Can someone please tell me how this was posted?

M

mathew2020

Newbie
Joined
Mar 21, 2025
Messages
9
Reaction score
2
this is an example of the link:

https://intelligencestudies.utexas.edu/wp-content/uploads/ninja-forms/3/jiouytf.pdf
 
Advertise on BHW
its pdf method

almost saturated

search bhw
 
The website is in wordpress a pdf file name "jiouytf.pdf" is uploaded through ninja forms interface
 
Hi,

thank for all this information!
Is is possible to do in manually?
( i don't know how to code)
I would make a test to send a pdf but i got an error message
 
SelenaQuintanilla said:
Hi,

thank for all this information!
Is is possible to do in manually?
( i don't know how to code)
I would make a test to send a pdf but i got an error message
Click to expand...
Find some forms to target (there are footprints shared in many pdf-related threads here)
Open up your Chrome dev tools (F12)
Fill in the form with dummy values and a test pdf
Keep an eye on what data is sent and returned in the network traffic tab of dev tools. If the site is running Wordpress, you usually need to pay attention to admin-ajax.php requests. See if this data returns any clues on what the filepath to your uploaded pdf might be.
 
Hi @Steptoe,

Thank you so much for taking the time to explain the process with the Chrome dev tools! I really appreciate your detailed response.

I've been able to successfully test it on some forms where there's actually a file upload interface visible in the browser - those work perfectly following your method.

However, I'm noticing that on many sites (especially the ones being heavily exploited), there's no visible upload button or file selection interface at all on the forms. Like, the browser doesn't even show any option to select or attach a PDF file anywhere on the page.

From what I'm understanding now, they must be exploiting a specific vulnerability in the WordPress plugin itself (like the Ninja Forms exploit mentioned earlier in this thread), bypassing the normal form interface entirely and directly posting to the vulnerable endpoints?

Would that mean they're using scripts to send POST requests directly to admin-ajax.php or the plugin's upload handlers, rather than going through the actual form interface?

Thanks again for your help - this community is amazing for learning!
Steptoe said:
Find some forms to target (there are footprints shared in many pdf-related threads here)
Open up your Chrome dev tools (F12)
Fill in the form with dummy values and a test pdf
Keep an eye on what data is sent and returned in the network traffic tab of dev tools. If the site is running Wordpress, you usually need to pay attention to admin-ajax.php requests. See if this data returns any clues on what the filepath to your uploaded pdf might be.
Click to expand...
 
SelenaQuintanilla said:
...
However, I'm noticing that on many sites (especially the ones being heavily exploited), there's no visible upload button or file selection interface at all on the forms. Like, the browser doesn't even show any option to select or attach a PDF file anywhere on the page.

From what I'm understanding now, they must be exploiting a specific vulnerability in the WordPress plugin itself (like the Ninja Forms exploit mentioned earlier in this thread), bypassing the normal form interface entirely and directly posting to the vulnerable endpoints?

Would that mean they're using scripts to send POST requests directly to admin-ajax.php or the plugin's upload handlers, rather than going through the actual form interface?
...
Click to expand...
Possibly, but they may just be using a different form entirely. For Ninja Forms the ability to enable file uploads is a paid addon IIRC, so not every such form will have upload capability, and if trying to brute force you would need to be able to work out the correct form field id for uploads. I would just move on to a different form if you are having troubles working things out - there are thousands out there.

Meo Agency said:
It looks like the file was uploaded directly to the site’s server (likely via a form or upload feature) and then accessed through its public URL.
Click to expand...
No shit Sherlock...
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top