text-align: justify;">
For more tutorials visit official website.</div>
<h3 style="text-align: justify;">
<b>Download ::</b></h3>
<div style="text-align: justify;">
<b>Linux ::</b> <a href="https://pypi.python.org/packages/source/p/pdfminer/pdfminer-20131113.tar.gz" target="_blank">PDFMiner-20131113.tar.gz</a><b> </b></div>
<div style="text-align: justify;">
<b>Official Website :: </b> <a href="http://www.unixuser.org/~euske/python/pdfminer/index.html">http://www.unixuser.org/~euske/python/pdfminer/index.html</a></div>

PDFMiner (PDF Parser and Analyzer) :: Tools

PDFMiner is a tool for extracting information from PDF documents. Unlike other PDF-related tools, it focuses entirely on getting and analyzing text data. PDFMiner allows one to obtain the exact loca…