← ~/bokkapig

pdf-inject

Builds a plausible business document with a prompt-injection payload planted in it, for testing document-ingesting AI pipelines. Everything runs in this browser — the PDF bytes are never uploaded.

Authorised testing and education only

This tool exists to help defenders and contracted testers find prompt-injection flaws in systems they are explicitly permitted to test. Do not point it at any asset, endpoint, inbox, or service you do not own or hold written authorisation to assess. Uploading a generated document to a third party's system without that authorisation is likely to be a criminal offence — in the UK under the Computer Misuse Act 1990, and there are equivalents nearly everywhere else.

Every PDF is stamped with a run id in its /Creator field so the artefact stays traceable to a scoped engagement. Keep the default footer stamp on unless your rules of engagement specifically call for an unmarked document. Use the canary rather than exfiltrating real data: proving the flaw exists is the job, and collecting someone's live secrets is not.

Nothing you do here is collected. The PDF is built in your browser and never uploaded. Every callback channel points at a listener you control — your own Collaborator, interactsh or webhook — because a shared collector would mean your canaries, your targets and your clients' leaked system prompts sitting on somebody else's domain. The one hosted file, the stage-two payload, is read-only and logs nothing.

1 · Cover document

2 · Objective

3 · Technique

4 · Placement

Where the payload physically sits in the file. Each is read by a different slice of the extraction ecosystem, so ticking several at once widens the net.

5 · Run
The run id is written to /Creator either way. Turn the visible footer
off only where your rules of engagement require an unmarked document.
Payload
Generated from the options on the left, and fully editable — this textarea is what
actually goes into the PDF.


Outbound requests
Exactly what the payload will ask the target to reach for. Check it against your
engagement scope, and watch your own listener for the result.
Stage-two instruction file
GET