1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
| ❯ pdfid Hello_SuNiNaTaS.pdf
PDFiD 0.2.10 Hello_SuNiNaTaS.pdf
PDF Header: %PDF-1.4
obj 40
endobj 40
stream 11
endstream 11
xref 2
trailer 2
startxref 2
/Page 1
/Encrypt 0
/ObjStm 0
/JS 1 <-
/JavaScript 2 <-
/AA 0
/OpenAction 0
/AcroForm 0
/JBIG2Decode 0
/RichMedia 0
/Launch 0
/EmbeddedFile 0 <-
/XFA 0
/Colors > 2^24 0
❯ pdf-parser -h
Options:
-s SEARCH, --search=SEARCH
string to search in indirect objects (except streams)
-f, --filter pass stream object through filters (FlateDecode,
ASCIIHexDecode, ASCII85Decode, LZWDecode and
RunLengthDecode only)
-o OBJECT, --object=OBJECT
id(s) of indirect object(s) to select, use comma (,)
to separate ids (version independent)
-w, --raw raw output for data and filters
...
❯ pdf-parser -s JavaScript Hello_SuNiNaTaS.pdf
This program has not been tested with this version of Python (3.14.2)
Should you encounter problems, please use Python version 3.12.2
obj 30 0
Type:
Referencing: 31 0 R, 38 0 R
<<
/JavaScript 31 0 R <-
/EmbeddedFiles 38 0 R <- not scan in pdfid, but exist in pdf-parser, this is a nest object
>>
obj 36 0
Type:
Referencing:
❯ pdf-parser -o 38 Hello_SuNiNaTaS.pdf
This program has not been tested with this version of Python (3.14.2)
Should you encounter problems, please use Python version 3.12.2
obj 38 0
Type:
Referencing: 40 0 R
<<
/Names
<<
/UF (object 2)
/F (object 2)
/Type /Filespec
/EF 40 0 R
>>
]
>>
❯ pdf-parser -o 39 -f -d nested.pdf Hello_SuNiNaTaS.pdf
This program has not been tested with this version of Python (3.14.2)
Should you encounter problems, please use Python version 3.12.2
obj 39 0
Type:
Referencing:
Contains stream <-
<<
/Subtype /a
/Filter /FlateDecode
/Length 565
/DL 823
/Params
<<
/Size 823
/ModDate (D:20160525212830Z)
/CreationDate (D:20160525213559Z)
>>
>>
❯ file nested.pdf
nested.pdf: PDF document, version 1.7, 1 page(s)
❯ pdfid nested.pdf
PDFiD 0.2.10 nested.pdf
PDF Header: %PDF-1.7
obj 5
endobj 5
stream 1
endstream 1
xref 1
trailer 1
startxref 1
/Page 1
/Encrypt 1 <-!!
/ObjStm 0
/JS 1 <-
/JavaScript 1 <-
/AA 0
/OpenAction 1 <-
/AcroForm 0
/JBIG2Decode 0
/RichMedia 0
/Launch 0
/EmbeddedFile 0
/XFA 0
/Colors > 2^24 0
~/Downloads took 3s
❯ qpdf --decrypt nested.pdf decrypted.pdf
❯ pdfid decrypted.pdf
PDFiD 0.2.10 decrypted.pdf
PDF Header: %PDF-1.7
obj 5
endobj 5
stream 1
endstream 1
xref 1
trailer 1
startxref 1
/Page 1
/Encrypt 0
/ObjStm 0
/JS 1
/JavaScript 1
/AA 0
/OpenAction 1
/AcroForm 0
/JBIG2Decode 0
/RichMedia 0
/Launch 0
/EmbeddedFile 0
/XFA 0
/Colors > 2^24 0
❯ pdf-parser -s js decrypted.pdf
This program has not been tested with this version of Python (3.14.2)
Should you encounter problems, please use Python version 3.12.2
obj 2 0
Type: /Action
Referencing: 4 0 R
<<
/JS 4 0 R <- Object 4 is a stream object
/S /JavaScript
/Type /Action
>>
❯ pdf-parser -o 4 decrypted.pdf
This program has not been tested with this version of Python (3.14.2)
Should you encounter problems, please use Python version 3.12.2
obj 4 0
Type:
Referencing:
Contains stream
<<
/Filter /FlateDecode
/Length 45
>>
❯ pdf-parser -o 4 -f -d dump decrypted.pdf
❯ cat dump
"HERE IS FLAGS *********************"⏎
|