What Is pdfdumper?
pdfdumper is a command-line tool designed to extract embedded objects and streams from PDF files. In CTF challenges, flags are often hidden in:
- Embedded images
- JavaScript scripts
- Attachments
- Encoded streams
pdfdumper automates the process of dumping these objects for further analysis.
Basic Usage
pdfdumper file.pdf
By default, pdfdumper will:
- List all objects in the PDF
- Extract streams (images, JavaScript, attachments) into files
- Provide object numbers and types
Example Output
Object 5: /Type /Page Object 12: /EmbeddedFile stream -> saved as obj12.bin Object 15: /XObject /Image -> saved as obj15.png Object 22: /JS stream -> saved as obj22.js
How pdfdumper Is Used in CTF Challenges
1. Extract Embedded Files
PDFs may contain attachments or hidden files.
pdfdumper challenge.pdf
Check for:
objXX.bin→ could contain flag dataobjXX.png→ images with steganographyobjXX.js→ scripts that reveal or decode flags
2. Analyze Embedded JavaScript
Some PDFs contain JavaScript that, when executed, generates the flag.
After extraction:
cat obj22.js
- Look for base64-encoded strings
- Look for function calls revealing secrets
3. Image Analysis
PDFs often hide flags in images or XObjects:
- Dumped images can be analyzed with:
zstegfor PNGsstegsolvefor bitplane analysisexiftoolfor metadata
4. Stream Inspection
Streams can contain:
- Base64-encoded flags
- Hidden text
- Hex-encoded messages
Use:
xxd objXX.bin | less strings objXX.bin | grep FLAG
Common Patterns in CTF PDF Challenges
| Pattern | Description | How pdfdumper Helps |
|---|---|---|
| Flag in embedded file | Flag is in an attachment | Extract attachments automatically |
| Flag in image | Image inside PDF contains hidden data | Dump images and analyze with stego tools |
| Flag in JavaScript | PDF script generates or encodes flag | Extract and inspect JS streams |
| Base64/Hex-encoded streams | Streams contain hidden data | Extract streams and decode |
| Multi-layer hiding | Combination of objects, images, and streams | Dump everything for inspection |
Recommended Workflow in CTF
- Dump all PDF objects and streams
pdfdumper challenge.pdf
- Check for embedded files
- Images →
objXX.png - Attachments →
objXX.bin
- Analyze JavaScript streams
- Decode base64 or other encodings
- Inspect images for hidden data
- Steganography or metadata
- Decode any extracted binary streams
strings,xxd,binwalk,zsteg
- Combine clues
- Sometimes the flag requires multiple objects to reconstruct
pdfdumper is a powerful first step for analyzing PDF challenges in CTFs, especially when flags are hidden in embedded streams or files.
Leave a Reply