"PDF Attack: A Journey From the Exploit Kit to the Shellcode" is a workshop to show how to analyze obfuscated JavaScript code from an Exploit Kit page, extract the exploits used and analyze them. Nowadays, it is possible to use automated tools to extract URLs and binaries but it is also important to know how to do it manually to not to miss a detail. We will focus on PDF documents mostly, starting from a simple JavaScript Hello World document and ending with a real file used by a fresh Exploit Kit. This workshop will also include exercises to modify malicious PDF files and obfuscate them to try to bypass AV software, very useful in pentesting. The last version of peepdf (included in REMnux, BackTrack and Kali Linux) will be used to accomplish these tasks, so it means that this presentation covers the latest tricks used by cybercriminals like using new filters and encryption to make the analysis more difficult.