{
    "info": {
        "author": "Grier Forensics",
        "author_email": "jdgrier@grierforensics.com",
        "bugtrack_url": null,
        "classifiers": [],
        "description": "# OfficeDissector\n\nOfficeDissector is a parser library for static security analysis of Office Open XML (OOXML) Documents,\ncreated by Grier Forensics for the Cyber System Assessments Group at MIT's Lincoln Laboratory.\n\nOfficeDissector is the first parser designed specifically for security analysis of OOXML documents.  It exposes all internals, including \ndocument properties, parts, content-type, relationships, embedded macros and multimedia, and comments, and more. \nIt provides full JSON export, and a MASTIFF based plugin architecture.  It also includes a nearly 600 MB test corpus, unit tests with nearly \n100% coverage, smoke tests running against the entire corpus, and simple, well factored, fully commented code \n\n## Install\n\nOfficeDissector requires Python 2.7 and the lxml package.\n\nThe easiest way to install OfficeDissector is to use pip to automatically download and install it:\n\n    $ sudo pip install lxml # If you haven't installed lxml already\n    $ sudo pip install officedissector\n\nAlternatively, you can download OfficeDissector from [github](https://github.com/grierforensics/officedissector/) or as a [zip](https://github.com/grierforensics/officedissector/archive/master.zip), and install your local copy, using either pip (recommended) or python setup:\n\n    $ sudo pip install /path/to/thisfolder # Recommended, as pip supports uninstall\n    $ sudo python setup.py install # Alternative\n\nFinally, to use OfficeDissector without installing it, download it and set the `PYTHONPATH` to the `officedissector` directory:\n\n    $ export PYTHONPATH=/path/to/thisfolder\n\n## Documentation\n\nTo view OfficeDissector documentation, open in a browser:\n\n    $ doc/html/index.html\n\n## Testing\n\nTo test, first set PYTHONPATH or install `officedissector` as described above.  Then:\n\n    # Unit tests\n    $ cd test/unit_test\n    $ python test_officedissector.py\n\n    # Smoke tests\n    $ cd test\n    $ python smoke_tests.py\n\nThe smoke tests will create log files with more information about them.\n\n## MASTIFF Plugins\n\nTo find more information about the MASTIFF architecture and sample plugins, see\n`mastiff-plugins/README.txt`.\n\n## Usage\n\nBelow is an ipython session demonstrating usage of OfficeDissector:\n\n    $ ipython\n    In [1]: import officedissector\n    In [2]: doc = officedissector.doc.Document('test/fraunhoferlibrary/Artikel.docx')\n    In [4]: doc.is_macro_enabled\n    Out[4]: False\n\n    In [5]: doc.is_template\n    Out[5]: False\n\n    In [6]: mp = doc.main_part()\n    In [7]: mp.content_type()\n    Out[7]: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml'\n\n    In [9]: mp.name\n    Out[9]: '/word/document.xml'\n\n    In [10]: mp.content_type()\n    Out[10]: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml'\n\n    # We can read the part's stream of data:\n    In [17]: mp.stream().read(200)\n    Out[17]: '<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\\r\\n<w:document xmlns:wpc=\"http://schemas.microsoft.com/office/word/2010/wordprocessingCanvas\" xmlns:mc=\"http://schemas.openxmlformats.org/markup-c'\n\n    # Or use XPath to parse it:\n    In [33]: t = mp.xpath('//w:t', {'w': \"http://schemas.openxmlformats.org/wordprocessingml/2006/main\"})\n    In [37]: t[2].text\n    Out[37]: u'Das vorliegende Dokument ist ein Beispiel f\\xfcr einen zur Publikation in einer Zeitschrift vorgesehenen Artikel. Es verwendet f\\xfcr Autor und Titel in den Dokumenteigenschaften festgelegte Eintr\\xe4ge.'\n\n    # All Relationships in and out are exposed:\n    In [38]: mp.relationships_in()\n    Out[38]: [Relationship [rId1] (source Part [RootPart])]\n\n    In [39]: mp.relationships_out()\n    Out[39]:\n    [Relationship [rId8] (source Part [/word/document.xml]),\n     Relationship [rId13] (source Part [/word/document.xml]),\n     Relationship [rId3] (source Part [/word/document.xml]),\n     ...\n     Relationship [rId14] (source Part [/word/document.xml])]\n\n    In [40]: rel = mp.relationships_out()[0]\n    In [43]: rel.type\n    Out[43]: 'http://schemas.openxmlformats.org/officeDocument/2006/relationships/endnotes'\n\n    In [46]: endnotes = rel.target_part\n    In [48]: endnotes.content_type()\n    Out[48]: 'application/vnd.openxmlformats-officedocument.wordprocessingml.endnotes+xml'\n\n    # Any Part (or the entire Document) can be exported to JSON:\n    In [50]: print endnotes.to_json()\n    {\n        \"content-type\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.endnotes+xml\",\n        \"uri\": \"/word/endnotes.xml\",\n        \"relationships_out\": [],\n        \"relationships_in\": [\n            \"Relationship [rId8] (source Part [/word/document.xml])\"\n        ]\n    }\n\n    # Features are automatically exposed:\n    In [55]: doc.features.[TAB]\n    ...\n    doc.features.comments\n    doc.features.custom_properties\n    doc.features.custom_xml\n    doc.features.digital_signatures\n    doc.features.doc\n    doc.features.embedded_controls\n    doc.features.embedded_objects\n    doc.features.embedded_packages\n    doc.features.fonts\n    doc.features.get_parts\n    doc.features.get_union\n    doc.features.images\n    doc.features.macros\n    doc.features.sounds\n    doc.features.videos\n\n    In [55]: doc.features.images\n    Out[55]: [Part [/word/media/image1.jpeg]]\n\n    In [56]: image = doc.features.images[0]\n    In [58]: image.content_type()\n    Out[58]: 'image/jpeg'\n\n    # We can export the binary data to JSON as well, by setting include_stream = True:\n    In [61]: print image.to_json(include_stream = True)\n    {\n        \"stream_b64\": \"/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAAFAAUDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD3uGGO3iWKJdqL0Gc0UUUAf//Z\",\n        \"content-type\": \"image/jpeg\",\n        \"uri\": \"/word/media/image1.jpeg\",\n        \"relationships_out\": [],\n        \"relationships_in\": [\n            \"Relationship [rId1] (source Part [/word/theme/theme1.xml])\"\n        ]\n    }\n\n    # Check for macros:\n    In [62]: doc.features.macros\n    Out[62]: []\n\n    # Or comments:\n    In [63]: doc.features.comments\n    Out[63]: []\n\n    # Core properties are exposed:\n    In [64]: doc.core_properties.[TAB]\n    ...\n    doc.core_properties.content_status\n    doc.core_properties.core_prop_part\n    doc.core_properties.created\n    doc.core_properties.creator\n    doc.core_properties.description\n    doc.core_properties.identifier\n    doc.core_properties.keywords\n    doc.core_properties.language\n    doc.core_properties.last_modified_by\n    doc.core_properties.last_printed\n    doc.core_properties.modified\n    doc.core_properties.name\n    doc.core_properties.parse_all\n    doc.core_properties.parse_prop\n    doc.core_properties.revision\n    doc.core_properties.subject\n    doc.core_properties.title\n    doc.core_properties.version\n    doc.core_properties.category\n\n    In [68]: doc.core_properties.modified\n    Out[68]: '2009-12-04T14:47:00Z'\n\n## Analyzing OOXML\n\nSee `doc/txt/ANALYZING_OOXML.txt` for a quick start guide on how to use \nOfficeDissector to analyze OOXML documents.\n\n## API\n\nFor more details about OfficeDissector, see the API - `doc/html/rst/api.html` documentation.\n\n## More Information\n\nSee http://www.officedissector.com for more information on the project.\n",
        "description_content_type": null,
        "docs_url": null,
        "download_url": "UNKNOWN",
        "downloads": {
            "last_day": -1,
            "last_month": -1,
            "last_week": -1
        },
        "home_page": "http://www.officedissector.com/",
        "keywords": null,
        "license": "UNKNOWN",
        "maintainer": null,
        "maintainer_email": null,
        "name": "officedissector",
        "package_url": "https://pypi.org/project/officedissector/",
        "platform": "UNKNOWN",
        "project_url": "https://pypi.org/project/officedissector/",
        "project_urls": {
            "Download": "UNKNOWN",
            "Homepage": "http://www.officedissector.com/"
        },
        "release_url": "https://pypi.org/project/officedissector/1.0/",
        "requires_dist": null,
        "requires_python": null,
        "summary": "OfficeDissector is a parser library for static security analysis of OOXML documents.",
        "version": "1.0"
    },
    "last_serial": 1511885,
    "releases": {
        "1.0": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "8f8dc85d774cad7f4bdcd4dd2dcdb049",
                    "sha256": "723b333b34d9bc14a8dc8294ffc53a95a5504828d5ac17229dcb762670662682"
                },
                "downloads": -1,
                "filename": "officedissector-1.0.tar.gz",
                "has_sig": false,
                "md5_digest": "8f8dc85d774cad7f4bdcd4dd2dcdb049",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": null,
                "size": 12782,
                "upload_time": "2015-04-19T22:47:42",
                "url": "https://files.pythonhosted.org/packages/46/7b/652f9d8b9b596a7dfcec0b58e46c9be18e50233a340d91c45d091342f9f0/officedissector-1.0.tar.gz"
            }
        ]
    },
    "urls": [
        {
            "comment_text": "",
            "digests": {
                "md5": "8f8dc85d774cad7f4bdcd4dd2dcdb049",
                "sha256": "723b333b34d9bc14a8dc8294ffc53a95a5504828d5ac17229dcb762670662682"
            },
            "downloads": -1,
            "filename": "officedissector-1.0.tar.gz",
            "has_sig": false,
            "md5_digest": "8f8dc85d774cad7f4bdcd4dd2dcdb049",
            "packagetype": "sdist",
            "python_version": "source",
            "requires_python": null,
            "size": 12782,
            "upload_time": "2015-04-19T22:47:42",
            "url": "https://files.pythonhosted.org/packages/46/7b/652f9d8b9b596a7dfcec0b58e46c9be18e50233a340d91c45d091342f9f0/officedissector-1.0.tar.gz"
        }
    ]
}