Awesome

PDFHunter

Requires scapy for pcap analysis

Looks for pdf files in pcap files and rebuilds them

Usage is ./pdf-hunter.py <pcap file> <file location> e.g. ./pdf-hunter.py pdftest.pcap /tmp/out.pdf

I have tested this on a few pcap files and seems to work fine.

Let me know if you encounter any issues.

catalyst256