References audit: 50 pages

src/generic-methodologies-and-resources/fuzzing.md

@@ -12,7 +12,7 @@ In **mutational grammar fuzzing**, inputs are mutated while staying **grammar-va
 
 ## Corpus Diversity Pitfalls
 
-Coverage-guided mutation is **greedy**: a new-coverage sample is saved immediately, often retaining large unchanged regions. Over time, corpora become **near-duplicates** with low structural diversity. Aggressive minimization can remove useful context, so a practical compromise is **grammar-aware minimization** that **stops after a minimum token threshold** (reduce noise while keeping enough surrounding structure to remain mutation-friendly).
+Coverage-guided mutation is **greedy**: a new-coverage sample is saved immediately, often retaining large unchanged regions. Over time, corpora become **near-duplicates** with low structural diversity. Aggressive minimization can remove useful context, so a practical compromise is **grammar-aware minimization** that **stops after a minimum token threshold** (reduce noise while keeping enough surrounding structure to remain mutation-friendly).<sup>[[1]](#references)</sup>
 
 A practical corpus rule for mutational fuzzing is: **prefer a small set of structurally different seeds that maximize coverage** over a large pile of near-duplicates. In practice, this usually means:<sup>[[1]](#references)</sup>
 

src/generic-methodologies-and-resources/lua/bypass-lua-sandboxes/README.md

@@ -59,6 +59,7 @@ io.popen("/bin/sh -c 'id'")
 ```
 
 Notes:
+
 - Execution happens inside the client process; many anti-cheat/antidebug layers that block external debuggers won’t prevent in-VM process creation.
 - Also check: package.loadlib (arbitrary DLL/.so loading), require with native modules, LuaJIT's ffi (if present), and the debug library (can raise privileges inside the VM).
 

src/generic-methodologies-and-resources/pentesting-network/README.md

@@ -207,7 +207,7 @@ nmap-summary-esp.md
 
 ### Revealing Internal IP Addresses
 
-**Misconfigured routers, firewalls, and network devices** sometimes respond to network probes using **nonpublic source addresses**. **tcpdump** can be utilized to identify packets received from private addresses during testing. Specifically, on Kali Linux, packets can be captured on the **eth2 interface**, which is accessible from the public Internet. It's important to note that if your setup is behind a NAT or a Firewall, such packets are likely to be filtered out.
+**Misconfigured routers, firewalls, and network devices** sometimes respond to network probes using **nonpublic source addresses**. **tcpdump** can be utilized to identify packets received from private addresses during testing. Specifically, on Kali Linux, packets can be captured on the **eth2 interface**, which is accessible from the public Internet. It's important to note that if your setup is behind a NAT or a Firewall, such packets are likely to be filtered out.<sup>[[2]](#references)</sup>
 
 ```bash
 tcpdump –nt -i eth2 src net 10 or 172.16/12 or 192.168/16
@@ -259,7 +259,7 @@ You can use tools like [https://github.com/lgandx/PCredz](https://github.com/lga
 
 ### Transparent interception with mitmproxy
 
-`mitmproxy` is useful when passive sniffing is not enough and you need to **decrypt, modify, and replay** traffic. For network pentests, the most interesting modes are:<sup>[[8]](#references)</sup>
+`mitmproxy` is useful when passive sniffing is not enough and you need to **decrypt, modify, and replay** traffic. For network pentests, the most interesting modes are:<sup>[[7]](#references)</sup>
 
 - **Explicit proxy**: the client is configured to use the proxy.
 - **Transparent proxy**: traffic is redirected with firewall/routing rules and the client is unaware of the proxy.
@@ -274,7 +274,7 @@ Linux **network namespaces** let you build a disposable interception lab without
 1. Create a namespace and move the interception interfaces into it.
 2. Create a Wi-Fi AP inside the namespace with `lnxrouter`.
 3. Redirect HTTP/HTTPS/DNS to `mitmproxy` with `nftables`.
-4. Run `mitmweb` or `mitmdump` inside the namespace.<sup>[[7]](#references)</sup>
+4. Run `mitmweb` or `mitmdump` inside the namespace.<sup>[[6]](#references)[[8]](#references)</sup>
 
 ```bash
 MITM_NS=mitm
@@ -309,7 +309,7 @@ The `ip daddr != $MITM_IP` check avoids redirect loops when clients talk directl
 
 #### Rewriting Git smart-HTTP during `git clone`
 
-Git over HTTPS is a good target because many developers only check `git remote -v`, not the downloaded object IDs or commit signatures. If the victim uses `HTTP_PROXY` / `HTTPS_PROXY` and trusts your interception CA with `GIT_SSL_CAINFO` (or disables validation with `GIT_SSL_NO_VERIFY=true`), you can rewrite only the smart-HTTP endpoints and silently swap the fetched repository:<sup>[[7]](#references)</sup>
+Git over HTTPS is a good target because many developers only check `git remote -v`, not the downloaded object IDs or commit signatures. If the victim uses `HTTP_PROXY` / `HTTPS_PROXY` and trusts your interception CA with `GIT_SSL_CAINFO` (or disables validation with `GIT_SSL_NO_VERIFY=true`), you can rewrite only the smart-HTTP endpoints and silently swap the fetched repository:<sup>[[6]](#references)</sup>
 
 ```python
 from mitmproxy import ctx, http
@@ -333,7 +333,7 @@ This keeps the visible remote URL unchanged while swapping the refs and objects
 
 #### Tampering with raw gRPC / protobuf traffic
 
-For native mobile/desktop apps, you will often see **HTTP/2 gRPC**, not gRPC-Web. Once TLS is decrypted, the request body usually starts with the standard gRPC frame:<sup>[[7]](#references)</sup>
+For native mobile/desktop apps, you will often see **HTTP/2 gRPC**, not gRPC-Web. Once TLS is decrypted, the request body usually starts with the standard gRPC frame:<sup>[[6]](#references)</sup>
 
 - `1 byte` compression flag
 - `4 bytes` message length in **big endian**
@@ -368,7 +368,7 @@ This is the reusable part: **decode gRPC framing, mutate protobuf, reframe**. Th
 
 #### Intercepting non-HTTP TLS protocols with `reverse:tls`
 
-Some apps do not speak HTTP at all. If the application uses **TLS over raw TCP** and the client accepts your certificate, you can still terminate TLS with `mitmproxy` and decode the inner protocol yourself:<sup>[[7]](#references)</sup>
+Some apps do not speak HTTP at all. If the application uses **TLS over raw TCP** and the client accepts your certificate, you can still terminate TLS with `mitmproxy` and decode the inner protocol yourself:<sup>[[6]](#references)</sup>
 
 ```bash
 mitmweb \
@@ -453,7 +453,7 @@ To enumerate the VLANs it's also possible to generate the DTP Desirable frame wi
 sudo python3 DTPHijacking.py --interface eth0
 ```
 
-I would like to point out that **Access/Desirable (0x03)** indicates that the DTP frame is of the Desirable type, which tells the port to switch to Trunk mode. And **802.1Q/802.1Q (0xa5**) indicates the **802.1Q** encapsulation type.
+I would like to point out that **Access/Desirable (0x03)** indicates that the DTP frame is of the Desirable type, which tells the port to switch to Trunk mode. And **802.1Q/802.1Q (0xa5**) indicates the **802.1Q** encapsulation type.<sup>[[9]](#references)</sup>
 
 By analyzing the STP frames, **we learn about the existence of VLAN 30 and VLAN 60.**<sup>[[1]](#references)</sup>
 
@@ -641,7 +641,7 @@ You could also use [**scapy**](https://github.com/secdev/scapy/). Be sure to ins
 
 ### VoIP Attacks and the VoIP Hopper Tool
 
-VoIP phones, increasingly integrated with IoT devices, offer functionalities like unlocking doors or controlling thermostats through special phone numbers. However, this integration can pose security risks.
+VoIP phones, increasingly integrated with IoT devices, offer functionalities like unlocking doors or controlling thermostats through special phone numbers. However, this integration can pose security risks.<sup>[[3]](#references)</sup>
 
 The tool [**voiphopper**](http://voiphopper.sourceforge.net) is designed to emulate a VoIP phone in various environments (Cisco, Avaya, Nortel, Alcatel-Lucent). It discovers the voice network's VLAN ID using protocols like CDP, DHCP, LLDP-MED, and 802.1Q ARP.
 
@@ -792,7 +792,7 @@ In Open Shortest Path First (OSPF) protocol **MD5 authentication is commonly emp
 ### Other Generic Tools & Sources
 
 - [**Above**](https://github.com/c4s73r/Above): Tool to scan network traffic and find vulnerabilities
-- You can find some **more information about network attacks** [**here**](https://github.com/Sab0tag3d/MITM-cheatsheet).
+- You can find some **more information about network attacks** [**here**](https://github.com/Sab0tag3d/MITM-cheatsheet).<sup>[[10]](#references)</sup>
 
 ## **Spoofing**
 
@@ -932,7 +932,7 @@ iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port
 iptables -A INPUT -p tcp --destination-port 10000 -j ACCEPT
 ```
 
-More info [here](https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf).
+More info [here](https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf).<sup>[[11]](#references)</sup>
 
 ### sslStrip+ and dns2proxy for bypassing HSTS
 
@@ -941,7 +941,7 @@ The **difference** between **sslStrip+ and dns2proxy** against **sslStrip** is t
 The **goal** of this technique is to **avoid HSTS** because _**wwww**.facebook.com_ **won't** be saved in the **cache** of the browser, so the browser will be tricked to perform **facebook authentication in HTTP**.\
 Note that in order to perform this attack the victim has to try to access initially to [http://www.faceook.com](http://www.faceook.com) and not https. This can be done modifying the links inside an http page.
 
-More info [here](https://www.bettercap.org/legacy/#hsts-bypass), [here](https://www.slideshare.net/Fatuo__/offensive-exploiting-dns-servers-changes-blackhat-asia-2014) and [here](https://security.stackexchange.com/questions/91092/how-does-bypassing-hsts-with-sslstrip-work-exactly).
+More info [here](https://www.bettercap.org/legacy/#hsts-bypass), [here](https://www.slideshare.net/Fatuo__/offensive-exploiting-dns-servers-changes-blackhat-asia-2014) and [here](https://security.stackexchange.com/questions/91092/how-does-bypassing-hsts-with-sslstrip-work-exactly).<sup>[[12]](#references)[[13]](#references)[[14]](#references)</sup>
 
 **sslStrip or sslStrip+ doesn't work anymore. This is because there are HSTS rules presaved in the browsers, so even if it's the first time that a user access an "important" domain he will access it via HTTPS. Also, notice that the presaved rules and other generated rules can use the flag** [**`includeSubdomains`**](https://hstspreload.appspot.com) **so the** _**wwww.facebook.com**_ **example from before won't work anymore as** _**facebook.com**_ **uses HSTS with `includeSubdomains`.**
 
@@ -1052,7 +1052,7 @@ Bettercap broadcast WSD packets searching for services (UDP Port 3702).
 
 ## Bluetooth (L2CAP/ATT/GATT) Attacks
 
-- Android Fluoride exposes services over L2CAP PSMs (e.g., SDP 0x0001, RFCOMM 0x0003, BNEP 0x000F, AVCTP 0x0017/0x001B, AVDTP 0x0019, ATT/GATT 0x001F).<sup>[[5]](#references)</sup> Services register via:
+- Android Fluoride exposes services over L2CAP PSMs (e.g., SDP 0x0001, RFCOMM 0x0003, BNEP 0x000F, AVCTP 0x0017/0x001B, AVDTP 0x0019, ATT/GATT 0x001F).<sup>[[4]](#references)</sup> Services register via:
 
 ```c
 uint16_t L2CA_Register2(uint16_t psm, const tL2CAP_APPL_INFO& p_cb_info,
@@ -1061,7 +1061,7 @@ uint16_t L2CA_Register2(uint16_t psm, const tL2CAP_APPL_INFO& p_cb_info,
                         uint16_t sec_level);
 ```
 
-- BlueBlue framework enables Scapy-based L2CAP/ATT crafting (built on BlueBorne l2cap_infra).<sup>[[5]](#references)[[6]](#references)</sup> Example:
+- BlueBlue framework enables Scapy-based L2CAP/ATT crafting (built on BlueBorne l2cap_infra).<sup>[[4]](#references)[[5]](#references)</sup> Example:
 
 ```python
 acl  = ACLConnection(src_bdaddr, dst_bdaddr, auth_mode='justworks')
@@ -1070,7 +1070,7 @@ gatt.send_frag(p8(GATT_READ)+p16(1234))
 print(gatt.recv())
 ```
 
-- CVE-2023-40129 (Fluoride GATT): integer underflow in Read Multiple Variable response builder can cause ~64KB heap overflow when MTU truncates a variable-length element but the +2 length field is not accounted for.<sup>[[5]](#references)</sup>
+- CVE-2023-40129 (Fluoride GATT): integer underflow in Read Multiple Variable response builder can cause ~64KB heap overflow when MTU truncates a variable-length element but the +2 length field is not accounted for.<sup>[[4]](#references)</sup>
 
 <details>
 <summary>Root cause (GATT Read Multiple Variable)</summary>
@@ -1099,7 +1099,7 @@ static void build_read_multi_rsp(tGATT_SR_CMD* p_cmd, uint16_t mtu) {
 }
 ```
 
-- On variable-length entries, the overflow path subtracts only (total_len - mtu), ignoring the +2 length field, so len underflows (e.g., 0xFFFE) and memcpy writes ~64KB past the end of the buffer.<sup>[[5]](#references)</sup>
+- On variable-length entries, the overflow path subtracts only (total_len - mtu), ignoring the +2 length field, so len underflows (e.g., 0xFFFE) and memcpy writes ~64KB past the end of the buffer.<sup>[[4]](#references)</sup>
 </details>
 
 - Minimal unauthenticated trigger (small MTU forces underflow on the 4th attribute):
@@ -1126,12 +1126,17 @@ telecom-network-exploitation.md
 - [1] [Cisco Nightmare: Pentesting Cisco Networks Like a Devil](https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9)
 - [2] Network Security Assessment: Know Your Network (3rd edition)
 - [3] Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things. By Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, Beau Wood
-- [4] [Cisco Nightmare: Pentesting Cisco Networks Like a Devil](https://medium.com/@cursedpkt/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9)
-- [5] [Paint it blue: Attacking the bluetooth stack (Synacktiv)](https://www.synacktiv.com/en/publications/paint-it-blue-attacking-the-bluetooth-stack)
-- [6] [BlueBorne L2CAP testing infra (l2cap_infra)](https://github.com/ArmisSecurity/blueborne/tree/master/l2cap_infra)
-- [7] [mitmproxy for fun and profit: Interception and Analysis of Application Traffic](https://www.synacktiv.com/en/publications/mitmproxy-for-fun-and-profit-interception-and-analysis-of-application-traffic.html)
-- [8] [mitmproxy docs - modes](https://docs.mitmproxy.org/stable/concepts/modes/)
-- [9] [linux-router / lnxrouter](https://github.com/garywill/linux-router)
+- [4] [Paint it blue: Attacking the bluetooth stack (Synacktiv)](https://www.synacktiv.com/en/publications/paint-it-blue-attacking-the-bluetooth-stack)
+- [5] [BlueBorne L2CAP testing infra (l2cap_infra)](https://github.com/ArmisSecurity/blueborne/tree/master/l2cap_infra)
+- [6] [mitmproxy for fun and profit: Interception and Analysis of Application Traffic](https://www.synacktiv.com/en/publications/mitmproxy-for-fun-and-profit-interception-and-analysis-of-application-traffic.html)
+- [7] [mitmproxy docs - modes](https://docs.mitmproxy.org/stable/concepts/modes/)
+- [8] [linux-router / lnxrouter](https://github.com/garywill/linux-router)
+- [9] [Cisco Nightmare: Pentesting Cisco Networks Like a Devil](https://medium.com/@cursedpkt/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9)
+- [10] [Sab0tag3d/MITM-cheatsheet](https://github.com/Sab0tag3d/MITM-cheatsheet)
+- [11] [blackhat.com - BlackHat DC 09 Marlinspike Defeating SSL](https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf)
+- [12] [bettercap.org - Legacy: Hsts Bypass](https://www.bettercap.org/legacy/#hsts-bypass)
+- [13] [slideshare.net - Offensive Exploiting Dns Servers Changes Blackhat Asia 2014](https://www.slideshare.net/Fatuo__/offensive-exploiting-dns-servers-changes-blackhat-asia-2014)
+- [14] [security.stackexchange.com - How Does Bypassing Hsts With Sslstrip Work Exactly](https://security.stackexchange.com/questions/91092/how-does-bypassing-hsts-with-sslstrip-work-exactly)
 
 
 

src/generic-methodologies-and-resources/pentesting-network/ids-evasion.md

@@ -64,12 +64,9 @@ Practical patterns:
 - [https://github.com/vecna/sniffjoke](https://github.com/vecna/sniffjoke)
 - [https://github.com/secdev/scapy](https://github.com/secdev/scapy)
 
-
-
 ## References
 
 - [1] [RFC 7112 - Implications of Oversized IPv6 Header Chains](https://www.rfc-editor.org/rfc/rfc7112)
 - [2] [RFC 9098 - Operational Implications of IPv6 Packets with Extension Headers](https://www.rfc-editor.org/rfc/rfc9098)
 
 {{#include ../../banners/hacktricks-training.md}}
-

src/generic-methodologies-and-resources/pentesting-network/lateral-vlan-segmentation-bypass.md

@@ -149,7 +149,7 @@ sudo voiphopper -i eth0 -z
 # Result: new sub-interface eth0.<VVID> with a DHCP or static address inside the voice VLAN
 ```
 
-The technique bypasses data/voice separation and is extremely common on enterprise edge switches in 2025 because LLDP auto-policy is enabled by default on many models .
+The technique bypasses data/voice separation and is extremely common on enterprise edge switches in 2025 because LLDP auto-policy is enabled by default on many models .<sup>[[4]](#references)</sup>
 
 ---
 
@@ -169,7 +169,7 @@ The technique bypasses data/voice separation and is extremely common on enterpri
 Even a perfectly hardened switch configuration can still be undermined by firmware bugs.  Recent examples include:
 
 * **CVE-2022-20728† – Cisco Aironet/Catalyst Access Points** allow injection from the native VLAN into non-native WLAN VLANs, bypassing wired/wireless segmentation .<sup>[[5]](#references)</sup>
-* **CVE-2024-20465 (Cisco IOS Industrial Ethernet)** permits ACL bypass on SVIs after toggling Resilient Ethernet Protocol, leaking traffic between VRFs/VLANs.  Patch 17.9.5 or later.
+* **CVE-2024-20465 (Cisco IOS Industrial Ethernet)** permits ACL bypass on SVIs after toggling Resilient Ethernet Protocol, leaking traffic between VRFs/VLANs.  Patch 17.9.5 or later.<sup>[[6]](#references)</sup>
 
 Always monitor the vendor advisories for VLAN-related bypass/ACL issues and keep infrastructure images current.
 
@@ -182,5 +182,6 @@ Always monitor the vendor advisories for VLAN-related bypass/ACL issues and keep
 - [3] [Twingate: What is VLAN Hopping? (Aug 2024)](https://www.twingate.com/blog/glossary/vlan%20hopping)
 - [4] [VoIP Hopper project](https://github.com/hmgh0st/voiphopper)
 - [5] [Cisco Advisory "cisco-sa-apvlan-TDTtb4FY"](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apvlan-TDTtb4FY)
+- [6] [Cisco Advisory "cisco-sa-repacl-9eXgnBpD" (CVE-2024-20465)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-repacl-9eXgnBpD)
 
 {{#include ../../banners/hacktricks-training.md}}

src/generic-methodologies-and-resources/pentesting-network/network-protocols-explained-esp.md

@@ -55,6 +55,3 @@ LDAP is a protocol enabling the management and access of directory information o
 Active Directory is a network-accessible database containing objects like users, groups, privileges, and resources, facilitating centralized management of network entities. AD organizes its data into a hierarchical structure of domains, which can encompass servers, groups, and users. Subdomains allow further segmentation, each potentially maintaining its own server and user base. This structure centralizes user management, granting or restricting access to network resources. Queries can be made to retrieve specific information, like contact details, or to locate resources, like printers, within the domain.
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
-