On Tue, 22 Aug 2017 20:19:06 -0400
Alex <mysqlstud...@gmail.com> wrote:
> > Take a look at podofopdfinfo. It can extract URLs from PDF docs
> > and you can trigger on those.
> Thank you. It didn't work on this one :-(
It worked for me:
$ podofopdfinfo pdf-phish.pdf
Document Info
-------------
File: pdf-phish.pdf
PDF Version: 1.5
[,,, much output deleted ...]
Annotation 0
[,,, much output deleted ...]
Link Target: 1
Action URI: http://dabanlar.com/west/scan.html
My verstion of podofopdfinfo is 0.9.3 as packaged on Debian Jessie.
> I also don't see a way to use it with amavisd.
Right. I use MIMEDefang which is a little more flexible in how you
glue the bits and pieces together.
> "strings" was able to extract the URL.
That works this time, but generally speaking, PDF documents may be
compressed in which case "strings" won't be useful.
I reported the URL to Google as fraudulent.
Regards,
Dianne.
