Everything Stays Local
Document malware, and sanitising it without uploading anything.
Slides
Both open as presentations — full screen, arrow keys or the
◀ ▶ controls in the
corner to move between slides. Same 26 slides, two house styles.
Present → project style
26 slides · the five families of document-borne execution,
why the usual defences fit badly, and how the sanitiser is built
Present → client house style
the same 26 slides, set in a client’s template
What the talk covers
- Why a document is a container format with an execution surface, not a picture of information
- Macro code, embedded objects, remote fetch, reader features, legacy containers — and the artifact each one leaves
- Remote template injection: a file that is malicious while containing nothing malicious
- Why uploading a suspicious document to ask whether it is dangerous publishes it
- The length-preserving PDF disarm, and why byte-identical output is the canary for rewriter correctness
- Capability naming: saying what a document tries to do — auto-execute, launch, download, persist — without shipping a signature corpus
- What the tool does not do
The tool
Toilet Duck Web is a single index.html. It opens from disk, has no
dependencies, and makes no network requests — the files you scan never
leave the machine.
toiletduck.cleaning