inkLeak

inkLeak extracts print jobs from PCAP/PCAPNG network captures and reconstructs them as readable PDFs.

Most printers still accept jobs over unencrypted protocols. inkLeak shows what a passive eavesdropper or man-in-the-middle attacker on the same network can see.

• Supports IPv4 and IPv6
• Supports RAW/JetDirect (9100), IPP (631), LPR (515), IPP & WSD/WS-Print over HTTP (80)
• Converts PCL5, PCL-XL/6, PostScript and PDF to readable PDFs (via GhostPCL/Ghostscript)
• Native decoding of Brother host-based PCL raster (method 1030) and PWG Raster / Apple URF (IPP Everywhere / AirPrint)
• Detects and labels further languages (XPS, ZPL, ESC/POS, and host-based QPDL, SPL, DDST, HBPL, ...), saving them as raw data
• Extracts job metadata (document name, user, host, printer, timestamp)
• Runs on Linux and Windows

Originally created during a multi-function printer (MFP) penetration test and successfully used as a proof of concept. Built with Claude Code.

Disclaimer

This tool is intended for authorized security testing, penetration testing engagements, and educational purposes only. Only use it on networks you own or have explicit written permission to test. Be sure that you understand and are complying with the laws in your area. In other words, don't be stupid, don't be an asshole, and use this tool responsibly and legally.

Installation

Download inkLeak by cloning the repository and installing its requirements:

git clone https://github.com/whoot/inkleak.git
cd inkleak
pip install -r requirements.txt

GhostPCL and Ghostscript are automatically downloaded on first use if not found on the system.

inkLeak requires Python >= 3.12 and runs on Linux and Windows.

Usage

# Extract print jobs and convert to PDF
python3 inkleak.py capture.pcapng

# Specify output directory
python3 inkleak.py capture.pcapng -o output

# Save raw print data without PDF conversion
python3 inkleak.py capture.pcapng --raw

Example output:

  ██╗███╗  ██╗██╗ ██╗██╗    ███████╗ █████╗ ██╗ ██╗
  ██║████╗ ██║██║ ██║██║    ██╔════╝██╔══██╗██║ ██║
  ██║██╔██╗██║█████╔╝██║    █████╗  ███████║█████╔╝
  ██║██║╚████║██╔═██╗██║    ██╔══╝  ██╔══██║██╔═██╗
  ██║██║ ╚███║██║ ██║██████╗███████╗██║  ██║██║ ██║
  ╚═╝╚═╝  ╚══╝╚═╝ ╚═╝╚═════╝╚══════╝╚═╝  ╚═╝╚═╝ ╚═╝ v1.0
        print job extraction from pcap files      

[*] Input file : capture.pcapng
[*] Scan ports : 80 (HTTP), 515 (LPR), 631 (IPP), 9100 (RAW)

[*] Found 1 print job(s).

  Job 1:  192.168.1.156:57449  ->  192.168.1.231:9100  [RAW]
    Document : file:///C:/Users/jsmith/AppData/Local/Temp/report.html
    Format   : PCL-XL
    User     : jsmith
    Host     : WORKSTATION01
    Time     : 2026/07/15 14:55:30
    Printer  : RICOH PCL6 UniversalDriver V4.45
    Size     : 53,110 bytes
    PDF      : printjobs/01_report.pdf

[*] Done. 1 file(s) written to: printjobs

Mitigation

To prevent print job interception on your network:

• Enable IPP over TLS (IPPS, port 443) and disable unencrypted IPP (port 631, 80) where possible
• Disable RAW (port 9100) and LPR (port 515) — these protocols have no encryption support at all
• Use network segmentation: isolate printers in dedicated VLANs
• Monitor for ARP spoofing and rogue devices on the network

Note that in practice, disabling all unencrypted protocols may break certain features. Many vendor drivers default to RAW (port 9100) even when the printer supports IPP, and functions like scanning, faxing, or device management often rely on SNMP, HTTP, or proprietary protocols. Test before enforcing and where you can't encrypt, segmentation is your fallback.

License

This project is licensed under the MIT License.