What Is pdfinfo?
pdfinfo is a command-line tool from the Poppler-utils package used to extract metadata and general information from PDF files. In CTF challenges, PDF files often contain hidden flags, metadata clues, or unusual structures. pdfinfo allows you to quickly examine these files without opening them in a viewer.
Key information pdfinfo can provide:
- Title, Author, Subject, Keywords
- Creation and Modification dates
- Page count
- PDF version
- Producer software
Basic Usage
pdfinfo file.pdf
Example output:
Title: Secret Challenge Author: CTF Organizer Creator: LibreOffice Producer: qpdf 10.1 CreationDate: Mon Nov 18 10:00:00 2025 ModDate: Mon Nov 18 12:00:00 2025 Pages: 3 Encrypted: no Page size: 612 x 792 pts File size: 12 kB Optimized: no PDF version: 1.4
How pdfinfo Is Used in CTF Challenges
1. Metadata Clues
CTF flags are often hidden in metadata fields such as:
- Title
- Author
- Subject
- Keywords
Example:
pdfinfo challenge.pdf | grep -i "title\|author\|subject\|keywords"
2. Checking for Encryption
Some PDFs are password-protected. pdfinfo can tell you:
Encrypted: yes (print:yes copy:no)
This is a hint to use tools like:
qpdfpdfcrackpdfgrep
3. PDF Version and Producer
Unusual producers or versions may hint at:
- Custom scripts used to generate the PDF
- Potential steganography or embedded objects
- Historical clues (older versions may allow specific exploits)
4. Page Count and Size
Sometimes the challenge hides a flag in a single page:
- Check number of pages
- Look for unusual dimensions (e.g., very small or large pages)
5. Integration With Other Tools
pdfinfo is often combined with:
pdfgrep→ search for text or flag patternsstrings→ extract hidden strings from PDFbinwalk→ detect embedded files or steganography
Example workflow:
pdfinfo challenge.pdf pdfgrep -i flag challenge.pdf strings challenge.pdf | grep FLAG
Common Patterns in CTF PDF Challenges
| Pattern | Description | How pdfinfo Helps |
|---|---|---|
| Flag in metadata | Title, Author, Subject, or Keywords contain the flag | Quickly extract metadata |
| Hidden in a single page | Flag is embedded on an unusual page | Check number of pages, dimensions |
| Encrypted PDF | PDF requires a password to open | Detect encryption before cracking |
| Embedded files | PDF contains hidden attachments | PDF version/producer may hint at custom creation |
| Unusual producers | Older or uncommon PDF software | May indicate steganography techniques |
Recommended Workflow in CTF
- Check PDF metadata with
pdfinfo:
pdfinfo challenge.pdf
- Examine encryption status.
- Search for potential flags:
pdfgrep -i "flag" challenge.pdf strings challenge.pdf | grep -i "FLAG"
- Check for unusual page sizes or number of pages.
- Use additional forensic tools for deeper analysis if needed:
binwalkfor embedded filesexiftoolfor metadata extractionqpdffor decryption
pdfinfo is a simple yet powerful first step in PDF forensics, helping CTF players identify flags, encryption, and hidden information efficiently.
Leave a Reply