jonaslejon/malicious-pdfGenerate malicious PDF test files for penetration testing, bug bounty hunting, and red teaming. Tests SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Integrates with Burp Collaborator and Interact.sh.
Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh
Used for penetration testing, bug bounty hunting, and/or red-teaming etc. I created this tool because I needed a tool to generate a bunch of PDF files with various links. Educational and professional purposes only.
pip install -r requirements.txt
python3 malicious-pdf.py burp-collaborator-url
Output will be written to the output/ directory as: test1.pdf, test2.pdf, test3.pdf etc.
--output-dir DIR Directory to save generated PDF files (default: output/)
--no-credit Do not embed credit/attribution metadata in generated PDFs
--obfuscate LEVEL Obfuscation level (0-3):
0 = None (default)
1 = PDF name hex encoding + string octal/hex encoding
2 = Level 1 + JS bracket notation + javascript: URI case/whitespace obfuscation
3 = Level 2 + FlateDecode stream compression
Example with obfuscation:
python3 malicious-pdf.py https://your-interact-sh-url --obfuscate 2
Maximum obfuscation (Level 4 wraps JS payloads in a base64 decoder stub so the original API calls never appear as literal substrings):
python3 malicious-pdf.py https://your-interact-sh-url --obfuscate 4
/V, base64 decoder) defeat naïve /JS regex scanners