pdftriage

Documentation

Overview

Package pdftriage decodes a PDF's standard-security encryption dictionary into its password-cracking triage facts.

Encrypted PDFs (financial, legal, scanned documents) are among the most common high-value loot artifacts, and the operator's first question is "can I crack this, and with which hashcat mode?". The answer is fully determined by the PDF Standard security handler's algorithm (/V), revision (/R), key length, and — for /V 4 — the crypt-filter method (/CFM): RC4-40 (R2) → hashcat 10400, RC4-128 (R3, or R4 with /V2) → 10500, AES-128 (R4 with /AESV2) → 10600, and AES-256 (R5/R6, /AESV3) → 10700. This extracts those parameters offline.

The PDF spec (ISO 32000-1 §7.6.1) requires the /Encrypt dictionary to be a DIRECT, uncompressed object — it must be readable before anything else can be decrypted — so scanning the raw bytes for the `/Filter /Standard` handler dictionary is reliable, not a heuristic shortcut.

No confidently-wrong output: it reports the encryption *parameters* only — it does not crack, decrypt, or emit the pdf2john hash; a PDF with no /Encrypt is reported as not password-protected (nothing to crack); a non-Standard (public-key) handler is named but not given a password hashcat mode; and non-PDF input is rejected.

Wrap-vs-native: native — a byte scan over the documented PDF encryption dictionary; stdlib only, no new go.mod dependency. Anchored to real pikepdf/qpdf-generated encrypted PDFs (R4 RC4, R4 AES-128, R6 AES-256).

Index

• type Result
  • func Decode(raw []byte) (*Result, error)

Types

type Result

type Result struct {
	Format          string `json:"format"`
	PDFVersion      string `json:"pdf_version,omitempty"`
	Encrypted       bool   `json:"encrypted"`
	SecurityHandler string `json:"security_handler,omitempty"`

	V       int `json:"v,omitempty"`
	R       int `json:"r,omitempty"`
	KeyBits int `json:"key_bits,omitempty"`

	Cipher      string `json:"cipher,omitempty"`
	Permissions int    `json:"permissions,omitempty"`

	HashcatMode     int    `json:"hashcat_mode"`
	HashcatModeNote string `json:"hashcat_mode_note,omitempty"`
	JohnTool        string `json:"john_tool"`
	Note            string `json:"note"`
}

Result is the decoded PDF encryption posture.

func Decode

func Decode(raw []byte) (*Result, error)

Decode parses a PDF's encryption dictionary from its raw bytes.