How to find events in pdf while uploading

Question

0.00/5 (No votes)

See more:

I have several malicious pdfs file which execute some event(JS perhaps) while opening. I want to detect all such pdfs with any event attached to it. Also is there a way where we can detect a malicious pdf while uploading in Web application.

What I have tried:

Reading the content header to check if anything added. Also tried iTextSharp to check if any JavaScript attached or the pdf is tempered.

Posted 6-Jul-17 6:46am

dews turner

Add a Solution

Comments

David_Wimbley 7-Jul-17 0:14am

I think you need to clarify or rethink your approach. In the process of uploading a file, you want to know if anything malicious is in that file? How do you read a file if you don't have all the bytes? If you stopped the process mid upload, pretty sure you'd run into corrupt file errors or what not.

Maybe you meant once its uploaded but prior to it being opened by a user? If so, i'm sure you can use something like itextsharp to see if there is any javascript in the PDF. But even then, what would you clarify as malicious? Just say all javascript is malicious?

[no name] 7-Jul-17 4:53am

Thanks for your reply, David!

I’m not too sure whether we might end-up with corrupted file while reading, as we’ll close and terminate the read stream without changing anything in the original file or make a backup upfront.

As for as the second approach is considered, I can go for validating the PDF once uploaded, if I can notify the user immediately.

I have one malicious file which opens a save window when opened. I tried to validate the same with iText (using c#) but could not find and JavaScript/Events or tampering sign.

Finally, by malicious I meant a) The pdf should not have any event/Javascript attached to it like OnDocumentOpen, OnDocumentClose etc. b) The pdf should not have any trace of UNC path (usually attached when save by network printer as PDF or Scanned).

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)