Contents
What do you need to know about pdfid?
This tool is not a PDF parser, but it will scan a file to look for certain PDF keywords, allowing you to identify PDF documents that contain (for example) JavaScript or execute an action when opened. PDFiD will also handle name obfuscation.
Why does pdfid spit out results that cause concern?
The pdfid results that spit out would cause concern if /JS, /JavaScript, /AA, /OpenAction, /AcroForm, /JBIG2Decode, /RichMedia, or /Launch were not displaying zero. Next I took this same PDF and packaged a reverse TCP meterpreter shell inside of it with Metasploit.
Can a PDF file be used to trigger malicious content?
PDF files may be used to trigger malicious content, as described here. PDFiD is a Python tool to analyze and sanitize PDF files, written by Didier Stevens. Here is PDFiD_PL, a version that I have slightly modified so that it can be imported as a module in Python applications (originally for ExeFilter ).
Can a vulnerability in a random reader affect pdfid?
It generally depends on how it is unsafe. If it is unsafe because of a vulnerability in a pdf handling library used by pdfid then it may compromise that machine. If it’s unsafe because of a vulnerability in random reader, that does not affect pdfid or any of it’s libraries, then no, it will not affect that machine.
Where is the pdfid script in BackTrack Linux?
The pdfid script in Backtrack Linux is a PDF forensics tool that will quickly provide you an overview of a PDF files potential threats and pdfid provides a way to disarm those threats. PDFid is written in Python and is located in /pentest/forensics/pdfid/.
How many embedded files are there in pdfid?
[…] to PDFiD, we are able to see there’s an AcroForm action and 6 embedded files. Basically, AcroForm is […] […] to PDFiD, we are means to see there’s an AcroForm movement and 6 embedded files. Basically, AcroForm is […] […] to PDFiD, we are able to see there’s an AcroForm action and 6 embedded files.