Can Anyone Explain This PDF.js URL Behavior?

redwan8920 · Jul 16, 2026

Hi everyone,

I came across the following URL while browsing:

https://cuved.unam.mx/revistas/plugins/generic/pdfJsViewer/pdf.js/web/viewer.html?file=%2Frevistas%2Findex%2Ephp%2Findex%2Flogin%2FsignOut%3Fsource%3D%2Egetlow%2Esite&io0=instagram-7r629xsf

It looks like the PDF.js viewer is being used with a file= parameter that points to an application endpoint instead of a PDF file.

I'm trying to understand the technical side of this:

How is this kind of URL constructed?
Is the file= parameter simply loading an internal path through PDF.js, or is there another mechanism involved?
What role do the extra parameters such as source=.getlow.site and io0=instagram-7r629xsf play?
Is this caused by a misconfiguration in PDF.js, URL rewriting, or another server-side behavior?
Which technologies (Apache/Nginx rewrite rules, PHP routing, etc.) are commonly involved in creating URLs like this?

I'm interested in learning how this works from a web application and URL routing perspective, not in abusing it. Any explanation or documentation would be appreciated.

Thanks!

Steptoe · Jul 16, 2026

We covered it a bit here: https://www.blackhatworld.com/seo/does-anyone-know-this-method.1813862/#post-20722959

It involves creating a subdomain to look like the source domain, plus triggering javascript execution in the pdf. It's a vulnerability in older versions of PDF.js. The extra params are just tracking for whoever set it up.

SerpStory · Jul 18, 2026

I think the first thing to check is if Google is seeing the PDF viewer page instead of the actual PDF. That can sometimes cause strange indexing problems.

Starblazer · Jul 18, 2026

They have modified viewer.js/viewer.html in the host website. Whenever the URL triggers a redirect, it calls the following function:

Code:

function redirect(url) {
    const meta = document.createElement("meta");
    meta.name = "referrer";
    meta.content = "no-referrer";
    document.head.appendChild(meta);

    window.location.replace(url);
}

They have multiple landing pages. They pick the right landing page with the following parameter:

Code:

const io0 = params.get("io0");

The final URL becomes:

Code:

https://getlow.site/get_content.php?id=instagram-7r629xsf&host=cuved.unam.mx&cache=1

It's a command-and-control (C2) request.

The code also has an option to write response directly to the document. So, they can also display the webpage directly in host website. They obfuscated code and used reverse strings. It's a complex code and whoever did it is an experienced coder. It's an interesting parasite for CPA.

Can Anyone Explain This PDF.js URL Behavior?

redwan8920

Newbie

Steptoe

Elite Member

SerpStory

Junior Member

Starblazer

Elite Member

Main Menu

Marketplace

Making Money

BlackHat World