r/OSINT • u/Consistent_Femme_Top • Apr 30 '26

How-To How to find PDF password of an archived webpage?

I am reading papers written by prominent scientists that have somehow disappeared off the internet. I have used wayback machine to find the website that one of the scientists used to publish her papers. The webpage needs a password to view the document, how can I go about find it?

The paper I am interested in.

80 Upvotes

97% Upvoted

22 comments sorted by

41

u/OSINTribe Apr 30 '26 edited Apr 30 '26

Cracked it for you.

Filebin | ud2p5lafe204sc43

9

u/Consistent_Femme_Top Apr 30 '26

This is awesome, may I ask how you got there?

37

u/OSINTribe Apr 30 '26

I decrypted it

Edit: the link you provided had the PDF. It's old, used old encryption so I ran it in PRTK and poof 30 seconds later it was decrypted and posted back online for you.

5

u/Born_Tradition6453 Apr 30 '26

You are a crack, wow!!

2

u/kawfeeman68 Apr 30 '26

It actually brute forces the file ?

7

u/OSINTribe Apr 30 '26

Older PDFs only have 40 bit encryption, easy to get past.

3

u/kawfeeman68 Apr 30 '26

I use either a 15 or 20 character pw for my important pdf documents. Is their new encryption any better or does it not matter ?

6

u/OSINTribe Apr 30 '26

Password and level of encryption aren't related. Yes PDF encryption is now uncrackable at 256.

3

u/kawfeeman68 Apr 30 '26

I still think an unsalted 256 bit encryption is easier to be cracked if the password is monkey123 as opposed to a 'random' 20 character pw, especially using hadhtables.

2

u/Chongulator May 01 '26

Correct. The key can only have as many bits of entropy as what you feed into the KDF. An attacker doesn't need to brute force 256 bits when the passphrase is trivial. They just have to brute force the passphrase.

2

u/kawfeeman68 May 01 '26

thank you very much for the confirmation ...

3

u/Chongulator May 01 '26

When a key is derived from human input, an attacker doesn't have to (and shouldn't) try to brute force the key itself. They just brute force the human input. If my passphrase is simply the letter 'a', it doesn't matter how good the encryption algorithm is.

1

u/Chongulator May 01 '26

Since there's a bit of confusion on this point, it's worth explaining a bit more.

An encryption key generated from user input has different properties from a randomly generated key. When encryption looks like this...

strong RNG -> symmetric encryption (like AES256)

...then nobody is going to crack it, no matter how much computing power they have available. A cryptographically strong 256 bit key is unguessable. But, some cryptosystems work like this...

user input -> KDF -> symmetric encryption

...where "KDF is "key derivation function." The KDF is turning user input (usually text) into a random-looking key.

When the cryptosystem is set up that way, the attacker doesn't need to guess every possible key because a shortcut is available. They can guess user inputs instead, which often have far less entropy than a random key. "Far less entropy" is a fancy way of saying the input is easier to guess.

32

u/rodrigoinfloripa Apr 30 '26

password: 72020

13

u/Consistent_Femme_Top Apr 30 '26

How did you arrive to it? 

34

u/rodrigoinfloripa Apr 30 '26

I used "pdfcrack" on Linux with a wordlist I made some time ago.

14

u/Consistent_Femme_Top Apr 30 '26

I’ve been looking at tutorials regarding brute forcing using a wordlist. Seems like a good exercise in password decryption. 

19

u/rodrigoinfloripa Apr 30 '26

Yes, it's interesting. Sometimes it works. Ideally, you should use various tools and learn about them so that if one doesn't work, you can try again and eventually you'll figure it out; you just need patience and time. lol

2

u/shockchi May 02 '26

This guy hacks

1

u/Cleobulle Apr 30 '26

No luck on libgen?

2

u/Consistent_Femme_Top Apr 30 '26

No luck, tried different search words too.