Can someone please tell me how this was posted?

[mathew2020]

this is an example of the link:

https://intelligencestudies.utexas.edu/wp-content/uploads/ninja-forms/3/jiouytf.pdf

 

[javadth]

its pdf method

almost saturated

search bhw

 

[edmin]

The website is in wordpress a pdf file name "jiouytf.pdf" is uploaded through ninja forms interface

 

[AvaJohnson]

Looks like it was posted using a bot or auto tool.

 

[Starblazer]

Ninja forms has an exploit. The file was posted using post method.

https://www.exploit-db.com/exploits/51644

 

[Steptoe]

this is an example of the link:

hxxps://intelligencestudies.utexas.edu/wp-content/uploads/ninja-forms/3/jiouytf.pdf

Probably through one of these forms:

https://intelligencestudies.utexas.edu/tia-application/
https://intelligencestudies.utexas.edu/ninja-forms/5x1vp/

 

[SelenaQuintanilla]

Hi,

thank for all this information!
Is is possible to do in manually?
( i don't know how to code)
I would make a test to send a pdf but i got an error message

 

[Steptoe]

Hi,

thank for all this information!
Is is possible to do in manually?
( i don't know how to code)
I would make a test to send a pdf but i got an error message

Find some forms to target (there are footprints shared in many pdf-related threads here)
Open up your Chrome dev tools (F12)
Fill in the form with dummy values and a test pdf
Keep an eye on what data is sent and returned in the network traffic tab of dev tools. If the site is running Wordpress, you usually need to pay attention to admin-ajax.php requests. See if this data returns any clues on what the filepath to your uploaded pdf might be.

 

[SelenaQuintanilla]

Hi @Steptoe,

Thank you so much for taking the time to explain the process with the Chrome dev tools! I really appreciate your detailed response.

I've been able to successfully test it on some forms where there's actually a file upload interface visible in the browser - those work perfectly following your method.

However, I'm noticing that on many sites (especially the ones being heavily exploited), there's no visible upload button or file selection interface at all on the forms. Like, the browser doesn't even show any option to select or attach a PDF file anywhere on the page.

From what I'm understanding now, they must be exploiting a specific vulnerability in the WordPress plugin itself (like the Ninja Forms exploit mentioned earlier in this thread), bypassing the normal form interface entirely and directly posting to the vulnerable endpoints?

Would that mean they're using scripts to send POST requests directly to admin-ajax.php or the plugin's upload handlers, rather than going through the actual form interface?

Thanks again for your help - this community is amazing for learning!

Find some forms to target (there are footprints shared in many pdf-related threads here)
Open up your Chrome dev tools (F12)
Fill in the form with dummy values and a test pdf
Keep an eye on what data is sent and returned in the network traffic tab of dev tools. If the site is running Wordpress, you usually need to pay attention to admin-ajax.php requests. See if this data returns any clues on what the filepath to your uploaded pdf might be.

 

[Meo Agency]

It looks like the file was uploaded directly to the site’s server (likely via a form or upload feature) and then accessed through its public URL.

 

[Steptoe]

...
However, I'm noticing that on many sites (especially the ones being heavily exploited), there's no visible upload button or file selection interface at all on the forms. Like, the browser doesn't even show any option to select or attach a PDF file anywhere on the page.

From what I'm understanding now, they must be exploiting a specific vulnerability in the WordPress plugin itself (like the Ninja Forms exploit mentioned earlier in this thread), bypassing the normal form interface entirely and directly posting to the vulnerable endpoints?

Would that mean they're using scripts to send POST requests directly to admin-ajax.php or the plugin's upload handlers, rather than going through the actual form interface?
...

Possibly, but they may just be using a different form entirely. For Ninja Forms the ability to enable file uploads is a paid addon IIRC, so not every such form will have upload capability, and if trying to brute force you would need to be able to work out the correct form field id for uploads. I would just move on to a different form if you are having troubles working things out - there are thousands out there.

It looks like the file was uploaded directly to the site’s server (likely via a form or upload feature) and then accessed through its public URL.

No shit Sherlock...

 

[CharlotteJohnson]

It was uploaded through a vulnerable form plugin (Ninja forms),which allowed direct file upload into the site's uploads folder.

 

[emmamoore_us]

Ninja forms has an exploit. The file was posted using post method.

https://www.exploit-db.com/exploits/51644

How this works how can I upload

 

[emmamoore_us]

How to I upload PDF can someone explain step by step

 

[BulkCloudStore]

From the link, we can assume that this file belonged to a WordPress website.