https://github.com/jesparza/peepdf Skip to content Toggle navigation Sign up * Product + Actions Automate any workflow + Packages Host and manage packages + Security Find and fix vulnerabilities + Codespaces Instant dev environments + Copilot Write better code with AI + Code review Manage code changes + Issues Plan and track work + Discussions Collaborate outside of code Explore + All features + Documentation + GitHub Skills + Blog * Solutions For + Enterprise + Teams + Startups + Education By Solution + CI/CD & Automation + DevOps + DevSecOps Resources + Customer Stories + White papers, Ebooks, Webinars + Partners * Open Source + GitHub Sponsors Fund open source developers + The ReadME Project GitHub community articles Repositories + Topics + Trending + Collections * Pricing Search or jump to... Search code, repositories, users, issues, pull requests... Search [ ] Clear Search syntax tips Provide feedback We read every piece of feedback, and take your input very seriously. [ ] [ ] Include my email address so I can be contacted Cancel Submit feedback Saved searches Use saved searches to filter your results more quickly Name [ ] Query [ ] To see all available qualifiers, see our documentation. Cancel Create saved search Sign in Sign up You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. {{ message }} jesparza / peepdf Public * Notifications * Fork 227 * Star 1k Powerful Python tool to analyze PDF documents peepdf.eternal-todo.com License GPL-3.0 license 1k stars 227 forks Star Notifications * Code * Issues 34 * Pull requests 15 * Actions * Projects 0 * Wiki * Security * Insights More * Code * Issues * Pull requests * Actions * Projects * Wiki * Security * Insights jesparza/peepdf This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. master Switch branches/tags [ ] Branches Tags Could not load branches Nothing to show {{ refName }} default View all branches Could not load tags Nothing to show {{ refName }} default View all tags Name already in use A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch? Cancel Create 3 branches 4 tags Code * Local * Codespaces * Clone HTTPS GitHub CLI [https://github.com/j] Use Git or checkout with SVN using the web URL. [gh repo clone jespar] Work fast with our official CLI. Learn more about the CLI. * Open with GitHub Desktop * Download ZIP Sign In Required Please sign in to use Codespaces. Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Launching Xcode If nothing happens, download Xcode and try again. Launching Visual Studio Code Your codespace will open once ready. There was a problem preparing your codespace, please try again. Latest commit @jesparza jesparza Modified readmes to add updated information about how to install PyV8... ... c74dc65 Nov 17, 2016 Modified readmes to add updated information about how to install PyV8... ... and pylibemu (via buffer repo). Fixed issue 46. c74dc65 Git stats * 216 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time aespython colorama jsbeautifier AUTHORS CHANGELOG COPYING JSAnalysis.py PDFConsole.py PDFCore.py PDFCrypto.py PDFFilters.py PDFUtils.py README README.md TODO aes.py ccitt.py jjdecode.py lzw.py peepdf.dtd peepdf.py View code README.md peepdf is a Python tool to explore PDF files in order to find out if the file can be harmful or not. The aim of this tool is to provide all the necessary components that a security researcher could need in a PDF analysis without using 3 or 4 tools to make all the tasks. With peepdf it's possible to see all the objects in the document showing the suspicious elements, supports all the most used filters and encodings, it can parse different versions of a file, object streams and encrypted files. With the installation of PyV8 and Pylibemu it provides Javascript and shellcode analysis wrappers too. Apart of this it's able to create new PDF files and to modify/obfuscate existent ones. The main functionalities of peepdf are the following: Analysis: * Decodings: hexadecimal, octal, name objects * More used filters * References in objects and where an object is referenced * Strings search (including streams) * Physical structure (offsets) * Logical tree structure * Metadata * Modifications between versions (changelog) * Compressed objects (object streams) * Analysis and modification of Javascript (PyV8): unescape, replace, join * Shellcode analysis (Libemu python wrapper, pylibemu) * Variables (set command) * Extraction of old versions of the document * Easy extraction of objects, Javascript code, shellcodes (>, >>, $ >, $>>) * Checking hashes on VirusTotal Creation/Modification: * Basic PDF creation * Creation of PDF with Javascript executed wen the document is opened * Creation of object streams to compress objects * Embedded PDFs * Strings and names obfuscation * Malformed PDF output: without endobj, garbage in the header, bad header... * Filters modification * Objects modification Execution modes: * Simple command line execution * Powerful interactive console (colorized or not) * Batch mode TODO: * Embedded PDFs analysis * Improving automatic Javascript analysis * GUI Related articles: * Spammed CVE-2013-2729 PDF exploit dropping ZeuS-P2P/Gameover * New peepdf v0.2 (Version Black Hat Vegas 2012) * peepdf supports CCITTFaxDecode encoded streams * Explanation of the changelog of peepdf for Black Hat Europe Arsenal 2012 * How to extract streams and shellcodes from a PDF, the easy way * Static analysis of a CVE-2011-2462 PDF exploit * Analysis of a malicious PDF from a SEO Sploit Pack * Analysing the Honeynet Project challenge PDF file with peepdf Part 1 Part 2 * Analyzing Suspicious PDF Files With Peepdf Included in: * REMnux * BackTrack 5 * Kali Linux You are free to contribute with feedback, bugs, patches, etc. Any help is welcome. Also, if you really enjoy using peepdf, you think it is worth it and you feel really generous today you can donate some bucks to the project ;) Thanks! [6874747073] About Powerful Python tool to analyze PDF documents peepdf.eternal-todo.com Resources Readme License GPL-3.0 license Stars 1k stars Watchers 55 watching Forks 227 forks Report repository Releases 4 tags Packages 0 No packages published Contributors 3 * @jesparza jesparza Jose Miguel Esparza * @rohit-dua rohit-dua Rohit Dua * @buffer buffer Angelo Dell'Aera Languages * Python 100.0% Footer (c) 2023 GitHub, Inc. Footer navigation * Terms * Privacy * Security * Status * Docs * Contact GitHub * Pricing * API * Training * Blog * About You can't perform that action at this time.