PDF Extractor Your PDF Osint tool

Code
import re

import json

import os

import argparse

import collections

from pdfminer.high_level import extract_text

import PyPDF2

import tldextract





url = re.compile(r'\b(?:https?://|http://|www\.)[^\s<>"\')]+\b', re.I)

email = re.compile(r'[\w\.-]+@[\w\.-]+\.\w{2,}', re.I)

ip = re.compile(r'\b(?:\d{1,3}\.){3}\d{1,3}\b')





OBFUS_HXXP = re.compile(r'\bhxxps?:\/\/[^\s<>"\')]+\b', re.I)

OBFUS_HTTP_SQUARE = re.compile(r'http\[:\]\/\/[^\s<>"\')]+\b', re.I)



def normalize_domain(host: str) -> str:

    host = host.strip().lower()

    host = re.sub(r'^https?://', '', host)

    host = host.split('/')[0].split(':')[0]

    te = tldextract.extract(host)

    if te.domain and te.suffix:

        return f"{te.domain}.{te.suffix}"

    return host





def textpdf(path: str):

    try:

        return extract_text(path) or ""

    except Exception:

        return ""



def annotations(path: str):



    found = set()

    try:

        with open(path, 'rb') as fh:

            reader = PyPDF2.PdfReader(fh)

            for p in reader.pages:

                try:

                    if '/Annots' in p:

                        for a in p['/Annots']:

                            aobj = a.get_object()

                            if '/A' in aobj and '/URI' in aobj['/A']:

                                uri = aobj['/A']['/URI']

                                if isinstance(uri, str):

                                    found.add(uri)

                            if '/URI' in aobj:

                                u = aobj.get('/URI')

                                if u:

                                    found.add(u)

                except Exception:

                    continue

    except Exception:

        pass

    return sorted(found)



def rawtext(path: str) -> str:

    try:

        with open(path, 'rb') as fh:

            data = fh.read()

            return data.decode('latin1', errors='ignore')

    except Exception:

        return ""





def analyze_pdf(path: str):

    report = {

        "file": path,

        "urls": [],

        "emails": [],

        "annotations": [],

        "obfuscated": [],

        "ips": [],

        "domains": {}

    }



    text = textpdf(path)

    raw = rawtext(path)

    annots = annotations(path)



    urls = set(url.findall(text)) | set(url.findall(raw))

    for a in annots:

        urls.update(url.findall(a))





    mails = set(email.findall(text)) | set(email.findall(raw))

    for a in annots:

        mails.update(email.findall(a))



    obfus = set()

    obfus.update(OBFUS_HXXP.findall(text))

    obfus.update(OBFUS_HXXP.findall(raw))

    obfus.update(OBFUS_HTTP_SQUARE.findall(text))

    obfus.update(OBFUS_HTTP_SQUARE.findall(raw))



    ips = set(ip.findall(text)) | set(ip.findall(raw))



    domain_map = {}

    for u in urls:

        clean = u.strip('.,;:()[]\'"')

        host = clean

        if clean.lower().startswith('http'):

            host = re.sub(r'^https?://', '', clean, flags=re.I).split('/')[0]

        elif clean.lower().startswith('www.'):

            host = clean.split('/')[0]

        domain = normalize_domain(host)

        domain_map.setdefault(domain, set()).add(clean)



    report['urls'] = sorted(urls)

    report['emails'] = sorted(mails)

    report['annotations'] = sorted(annots)

    report['obfuscated'] = sorted(obfus)

    report['ips'] = sorted(ips)

    report['domains'] = {d: {"examples": sorted(list(s))[:8]} for d, s in domain_map.items()}



    return report





# CLI

def cli():

    p = argparse.ArgumentParser(

        description="PDF Link Extractor (mini) — Text + Annotationen + simple Obfuscation detection")

    p.add_argument("file", nargs="?", help="Path to PDF")

    p.add_argument("--out", "-o", help="JSON-outputpath (default: <basename>_links.json)")

    p.add_argument("--pretty", action="store_true", help="Prettier Version of JSON output")

    p.add_argument("--info", "-i", action="store_true", help="Output General information of tool")

    args = p.parse_args()



    if args.info:

        print("PDF File Link Extractor v1\nFeatures: Text + Annotations + Obfuscation Detection\nOriginal Autor: HerrWinston on HackForum")

        return



    if not args.file:

        p.error("the following argument is required: file (unless --info is used)")

    

    path = args.file

    if not os.path.exists(path):

        print("File Not Found:", path)

        return



    rpt = analyze_pdf(path)



    # Output

    print(f"[+] File: {rpt['file']}")

    print(f"  -> Found URLs: {len(rpt['urls'])}")

    for u in rpt['urls'][:50]:

        print("    -", u)

    if len(rpt['urls']) > 50:

        print("    ... ({} more)".format(len(rpt['urls']) - 50))



    print(f"\n  -> Annotation-Links: {len(rpt['annotations'])}")

    for anos in rpt['annotations'][:30]:

        print("    -", anos)



    print(f"\n  -> Emails: {len(rpt['emails'])}")

    for e in rpt['emails'][:30]:

        print("    -", e)



    print(f"\n  -> Obfuscated Hits: {len(rpt['obfuscated'])}")

    for o in rpt['obfuscated'][:30]:

        print("    -", o)



    print(f"\n  -> IPs: {len(rpt['ips'])}  (Example: {rpt['ips'][:6]})")



    print(f"\n  -> Domains ({len(rpt['domains'])}):")

    for d, info in list(rpt['domains'].items())[:40]:

        print(f"    - {d}  examples: {info['examples'][:3]}")



    out = args.out or os.path.splitext(os.path.basename(path))[0] + "_links.json"

    try:

        with open(out, 'w', encoding='utf-8') as fh:

            if args.pretty:

                json.dump(rpt, fh, indent=2, ensure_ascii=False)

            else:

                json.dump(rpt, fh, ensure_ascii=False)

            print("\nReport saved:", out)

    except Exception as didntwork:

        print(f"Could not write Output: {didntwork}")



if __name__ == "__main__":

    cli()