malicious-pdf is a Python generator of 67 malicious PDF test files for penetration testers, bug bounty hunters, and red teams who need to probe how PDF viewers, converters, and web applications handle hostile document content.

What it is

malicious-pdf is a command-line Python tool that emits a collection of 67 malicious PDF test files, each embedding links and payloads designed to reveal how a target handles untrusted documents. The generated files are written to the output/ directory as test1.pdf, test2.pdf, test3.pdf, and so on, with an optional --no-credit flag to suppress embedded attribution metadata. The tool sits in the security-testing ecosystem and is built to work alongside out-of-band interaction servers such as Burp Collaborator and Interact.sh, into which you pass your callback URL as the script's argument.

The concrete problem it solves is that testing whether a PDF-consuming system leaks data or makes outbound requests normally requires hand-crafting many distinct PDF attack variants. Upload endpoints, PDF-to-image converters, server-side processing libraries such as PDFBox and iText, PDF readers, and static analysis tools each expose different behaviours, so a tester needs a broad set of samples covering phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration. This tool replaces that manual assembly with a single invocation that produces the whole batch at once.

Key capabilities

• Generates 67 distinct malicious PDF samples in one run against a supplied callback URL, covering phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration.
• Supports four obfuscation levels through --obfuscate LEVEL: level 1 applies PDF name hex encoding plus string octal/hex encoding, level 2 adds JS bracket notation and `` URI case/whitespace obfuscation, level 3 adds FlateDecode stream compression, and level 4 wraps JS payloads in a base64 decoder stub so the original API calls never appear as literal substrings.
• Produces staged JavaScript payloads, including form-field /V and base64 decoder techniques, which defeat naïve /JS regex scanners in PDF static analysis tools.
• Writes output to a configurable directory via --output-dir DIR (default output/) and offers --no-credit to omit credit and attribution metadata from the generated PDFs.
• Targets server-side PDF processing libraries by name, including PDFBox and iText, whose XXE history (CVE-2016-2175 and CVE-2017-9096) and related flaws are among the references it builds on.
• Integrates directly with Burp Collaborator and Interact.sh as the callback receiver for blind interaction detection.
• Ships under a BSD-2-Clause licence and carries an OpenSSF Best Practices badge.

Who uses it and how

• Penetration testers feed a Burp Collaborator URL to python3 malicious-pdf.py and upload the resulting output/ files to web pages and services that accept PDF input.
• Bug bounty hunters use the samples to look for SSRF, XXE, blind callbacks, and NTLM leaks in file upload endpoints, PDF-to-image converters, and document processing pipelines on programs that accept PDF input.
• Red teams evaluate security products and PDF readers by observing which generated files trigger outbound interactions.
• Defenders and QA engineers test server-side PDF processing libraries such as PDFBox and iText, and validate PDF static analysis tools against staged payloads.

Getting started

Install the dependencies with pip install -r requirements.txt, then run python3 malicious-pdf.py burp-collaborator-url to write the generated PDFs into the output/ directory.

How it compares

Among the related work it credits, Bad-PDF and Burp Suite UploadScanner address overlapping ground, but this project is specifically a standalone batch generator rather than a Burp extension, so it pairs with a collaborator URL instead of living inside an intercepting proxy. That keeps it usable from a plain Python environment on any target where you can upload the resulting files.

When to use it — and when not

A self-hoster needs only Python and an out-of-band listener such as Burp Collaborator or Interact.sh to receive callbacks, since the tool itself generates files rather than serving them. It is not a scanner or an exploit: it will not find vulnerabilities on its own, and it should not be used outside authorized testing, as the README states the project is for educational and professional purposes only. The documentation is also somewhat inconsistent — the options block describes --obfuscate LEVEL as 0–3 while the examples demonstrate level 4 — so the exact range should be confirmed before relying on a specific level.

pip install -r requirements.txt
python3 malicious-pdf.py burp-collaborator-url

--output-dir DIR    Directory to save generated PDF files (default: output/)
--no-credit         Do not embed credit/attribution metadata in generated PDFs
--obfuscate LEVEL   Obfuscation level (0-3):
                      0 = None (default)
                      1 = PDF name hex encoding + string octal/hex encoding
                      2 = Level 1 + JS bracket notation + javascript: URI case/whitespace obfuscation
                      3 = Level 2 + FlateDecode stream compression

python3 malicious-pdf.py https://your-interact-sh-url --obfuscate 2

python3 malicious-pdf.py https://your-interact-sh-url --obfuscate 4