pdf-parser

Display statistics for a PDF file

$ pdf-parser --stats [path/to/file.pdf]

$ pdf-parser --type=[/Font] [path/to/file.pdf]

$ pdf-parser --search=[search_string] [path/to/file.pdf]

pdf-parser.py [options]

-h, --help
    Show help message and exit.

-o OBJECT, --object=OBJECT
    Select object(s) to display. Can be a single object number or a range (e.g., 1-5).

-s SEARCH, --search=SEARCH
    Search for a string in the PDF file.

-m, --metadata
    Extract and display PDF metadata.

-w, --raw
    Output raw object content.

-i, --info
    Display general PDF information.

-f, --filter
    Apply filters to extract data.

-n, --nocase
    Perform case-insensitive search.

-e, --elements
    Show elements of objects (for debugging).

-d, --debug
    Enable debugging output.

-v, --version
    Show version information and exit.

-a, --asci
    Use ASCII for string extraction (default is UTF-8).

The `pdf-parser` command is a command-line tool designed to parse and analyze PDF documents. It allows users to extract various information from PDF files, such as metadata, text content, object structures, and embedded files. The tool is particularly useful for security analysts, forensic investigators, and developers who need to examine the internal structure of PDF documents to identify potential vulnerabilities, malware, or extract specific data. `pdf-parser` provides a set of options to filter and extract specific objects or data streams from the PDF file, offering a detailed look at the document's components. It can handle both standard PDF files and those with certain levels of obfuscation or encryption (depending on the implemented features and decryption capabilities). This command aids in understanding how a PDF document is structured and whether it contains any malicious or unexpected content.

The effectiveness of `pdf-parser` in analyzing encrypted or heavily obfuscated PDF files may be limited, depending on the complexity of the protection mechanisms and whether the tool has implemented decryption or deobfuscation capabilities. Results may vary with different PDF versions and structures.

The pdf-parser command typically returns 0 upon successful execution and a non-zero value in case of errors (e.g., invalid PDF file, incorrect options).

The `pdf-parser` tool has evolved over time as a Python script, primarily aimed at providing security researchers and forensic analysts with a means to dissect PDF documents. Its development has focused on enhancing its ability to identify malicious content embedded within PDFs, such as JavaScript code, shellcode, or embedded files. The tool has been improved to handle various PDF structures and encoding schemes, making it a versatile asset for PDF analysis.

pdfinfo(1), pdftotext(1), pdfimages(1)