From 575c76c6a143bbcc437045f649ab7886e4b5991e Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Thu, 6 Aug 2026 10:34:58 +0200 Subject: [PATCH 1/6] References audit: numbered citations for 49 pages Audits the '## References' of these pages: merges duplicated reference sections into one, numbers every entry, adds the linked [[N]](#references) citations to the content each reference is the source of, drops unused references and credits the original research. Co-Authored-By: Claude Opus 5 (1M context) --- ...s-automator-preference-panes-nsservices.md | 6 ++- .../macos-chromium-injection.md | 4 +- .../macos-proces-abuse/macos-dirty-nib.md | 1 - .../macos-electron-applications-injection.md | 8 +--- .../macos-function-hooking.md | 2 +- .../README.md | 27 +++++------ .../macos-mig-mach-interface-generator.md | 9 ++-- .../macos-thread-injection-via-task-port.md | 2 +- .../macos-xpc/README.md | 2 - .../macos-xpc/macos-xpc-authorization.md | 14 +++--- .../README.md | 1 - .../macos-pid-reuse.md | 6 +-- ...s-xpc_connection_get_audit_token-attack.md | 1 + .../macos-java-apps-injection.md | 2 - .../macos-library-injection/README.md | 3 +- ...yld-hijacking-and-dyld_insert_libraries.md | 3 -- .../macos-dyld-process.md | 4 +- .../macos-perl-applications-injection.md | 4 +- .../macos-python-applications-injection.md | 7 +-- .../macos-quicklook-generators.md | 2 - .../macos-ruby-applications-injection.md | 3 -- ...-signing-weaknesses-and-sandbox-escapes.md | 10 ++-- .../macos-code-signing.md | 11 ++--- .../macos-dangerous-entitlements.md | 39 ++++++++++------ .../macos-fs-tricks/README.md | 4 +- .../macos-xattr-acls-extra-stuff.md | 3 -- .../macos-gatekeeper.md | 4 +- ...monitoring-screen-capture-accessibility.md | 1 - .../macos-launch-environment-constraints.md | 9 ++-- ...macf-mandatory-access-control-framework.md | 9 ++-- .../macos-sandbox/README.md | 2 - .../macos-default-sandbox-debug.md | 3 -- .../macos-sandbox-debug-and-bypass/README.md | 2 +- .../macos-office-sandbox-bypasses.md | 3 +- .../macos-tcc/README.md | 3 +- .../macos-tcc-bypasses/macos-apple-scripts.md | 2 - .../macos-tcc-credential-and-data-theft.md | 9 ++-- .../macos-tcc/macos-tcc-payloads.md | 11 ++--- .../macos-users.md | 3 -- src/macos-hardening/macos-useful-commands.md | 3 -- .../android-app-pentesting/README.md | 46 +++++++++---------- ...g-android-media-pipelines-image-parsers.md | 1 + .../accessibility-services-abuse.md | 2 +- .../android-app-pentesting/adb-commands.md | 1 - .../android-applications-basics.md | 4 +- .../burp-configuration-for-ios.md | 11 +++-- ...-entitlements-from-compiled-application.md | 2 - .../frida-configuration-in-ios.md | 6 +-- .../ios-pentesting/ios-app-extensions.md | 2 - 49 files changed, 136 insertions(+), 181 deletions(-) diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-automator-preference-panes-nsservices.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-automator-preference-panes-nsservices.md index 88f1a2fb478..50d7a5f5abd 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-automator-preference-panes-nsservices.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-automator-preference-panes-nsservices.md @@ -331,8 +331,8 @@ A good recent example is **CVE-2022-48574**, where the Services mechanism could ## Recent Security Notes - **Quick Actions are executable content**: Apple fixed a Gatekeeper bypass in 2024 where an app-bundled Automator Quick Action could run without normal assessment. When auditing apps, inspect `Contents/PlugIns/*.workflow/Contents/document.wflow` exactly like you would inspect helper scripts or login items. See [the Gatekeeper page](../macos-security-protections/macos-gatekeeper.md).[[1]](#references) -- **Shortcuts can inherit legacy Automator behavior**: Apple also added an additional user-consent prompt after third-party shortcuts were found using a **legacy Automator action** to send Apple Events without the expected permission flow. Imported workflows and shortcut bundles should be reviewed for `Run AppleScript`, `Run Shell Script`, and similar bridge actions. See [the TCC page](../macos-security-protections/macos-tcc/README.md). -- **Automator is still a live privacy boundary**: Apple shipped another Automator fix in 2025 for access to protected user data. Even if Automator is a legacy surface, treat any workflow runner, Quick Action host, or automation bridge as a current attack surface rather than dead code. +- **Shortcuts can inherit legacy Automator behavior**: Apple also added an additional user-consent prompt after third-party shortcuts were found using a **legacy Automator action** to send Apple Events without the expected permission flow. Imported workflows and shortcut bundles should be reviewed for `Run AppleScript`, `Run Shell Script`, and similar bridge actions. See [the TCC page](../macos-security-protections/macos-tcc/README.md).[[3]](#references) +- **Automator is still a live privacy boundary**: Apple shipped another Automator fix in 2025 for access to protected user data. Even if Automator is a legacy surface, treat any workflow runner, Quick Action host, or automation bridge as a current attack surface rather than dead code.[[4]](#references) --- @@ -371,5 +371,7 @@ A good recent example is **CVE-2022-48574**, where the Services mechanism could - [1] [Apple — About the security content of macOS Ventura 13.7, Sonoma 14.7, and Sequoia 15](https://support.apple.com/en-us/121238) - [2] [Moonlock — How the NSServices exploit worked on macOS](https://moonlock.com/nsservices-macos) +- [3] [Apple — About the security content of macOS Sonoma 14.6 (CVE-2024-40834)](https://support.apple.com/en-us/120911) +- [4] [Apple — About the security content of macOS Sequoia 15.4 (CVE-2025-30460)](https://support.apple.com/en-us/122373) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-chromium-injection.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-chromium-injection.md index c4e4a4b864b..f1023fc0649 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-chromium-injection.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-chromium-injection.md @@ -12,7 +12,7 @@ macOS keeps a single UI instance per Chromium profile, so instrumentation normal #### `--load-extension` Flag -The `--load-extension` flag auto-loads unpacked extensions (comma-separated paths). Pair it with `--disable-extensions-except` to block legitimate extensions while forcing only your payload to run. Malicious extensions can request high-impact permissions such as `debugger`, `webRequest`, and `cookies` to pivot into DevTools protocols, patch CSP headers, downgrade HTTPS, or exfiltrate session material as soon as the browser starts. +The `--load-extension` flag auto-loads unpacked extensions (comma-separated paths). Pair it with `--disable-extensions-except` to block legitimate extensions while forcing only your payload to run. Malicious extensions can request high-impact permissions such as `debugger`, `webRequest`, and `cookies` to pivot into DevTools protocols, patch CSP headers, downgrade HTTPS, or exfiltrate session material as soon as the browser starts.[[4]](#references) #### `--remote-debugging-port` / `--remote-debugging-pipe` Flags @@ -24,7 +24,7 @@ This flag redirects the entire browser profile (History, Cookies, Login Data, Pr #### `--use-fake-ui-for-media-stream` Flag -This switch bypasses the camera/mic permission prompt so any page that calls `getUserMedia` receives access immediately. Combine it with flags such as `--auto-select-desktop-capture-source="Entire Screen"`, `--kiosk`, or CDP `Browser.grantPermissions` commands to silently capture audio/video, desk-share, or satisfy WebRTC permission checks without user interaction. +This switch bypasses the camera/mic permission prompt so any page that calls `getUserMedia` receives access immediately. Combine it with flags such as `--auto-select-desktop-capture-source="Entire Screen"`, `--kiosk`, or CDP `Browser.grantPermissions` commands to silently capture audio/video, desk-share, or satisfy WebRTC permission checks without user interaction.[[4]](#references) ## Delivery & Relaunch Patterns Seen in the Wild diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.md index 193c18019b8..8e3c863ed28 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib.md @@ -8,7 +8,6 @@ Dirty NIB refers to abusing Interface Builder files (.xib/.nib) inside a signed > • Before macOS 13 Ventura: replacing a bundle’s MainMenu.nib (or another nib loaded at startup) could reliably achieve process injection and often privilege escalation. > • Since macOS 13 (Ventura) and improved in macOS 14 (Sonoma): first‑launch deep verification, bundle protection, Launch Constraints, and the new TCC “App Management” permission largely prevent post‑launch nib tampering by unrelated apps. Attacks may still be feasible in niche cases (e.g., same‑developer tooling modifying own apps, or terminals granted App Management/Full Disk Access by the user). - ## What are NIB/XIB files Nib (short for NeXT Interface Builder) files are serialized UI object graphs used by AppKit apps. Modern Xcode stores editable XML .xib files which are compiled into .nib at build time. A typical app loads its main UI via `NSApplicationMain()` which reads the `NSMainNibFile` key from the app’s Info.plist and instantiates the object graph at runtime. diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md index 0b08316c1a2..a8cf1e9fd58 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md @@ -68,7 +68,7 @@ There could be **external JS/HTML files** that an Electron App is using, so an a > > Making this attack path more complicated (or impossible). -Note that it's possible to bypass the requirement of **`kTCCServiceSystemPolicyAppBundles`** by copying the application to another directory (like **`/tmp`**), renaming the folder **`app.app/Contents`** to **`app.app/NotCon`**, **modifying** the **asar** file with your **malicious** code, renaming it back to **`app.app/Contents`** and executing it. +Note that it's possible to bypass the requirement of **`kTCCServiceSystemPolicyAppBundles`** by copying the application to another directory (like **`/tmp`**), renaming the folder **`app.app/Contents`** to **`app.app/NotCon`**, **modifying** the **asar** file with your **malicious** code, renaming it back to **`app.app/Contents`** and executing it.[[5]](#references) You can unpack the code from the asar file with: @@ -452,7 +452,7 @@ Defensive guidance from the Electron maintainers:[[4]](#references) - [**electroniz3r**](https://github.com/r3ggi/electroniz3r) -The tool [**electroniz3r**](https://github.com/r3ggi/electroniz3r) can be easily used to **find vulnerable electron applications** installed and inject code on them. This tool will try to use the **`--inspect`** technique: +The tool [**electroniz3r**](https://github.com/r3ggi/electroniz3r) can be easily used to **find vulnerable electron applications** installed and inject code on them. This tool will try to use the **`--inspect`** technique:[[5]](#references) You need to compile it yourself and can use it like this: @@ -492,12 +492,10 @@ The webSocketDebuggerUrl is: ws://127.0.0.1:13337/8e0410f0-00e8-4e0e-92e4-58984d Shell binding requested. Check `nc 127.0.0.1 12345` ``` - - [https://github.com/boku7/Loki](https://github.com/boku7/Loki) Loki was designed to backdoor Electron applications by replacing the applications JavaScript files with the Loki Command & Control JavaScript files. - ## References - [1] [Electron Fuses](https://www.electronjs.org/docs/latest/tutorial/fuses) @@ -512,5 +510,3 @@ Loki was designed to backdoor Electron applications by replacing the application - [10] [Debugging Cookie Dumping Failures with Chromium's Remote Debugger - slyd0g](https://slyd0g.medium.com/debugging-cookie-dumping-failures-with-chromiums-remote-debugger-8a4c4d19429f) {{#include ../../../banners/hacktricks-training.md}} - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.md index a89c132000d..f2d862dcd7d 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-function-hooking.md @@ -153,7 +153,7 @@ It's needed the **object**, the **method** and the **params**. And when a method The object is **`someObject`**, the method is **`@selector(method1p1:p2:)`** and the arguments are **value1**, **value2**. -Following the object structures, it's possible to reach an **array of methods** where the **names** and **pointers** to the method code are **located**. +Following the object structures, it's possible to reach an **array of methods** where the **names** and **pointers** to the method code are **located**.[[1]](#references) > [!CAUTION] > Note that because methods and classes are accessed based on their names, this information is stored in the binary, so it's possible to retrieve it with `otool -ov ` or [`class-dump `](https://github.com/nygard/class-dump) diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md index b2b9a87bf60..ba894d72e05 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md @@ -97,7 +97,7 @@ The initial field **`msgh_bits`** is a bitmap: - The **5 least significant bits of the 3rd byte** from can be used for **local port** - The **5 least significant bits of the 4th byte** from can be used for **remote port** -The types that can be specified in the voucher, local and remote ports are (from [**mach/message.h**](https://opensource.apple.com/source/xnu/xnu-7195.81.3/osfmk/mach/message.h.auto.html)): +The types that can be specified in the voucher, local and remote ports are (from [**mach/message.h**](https://opensource.apple.com/source/xnu/xnu-7195.81.3/osfmk/mach/message.h.auto.html)):[[5]](#references) ```c #define MACH_MSG_TYPE_MOVE_RECEIVE 16 /* Must hold receive right */ @@ -137,7 +137,7 @@ A **trailer** is **information added to the message by the kernel** (cannot be s However, there are other more **complex** messages, like the ones passing additional port rights or sharing memory, where the kernel also needs to send these objects to the recipient. In this cases the most significant bit of the header `msgh_bits` is set. -The possible descriptors to pass are defined in [**`mach/message.h`**](https://opensource.apple.com/source/xnu/xnu-7195.81.3/osfmk/mach/message.h.auto.html): +The possible descriptors to pass are defined in [**`mach/message.h`**](https://opensource.apple.com/source/xnu/xnu-7195.81.3/osfmk/mach/message.h.auto.html):[[5]](#references) ```c #define MACH_MSG_PORT_DESCRIPTOR 0 @@ -165,7 +165,7 @@ In 32bits, all the descriptors are 12B and the descriptor type is in the 11th on ### Mac Ports APIs -Note that ports are associated to the task namespace, so to create or search for a port, the task namespace is also queried (more in `mach/mach_port.h`): +Note that ports are associated to the task namespace, so to create or search for a port, the task namespace is also queried (more in `mach/mach_port.h`):[[6]](#references) - **`mach_port_allocate` | `mach_port_construct`**: **Create** a port. - `mach_port_allocate` can also create a **port set**: receive right over a group of ports. Whenever a message is received it's indicated the port from where it was. @@ -475,7 +475,7 @@ typedef int task_special_port_t; #define TASK_PAGED_LEDGER_PORT 6 /* Paged resource ledger for task. */ ``` -From [here](https://web.mit.edu/darwin/src/modules/xnu/osfmk/man/task_get_special_port.html):[[9]](#references) +From [here](https://web.mit.edu/darwin/src/modules/xnu/osfmk/man/task_get_special_port.html):[[8]](#references) - **TASK_KERNEL_PORT**\[task-self send right]: The port used to control this task. Used to send messages that affect the task. This is the port returned by **mach_task_self (see Task Ports below)**. - **TASK_BOOTSTRAP_PORT**\[bootstrap send right]: The task's bootstrap port. Used to send messages requesting return of other system service ports. @@ -487,7 +487,7 @@ From [here](https://web.mit.edu/darwin/src/modules/xnu/osfmk/man/task_get_specia Originally Mach didn't have "processes" it had "tasks" which was considered more like a container of threads. When Mach was merged with BSD **each task was correlated with a BSD process**. Therefore every BSD process has the details it needs to be a process and every Mach task also have its inner workings (except for the inexistent pid 0 which is the `kernel_task`). -There are two very interesting functions related to this: +There are two very interesting functions related to this:[[7]](#references) - `task_for_pid(target_task_port, pid, &task_port_of_pid)`: Get a SEND right for the task por of the task related to the specified by the `pid` and give it to the indicated `target_task_port` (which is usually the caller task which has used `mach_task_self()`, but could be a SEND port over a different task.) - `pid_for_task(task, &pid)`: Given a SEND right to a task, find to which PID this task is related to. @@ -1144,7 +1144,7 @@ These are some interesting APIs to interact with the processor set: - `processor_set_info` As mentioned in [**this post**](https://reverse.put.as/2014/05/05/about-the-processor_set_tasks-access-to-kernel-memory-vulnerability/), in the past this allowed to bypass the previously mentioned protection to get task ports in other processes to control them by calling **`processor_set_tasks`** and getting a host port on every process.\ -Nowadays you need root to use that function and this is protected so you will only be able to get these ports on unprotected processes.[[11]](#references) +Nowadays you need root to use that function and this is protected so you will only be able to get these ports on unprotected processes.[[10]](#references) You can try it with: @@ -1281,7 +1281,7 @@ macos-mig-mach-interface-generator.md ## MIG handler type confusion -> fake vtable pointer-chain hijack -If a MIG handler **retrieves a C++ object by Mach message-supplied ID** (e.g., from an internal Object Map) and then **assumes a specific concrete type without validating the real dynamic type**, later virtual calls can dispatch through attacker-controlled pointers. In `coreaudiod`’s `com.apple.audio.audiohald` service (CVE-2024-54529), `_XIOContext_Fetch_Workgroup_Port` used the looked-up `HALS_Object` as an `ioct` and executed a vtable call via:[[10]](#references) +If a MIG handler **retrieves a C++ object by Mach message-supplied ID** (e.g., from an internal Object Map) and then **assumes a specific concrete type without validating the real dynamic type**, later virtual calls can dispatch through attacker-controlled pointers. In `coreaudiod`’s `com.apple.audio.audiohald` service (CVE-2024-54529), `_XIOContext_Fetch_Workgroup_Port` used the looked-up `HALS_Object` as an `ioct` and executed a vtable call via:[[9]](#references) ```asm mov rax, qword ptr [rdi] @@ -1316,13 +1316,10 @@ HALS_Object + 0x68 -> controlled_object - [3] [knightsc/inject.c – dlopen dylib injection into a remote Mach task (Gist)](https://gist.github.com/knightsc/45edfc4903a9d2fa9f5905f60b02ce5a) - [4] [Don't talk all at once: Elevating privileges on macOS by audit token spoofing – Sector 7](https://sector7.computest.nl/post/2023-10-xpc-audit-token-spoofing/) - [5] [XNU — `osfmk/mach/message.h` (Mach message structures and flags)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/message.h) -- [6] [XNU — `osfmk/ipc/ipc_port.h` (port rights and internals)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/ipc/ipc_port.h) -- [7] [XNU — `osfmk/mach/mach_port.defs` (port manipulation MIG interface)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/mach_port.defs) -- [8] [XNU — `osfmk/mach/task.defs` (`task_for_pid`, thread/task port operations)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/task.defs) -- [9] [task_get_special_port – MIT Darwin XNU manual](https://web.mit.edu/darwin/src/modules/xnu/osfmk/man/task_get_special_port.html) -- [10] [Project Zero – Sound Barrier 2](https://projectzero.google/2026/01/sound-barrier-2.html) -- [11] [About the processor_set_tasks() access to kernel memory vulnerability – reverse.put.as](https://reverse.put.as/2014/05/05/about-the-processor_set_tasks-access-to-kernel-memory-vulnerability/) +- [6] [XNU — `osfmk/mach/mach_port.defs` (port manipulation MIG interface)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/mach_port.defs) +- [7] [XNU — `osfmk/mach/task.defs` (`task_for_pid`, thread/task port operations)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/task.defs) +- [8] [task_get_special_port – MIT Darwin XNU manual](https://web.mit.edu/darwin/src/modules/xnu/osfmk/man/task_get_special_port.html) +- [9] [Project Zero – Sound Barrier 2](https://projectzero.google/2026/01/sound-barrier-2.html) +- [10] [About the processor_set_tasks() access to kernel memory vulnerability – reverse.put.as](https://reverse.put.as/2014/05/05/about-the-processor_set_tasks-access-to-kernel-memory-vulnerability/) {{#include ../../../../banners/hacktricks-training.md}} - - diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md index 30109415ca5..bb1d521be07 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md @@ -4,7 +4,7 @@ ## Basic Information -MIG was created to **simplify the process of Mach IPC** code creation. It basically **generates the needed code** for server and client to communicate with a given definition. Even if the generated code is ugly, a developer will just need to import it and his code will be much simpler than before. +MIG was created to **simplify the process of Mach IPC** code creation. It basically **generates the needed code** for server and client to communicate with a given definition. Even if the generated code is ugly, a developer will just need to import it and his code will be much simpler than before.[[1]](#references) The definition is specified in Interface Definition Language (IDL) using the `.defs` extension. @@ -54,7 +54,7 @@ Several new files will be created in the current directory. > [!TIP] > You can find a more complex example in your system with: `mdfind mach_port.defs`\ -> And you can compile it from the same folder as the file with: `mig -DLIBSYSCALL_INTERFACE mach_ports.defs` +> And you can compile it from the same folder as the file with: `mig -DLIBSYSCALL_INTERFACE mach_ports.defs`[[2]](#references) In the files **`myipcServer.c`** and **`myipcServer.h`** you can find the declaration and definition of the struct **`SERVERPREFmyipc_subsystem`**, which basically defines the function to call based on the received message ID (we indicated a starting number of 500): @@ -127,7 +127,7 @@ Actually it's possible to identify this relation in the struct **`subsystem_to_n #endif ``` -Finally, another important function to make the server work will be **`myipc_server`**, which is the one that will actually **call the function** related to the received id: +Finally, another important function to make the server work will be **`myipc_server`**, which is the one that will actually **call the function** related to the received id:[[3]](#references) 
mig_external boolean_t myipc_server
 	(mach_msg_header_t *InHeadP, mach_msg_header_t *OutHeadP)
@@ -401,8 +401,7 @@ The code generated by MIG also calles `kernel_debug` to generate logs about oper
 
 - [1] [bootstrap_cmds — `migcom.tproj` (the MIG compiler itself)](https://github.com/apple-oss-distributions/bootstrap_cmds/tree/main/migcom.tproj)
 - [2] [XNU — `osfmk/mach/mach_port.defs` (example MIG subsystem definition)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/mach_port.defs)
-- [3] [XNU — `osfmk/mach/task.defs` (task subsystem MIG definition)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/task.defs)
-- [4] [XNU — `osfmk/mach/message.h` (Mach message header layout)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/message.h)
+- [3] [XNU — `osfmk/mach/message.h` (Mach message header layout)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/message.h)
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.md
index 9aa844fc4be..28e2639b1af 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-thread-injection-via-task-port.md
@@ -177,7 +177,7 @@ Distributing your application **without** the `com.apple.security.get-task-allow
 
 | Tool | Year | Remarks |
 |------|------|---------|
-| [`task_vaccine`](https://github.com/rodionovd/task_vaccine) | 2023 | Compact PoC that demonstrates PAC-aware thread hijacking on Ventura/Sonoma |
+| [`task_vaccine`](https://github.com/rodionovd/task_vaccine) | 2023 | Compact PoC that demonstrates PAC-aware thread hijacking on Ventura/Sonoma[[2]](#references) |
 | `remote_thread_es` | 2024 | EndpointSecurity helper used by several EDR vendors to surface `REMOTE_THREAD_CREATE` events |
 
 > Reading these projects’ source code is useful to understand API changes introduced in macOS 13/14 and to stay compatible across Intel ↔ Apple Silicon.
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/README.md
index a42b8516f8d..903e2ad0f14 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/README.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/README.md
@@ -486,5 +486,3 @@ The communication between BridgeOS and the host occurs through a dedicated IPv6
 It's possible to find thee communications using `netstat`, `nettop` or the open source option, `netbottom`.
 
 {{#include ../../../../../banners/hacktricks-training.md}}
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.md
index 8f45bed6c5c..af8232f74a7 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-authorization.md
@@ -4,7 +4,7 @@
 
 ## XPC Authorization
 
-Apple also proposes another way to authenticate if the connecting process has **permissions to call the an exposed XPC method**.
+Apple also proposes another way to authenticate if the connecting process has **permissions to call the an exposed XPC method**.[[2]](#references)
 
 When an application needs to **execute actions as a privileged user**, instead of running the app as a privileged user it usually installs as root a HelperTool as an XPC service that could be called from the app to perform those actions. However, the app calling the service should have enough authorization.
 
@@ -181,9 +181,9 @@ static NSString * kCommandKeyAuthRightDesc    = @"authRightDescription";
 }
 ```
 
-This means that at the end of this process, the permissions declared inside `commandInfo` will be stored in `/var/db/auth.db`. Note how there you can find for **each method** that will r**equire authentication**, **permission name** and the **`kCommandKeyAuthRightDefault`**. The later one **indicates who can get this right**.
+This means that at the end of this process, the permissions declared inside `commandInfo` will be stored in `/var/db/auth.db`. Note how there you can find for **each method** that will r**equire authentication**, **permission name** and the **`kCommandKeyAuthRightDefault`**. The later one **indicates who can get this right**.[[1]](#references)
 
-There are different scopes to indicate who can access a right. Some of them are defined in [AuthorizationDB.h](https://github.com/aosm/Security/blob/master/Security/libsecurity_authorization/lib/AuthorizationDB.h) (you can find [all of them in here](https://www.dssw.co.uk/reference/authorization-rights/)), but as summary:
+There are different scopes to indicate who can access a right. Some of them are defined in [AuthorizationDB.h](https://github.com/aosm/Security/blob/master/Security/libsecurity_authorization/lib/AuthorizationDB.h) (you can find [all of them in here](https://www.dssw.co.uk/reference/authorization-rights/)), but as summary:[[9]](#references)[[10]](#references)
 
 
NameValueDescription
kAuthorizationRuleClassAllowallowAnyone
kAuthorizationRuleClassDenydenyNobody
kAuthorizationRuleIsAdminis-adminCurrent user needs to be an admin (inside admin group)
kAuthorizationRuleAuthenticateAsSessionUserauthenticate-session-ownerAsk user to authenticate.
kAuthorizationRuleAuthenticateAsAdminauthenticate-adminAsk user to authenticate. He needs to be an admin (inside admin group)
kAuthorizationRightRuleruleSpecify rules
kAuthorizationCommentcommentSpecify some extra comments on the right

 
@@ -239,7 +239,7 @@ In `HelperTool/HelperTool.m` the function **`readLicenseKeyAuthorization`** chec
 }
 ```
 
-Note that to **check the requirements to get the right** to call that method the function `authorizationRightForCommand` will just check the previously comment object **`commandInfo`**. Then, it will call **`AuthorizationCopyRights`** to check **if it has the rights** to call the function (note that the flags allow interaction with the user).
+Note that to **check the requirements to get the right** to call that method the function `authorizationRightForCommand` will just check the previously comment object **`commandInfo`**. Then, it will call **`AuthorizationCopyRights`** to check **if it has the rights** to call the function (note that the flags allow interaction with the user).[[1]](#references)[[3]](#references)
 
 In this case, to call the function `readLicenseKeyAuthorization` the `kCommandKeyAuthRightDefault` is defined to `@kAuthorizationRuleClassAllow`. So **anyone can call it**.
 
@@ -261,7 +261,7 @@ security authorizationdb read com.apple.safaridriver.allow
 
 ### Permissive rights
 
-You can find **all the permissions configurations** [**in here**](https://www.dssw.co.uk/reference/authorization-rights/), but the combinations that won't require user interaction would be:
+You can find **all the permissions configurations** [**in here**](https://www.dssw.co.uk/reference/authorization-rights/), but the combinations that won't require user interaction would be:[[10]](#references)
 
 1. **'authenticate-user': 'false'**
    - This is the most direct key. If set to `false`, it specifies that a user does not need to provide authentication to gain this right.
@@ -469,7 +469,7 @@ int main(void) {
 - [6] [CVE-2025-65842 – Acustica Audio HelperTool XPC Service Local Privilege Escalation in Aquarius Desktop on macOS](https://almightysec.com/helpertool-xpc-service-local-privilege-escalation/)
 - [7] [CVE-2025-55076 – Plugin Alliance InstallationHelper XPC Service Local Privilege Escalation](https://almightysec.com/Plugin-Alliance-HelperTool-XPC-Service-Local-Privilege-Escalation/)
 - [8] [CVE-2019-8805: Apple EndpointSecurity framework Privilege Escalation (SecureLayer7)](https://blog.securelayer7.net/applied-endpointsecurity-framework-previlege-escalation/?utm_source=pocket_shared)
+- [9] [Apple Open Source — AuthorizationDB.h](https://github.com/aosm/Security/blob/master/Security/libsecurity_authorization/lib/AuthorizationDB.h)
+- [10] [Authorization Rights Reference (dssw.co.uk)](https://www.dssw.co.uk/reference/authorization-rights/)
 
 {{#include ../../../../../banners/hacktricks-training.md}}
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/README.md
index c149b5bfb89..2772b85b133 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/README.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/README.md
@@ -114,4 +114,3 @@ The `cs_*` constants above are the code-signing flags defined in XNU's `osfmk/ke
 
 {{#include ../../../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-pid-reuse.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-pid-reuse.md
index 56e08d8650e..55d308a2952 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-pid-reuse.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-pid-reuse.md
@@ -4,9 +4,9 @@
 
 ## PID Reuse
 
-When a macOS **XPC service** is checking the called process based on the **PID** and not on the **audit token**, it's vulnerable to PID reuse attack. This attack is based on a **race condition** where an **exploit** is going to **send messages to the XPC** service **abusing** the functionality and just **after** that, executing **`posix_spawn(NULL, target_binary, NULL, &attr, target_argv, environ)`** with the **allowed** binary.
+When a macOS **XPC service** is checking the called process based on the **PID** and not on the **audit token**, it's vulnerable to PID reuse attack. This attack is based on a **race condition** where an **exploit** is going to **send messages to the XPC** service **abusing** the functionality and just **after** that, executing **`posix_spawn(NULL, target_binary, NULL, &attr, target_argv, environ)`** with the **allowed** binary.[[1]](#references)[[2]](#references)
 
-This function will make the **allowed binary own the PID** but the **malicious XPC message would have been sent** just before. So, if the **XPC** service **use** the **PID** to **authenticate** the sender and checks it **AFTER** the execution of **`posix_spawn`**, it will think it comes from an **authorized** process.
+This function will make the **allowed binary own the PID** but the **malicious XPC message would have been sent** just before. So, if the **XPC** service **use** the **PID** to **authenticate** the sender and checks it **AFTER** the execution of **`posix_spawn`**, it will think it comes from an **authorized** process.[[1]](#references)[[2]](#references)
 
 ### Exploit example
 
@@ -296,5 +296,3 @@ int main(int argc, const char * argv[]) {
 
 {{#include ../../../../../../banners/hacktricks-training.md}}
 
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.md
index 850b773f0c0..386dd22f47a 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.md
@@ -181,3 +181,4 @@ These require low-level mach message crafting for the XPC bootstrap and message
 
 
 {{#include ../../../../../../banners/hacktricks-training.md}}
+
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-java-apps-injection.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-java-apps-injection.md
index 3b0cd8bd4d1..47ae924792b 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-java-apps-injection.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-java-apps-injection.md
@@ -173,5 +173,3 @@ Note how interesting is that Android Studio in this example is trying to load th
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/README.md
index 52f1d433194..7b2d05b4e2d 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/README.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/README.md
@@ -16,7 +16,7 @@ macos-dyld-process.md
 
 ## **DYLD_INSERT_LIBRARIES**
 
-This is like the [**LD_PRELOAD on Linux**](../../../../linux-hardening/linux-basics/linux-privilege-escalation/index.html#ld_preload). It allows to indicate a process that is going to be run to load a specific library from a path (if the env var is enabled)
+This is like the [**LD_PRELOAD on Linux**](../../../../linux-hardening/linux-basics/linux-privilege-escalation/index.html#ld_preload). It allows to indicate a process that is going to be run to load a specific library from a path (if the env var is enabled)[[4]](#references)
 
 This technique may be also **used as an ASEP technique** as every application installed has a plist called "Info.plist" that allows for the **assigning of environmental variables** using a key called `LSEnvironmental`.
 
@@ -366,4 +366,3 @@ DYLD_INSERT_LIBRARIES=inject.dylib ./hello-signed # Won't work
 - [4] [dyld — `dyld/dyldMain.cpp` (process startup and library insertion)](https://github.com/apple-oss-distributions/dyld/blob/main/dyld/dyldMain.cpp)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-hijacking-and-dyld_insert_libraries.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-hijacking-and-dyld_insert_libraries.md
index 23c5c28c596..89bb7a820a4 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-hijacking-and-dyld_insert_libraries.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-hijacking-and-dyld_insert_libraries.md
@@ -168,6 +168,3 @@ sudo log stream --style syslog --predicate 'eventMessage CONTAINS[c] "[+] dylib"
 - [1] [CVE-2023-26818 - Bypassing TCC with Telegram in macOS](https://danrevah.github.io/2023/05/15/CVE-2023-26818-Bypass-TCC-with-Telegram/)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.md
index ad1d546dd33..6c091c62218 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-library-injection/macos-dyld-process.md
@@ -193,7 +193,7 @@ it's possible to see all these interesting values debugging before getting into
 
 ## dyld_all_image_infos
 
-This is a structure exported by dyld with information about the dyld state which can be found in the [**source code**](https://opensource.apple.com/source/dyld/dyld-852.2/include/mach-o/dyld_images.h.auto.html) with information like the version, pointer to dyld_image_info array, to dyld_image_notifier, if proc is detached from shared cache, if libSystem initializer was called, pointer to dyls's own Mach header, pointer to dyld version string...
+This is a structure exported by dyld with information about the dyld state which can be found in the [**source code**](https://opensource.apple.com/source/dyld/dyld-852.2/include/mach-o/dyld_images.h.auto.html) with information like the version, pointer to dyld_image_info array, to dyld_image_notifier, if proc is detached from shared cache, if libSystem initializer was called, pointer to dyls's own Mach header, pointer to dyld version string...[[4]](#references)
 
 ## dyld env variables
 
@@ -315,7 +315,7 @@ find . -type f | xargs grep strcmp| grep key,\ \" | cut -d'"' -f2 | sort -u
 - [1] [dyld — `dyld/dyldMain.cpp` (process startup path)](https://github.com/apple-oss-distributions/dyld/blob/main/dyld/dyldMain.cpp)
 - [2] [dyld — `dyld/DyldProcessConfig.cpp` (process/security configuration)](https://github.com/apple-oss-distributions/dyld/blob/main/dyld/DyldProcessConfig.cpp)
 - [3] [XNU — `bsd/kern/kern_exec.c` (kernel side of `execve`, loading dyld)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/kern/kern_exec.c)
+- [4] [dyld — `include/mach-o/dyld_images.h` (`dyld_all_image_infos` structure)](https://opensource.apple.com/source/dyld/dyld-852.2/include/mach-o/dyld_images.h.auto.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-perl-applications-injection.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-perl-applications-injection.md
index c948c5d329d..018c4d2e205 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-perl-applications-injection.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-perl-applications-injection.md
@@ -36,7 +36,7 @@ PERL5LIB=/tmp/ PERL5OPT=-Mpmod perl victim.pl
 
 ### Other interesting environment variables
 
-* **`PERL5DB`** – when the interpreter is started with the **`-d`** (debugger) flag, the content of `PERL5DB` is executed as Perl code *inside* the debugger context.  
+- **`PERL5DB`** – when the interpreter is started with the **`-d`** (debugger) flag, the content of `PERL5DB` is executed as Perl code *inside* the debugger context.  
   If you can influence both the environment **and** the command-line flags of a privileged Perl process you can do something like:
   
   ```bash
@@ -44,7 +44,7 @@ PERL5LIB=/tmp/ PERL5OPT=-Mpmod perl victim.pl
   sudo perl -d /usr/bin/some_admin_script.pl   # will drop a shell before executing the script
   ```
 
-* **`PERL5SHELL`** – on Windows this variable controls which shell executable Perl will use when it needs to spawn a shell. It is mentioned here only for completeness, as it is not relevant on macOS.
+- **`PERL5SHELL`** – on Windows this variable controls which shell executable Perl will use when it needs to spawn a shell. It is mentioned here only for completeness, as it is not relevant on macOS.
 
 Although `PERL5DB` requires the `-d` switch, it is common to find maintenance or installer scripts that are executed as *root* with this flag enabled for verbose troubleshooting, making the variable a valid escalation vector.
 
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-python-applications-injection.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-python-applications-injection.md
index 24e39385622..f97c225cf20 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-python-applications-injection.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-python-applications-injection.md
@@ -4,7 +4,7 @@
 
 ## Via `PYTHONWARNINGS` and `BROWSER` env variables
 
-It's possible to alter both environment variables to execute arbitrary code whenever python is called, for example:
+It's possible to alter both environment variables to execute arbitrary code whenever python is called, for example:[[1]](#references)
 
 ```bash
 # Generate example python script
@@ -17,7 +17,8 @@ PYTHONWARNINGS="all:0:antigravity.x:0:0" BROWSER="/bin/sh -c 'touch /tmp/hacktri
 BROWSER="/bin/sh -c 'touch /tmp/hacktricks' #%s" python3 -I -W all:0:antigravity.x:0:0 /tmp/script.py
 ```
 
-{{#include ../../../banners/hacktricks-training.md}}
-
+## References
 
+- [1] [Hacking with Environment Variables - elttam](https://www.elttam.com/blog/env/)
 
+{{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-quicklook-generators.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-quicklook-generators.md
index b0877e64d23..509a28cc056 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-quicklook-generators.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-quicklook-generators.md
@@ -179,7 +179,5 @@ done
 ## References
 
 - [1] [Apple Developer — Quick Look Programming Guide](https://developer.apple.com/library/archive/documentation/UserExperience/Conceptual/Quicklook_Programming_Guide/Introduction/Introduction.html)
-- [2] [Apple Security Updates — Quick Look CVEs](https://support.apple.com/en-us/HT201222)
-- [3] [Objective-See — Quick Look Attack Surface](https://objective-see.org/blog.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ruby-applications-injection.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ruby-applications-injection.md
index acac3c28f88..538fa12bc5c 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ruby-applications-injection.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ruby-applications-injection.md
@@ -31,6 +31,3 @@ RUBYOPT="-I/tmp -rinject" ruby hello.rb --disable-rubyopt
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md
index ec053dbb310..56a238a889c 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md
@@ -6,7 +6,7 @@
 
 ### Basic Information
 
-**Ad-hoc signing** (`CS_ADHOC`) creates a code signature with **no certificate chain** — it's a hash of the code with no developer identity verification. The binary's origin cannot be traced to any developer or organization.
+**Ad-hoc signing** (`CS_ADHOC`) creates a code signature with **no certificate chain** — it's a hash of the code with no developer identity verification. The binary's origin cannot be traced to any developer or organization.[[1]](#references)
 
 On Apple Silicon Macs, all executables require at minimum an ad-hoc signature. This means you'll find ad-hoc signatures on many development tools, Homebrew packages, and third-party utilities.
 
@@ -58,7 +58,7 @@ codesign -s - /path/to/target
 
 ### Basic Information
 
-The **`com.apple.security.get-task-allow`** entitlement (or `CS_GET_TASK_ALLOW` flag) allows **any process to attach as a debugger**, reading memory, modifying registers, injecting code, and controlling execution.
+The **`com.apple.security.get-task-allow`** entitlement (or `CS_GET_TASK_ALLOW` flag) allows **any process to attach as a debugger**, reading memory, modifying registers, injecting code, and controlling execution.[[3]](#references)
 
 This is intended **only for development builds**. However, some third-party binaries ship with this entitlement in production.
 
@@ -115,7 +115,7 @@ if (kr == KERN_SUCCESS) {
 
 ### The Deadly Combination
 
-When a binary has **both**:
+When a binary has **both**:[[3]](#references)
 - `com.apple.security.cs.disable-library-validation` (loads any dylib)
 - `com.apple.security.cs.allow-dyld-environment-variables` (accepts DYLD env vars)
 
@@ -182,7 +182,7 @@ cat /tmp/injected_proof.txt
 
 ### How They Weaken the Sandbox
 
-Sandbox temporary exceptions (`com.apple.security.temporary-exception.*`) punch holes in the App Sandbox:
+Sandbox temporary exceptions (`com.apple.security.temporary-exception.*`) punch holes in the App Sandbox:[[2]](#references)
 
 | Exception | What It Allows |
 |---|---|
@@ -346,7 +346,5 @@ cp /tmp/evil.dylib /path/to/writable.dylib
 - [1] [Apple Developer — Code Signing Guide](https://developer.apple.com/library/archive/technotes/tn2206/_index.html)
 - [2] [Apple Developer — App Sandbox](https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AboutAppSandbox/AboutAppSandbox.html)
 - [3] [Apple Developer — Entitlements](https://developer.apple.com/documentation/bundleresources/entitlements)
-- [4] [XNU — `bsd/sys/codesign.h` (`CS_OPS_*` operations and `CLEAR_LV_ENTITLEMENT`)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/sys/codesign.h)
-- [5] [XNU — `bsd/kern/kern_proc.c` (`csops` / `CS_OPS_CLEAR_LV` handler)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/kern/kern_proc.c)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.md
index ba829ca919e..54cfd2fa5d9 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.md
@@ -261,7 +261,7 @@ Note that the function [**exec_mach_imgact**](https://github.com/apple-oss-distr
 
 Each application store some **requirements** that it must **satisfy** in order to be able to be executed. If the **application contains requirements aren't satisfied by the application**, it won't be executed (as it has probably been altered).
 
-The requirements of a binary use a **special grammar** which is a stream of **expressions** and are encoded as blobs using `0xfade0c00` as the magic whose **hash is stored in a special code slot**.
+The requirements of a binary use a **special grammar** which is a stream of **expressions** and are encoded as blobs using `0xfade0c00` as the magic whose **hash is stored in a special code slot**.[[4]](#references)
 
 The requirements of a binary can be seen running:
 
@@ -292,7 +292,7 @@ od -A x -t x1 /tmp/output.csreq
 [...]
 ```
 
-It's possible to access this information and create or modify requirements with some APIs from the `Security.framework` like:[[4]](#references)
+It's possible to access this information and create or modify requirements with some APIs from the `Security.framework` like:[[3]](#references)
 
 #### **Checking Validity**
 
@@ -342,7 +342,7 @@ The **kernel** is the one that **checks the code signature** before allowing the
 
 ## `cs_blobs` & `cs_blob`
 
-[**cs_blob**](https://github.com/apple-oss-distributions/xnu/blob/94d3b452840153a99b38a3a9659680b2a006908e/bsd/sys/ubc_internal.h#L106) struct contains the information about the entitlement of the running process on it. `csb_platform_binary` also informs if the application is a **platform binary** (which is checked in different moments by the OS to apply security mechanisms like to protect the SEND rights to the task ports of these processes).
+[**cs_blob**](https://github.com/apple-oss-distributions/xnu/blob/94d3b452840153a99b38a3a9659680b2a006908e/bsd/sys/ubc_internal.h#L106) struct contains the information about the entitlement of the running process on it. `csb_platform_binary` also informs if the application is a **platform binary** (which is checked in different moments by the OS to apply security mechanisms like to protect the SEND rights to the task ports of these processes).[[2]](#references)
 
 > [!WARNING]
 > Note that several security measures depend on the binary being a platform binary, so way to escalate privileges is to **make the binary a platform binary** (for example, by re-signing it with a certificate that allows it).
@@ -410,8 +410,7 @@ struct cs_blob {
 
 - [1] [XNU — `osfmk/kern/cs_blobs.h` (`CodeDirectory`, `CS_*` flags, blob magic values)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/kern/cs_blobs.h)
 - [2] [XNU — `bsd/kern/ubc_subr.c` (`cs_blob` handling and signature validation)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/kern/ubc_subr.c)
-- [3] [XNU — `bsd/sys/codesign.h` (`csops`/`csops_audittoken` operations)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/sys/codesign.h)
-- [4] [Apple Security framework source — `libsecurity_codesigning`](https://github.com/apple-oss-distributions/Security/tree/main/OSX/libsecurity_codesigning)
-- [5] [Apple Developer — Code Signing Guide](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)
+- [3] [Apple Security framework source — `libsecurity_codesigning`](https://github.com/apple-oss-distributions/Security/tree/main/OSX/libsecurity_codesigning)
+- [4] [Apple Developer — Code Signing Guide](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.md
index a30eb34dbb0..f08d42bdd02 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.md
@@ -25,17 +25,17 @@ This entitlement allows other processes with the **`com.apple.security.cs.debugg
 
 ### `com.apple.security.cs.debugger`
 
-Apps with the Debugging Tool Entitlement can call `task_for_pid()` to retrieve a valid task port for unsigned and third-party apps with the `Get Task Allow` entitlement set to `true`. However, even with the debugging tool entitlement, a debugger **can’t get the task ports** of processes that **don’t have the `Get Task Allow` entitlement**, and that are therefore protected by System Integrity Protection. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_debugger).
+Apps with the Debugging Tool Entitlement can call `task_for_pid()` to retrieve a valid task port for unsigned and third-party apps with the `Get Task Allow` entitlement set to `true`. However, even with the debugging tool entitlement, a debugger **can’t get the task ports** of processes that **don’t have the `Get Task Allow` entitlement**, and that are therefore protected by System Integrity Protection. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_debugger).[[3]](#references)
 
 ### `com.apple.security.cs.disable-library-validation`
 
-This entitlement allows to **load frameworks, plug-ins, or libraries without being either signed by Apple or signed with the same Team ID** as the main executable, so an attacker could abuse some arbitrary library load to inject code. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_disable-library-validation).
+This entitlement allows to **load frameworks, plug-ins, or libraries without being either signed by Apple or signed with the same Team ID** as the main executable, so an attacker could abuse some arbitrary library load to inject code. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_disable-library-validation).[[4]](#references)
 
 ### `com.apple.private.security.clear-library-validation`
 
 This entitlement is very similar to **`com.apple.security.cs.disable-library-validation`** but **instead** of **directly disabling** library validation, it allows the process to **call a `csops` system call to disable it** at runtime.
 
-The entitlement name is hardcoded in XNU next to the `csops` operation that consumes it:[[2]](#references)
+The entitlement name is hardcoded in XNU next to the `csops` operation that consumes it:[[1]](#references)
 
 ```c
 /* bsd/sys/codesign.h */
@@ -44,7 +44,7 @@ The entitlement name is hardcoded in XNU next to the `csops` operation that cons
 #define CS_OPS_CLEAR_LV     15  /* clear the library validation flag */
 ```
 
-The kernel handler for `CS_OPS_CLEAR_LV` (`bsd/kern/kern_proc.c`) shows exactly how narrow the primitive is:[[3]](#references)
+The kernel handler for `CS_OPS_CLEAR_LV` (`bsd/kern/kern_proc.c`) shows exactly how narrow the primitive is:[[2]](#references)
 
 ```c
 case CS_OPS_CLEAR_LV: {
@@ -74,11 +74,11 @@ In other words, **any binary carrying this entitlement is a dylib-injection targ
 
 ### `com.apple.security.cs.allow-dyld-environment-variables`
 
-This entitlement allows to **use DYLD environment variables** that could be used to inject libraries and code. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-dyld-environment-variables).
+This entitlement allows to **use DYLD environment variables** that could be used to inject libraries and code. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-dyld-environment-variables).[[5]](#references)
 
 ### `com.apple.private.tcc.manager` or `com.apple.rootless.storage`.`TCC`
 
-[**According to this blog**](https://objective-see.org/blog/blog_0x4C.html) **and** [**this blog**](https://wojciechregula.blog/post/play-the-music-and-bypass-tcc-aka-cve-2020-29621/), these entitlements allows to **modify** the **TCC** database.
+[**According to this blog**](https://objective-see.org/blog/blog_0x4C.html) **and** [**this blog**](https://wojciechregula.blog/post/play-the-music-and-bypass-tcc-aka-cve-2020-29621/), these entitlements allows to **modify** the **TCC** database.[[6]](#references)[[7]](#references)
 
 ### **`system.install.apple-software`** and **`system.install.apple-software.standar-user`**
 
@@ -94,7 +94,7 @@ The entitlement **`com.apple.private.icloud-account-access`** it's possible to c
 
 **iMovie** and **Garageband** had this entitlement.
 
-For more **information** about the exploit to **get icloud tokens** from that entitlement check the talk: [**#OBTS v5.0: "What Happens on your Mac, Stays on Apple's iCloud?!" - Wojciech Regula**](https://www.youtube.com/watch?v=_6e2LhmxVc0)
+For more **information** about the exploit to **get icloud tokens** from that entitlement check the talk: [**#OBTS v5.0: "What Happens on your Mac, Stays on Apple's iCloud?!" - Wojciech Regula**](https://www.youtube.com/watch?v=_6e2LhmxVc0)[[8]](#references)
 
 ### `com.apple.private.tcc.manager.check-by-audit-token`
 
@@ -102,11 +102,11 @@ TODO: I don't know what this allows to do
 
 ### `com.apple.private.apfs.revert-to-snapshot`
 
-TODO: In [**this report**](https://jhftss.github.io/The-Nightmare-of-Apple-OTA-Update/) **is mentioned that this could be used to** update the SSV-protected contents after a reboot. If you know how it send a PR please!
+TODO: In [**this report**](https://jhftss.github.io/The-Nightmare-of-Apple-OTA-Update/) **is mentioned that this could be used to** update the SSV-protected contents after a reboot. If you know how it send a PR please![[9]](#references)
 
 ### `com.apple.private.apfs.create-sealed-snapshot`
 
-TODO: In [**this report**](https://jhftss.github.io/The-Nightmare-of-Apple-OTA-Update/) **is mentioned that this could be used to** update the SSV-protected contents after a reboot. If you know how it send a PR please!
+TODO: In [**this report**](https://jhftss.github.io/The-Nightmare-of-Apple-OTA-Update/) **is mentioned that this could be used to** update the SSV-protected contents after a reboot. If you know how it send a PR please![[9]](#references)
 
 ### `keychain-access-groups`
 
@@ -167,18 +167,18 @@ There are some entitlements that could be used to bypass Trustcache/CDhash prote
 
 ### `com.apple.security.cs.allow-jit`
 
-This entitlement allows to **create memory that is writable and executable** by passing the `MAP_JIT` flag to the `mmap()` system function. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-jit).
+This entitlement allows to **create memory that is writable and executable** by passing the `MAP_JIT` flag to the `mmap()` system function. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-jit).[[10]](#references)
 
 ### `com.apple.security.cs.allow-unsigned-executable-memory`
 
-This entitlement allows to **override or patch C code**, use the long-deprecated **`NSCreateObjectFileImageFromMemory`** (which is fundamentally insecure), or use the **DVDPlayback** framework. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-unsigned-executable-memory).
+This entitlement allows to **override or patch C code**, use the long-deprecated **`NSCreateObjectFileImageFromMemory`** (which is fundamentally insecure), or use the **DVDPlayback** framework. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-unsigned-executable-memory).[[11]](#references)
 
 > [!CAUTION]
 > Including this entitlement exposes your app to common vulnerabilities in memory-unsafe code languages. Carefully consider whether your app needs this exception.
 
 ### `com.apple.security.cs.disable-executable-page-protection`
 
-This entitlement allows to **modify sections of its own executable files** on disk to forcefully exit. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_disable-executable-page-protection).
+This entitlement allows to **modify sections of its own executable files** on disk to forcefully exit. Check [**this for more info**](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_disable-executable-page-protection).[[12]](#references)
 
 > [!CAUTION]
 > The Disable Executable Memory Protection Entitlement is an extreme entitlement that removes a fundamental security protection from your app, making it possible for an attacker to rewrite your app’s executable code without detection. Prefer narrower entitlements if possible.
@@ -298,8 +298,17 @@ For detailed IOKit/DriverKit exploitation, see:
 
 ## References
 
-- [1] [Apple Developer — Entitlements](https://developer.apple.com/documentation/bundleresources/entitlements)
-- [2] [XNU — `bsd/sys/codesign.h` (`CS_OPS_*` operations and `CLEAR_LV_ENTITLEMENT`)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/sys/codesign.h)
-- [3] [XNU — `bsd/kern/kern_proc.c` (`csops` / `CS_OPS_CLEAR_LV` handler)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/kern/kern_proc.c)
+- [1] [XNU — `bsd/sys/codesign.h` (`CS_OPS_*` operations and `CLEAR_LV_ENTITLEMENT`)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/sys/codesign.h)
+- [2] [XNU — `bsd/kern/kern_proc.c` (`csops` / `CS_OPS_CLEAR_LV` handler)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/kern/kern_proc.c)
+- [3] [Apple Developer — Debugging Tool Entitlement (`com.apple.security.cs.debugger`)](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_debugger)
+- [4] [Apple Developer — Disable Library Validation Entitlement](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_disable-library-validation)
+- [5] [Apple Developer — Allow DYLD Environment Variables Entitlement](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-dyld-environment-variables)
+- [6] [Objective-See — CVE-2020-9934: Bypassing TCC](https://objective-see.org/blog/blog_0x4C.html)
+- [7] [Wojciech Reguła — Play the music and bypass TCC aka CVE-2020-29621](https://wojciechregula.blog/post/play-the-music-and-bypass-tcc-aka-cve-2020-29621/)
+- [8] [#OBTS v5.0: "What Happens on your Mac, Stays on Apple's iCloud?!" - Wojciech Regula (YouTube)](https://www.youtube.com/watch?v=_6e2LhmxVc0)
+- [9] [The Nightmare of Apple's OTA Update: Bypassing the Signature Verification and Pwning the Kernel](https://jhftss.github.io/The-Nightmare-of-Apple-OTA-Update/)
+- [10] [Apple Developer — Allow Execution of JIT-compiled Code Entitlement (`com.apple.security.cs.allow-jit`)](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-jit)
+- [11] [Apple Developer — Allow Unsigned Executable Memory Entitlement](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-unsigned-executable-memory)
+- [12] [Apple Developer — Disable Executable Memory Protection Entitlement](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_disable-executable-page-protection)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/README.md
index e3d487e1eb5..e1c71ea8f6d 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/README.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/README.md
@@ -383,7 +383,7 @@ A very common privesc primitive is making a **privileged process create a file f
 1. A directory you own (or where you can set an **inheritable ACL**), so anything created inside inherits your permissions.
 2. A privileged/`suid` process that can be told **where** to create a file — typically through a debug/logging environment variable, a config file, or a helper's XPC API.
 
-The **inheritable ACL** part is what makes the created file writable by you even though it is owned by another user. The `file_inherit` / `directory_inherit` inheritance flags are documented in [`chmod(1)`](https://keith.github.io/xcode-man-pages/chmod.1.html):
+The **inheritable ACL** part is what makes the created file writable by you even though it is owned by another user. The `file_inherit` / `directory_inherit` inheritance flags are documented in [`chmod(1)`](https://keith.github.io/xcode-man-pages/chmod.1.html):[[2]](#references)
 
 ```bash
 DIRNAME=/tmp/inherit_test
@@ -521,5 +521,3 @@ This feature is particularly useful for preventing certain classes of security v
 - [8] [Kandji - Uncovering Apple Vulnerabilities: The diskarbitrationd and storagekitd Audit Story Part 1](https://www.kandji.io/blog/macos-audit-story-part1)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/macos-xattr-acls-extra-stuff.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/macos-xattr-acls-extra-stuff.md
index 1f01dd1e6f2..8cc183e726b 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/macos-xattr-acls-extra-stuff.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-fs-tricks/macos-xattr-acls-extra-stuff.md
@@ -180,6 +180,3 @@ xattr -l protected
 ```
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.md
index 5e17b4ca801..9f1664fdb5a 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.md
@@ -533,7 +533,7 @@ aa archive -d s/ -o app.aar
 
 ### [CVE-2023-41067]
 
-A Gatekeeper bypass fixed in macOS Sonoma 14.0 allowed crafted apps to run without prompting. Details were disclosed publicly after patching and the issue was actively exploited in the wild before fix. Ensure Sonoma 14.0 or later is installed.
+A Gatekeeper bypass fixed in macOS Sonoma 14.0 allowed crafted apps to run without prompting. Details were disclosed publicly after patching and the issue was actively exploited in the wild before fix. Ensure Sonoma 14.0 or later is installed.[[13]](#references)
 
 ### [CVE-2024-27853]
 
@@ -560,7 +560,6 @@ Several vulnerabilities in popular extraction tools (e.g., The Unarchiver) cause
 
 In an ".app" bundle if the quarantine xattr is not added to it, when executing it **Gatekeeper won't be triggered**.
 
-
 ## References
 
 - [1] [Apple Platform Security: About the security content of macOS Sonoma 14.4 (includes CVE-2024-27853)](https://support.apple.com/en-us/HT214084)
@@ -575,5 +574,6 @@ In an ".app" bundle if the quarantine xattr is not added to it, when executing i
 - [10] [F-Secure: Discovery of a Gatekeeper Bypass (CVE-2023-27943)](https://blog.f-secure.com/discovery-of-gatekeeper-bypass-cve-2023-27943/)
 - [11] [Finding and reporting a Gatekeeper bypass exploit with help from Mac Monitor](https://redcanary.com/blog/gatekeeper-bypass-vulnerabilities/)
 - [12] [CODE BLUE 2023: Bypassing macOS Security and Privacy Mechanisms — From Gatekeeper to System Integrity Protection (Koh Nakagawa)](https://codeblue.jp/2023/result/pdf/cb23-bypassing-macos-security-and-privacy-mechanisms-from-gatekeeper-to-system-integrity-protection-by-koh-nakagawa.pdf)
+- [13] [Apple: About the security content of macOS Sonoma 14 (CVE-2023-41067)](https://support.apple.com/en-us/HT213940)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-input-monitoring-screen-capture-accessibility.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-input-monitoring-screen-capture-accessibility.md
index 2bef53a5c51..e975d95a5a5 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-input-monitoring-screen-capture-accessibility.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-input-monitoring-screen-capture-accessibility.md
@@ -331,6 +331,5 @@ WHERE tccPermsStr LIKE '%kTCCServiceListenEvent%'
 - [1] [Apple Developer — Event Taps](https://developer.apple.com/documentation/coregraphics/quartz_event_services)
 - [2] [Apple Developer — Accessibility API](https://developer.apple.com/documentation/applicationservices/axuielement_h)
 - [3] [Apple Developer — ScreenCaptureKit](https://developer.apple.com/documentation/screencapturekit)
-- [4] [Objective-See — Accessibility Abuse as TCC Bypass](https://objective-see.org/blog.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.md
index fa271a7f656..ebe2b940b7e 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.md
@@ -4,11 +4,11 @@
 
 ## Basic Information
 
-Launch constraints in macOS were introduced to enhance security by **regulating how, who, and from where a process can be initiated**. Initiated in macOS Ventura, they provide a framework that categorizes **each system binary into distinct constraint categories**, which are defined within the **trust cache**, a list containing system binaries and their respective hashes​. These constraints extend to every executable binary within the system, entailing a set of **rules** delineating the requirements for **launching a particular binary**. The rules encompass self constraints that a binary must satisfy, parent constraints required to be met by its parent process, and responsible constraints to be adhered to by other relevant entities​.
+Launch constraints in macOS were introduced to enhance security by **regulating how, who, and from where a process can be initiated**. Initiated in macOS Ventura, they provide a framework that categorizes **each system binary into distinct constraint categories**, which are defined within the **trust cache**, a list containing system binaries and their respective hashes​. These constraints extend to every executable binary within the system, entailing a set of **rules** delineating the requirements for **launching a particular binary**. The rules encompass self constraints that a binary must satisfy, parent constraints required to be met by its parent process, and responsible constraints to be adhered to by other relevant entities​.[[1]](#references)[[4]](#references)
 
-The mechanism extends to third-party apps through **Environment Constraints**, beginning from macOS Sonoma, allowing developers to protect their apps by specifying a **set of keys and values for environment constraints.**
+The mechanism extends to third-party apps through **Environment Constraints**, beginning from macOS Sonoma, allowing developers to protect their apps by specifying a **set of keys and values for environment constraints.**[[5]](#references)
 
-You define **launch environment and library constraints** in constraint dictionaries that you either save in **`launchd` property list files**, or in **separate property list** files that you use in code signing.
+You define **launch environment and library constraints** in constraint dictionaries that you either save in **`launchd` property list files**, or in **separate property list** files that you use in code signing.[[5]](#references)
 
 There are 4 types of constraints:
 
@@ -192,6 +192,3 @@ After the fix, **both** the built-in and the supplied constraints are validated,
 - [7] [macOS Sonoma (14) Launch Constraints (theevilbit gist)](https://gist.github.com/theevilbit/a6fef1e0397425a334d064f7b6e1be53)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.md
index ed1491813af..459a6801d1c 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-macf-mandatory-access-control-framework.md
@@ -12,9 +12,7 @@ Note that MACF doesn't really make any decisions as it just **intercepts** actio
 - A policy may be monitoring (return 0, so as not to object but piggyback on hook to do something)
 - A MACF static policy is installed in boot and will NEVER be removed
 - A MACF dynamic policy is installed by a KEXT (kextload) and may hypothetically be kextunloaded
-- In iOS only static policies are allowed and in macOS static + dynamic.
-- [https://newosxbook.com/xxr/index.php](https://newosxbook.com/xxr/index.php)
-
+- In iOS only static policies are allowed and in macOS static + dynamic.[[7]](#references)
 
 ### Flow
 
@@ -478,7 +476,7 @@ When auditing root brokers reachable from the sandbox, grep first for:
 
 ### Trusted deputies with private entitlements
 
-Another practical pattern is to avoid attacking MACF hooks directly and instead abuse a **trusted process** that already carries the rights needed to cross the boundary. Recent Safari/TCC research is a good example: the interesting primitive was not "disable TCC in the kernel", but modifying local policy/configuration so an Apple-signed process with **`com.apple.private.tcc.allow`** performs the sensitive action on your behalf. In practice, high-value auditing targets are Apple daemons/apps that combine:
+Another practical pattern is to avoid attacking MACF hooks directly and instead abuse a **trusted process** that already carries the rights needed to cross the boundary. Recent Safari/TCC research is a good example: the interesting primitive was not "disable TCC in the kernel", but modifying local policy/configuration so an Apple-signed process with **`com.apple.private.tcc.allow`** performs the sensitive action on your behalf.[[8]](#references) In practice, high-value auditing targets are Apple daemons/apps that combine:
 
 - **private entitlements** or FDA-like reach
 - a writable config / database / mount point / policy file
@@ -494,6 +492,7 @@ For deeper product-specific reversing, check the dedicated pages on [macOS Sandb
 - [4] [XNU — `bsd/sys/priv.h` (privilege codes used by `priv_check`/`priv_grant`)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/sys/priv.h)
 - [5] [AMFI Syscall (Offensive Security)](https://www.offsec.com/blog/amfi-syscall/)
 - [6] [Uncovering Apple Vulnerabilities: diskarbitrationd and storagekitd Audit Part 2](https://blog.kandji.io/macos-audit-story-part2)
-
+- [7] [XXR — XNU Cross Reference tool](https://newosxbook.com/xxr/index.php)
+- [8] [New macOS vulnerability, "HM Surf", could lead to unauthorized data access (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2024/10/17/new-macos-vulnerability-hm-surf-could-lead-to-unauthorized-data-access/)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/README.md
index 1a4ed9da9eb..8b044cf9b55 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/README.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/README.md
@@ -409,5 +409,3 @@ Sandbox also has a user daemon running exposing the XPC Mach service `com.apple.
 - [8] [HITBGSEC 2016 SG - The Apple Sandbox: Deeper Into The Quagmire - Jonathan Levin](https://www.youtube.com/watch?v=mG715HcDgO8&t=3011s)
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-default-sandbox-debug.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-default-sandbox-debug.md
index 9efff647086..380f3c5c7e2 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-default-sandbox-debug.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-default-sandbox-debug.md
@@ -113,6 +113,3 @@ codesign --remove-signature SandboxedShellApp.app
 ```
 
 {{#include ../../../../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/README.md
index a1a302e9be0..d7bbfd7d5d0 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/README.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/README.md
@@ -11,7 +11,7 @@ In the previous image it's possible to observe **how the sandbox will be loaded*
 The compiler will link `/usr/lib/libSystem.B.dylib` to the binary.
 
 Then, **`libSystem.B`** will be calling other several functions until the **`xpc_pipe_routine`** sends the entitlements of the app to **`securityd`**. Securityd checks if the process should be quarantine inside the Sandbox, and if so, it will be quarentine.\
-Finally, the sandbox will be activated will a call to **`__sandbox_ms`** which will call **`__mac_syscall`**.[[1]](#references)
+Finally, the sandbox will be activated will a call to **`__sandbox_ms`** which will call **`__mac_syscall`**.[[1]](#references)[[3]](#references)
 
 ## Possible Bypasses
 
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/macos-office-sandbox-bypasses.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/macos-office-sandbox-bypasses.md
index 311aada5c37..8822ea48833 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/macos-office-sandbox-bypasses.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox/macos-sandbox-debug-and-bypass/macos-office-sandbox-bypasses.md
@@ -47,7 +47,7 @@ The **`open`** utility also supported the **`--stdin`** param (and after the pre
 The thing is that even if **`python`** was signed by Apple, it **won't execute** a script with the **`quarantine`** attribute. However, it was possible to pass it a script from stdin so it won't check if it was quarantined or not:
 
 1. Drop a **`~$exploit.py`** file with arbitrary Python commands.
-2. Run _open_ **`–stdin='~$exploit.py' -a Python`**, which runs the Python app with our dropped file serving as its standard input. Python happily runs our code, and since it’s a child process of _launchd_, it isn’t bound to Word’s sandbox rules.
+2. Run _open_ **`–stdin='~$exploit.py' -a Python`**, which runs the Python app with our dropped file serving as its standard input. Python happily runs our code, and since it’s a child process of _launchd_, it isn’t bound to Word’s sandbox rules.[[5]](#references)
 
 ## References
 
@@ -55,6 +55,7 @@ The thing is that even if **`python`** was signed by Apple, it **won't execute**
 - [2] [Office Drama on macOS](https://objective-see.org/blog/blog_0x4B.html)
 - [3] [Office365 MacOS Sandbox Escape](https://desi-jarvis.medium.com/office365-macos-sandbox-escape-fcce4fa4123c)
 - [4] [Technical Analysis of CVE-2021-30864](https://perception-point.io/blog/technical-analysis-of-cve-2021-30864/)
+- [5] [Uncovering a macOS App Sandbox escape vulnerability: A deep dive into CVE-2022-26706 - Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2022/07/13/uncovering-a-macos-app-sandbox-escape-vulnerability-a-deep-dive-into-cve-2022-26706/)
 
 {{#include ../../../../../banners/hacktricks-training.md}}
 
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/README.md
index 5e58032821c..924e270ebde 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/README.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/README.md
@@ -725,7 +725,7 @@ If you have **`kTCCServiceEndpointSecurityClient`**, you have FDA. End.
 
 ### System Policy SysAdmin File to FDA
 
-**`kTCCServiceSystemPolicySysAdminFiles`** allows to **change** the **`NFSHomeDirectory`** attribute of a user that changes his home folder and therefore allows to **bypass TCC**.
+**`kTCCServiceSystemPolicySysAdminFiles`** allows to **change** the **`NFSHomeDirectory`** attribute of a user that changes his home folder and therefore allows to **bypass TCC**.[[5]](#references)
 
 ### User TCC DB to FDA
 
@@ -794,6 +794,7 @@ macos-tcc-bypasses/
 - [2] [maclTrack.command - script to track com.apple.macl (Gist by brunerd)](https://gist.githubusercontent.com/brunerd/8bbf9ba66b2a7787e1a6658816f3ad3b/raw/34cabe2751fb487dc7c3de544d1eb4be04701ac5/maclTrack.command)
 - [3] [Track and Tackle com.apple.macl](https://www.brunerd.com/blog/2020/01/07/track-and-tackle-com-apple-macl/)
 - [4] [Bypassing macOS TCC User Privacy Protections By Accident And Design](https://www.sentinelone.com/labs/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/)
+- [5] [Change home directory and bypass TCC aka CVE-2020-27937](https://wojciechregula.blog/post/change-home-directory-and-bypass-tcc-aka-cve-2020-27937/)
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.md
index 8f9fabbeba8..46203fababf 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.md
@@ -64,5 +64,3 @@ However, there are still some tools that can be used to understand this kind of
 - [4] [FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts](https://labs.sentinelone.com/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/)
 
 {{#include ../../../../../banners/hacktricks-training.md}}
-
-
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-credential-and-data-theft.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-credential-and-data-theft.md
index aad337e138b..6cd4e4072c0 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-credential-and-data-theft.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-credential-and-data-theft.md
@@ -4,7 +4,7 @@
 
 ## Overview
 
-macOS TCC (Transparency, Consent, and Control) protects access to sensitive user data. When an attacker **compromises a binary that already has TCC grants**, they inherit those permissions. This page documents the exploitation potential of each data-theft-related TCC permission.
+macOS TCC (Transparency, Consent, and Control) protects access to sensitive user data. When an attacker **compromises a binary that already has TCC grants**, they inherit those permissions. This page documents the exploitation potential of each data-theft-related TCC permission.[[2]](#references)
 
 > [!WARNING]
 > Code injection into a TCC-granted binary (via DYLD injection, dylib hijacking, or task port) **silently inherits all its TCC permissions**. There is no additional prompt or verification when the same process reads protected data.
@@ -24,7 +24,7 @@ The macOS Keychain stores:
 
 ### Entitlement: `keychain-access-groups`
 
-Keychain items are organized into **access groups**. An application's `keychain-access-groups` entitlement lists which groups it can access:
+Keychain items are organized into **access groups**. An application's `keychain-access-groups` entitlement lists which groups it can access:[[1]](#references)
 
 ```xml
 keychain-access-groups
@@ -266,7 +266,7 @@ This entitlement allows communicating with `com.apple.iCloudHelper` XPC service,
 - **iCloud tokens** — authentication tokens for the user's Apple ID
 - **iCloud Drive** — synced documents from all devices
 - **iCloud Keychain** — passwords synced across all Apple devices
-- **Find My** — location of all the user's Apple devices[[4]](#references)
+- **Find My** — location of all the user's Apple devices[[3]](#references)
 
 ```bash
 # Find iCloud-entitled binaries
@@ -354,7 +354,6 @@ SELECT path FROM executables WHERE iCloudAccs = 1;" 2>/dev/null
 
 - [1] [Apple Developer — Keychain Services](https://developer.apple.com/documentation/security/keychain_services)
 - [2] [Apple Developer — TCC](https://developer.apple.com/documentation/security/protecting-the-user-s-privacy)
-- [3] [Objective-See — TCC Exploitation](https://objective-see.org/blog/blog_0x4C.html)
-- [4] [OBTS v5.0 — "What Happens on your Mac, Stays on Apple's iCloud?!" (Wojciech Regula)](https://www.youtube.com/watch?v=_6e2LhmxVc0)
+- [3] [OBTS v5.0 — "What Happens on your Mac, Stays on Apple's iCloud?!" (Wojciech Regula)](https://www.youtube.com/watch?v=_6e2LhmxVc0)
 
 {{#include ../../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.md
index 84be17f55c3..7928b04feeb 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-payloads.md
@@ -8,7 +8,7 @@
 > For **Screen Recording**, **Input Monitoring**, and **synthetic input**, modern macOS also exposes explicit preflight / request APIs such as `CGPreflightScreenCaptureAccess`, `CGRequestScreenCaptureAccess`, `CGRequestListenEventAccess`, and `CGRequestPostEventAccess`.
 
 > [!WARNING]
-> This is still a very realistic attack path: recent permission-theft research against Microsoft macOS apps showed that **weak library validation / plugin loading** can let an attacker reuse the victim app's already-granted **camera**, **microphone**, and other TCC permissions without a second prompt.
+> This is still a very realistic attack path: recent permission-theft research against Microsoft macOS apps showed that **weak library validation / plugin loading** can let an attacker reuse the victim app's already-granted **camera**, **microphone**, and other TCC permissions without a second prompt.[[1]](#references)
 
 ## Quick triage before using a payload
 
@@ -465,7 +465,7 @@ static void telegram(int argc, const char **argv) {
 {{#endtab}}
 
 {{#tab name="ObjectiveC - Prompt"}}
-Trigger the camera prompt if the current process is still `NotDetermined`.
+Trigger the camera prompt if the current process is still `NotDetermined`.[[3]](#references)
 
 ```objectivec
 #import 
@@ -637,7 +637,7 @@ static void telegram(int argc, const char **argv) {
 {{#endtab}}
 
 {{#tab name="ObjectiveC - Prompt"}}
-Trigger the microphone prompt if the current process is still `NotDetermined`.
+Trigger the microphone prompt if the current process is still `NotDetermined`.[[3]](#references)
 
 ```objectivec
 #import 
@@ -849,7 +849,7 @@ screencapture -V 5 /tmp/screen.mov
 {{#endtabs}}
 
 > [!TIP]
-> On **macOS 12.3+**, `ScreenCaptureKit` is usually the better post-exploitation primitive than `AVCaptureScreenInput`: it can do high-performance streaming, single-frame grabs with `SCScreenshotManager`, and stream **system audio**. Recent `ScreenCaptureKit` updates also added `captureMicrophone` / `microphoneCaptureDeviceID` on `SCStreamConfiguration` plus `SCRecordingOutput` for straight-to-file recording, so one hijacked screen-capture client can save screen + system audio directly and add mic audio when the process also holds `kTCCServiceMicrophone`. For more desktop-session abuse primitives, see [this related page](../macos-input-monitoring-screen-capture-accessibility.md).
+> On **macOS 12.3+**, `ScreenCaptureKit` is usually the better post-exploitation primitive than `AVCaptureScreenInput`: it can do high-performance streaming, single-frame grabs with `SCScreenshotManager`, and stream **system audio**. Recent `ScreenCaptureKit` updates also added `captureMicrophone` / `microphoneCaptureDeviceID` on `SCStreamConfiguration` plus `SCRecordingOutput` for straight-to-file recording, so one hijacked screen-capture client can save screen + system audio directly and add mic audio when the process also holds `kTCCServiceMicrophone`.[[4]](#references) For more desktop-session abuse primitives, see [this related page](../macos-input-monitoring-screen-capture-accessibility.md).
 
 ### Accessibility
 
@@ -1045,8 +1045,6 @@ int main() {
 > [!TIP]
 > Newer macOS versions also split desktop-session abuse across **Input Monitoring** (`kTCCServiceListenEvent`) and **synthetic input** (`kTCCServicePostEvent`). If you need keylogging, screen grabs, or raw event injection instead of AXUIElement automation, check [macOS Input Monitoring, Screen Capture & Accessibility Abuse](../macos-input-monitoring-screen-capture-accessibility.md).
 
-
-
 ## References
 
 - [1] [Cisco Talos - How multiple vulnerabilities in Microsoft apps for macOS pave the way to stealing permissions](https://blog.talosintelligence.com/how-multiple-vulnerabilities-in-microsoft-apps-for-macos-pave-the-way-to-stealing-permissions/)
@@ -1056,5 +1054,4 @@ int main() {
 - [5] [vsociety - CVE-2023-26818: MacOS TCC Bypass with Telegram using DyLib Injection Part1](https://vsociety.medium.com/cve-2023-26818-macos-tcc-bypass-with-telegram-using-dylib-injection-part1-768b34efd8c4)
 - [6] [Vicarius vsociety - CVE-2023-26818: Exploit macOS TCC Bypass w/ Telegram (Part 1)](https://www.vicarius.io/vsociety/posts/cve-2023-26818-exploit-macos-tcc-bypass-w-telegram-part-1-2)
 
-
 {{#include ../../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-users.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-users.md
index 8a2558bcb66..a18c0782cf4 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-users.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-users.md
@@ -33,6 +33,3 @@ MacOS also support to login via external identity providers such as FaceBook, Go
 Moreover, `accountsd` gets the list of account types from `/Library/Preferences/SystemConfiguration/com.apple.accounts.exists.plist`.
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/macos-hardening/macos-useful-commands.md b/src/macos-hardening/macos-useful-commands.md
index 07806a64012..6591e108fd9 100644
--- a/src/macos-hardening/macos-useful-commands.md
+++ b/src/macos-hardening/macos-useful-commands.md
@@ -162,6 +162,3 @@ Without prompts
 - [1] [2025, the year of the Infostealer](https://www.pentestpartners.com/security-blog/2025-the-year-of-the-infostealer/)
 
 {{#include ../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/mobile-pentesting/android-app-pentesting/README.md b/src/mobile-pentesting/android-app-pentesting/README.md
index cc0babc94b9..ecdb973e450 100644
--- a/src/mobile-pentesting/android-app-pentesting/README.md
+++ b/src/mobile-pentesting/android-app-pentesting/README.md
@@ -33,12 +33,12 @@ Sometimes it is interesting to **modify the application code** to access **hidde
 - [Abusing Accessibility Services (Android RAT)](accessibility-services-abuse.md)
 - [Android IME / InputMethodService Abuse (Malicious Keyboards)](inputmethodservice-ime-abuse.md)
 - [NFC/EMV Relay via HCE (Android Tap-to-Pay abuse)](android-hce-nfc-emv-relay-attacks.md)
-- [Android POS payment sockets / ISO 8583 backend abuse](../../network-services-pentesting/pentesting-iso-8583-payment-sockets.md)[[16]](#references)
+- [Android POS payment sockets / ISO 8583 backend abuse](../../network-services-pentesting/pentesting-iso-8583-payment-sockets.md)[[15]](#references)
 - **Download APKs**: [https://apps.evozi.com/apk-downloader/](https://apps.evozi.com/apk-downloader/), [https://apkpure.com/es/](https://apkpure.com/es/), [https://www.apkmirror.com/](https://www.apkmirror.com), [https://apkcombo.com/es-es/apk-downloader/](https://apkcombo.com/es-es/apk-downloader/), [https://github.com/kiber-io/apkd](https://github.com/kiber-io/apkd)
 
 ### Automated multi-source APK acquisition (justapk)
 
-`pip install justapk` (Python 3.11+). CLI outputs JSON to **stdout** and progress to **stderr** (pipe-friendly). It tries a deterministic fallback chain across **APK20 → F-Droid → APKPure (mobile API) → APKMirror (HTML scrape) → Uptodown (mobile API) → APKCombo (HTML scrape)**. Cloudflare-protected sources use **curl_cffi** with TLS fingerprint impersonation to mimic real clients and reduce bot-detection blocks.[[14]](#references)
+`pip install justapk` (Python 3.11+). CLI outputs JSON to **stdout** and progress to **stderr** (pipe-friendly). It tries a deterministic fallback chain across **APK20 → F-Droid → APKPure (mobile API) → APKMirror (HTML scrape) → Uptodown (mobile API) → APKCombo (HTML scrape)**. Cloudflare-protected sources use **curl_cffi** with TLS fingerprint impersonation to mimic real clients and reduce bot-detection blocks.[[13]](#references)
 
 ```bash
 justapk download               # auto fallback
@@ -48,7 +48,7 @@ justapk info org.telegram.messenger
 justapk convert app.xapk -o output/      # merges splits, re-signs with debug key
 ```
 
-**convert** merges XAPK/split APKs and signs them with a **debug key**, so the resulting APK signature/provenance differs from the original (use for testing/analysis, not production installs).[[14]](#references)
+**convert** merges XAPK/split APKs and signs them with a **debug key**, so the resulting APK signature/provenance differs from the original (use for testing/analysis, not production installs).[[13]](#references)
 
 - Extract APK from device:
 
@@ -75,7 +75,7 @@ java -jar uber-apk-signer.jar -a merged.apk --allowResign -o merged_signed
 
 ## Jezail rooted Android pentesting toolkit (REST API + web UI)
 
-- Runs on a **rooted device** (Magisk/rootAVD) and starts an **HTTP server on tcp/8080** with a **Flutter web UI** and **REST API**.[[15]](#references)
+- Runs on a **rooted device** (Magisk/rootAVD) and starts an **HTTP server on tcp/8080** with a **Flutter web UI** and **REST API**.[[14]](#references)
 - Install the release APK with perms: `adb install -g -r jezail.apk`, then launch the app (server auto-starts).
 - Endpoints: `http://:8080/` (UI), `http://:8080/api/json` (API listing), `http://:8080/api/swagger` (Swagger).
 - Emulator port-forward to reach UI/API from the host: `adb forward tcp:8080 tcp:8080` then browse `http://localhost:8080`.
@@ -133,7 +133,7 @@ Practical workflow when a sample "looks empty" or decompilers crash:
 2. If the file list differs across tools, or `jadx` / `apktool` fails on `AndroidManifest.xml`, treat the APK as intentionally malformed instead of assuming corruption in transit.
 3. Rebuild a **normalized APK** that rewrites ZIP metadata, repairs the manifest, and sanitises hostile asset names before deeper reversing.
 
-One purpose-built tool for this is **MalFixer**:[[12]](#references)
+One purpose-built tool for this is **MalFixer**:[[11]](#references)
 
 ```bash
 python malfixer.py /path/to/app.apk
@@ -304,7 +304,7 @@ bypass-biometric-authentication-android.md
 - **Send SMSs**: `sendTextMessage, sendMultipartTestMessage`
 - **Native functions** declared as `native`: `public native, System.loadLibrary, System.load`
   - [Read this to learn **how to reverse native functions**](reversing-native-libraries.md)
-- In-memory native code execution via JNI (downloaded shellcode → mmap/mprotect → call):[[13]](#references)
+- In-memory native code execution via JNI (downloaded shellcode → mmap/mprotect → call):[[12]](#references)
 
 {{#ref}}
 in-memory-jni-shellcode-execution.md
@@ -372,7 +372,7 @@ You need to activate the **debugging** options and it will be cool if you can **
 > Once you have installed the application, the first thing you should do is to try it and investigate what does it do, how does it work and get comfortable with it.\
 > I will suggest to **perform this initial dynamic analysis using MobSF dynamic analysis + pidcat**, so we will be able to **learn how the application works** while MobSF **captures** a lot of **interesting** **data** you can review later on.
 
-Magisk/Zygisk quick notes (recommended on Pixel devices)[[11]](#references)
+Magisk/Zygisk quick notes (recommended on Pixel devices)[[10]](#references)
 - Patch boot.img with the Magisk app and flash via fastboot to get systemless root
 - Enable Zygisk + DenyList for root hiding; consider LSPosed/Shamiko when stronger hiding is required
 - Keep original boot.img to recover from OTA updates; re-patch after each OTA
@@ -537,7 +537,7 @@ If **Flutter** is being used you need to to follow the instructions in [**this p
 
 Before attempting runtime bypasses, quickly map where pinning is enforced in the APK. Static discovery helps you plan hooks/patches and focus on the right code paths.
 
-Tool: SSLPinDetect[[8]](#references)[[9]](#references)
+Tool: SSLPinDetect[[7]](#references)[[8]](#references)
 - Open-source static-analysis utility that decompiles the APK to Smali (via apktool) and scans for curated regex patterns of SSL/TLS pinning implementations.
 - Reports exact file path, line number, and a code snippet for each match.
 - Covers common frameworks and custom code paths: OkHttp CertificatePinner, custom javax.net.ssl.X509TrustManager.checkServerTrusted, SSLContext.init with custom TrustManagers/KeyManagers, and Network Security Config XML pins.
@@ -579,7 +579,7 @@ Use or extend signatures to detect proprietary/custom pinning styles. You can lo
 
 Notes and tips
 - Fast scanning on large apps via multi-threading and memory-mapped I/O; pre-compiled regex reduces overhead/false positives.
-- Pattern collection: https://github.com/aancw/smali-sslpin-patterns[[10]](#references)
+- Pattern collection: https://github.com/aancw/smali-sslpin-patterns[[9]](#references)
 - Typical detection targets to triage next:
   - OkHttp: CertificatePinner usage, setCertificatePinner, okhttp3/okhttp package references
   - Custom TrustManagers: javax.net.ssl.X509TrustManager, checkServerTrusted overrides
@@ -946,20 +946,18 @@ AndroL4b is an Android security virtual machine based on ubuntu-mate includes th
 
 - [1] [Play Integrity API: How It Works & How to Bypass It](https://m4kr0.vercel.app/posts/play-integrity-api-how-it-works--how-to-bypass-it/)
 - [2] [OWASP Mobile Application Security](https://owasp.org/www-project-mobile-app-security/)
-- [3] [Application Security Wiki](https://appsecwiki.com/#/) - It is a great list of resources
-- [4] [Android App Reverse Engineering 101](https://maddiestone.github.io/AndroidAppRE/) - Android quick course
-- [5] [Android Application Security Series](https://manifestsecurity.com/android-application-security/)
-- [6] [Android-Security-Teryaagh](https://github.com/Ralireza/Android-Security-Teryaagh)
-- [7] [Mobile Hacking Workshop - Community Day](https://www.youtube.com/watch?v=PMKnPaGWxtg&feature=youtu.be&ab_channel=B3nacSec)
-- [8] [SSLPinDetect: Advanced SSL Pinning Detection for Android Security Analysis](https://petruknisme.medium.com/sslpindetect-advanced-ssl-pinning-detection-for-android-security-analysis-1390e9eca097)
-- [9] [SSLPinDetect GitHub](https://github.com/aancw/SSLPinDetect)
-- [10] [smali-sslpin-patterns](https://github.com/aancw/smali-sslpin-patterns)
-- [11] [Build a Repeatable Android Bug Bounty Lab: Emulator vs Magisk, Burp, Frida, and Medusa](https://www.yeswehack.com/learn-bug-bounty/android-lab-mobile-hacking-tools)
-- [12] [MalFixer](https://github.com/Cleafy/Malfixer)
-- [13] [CoRPhone — Android in-memory JNI execution and packaging pipeline](https://github.com/0xdevil/corphone)
-- [14] [justapk — multi-source APK downloader with Cloudflare bypass](https://github.com/TheQmaks/justapk)
-- [15] [Jezail rooted Android pentesting toolkit (REST API + Flutter UI)](https://github.com/zahidaz/jezail)
-- [16] [ISO 8583 Under Fire: Finding Vulnerabilities in a Payment Socket](https://m4kr0.vercel.app/posts/iso-8583-under-fire-finding-vulnerabilities-in-a-payment-socket/)
-
+- [3] [Android App Reverse Engineering 101](https://maddiestone.github.io/AndroidAppRE/) - Android quick course
+- [4] [Android Application Security Series](https://manifestsecurity.com/android-application-security/)
+- [5] [Android-Security-Teryaagh](https://github.com/Ralireza/Android-Security-Teryaagh)
+- [6] [Mobile Hacking Workshop - Community Day](https://www.youtube.com/watch?v=PMKnPaGWxtg&feature=youtu.be&ab_channel=B3nacSec)
+- [7] [SSLPinDetect: Advanced SSL Pinning Detection for Android Security Analysis](https://petruknisme.medium.com/sslpindetect-advanced-ssl-pinning-detection-for-android-security-analysis-1390e9eca097)
+- [8] [SSLPinDetect GitHub](https://github.com/aancw/SSLPinDetect)
+- [9] [smali-sslpin-patterns](https://github.com/aancw/smali-sslpin-patterns)
+- [10] [Build a Repeatable Android Bug Bounty Lab: Emulator vs Magisk, Burp, Frida, and Medusa](https://www.yeswehack.com/learn-bug-bounty/android-lab-mobile-hacking-tools)
+- [11] [MalFixer](https://github.com/Cleafy/Malfixer)
+- [12] [CoRPhone — Android in-memory JNI execution and packaging pipeline](https://github.com/0xdevil/corphone)
+- [13] [justapk — multi-source APK downloader with Cloudflare bypass](https://github.com/TheQmaks/justapk)
+- [14] [Jezail rooted Android pentesting toolkit (REST API + Flutter UI)](https://github.com/zahidaz/jezail)
+- [15] [ISO 8583 Under Fire: Finding Vulnerabilities in a Payment Socket](https://m4kr0.vercel.app/posts/iso-8583-under-fire-finding-vulnerabilities-in-a-payment-socket/)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/mobile-pentesting/android-app-pentesting/abusing-android-media-pipelines-image-parsers.md b/src/mobile-pentesting/android-app-pentesting/abusing-android-media-pipelines-image-parsers.md
index d70ccf0b412..e185b968e48 100644
--- a/src/mobile-pentesting/android-app-pentesting/abusing-android-media-pipelines-image-parsers.md
+++ b/src/mobile-pentesting/android-app-pentesting/abusing-android-media-pipelines-image-parsers.md
@@ -14,6 +14,7 @@ Opcode List 1 : [opcode 23], [opcode 23], ...
 ```
 
 **Key takeaways**
+
 - Delivery relies on system media re-parsing (not the chat client) and thus inherits that process' permissions (full read/write access to the gallery, ability to drop new media, etc.).
 - Any image parser reachable through `MediaStore` (vision widgets, wallpapers, AI résumé features, etc.) becomes remotely reachable if the attacker can convince a target to save media.
 
diff --git a/src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md b/src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md
index 5a04fe06ab2..54f6be1a1ba 100644
--- a/src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md
+++ b/src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md
@@ -4,7 +4,7 @@
 
 ## Overview
 
-`AccessibilityService` was created to help users with disabilities interact with Android devices.  Unfortunately, the same **powerful automation APIs** (global navigation, text input, gesture dispatch, overlay windows…) can be weaponised by malware to gain **complete remote control** of the handset _without root privileges_.
+`AccessibilityService` was created to help users with disabilities interact with Android devices.  Unfortunately, the same **powerful automation APIs** (global navigation, text input, gesture dispatch, overlay windows…) can be weaponised by malware to gain **complete remote control** of the handset _without root privileges_.[[4]](#references)
 
 Modern Android banking Trojans and Remote-Access-Trojans (RATs) such as **PlayPraetor, SpyNote, BrasDex, SOVA, ToxicPanda** and many others follow the same recipe:
 
diff --git a/src/mobile-pentesting/android-app-pentesting/adb-commands.md b/src/mobile-pentesting/android-app-pentesting/adb-commands.md
index acdf63a07f3..fb498d6731c 100644
--- a/src/mobile-pentesting/android-app-pentesting/adb-commands.md
+++ b/src/mobile-pentesting/android-app-pentesting/adb-commands.md
@@ -358,4 +358,3 @@ If you want to inspect the content of the backup:
 - [1] [ADB Shell - Android ADB Commands Manual](http://adbshell.com/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/mobile-pentesting/android-app-pentesting/android-applications-basics.md b/src/mobile-pentesting/android-app-pentesting/android-applications-basics.md
index 126fba230b6..9a0642d695e 100644
--- a/src/mobile-pentesting/android-app-pentesting/android-applications-basics.md
+++ b/src/mobile-pentesting/android-app-pentesting/android-applications-basics.md
@@ -471,7 +471,7 @@ In practice, if developers use `RECEIVER_EXPORTED` to receive framework / vendor
 
 #### Weak receiver challenge-response and crash-to-restart primitives
 
-Some OEM apps try to protect an exported receiver with a broadcasted challenge-response, but the challenge is generated from a **static `Random`** seeded once at process start (`new Random(System.currentTimeMillis())`). If you can force a restart or approximate the launch time, the receiver secret becomes brute-forceable within a very small seed window.
+Some OEM apps try to protect an exported receiver with a broadcasted challenge-response, but the challenge is generated from a **static `Random`** seeded once at process start (`new Random(System.currentTimeMillis())`). If you can force a restart or approximate the launch time, the receiver secret becomes brute-forceable within a very small seed window.[[18]](#references)
 
 What to look for:
 - exported receivers/services expecting a `VERIFY_*` / `AUTH_*` value back through another broadcast
@@ -584,7 +584,7 @@ Red flags:
 - v2 verification checks only the signature over the embedded digest, but **does not recompute the digest from the APK contents**
 - package-name or metadata checks exist, but signer validation is not bound to the actual file body
 
-This can enable a **dual-signed APK**:[[18]](#references)[[19]](#references)
+This can enable a **dual-signed APK**:[[11]](#references)[[18]](#references)[[19]](#references)
 1. Build the payload with the expected package name.
 2. Sign it with an attacker-controlled **v3** signature only.
 3. Transplant a trusted APK's **v2** signing block into the payload.
diff --git a/src/mobile-pentesting/ios-pentesting/burp-configuration-for-ios.md b/src/mobile-pentesting/ios-pentesting/burp-configuration-for-ios.md
index 6727aaaee03..54ec48a83e1 100644
--- a/src/mobile-pentesting/ios-pentesting/burp-configuration-for-ios.md
+++ b/src/mobile-pentesting/ios-pentesting/burp-configuration-for-ios.md
@@ -8,7 +8,7 @@ For secure web traffic analysis and SSL pinning on iOS devices, the Burp Suite c
 
 ### Automated Installation with Burp Mobile Assistant
 
-The **Burp Mobile Assistant** simplifies the installation process of the Burp Certificate, proxy configuration, and SSL Pinning. Detailed guidance can be found on [PortSwigger's official documentation](https://portswigger.net/burp/documentation/desktop/tools/mobile-assistant/installing).
+The **Burp Mobile Assistant** simplifies the installation process of the Burp Certificate, proxy configuration, and SSL Pinning. Detailed guidance can be found on [PortSwigger's official documentation](https://portswigger.net/burp/documentation/desktop/tools/mobile-assistant/installing).[[7]](#references)
 
 ### Manual Installation Steps
 
@@ -18,7 +18,7 @@ The **Burp Mobile Assistant** simplifies the installation process of the Burp Ce
 
 ### Configuring an Interception Proxy
 
-The setup enables traffic analysis between the iOS device and the internet through Burp, requiring a Wi-Fi network that supports client-to-client traffic. If unavailable, a USB connection via usbmuxd can serve as an alternative. PortSwigger's tutorials provide in-depth instructions on [device configuration](https://support.portswigger.net/customer/portal/articles/1841108-configuring-an-ios-device-to-work-with-burp) and [certificate installation](https://support.portswigger.net/customer/portal/articles/1841109-installing-burp-s-ca-certificate-in-an-ios-device).
+The setup enables traffic analysis between the iOS device and the internet through Burp, requiring a Wi-Fi network that supports client-to-client traffic. If unavailable, a USB connection via usbmuxd can serve as an alternative. PortSwigger's tutorials provide in-depth instructions on [device configuration](https://support.portswigger.net/customer/portal/articles/1841108-configuring-an-ios-device-to-work-with-burp) and [certificate installation](https://support.portswigger.net/customer/portal/articles/1841109-installing-burp-s-ca-certificate-in-an-ios-device).[[8]](#references)[[9]](#references)
 
 ### Transparent Proxying via OpenVPN + `iptables` REDIRECT
 
@@ -160,7 +160,7 @@ For users with jailbroken devices, SSH over USB (via **iproxy**) offers a method
 
 ### Full Network Monitoring/Sniffing
 
-Monitoring of non-HTTP device traffic can be efficiently conducted using **Wireshark**, a tool capable of capturing all forms of data traffic. For iOS devices, real-time traffic monitoring is facilitated through the creation of a Remote Virtual Interface, a process detailed in [this Stack Overflow post](https://stackoverflow.com/questions/9555403/capturing-mobile-phone-traffic-on-wireshark/33175819#33175819). Prior to beginning, installation of **Wireshark** on a macOS system is a prerequisite.
+Monitoring of non-HTTP device traffic can be efficiently conducted using **Wireshark**, a tool capable of capturing all forms of data traffic. For iOS devices, real-time traffic monitoring is facilitated through the creation of a Remote Virtual Interface, a process detailed in [this Stack Overflow post](https://stackoverflow.com/questions/9555403/capturing-mobile-phone-traffic-on-wireshark/33175819#33175819).[[10]](#references) Prior to beginning, installation of **Wireshark** on a macOS system is a prerequisite.
 
 The procedure involves several key steps:
 
@@ -214,7 +214,10 @@ Steps to configure Burp as proxy:
 - [4] [Invisible proxying - PortSwigger](https://portswigger.net/burp/documentation/desktop/tools/proxy/invisible)
 - [5] [Mobile device interception with MikroTik](https://sensepost.com/blog/2026/mobile-device-interception-with-mikrotik/)
 - [6] [MikroTik RouterOS REST API](https://manual.mikrotik.com/docs/developer-guides/rest-api)
+- [7] [Installing Burp's CA certificate with the Burp Mobile Assistant - PortSwigger](https://portswigger.net/burp/documentation/desktop/tools/mobile-assistant/installing)
+- [8] [Configuring an iOS device to work with Burp - PortSwigger](https://support.portswigger.net/customer/portal/articles/1841108-configuring-an-ios-device-to-work-with-burp)
+- [9] [Installing Burp's CA certificate in an iOS device - PortSwigger](https://support.portswigger.net/customer/portal/articles/1841109-installing-burp-s-ca-certificate-in-an-ios-device)
+- [10] [Capturing mobile phone traffic on Wireshark - Stack Overflow](https://stackoverflow.com/questions/9555403/capturing-mobile-phone-traffic-on-wireshark/33175819#33175819)
 
 {{#include ../../banners/hacktricks-training.md}}
 
-
diff --git a/src/mobile-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.md b/src/mobile-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.md
index 9a7ef9addff..fda8a6b6d35 100644
--- a/src/mobile-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.md
+++ b/src/mobile-pentesting/ios-pentesting/extracting-entitlements-from-compiled-application.md
@@ -50,5 +50,3 @@ Adjusting the `-A num, --after-context=num` flag allows for the display of more
 
 {{#include ../../banners/hacktricks-training.md}}
 
-
-
diff --git a/src/mobile-pentesting/ios-pentesting/frida-configuration-in-ios.md b/src/mobile-pentesting/ios-pentesting/frida-configuration-in-ios.md
index 2970edd3c4c..0b48bac6130 100644
--- a/src/mobile-pentesting/ios-pentesting/frida-configuration-in-ios.md
+++ b/src/mobile-pentesting/ios-pentesting/frida-configuration-in-ios.md
@@ -435,7 +435,7 @@ Instrumenting the function at this level means any secret `String` arguments—f
 
 ### Frida Stalker
 
-[From the docs](https://frida.re/docs/stalker/): Stalker is Frida’s code **tracing engine**. It allows threads to be **followed**, **capturing** every function, **every block**, even every instruction which is executed.
+[From the docs](https://frida.re/docs/stalker/): Stalker is Frida’s code **tracing engine**. It allows threads to be **followed**, **capturing** every function, **every block**, even every instruction which is executed.[[5]](#references)
 
 You have an example implementing Frida Stalker in [https://github.com/poxyran/misc/blob/master/frida-stalker-example.py](https://github.com/poxyran/misc/blob/master/frida-stalker-example.py)
 
@@ -1652,8 +1652,6 @@ console.log("  - changeProtection(address, size, 'rwx')")
 - [2] [Getting Started with Frida](https://www.briskinfosec.com/blogs/blogsdetail/Getting-Started-with-Frida)
 - [3] [Bypassing iOS Frida detection with LLDB and Frida](https://tonygo.tech/blog/2025/8ksec-ios-ctf-writeup)
 - [4] [Unlocking Potential: Exploring Frida & Objection on Non-Jailbroken Devices Without Application](https://mrbypass.medium.com/unlocking-potential-exploring-frida-objection-on-non-jailbroken-devices-without-application-ed0367a84f07)
-
+- [5] [Stalker - Frida docs](https://frida.re/docs/stalker/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
diff --git a/src/mobile-pentesting/ios-pentesting/ios-app-extensions.md b/src/mobile-pentesting/ios-pentesting/ios-app-extensions.md
index 9786e8eb1b4..5b45dc41200 100644
--- a/src/mobile-pentesting/ios-pentesting/ios-app-extensions.md
+++ b/src/mobile-pentesting/ios-pentesting/ios-app-extensions.md
@@ -53,5 +53,3 @@ Tools like `frida-trace` can aid in understanding the underlying processes, espe
 
 {{#include ../../banners/hacktricks-training.md}}
 
-
-

From cc854ffec2093f9ced7c9114294eb34c0aef5ea0 Mon Sep 17 00:00:00 2001
From: HackTricks News Bot 
Date: Thu, 6 Aug 2026 08:40:50 +0000
Subject: [PATCH 2/6] Add content from: Fuyao Enterprise: Building an Ad-Fraud
 Empire with AI and Ki...

---
 .../android-app-pentesting/README.md          | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/src/mobile-pentesting/android-app-pentesting/README.md b/src/mobile-pentesting/android-app-pentesting/README.md
index cc0babc94b9..5bcf0add5dd 100644
--- a/src/mobile-pentesting/android-app-pentesting/README.md
+++ b/src/mobile-pentesting/android-app-pentesting/README.md
@@ -106,6 +106,29 @@ abusing-android-media-pipelines-image-parsers.md
 firmware-level-zygote-backdoor-libandroid_runtime.md
 {{#endref}}
 
+### Pre-installed privileged Android TV-box implants (OEM / reseller firmware abuse)
+
+Some Android botnets are not sideloaded by the victim: they are baked into OEM/reseller firmware as privileged packages and later extend themselves with secondary APKs outside the normal user install flow. Treat these samples as a **firmware/supply-chain foothold** instead of as a normal malicious app: they can keep persistent C2 channels, install follow-on modules, stream the display, and repurpose the device for fraud or residential proxying.[[17]](#references)
+
+When reversing pre-installed Android implants, prioritize the following checks.[[17]](#references)
+
+- **Package origin / privilege mismatch**: compare `codePath`, shared UID, requested permissions, and install paths against stock firmware. APKs that live outside `/data/app`, cannot be removed normally, or reappear across unrelated brands/models are strong supply-chain indicators.
+- **Trusted follow-on install paths**: inspect locations such as `/data/local/system` for dynamically dropped APKs/JARs used as task modules or alternate execution modes.
+- **Cross-layer identity spoofing**: do not trust only `getprop` or only browser fingerprints. Reconcile system properties, screen size, chipset remnants like `rockchip`, `amlogic`, or `allwinner`, launcher/settings packages, and browser-visible CPU/GPU data to catch TV-box-to-phone masquerading.
+- **Selector-independent UI automation**: if the sample combines `AccessibilityService` abuse with OCR/object-detection assets, assume the operator can survive DOM/UI churn. Inspect `assets/` for ML models, OCR libraries, browser stealth scripts, and generated JavaScript task modules instead of focusing only on selectors.
+- **Proxy-only monetization mode**: hunt for bootstrap endpoints that fetch backconnect servers, then long-lived tunnels carrying multiplexed SOCKS5 sessions over a custom framing layer. This is closer to a residential proxy backhaul than a simple local SOCKS listener; see [Tunneling and Port Forwarding](../../generic-hacking/tunneling-and-port-forwarding.md).
+- **Expired management infrastructure**: extract hardcoded domains/IPs from privileged apps and management agents, then verify whether DNS/TLS ownership still matches the vendor. If a root-capable management domain has expired, the finding becomes a mass-device takeover opportunity rather than a mere dangling record; see [Domain/Subdomain takeover](../../pentesting-web/domain-subdomain-takeover.md).
+
+A quick rooted-device triage for this pattern is:[[17]](#references)
+
+```bash
+adb shell pm list packages -f
+adb shell dumpsys package 
+adb shell find /data/local/system -maxdepth 2 -type f 2>/dev/null
+adb shell getprop | grep -E 'ro.product|ro.board|ro.hardware|ro.build'
+adb shell dumpsys accessibility
+```
+
 ## Static Analysis
 
 First of all, for analysing an APK you should **take a look to the to the Java code** using a decompiler.\
@@ -960,6 +983,7 @@ AndroL4b is an Android security virtual machine based on ubuntu-mate includes th
 - [14] [justapk — multi-source APK downloader with Cloudflare bypass](https://github.com/TheQmaks/justapk)
 - [15] [Jezail rooted Android pentesting toolkit (REST API + Flutter UI)](https://github.com/zahidaz/jezail)
 - [16] [ISO 8583 Under Fire: Finding Vulnerabilities in a Payment Socket](https://m4kr0.vercel.app/posts/iso-8583-under-fire-finding-vulnerabilities-in-a-payment-socket/)
+- [17] [Fuyao Enterprise: Building an Ad-Fraud Empire with AI and Kids' Coding Blocks](https://bitsight.com/blog/fuyao-enterprise-building-ad-fraud-empire-ai-and-kids-coding-blocks)
 
 
 {{#include ../../banners/hacktricks-training.md}}

From 500048f1350edf5d196c066322199de44a92e397 Mon Sep 17 00:00:00 2001
From: Carlos Polop 
Date: Thu, 6 Aug 2026 12:52:42 +0200
Subject: [PATCH 3/6] References: restore 11 source entries dropped by the
 audit pass (9 files)

---
 .../macos-ipc-inter-process-communication/README.md             | 1 +
 .../macos-mig-mach-interface-generator.md                       | 1 +
 .../macos-proces-abuse/macos-quicklook-generators.md            | 2 ++
 .../macos-code-signing-weaknesses-and-sandbox-escapes.md        | 2 ++
 .../macos-security-protections/macos-code-signing.md            | 1 +
 .../macos-security-protections/macos-dangerous-entitlements.md  | 1 +
 .../macos-input-monitoring-screen-capture-accessibility.md      | 1 +
 .../macos-tcc/macos-tcc-credential-and-data-theft.md            | 1 +
 src/mobile-pentesting/android-app-pentesting/README.md          | 1 +
 9 files changed, 11 insertions(+)

diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md
index ba894d72e05..25bf84a6c5e 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md
@@ -1321,5 +1321,6 @@ HALS_Object + 0x68  -> controlled_object
 - [8] [task_get_special_port – MIT Darwin XNU manual](https://web.mit.edu/darwin/src/modules/xnu/osfmk/man/task_get_special_port.html)
 - [9] [Project Zero – Sound Barrier 2](https://projectzero.google/2026/01/sound-barrier-2.html)
 - [10] [About the processor_set_tasks() access to kernel memory vulnerability – reverse.put.as](https://reverse.put.as/2014/05/05/about-the-processor_set_tasks-access-to-kernel-memory-vulnerability/)
+- [11] [XNU — `osfmk/ipc/ipc_port.h` (port rights and internals)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/ipc/ipc_port.h)
 
 {{#include ../../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md
index bb1d521be07..de399577acb 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md
@@ -402,6 +402,7 @@ The code generated by MIG also calles `kernel_debug` to generate logs about oper
 - [1] [bootstrap_cmds — `migcom.tproj` (the MIG compiler itself)](https://github.com/apple-oss-distributions/bootstrap_cmds/tree/main/migcom.tproj)
 - [2] [XNU — `osfmk/mach/mach_port.defs` (example MIG subsystem definition)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/mach_port.defs)
 - [3] [XNU — `osfmk/mach/message.h` (Mach message header layout)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/message.h)
+- [4] [XNU — `osfmk/mach/task.defs` (task subsystem MIG definition)](https://github.com/apple-oss-distributions/xnu/blob/main/osfmk/mach/task.defs)
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-quicklook-generators.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-quicklook-generators.md
index 509a28cc056..b0877e64d23 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-quicklook-generators.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-quicklook-generators.md
@@ -179,5 +179,7 @@ done
 ## References
 
 - [1] [Apple Developer — Quick Look Programming Guide](https://developer.apple.com/library/archive/documentation/UserExperience/Conceptual/Quicklook_Programming_Guide/Introduction/Introduction.html)
+- [2] [Apple Security Updates — Quick Look CVEs](https://support.apple.com/en-us/HT201222)
+- [3] [Objective-See — Quick Look Attack Surface](https://objective-see.org/blog.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md
index 56a238a889c..40e764fffec 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md
@@ -346,5 +346,7 @@ cp /tmp/evil.dylib /path/to/writable.dylib
 - [1] [Apple Developer — Code Signing Guide](https://developer.apple.com/library/archive/technotes/tn2206/_index.html)
 - [2] [Apple Developer — App Sandbox](https://developer.apple.com/library/archive/documentation/Security/Conceptual/AppSandboxDesignGuide/AboutAppSandbox/AboutAppSandbox.html)
 - [3] [Apple Developer — Entitlements](https://developer.apple.com/documentation/bundleresources/entitlements)
+- [4] [XNU — `bsd/sys/codesign.h` (`CS_OPS_*` operations and `CLEAR_LV_ENTITLEMENT`)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/sys/codesign.h)
+- [5] [XNU — `bsd/kern/kern_proc.c` (`csops` / `CS_OPS_CLEAR_LV` handler)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/kern/kern_proc.c)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.md
index 54cfd2fa5d9..3c82be08578 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing.md
@@ -412,5 +412,6 @@ struct cs_blob {
 - [2] [XNU — `bsd/kern/ubc_subr.c` (`cs_blob` handling and signature validation)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/kern/ubc_subr.c)
 - [3] [Apple Security framework source — `libsecurity_codesigning`](https://github.com/apple-oss-distributions/Security/tree/main/OSX/libsecurity_codesigning)
 - [4] [Apple Developer — Code Signing Guide](https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html)
+- [5] [XNU — `bsd/sys/codesign.h` (`csops`/`csops_audittoken` operations)](https://github.com/apple-oss-distributions/xnu/blob/main/bsd/sys/codesign.h)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.md
index f08d42bdd02..439d00b03aa 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-dangerous-entitlements.md
@@ -310,5 +310,6 @@ For detailed IOKit/DriverKit exploitation, see:
 - [10] [Apple Developer — Allow Execution of JIT-compiled Code Entitlement (`com.apple.security.cs.allow-jit`)](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-jit)
 - [11] [Apple Developer — Allow Unsigned Executable Memory Entitlement](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-unsigned-executable-memory)
 - [12] [Apple Developer — Disable Executable Memory Protection Entitlement](https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_disable-executable-page-protection)
+- [13] [Apple Developer — Entitlements](https://developer.apple.com/documentation/bundleresources/entitlements)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-input-monitoring-screen-capture-accessibility.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-input-monitoring-screen-capture-accessibility.md
index e975d95a5a5..2bef53a5c51 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-input-monitoring-screen-capture-accessibility.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-input-monitoring-screen-capture-accessibility.md
@@ -331,5 +331,6 @@ WHERE tccPermsStr LIKE '%kTCCServiceListenEvent%'
 - [1] [Apple Developer — Event Taps](https://developer.apple.com/documentation/coregraphics/quartz_event_services)
 - [2] [Apple Developer — Accessibility API](https://developer.apple.com/documentation/applicationservices/axuielement_h)
 - [3] [Apple Developer — ScreenCaptureKit](https://developer.apple.com/documentation/screencapturekit)
+- [4] [Objective-See — Accessibility Abuse as TCC Bypass](https://objective-see.org/blog.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-credential-and-data-theft.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-credential-and-data-theft.md
index 6cd4e4072c0..81c42e1f276 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-credential-and-data-theft.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-credential-and-data-theft.md
@@ -355,5 +355,6 @@ SELECT path FROM executables WHERE iCloudAccs = 1;" 2>/dev/null
 - [1] [Apple Developer — Keychain Services](https://developer.apple.com/documentation/security/keychain_services)
 - [2] [Apple Developer — TCC](https://developer.apple.com/documentation/security/protecting-the-user-s-privacy)
 - [3] [OBTS v5.0 — "What Happens on your Mac, Stays on Apple's iCloud?!" (Wojciech Regula)](https://www.youtube.com/watch?v=_6e2LhmxVc0)
+- [4] [Objective-See — TCC Exploitation](https://objective-see.org/blog/blog_0x4C.html)
 
 {{#include ../../../../banners/hacktricks-training.md}}
diff --git a/src/mobile-pentesting/android-app-pentesting/README.md b/src/mobile-pentesting/android-app-pentesting/README.md
index ea270e8f712..2e350ecff98 100644
--- a/src/mobile-pentesting/android-app-pentesting/README.md
+++ b/src/mobile-pentesting/android-app-pentesting/README.md
@@ -983,5 +983,6 @@ AndroL4b is an Android security virtual machine based on ubuntu-mate includes th
 - [14] [Jezail rooted Android pentesting toolkit (REST API + Flutter UI)](https://github.com/zahidaz/jezail)
 - [15] [ISO 8583 Under Fire: Finding Vulnerabilities in a Payment Socket](https://m4kr0.vercel.app/posts/iso-8583-under-fire-finding-vulnerabilities-in-a-payment-socket/)
 - [16] [Fuyao Enterprise: Building an Ad-Fraud Empire with AI and Kids' Coding Blocks](https://bitsight.com/blog/fuyao-enterprise-building-ad-fraud-empire-ai-and-kids-coding-blocks)
+- [17] [Application Security Wiki](https://appsecwiki.com/#/) - It is a great list of resources
 
 {{#include ../../banners/hacktricks-training.md}}

From 914396a48089febaf6ea4fd6544b8695c13178b8 Mon Sep 17 00:00:00 2001
From: Carlos Polop 
Date: Thu, 6 Aug 2026 13:07:26 +0200
Subject: [PATCH 4/6] References: cite already-listed sources on the lines that
 mention them (11 citations)

---
 .../macos-ipc-inter-process-communication/README.md    |  2 +-
 .../macos-xpc_connection_get_audit_token-attack.md     |  6 +++---
 .../macos-security-protections/macos-gatekeeper.md     | 10 +++++-----
 .../macos-tcc-bypasses/macos-apple-scripts.md          |  2 +-
 .../accessibility-services-abuse.md                    |  2 +-
 5 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md
index 25bf84a6c5e..9b12a821267 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md
@@ -1143,7 +1143,7 @@ These are some interesting APIs to interact with the processor set:
 - `processor_set_stack_usage`
 - `processor_set_info`
 
-As mentioned in [**this post**](https://reverse.put.as/2014/05/05/about-the-processor_set_tasks-access-to-kernel-memory-vulnerability/), in the past this allowed to bypass the previously mentioned protection to get task ports in other processes to control them by calling **`processor_set_tasks`** and getting a host port on every process.\
+As mentioned in [**this post**](https://reverse.put.as/2014/05/05/about-the-processor_set_tasks-access-to-kernel-memory-vulnerability/), in the past this allowed to bypass the previously mentioned protection to get task ports in other processes to control them by calling **`processor_set_tasks`** and getting a host port on every process.[[10]](#references)\
 Nowadays you need root to use that function and this is protected so you will only be able to get these ports on unprotected processes.[[10]](#references)
 
 You can try it with:
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.md
index 386dd22f47a..36ff18a0893 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/macos-xpc-connecting-process-check/macos-xpc_connection_get_audit_token-attack.md
@@ -2,7 +2,7 @@
 
 {{#include ../../../../../../banners/hacktricks-training.md}}
 
-**For further information check the original post:** [**https://sector7.computest.nl/post/2023-10-xpc-audit-token-spoofing/**](https://sector7.computest.nl/post/2023-10-xpc-audit-token-spoofing/). This is a summary:
+**For further information check the original post:** [**https://sector7.computest.nl/post/2023-10-xpc-audit-token-spoofing/**](https://sector7.computest.nl/post/2023-10-xpc-audit-token-spoofing/). This is a summary:[[1]](#references)
 
 ## Mach Messages Basic Info
 
@@ -13,7 +13,7 @@ If you don't know what Mach Messages are start checking this page:
 ../../
 {{#endref}}
 
-For the moment remember that ([definition from here](https://sector7.computest.nl/post/2023-10-xpc-audit-token-spoofing)):\
+For the moment remember that ([definition from here](https://sector7.computest.nl/post/2023-10-xpc-audit-token-spoofing)):[[1]](#references)\
 Mach messages are sent over a _mach port_, which is a **single receiver, multiple sender communication** channel built into the mach kernel. **Multiple processes can send messages** to a mach port, but at any point **only a single process can read from it**. Just like file descriptors and sockets, mach ports are allocated and managed by the kernel and processes only see an integer, which they can use to indicate to the kernel which of their mach ports they want to use.
 
 ## XPC Connection
@@ -33,7 +33,7 @@ What is interesting for you to know is that **XPC’s abstraction is a one-to-on
 - An XPC connection’s audit token is the audit token of **copied from the most recently received message**.
 - Obtaining the **audit token** of an XPC connection is critical to many **security checks**.[[1]](#references)
 
-Although the previous situation sounds promising there are some scenarios where this is not going to cause problems ([from here](https://sector7.computest.nl/post/2023-10-xpc-audit-token-spoofing)):
+Although the previous situation sounds promising there are some scenarios where this is not going to cause problems ([from here](https://sector7.computest.nl/post/2023-10-xpc-audit-token-spoofing)):[[1]](#references)
 
 - Audit tokens are often used for an authorization check to decide whether to accept a connection. As this happens using a message to the service port, there is **no connection established yet**. More messages on this port will just be handled as additional connection requests. So any **checks before accepting a connection are not vulnerable** (this also means that within `-listener:shouldAcceptNewConnection:` the audit token is safe). We are therefore **looking for XPC connections that verify specific actions**.
 - XPC event handlers are handled synchronously. This means that the event handler for one message must be completed before calling it for the next one, even on concurrent dispatch queues. So inside an **XPC event handler the audit token can not be overwritten** by other normal (non-reply!) messages.[[1]](#references)
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.md
index 9f1664fdb5a..e0a76431f28 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.md
@@ -429,7 +429,7 @@ Any way to bypass Gatekeeper (manage to make the user download something and exe
 
 It was observed that if the **Archive Utility** is used for extraction, files with **paths exceeding 886 characters** do not receive the com.apple.quarantine extended attribute. This situation inadvertently allows those files to **circumvent Gatekeeper's** security checks.[[5]](#references)
 
-Check the [**original report**](https://labs.withsecure.com/publications/the-discovery-of-cve-2021-1810) for more information.
+Check the [**original report**](https://labs.withsecure.com/publications/the-discovery-of-cve-2021-1810) for more information.[[5]](#references)
 
 ### [CVE-2021-30990](https://ronmasas.com/posts/bypass-macos-gatekeeper)
 
@@ -439,7 +439,7 @@ Therefore, you could make `application.app/Contents/MacOS/Automator\ Application
 
 Example os expected location: `/System/Library/CoreServices/Automator\ Application\ Stub.app/Contents/MacOS/Automator\ Application\ Stub`
 
-Check the [**original report**](https://ronmasas.com/posts/bypass-macos-gatekeeper) for more information.
+Check the [**original report**](https://ronmasas.com/posts/bypass-macos-gatekeeper) for more information.[[6]](#references)
 
 ### [CVE-2022-22616](https://www.jamf.com/blog/jamf-threat-labs-safari-vuln-gatekeeper-bypass/)
 
@@ -449,7 +449,7 @@ In this bypass a zip file was created with an application starting to compress f
 zip -r test.app/Contents test.zip
 ```
 
-Check the [**original report**](https://www.jamf.com/blog/jamf-threat-labs-safari-vuln-gatekeeper-bypass/) for more information.
+Check the [**original report**](https://www.jamf.com/blog/jamf-threat-labs-safari-vuln-gatekeeper-bypass/) for more information.[[7]](#references)
 
 ### [CVE-2022-32910](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32910)
 
@@ -459,7 +459,7 @@ Even if the components are different the exploitation of this vulnerability is v
 aa archive -d test.app/Contents -o test.app.aar
 ```
 
-Check the [**original report**](https://www.jamf.com/blog/jamf-threat-labs-macos-archive-utility-vulnerability/) for more information.
+Check the [**original report**](https://www.jamf.com/blog/jamf-threat-labs-macos-archive-utility-vulnerability/) for more information.[[8]](#references)
 
 ### [CVE-2022-42821](https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/)
 
@@ -483,7 +483,7 @@ python3 -m http.server
 # Download the zip from the browser and decompress it, the file should be without a quarantine xattr
 ```
 
-Check the [**original report**](https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/) for more information.
+Check the [**original report**](https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/) for more information.[[9]](#references)
 
 Note that this could also be be exploited with AppleArchives:
 
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.md
index 46203fababf..66b9307ac18 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-tcc/macos-tcc-bypasses/macos-apple-scripts.md
@@ -14,7 +14,7 @@ end tell
 ```
 
 Here you have some examples: [https://github.com/abbeycode/AppleScripts](https://github.com/abbeycode/AppleScripts)\
-Find more info about malware using applescripts [**here**](https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/).
+Find more info about malware using applescripts [**here**](https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/).[[3]](#references)
 
 ### Automation / TCC quirks
 
diff --git a/src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md b/src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md
index 54f6be1a1ba..1015bc03b34 100644
--- a/src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md
+++ b/src/mobile-pentesting/android-app-pentesting/accessibility-services-abuse.md
@@ -316,7 +316,7 @@ Observed flows for MetaMask, Trust Wallet, Blockchain.com and Phantom:[[5]]
 ## NFC-relay orchestration
 Accessibility/RAT modules can install and launch a dedicated NFC-relay app (e.g., NFSkate) as a third stage and even inject an overlay guide to shepherd the victim through card-present relay steps.[[6]](#references)
 
-Background and TTPs: https://www.threatfabric.com/blogs/ghost-tap-new-cash-out-tactic-with-nfc-relay
+Background and TTPs: https://www.threatfabric.com/blogs/ghost-tap-new-cash-out-tactic-with-nfc-relay[[6]](#references)
 
 ---
 

From 4390098f9d9cdf1c8e796b97ffff76d5bf1d4c2a Mon Sep 17 00:00:00 2001
From: Carlos Polop 
Date: Thu, 6 Aug 2026 13:25:11 +0200
Subject: [PATCH 5/6] References: add entries for content sources cited only
 inline

Sources the prose draws on (writeups, advisories, research posts) now have
a numbered References entry and the line that uses them cites it.
Tool, download and product links are left inline.
---
 .../macos-launch-environment-constraints.md                 | 3 ++-
 src/mobile-pentesting/android-app-pentesting/README.md      | 6 ++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.md
index ebe2b940b7e..453cd870b99 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-launch-environment-constraints.md
@@ -56,7 +56,7 @@ Category 1:
 
 ### Reversing LC Categories
 
-You have more information [**about it in here**](https://theevilbit.github.io/posts/launch_constraints_deep_dive/#reversing-constraints), but basically, They are defined in **AMFI (AppleMobileFileIntegrity)**, so you need to download the Kernel Development Kit to get the **KEXT**. The symbols starting with **`kConstraintCategory`** are the **interesting** ones. Extracting them you will get a DER (ASN.1) encoded stream that you will need to decode with [ASN.1 Decoder](https://holtstrom.com/michael/tools/asn1decoder.php) or the python-asn1 library and its `dump.py` script, [andrivet/python-asn1](https://github.com/andrivet/python-asn1/tree/master) which will give you a more understandable string.[[3]](#references)
+You have more information [**about it in here**](https://theevilbit.github.io/posts/launch_constraints_deep_dive/#reversing-constraints), but basically, They are defined in **AMFI (AppleMobileFileIntegrity)**, so you need to download the Kernel Development Kit to get the **KEXT**. The symbols starting with **`kConstraintCategory`** are the **interesting** ones. Extracting them you will get a DER (ASN.1) encoded stream that you will need to decode with [ASN.1 Decoder](https://holtstrom.com/michael/tools/asn1decoder.php) or the python-asn1 library and its `dump.py` script, [andrivet/python-asn1](https://github.com/andrivet/python-asn1/tree/master) which will give you a more understandable string.[[3]](#references)[[8]](#references)
 
 ## Environment Constraints
 
@@ -190,5 +190,6 @@ After the fix, **both** the built-in and the supplied constraints are validated,
 - [5] [Protect your Mac app with environment constraints - WWDC23](https://developer.apple.com/videos/play/wwdc2023/10266/)
 - [6] [Description of the Launch Constraints introduced in iOS 16 (LinusHenze gist)](https://gist.github.com/LinusHenze/4cd5d7ef057a144cda7234e2c247c056)
 - [7] [macOS Sonoma (14) Launch Constraints (theevilbit gist)](https://gist.github.com/theevilbit/a6fef1e0397425a334d064f7b6e1be53)
+- [8] [Beyond the good ol` LaunchAgents - about it in here](https://theevilbit.github.io/posts/launch_constraints_deep_dive/#reversing-constraints)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/mobile-pentesting/android-app-pentesting/README.md b/src/mobile-pentesting/android-app-pentesting/README.md
index 2e350ecff98..4358806932a 100644
--- a/src/mobile-pentesting/android-app-pentesting/README.md
+++ b/src/mobile-pentesting/android-app-pentesting/README.md
@@ -302,7 +302,7 @@ Read the following page to learn how to easily access C# code of a xamarin appli
 
 ### Superpacked Applications
 
-According to this [**blog post**](https://clearbluejar.github.io/posts/desuperpacking-meta-superpacked-apks-with-github-actions/) superpacked is a Meta algorithm that compress the content of an application into a single file. The blog talks about the possibility of creating an app that decompress these kind of apps... and a faster way which involves to **execute the application and gather the decompressed files from the filesystem.**
+According to this [**blog post**](https://clearbluejar.github.io/posts/desuperpacking-meta-superpacked-apks-with-github-actions/) superpacked is a Meta algorithm that compress the content of an application into a single file. The blog talks about the possibility of creating an app that decompress these kind of apps... and a faster way which involves to **execute the application and gather the decompressed files from the filesystem.**[[18]](#references)
 
 ### Automated Static Code Analysis
 
@@ -362,7 +362,7 @@ Thanks to the ADB connection you can use **Drozer** and **Frida** inside the emu
 
 #### Using an emulator
 
-- [**Android Studio**](https://developer.android.com/studio) (You can create **x86** and **arm** devices, and according to [**this** ](https://android-developers.googleblog.com/2020/03/run-arm-apps-on-android-emulator.html)**latest x86** versions **support ARM libraries** without needing an slow arm emulator).
+- [**Android Studio**](https://developer.android.com/studio) (You can create **x86** and **arm** devices, and according to [**this** ](https://android-developers.googleblog.com/2020/03/run-arm-apps-on-android-emulator.html)**latest x86** versions **support ARM libraries** without needing an slow arm emulator).[[19]](#references)
   - Learn to set it up in this page:
 
 
@@ -984,5 +984,7 @@ AndroL4b is an Android security virtual machine based on ubuntu-mate includes th
 - [15] [ISO 8583 Under Fire: Finding Vulnerabilities in a Payment Socket](https://m4kr0.vercel.app/posts/iso-8583-under-fire-finding-vulnerabilities-in-a-payment-socket/)
 - [16] [Fuyao Enterprise: Building an Ad-Fraud Empire with AI and Kids' Coding Blocks](https://bitsight.com/blog/fuyao-enterprise-building-ad-fraud-empire-ai-and-kids-coding-blocks)
 - [17] [Application Security Wiki](https://appsecwiki.com/#/) - It is a great list of resources
+- [18] [clearbluejar.github.io - Desuperpacking Meta Superpacked Apks With Github Actions](https://clearbluejar.github.io/posts/desuperpacking-meta-superpacked-apks-with-github-actions)
+- [19] [android-developers.googleblog.com - Run Arm Apps On Android Emulator](https://android-developers.googleblog.com/2020/03/run-arm-apps-on-android-emulator.html)
 
 {{#include ../../banners/hacktricks-training.md}}

From 4456211075745c0d431e1394c6da5dc77474c615 Mon Sep 17 00:00:00 2001
From: Carlos Polop 
Date: Thu, 6 Aug 2026 13:50:43 +0200
Subject: [PATCH 6/6] References: cite previously-unused reference entries

Each superscript points at the existing line the reference documents.
---
 .../macos-ipc-inter-process-communication/README.md             | 2 +-
 .../macos-mig-mach-interface-generator.md                       | 2 +-
 .../macos-code-signing-weaknesses-and-sandbox-escapes.md        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md
index 9b12a821267..5826e8058cb 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/README.md
@@ -87,7 +87,7 @@ typedef struct {
 } mach_msg_header_t;
 ```
 
-Processes possessing a _**receive right**_ can receive messages on a Mach port. Conversely, the **senders** are granted a _**send**_ or a _**send-once right**_. The send-once right is exclusively for sending a single message, after which it becomes invalid.
+Processes possessing a _**receive right**_ can receive messages on a Mach port. Conversely, the **senders** are granted a _**send**_ or a _**send-once right**_. The send-once right is exclusively for sending a single message, after which it becomes invalid.[[11]](#references)
 
 The initial field **`msgh_bits`** is a bitmap:
 
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md
index de399577acb..9729107c846 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-mig-mach-interface-generator.md
@@ -10,7 +10,7 @@ The definition is specified in Interface Definition Language (IDL) using the `.d
 
 These definitions have 5 sections:
 
-- **Subsystem declaration**: The keyword subsystem is used to indicate the **name** and the **id**. It's also possible to mark it as **`KernelServer`** if the server should run in the kernel.
+- **Subsystem declaration**: The keyword subsystem is used to indicate the **name** and the **id**. It's also possible to mark it as **`KernelServer`** if the server should run in the kernel.[[4]](#references)
 - **Inclusions and imports**: MIG uses the C-prepocessor, so it's able to use imports. Moreover, it's possible to use `uimport` and `simport` for user or server generated code.
 - **Type declarations**: It's possible to define data types although usually it will import `mach_types.defs` and `std_types.defs`. For custom ones some syntax can be used:
   - \[i`n/out]tran`: Function that needs to be trasnlated from an incoming or to an outgoing message
diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md
index 40e764fffec..4072e088934 100644
--- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md
+++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-code-signing-weaknesses-and-sandbox-escapes.md
@@ -6,7 +6,7 @@
 
 ### Basic Information
 
-**Ad-hoc signing** (`CS_ADHOC`) creates a code signature with **no certificate chain** — it's a hash of the code with no developer identity verification. The binary's origin cannot be traced to any developer or organization.[[1]](#references)
+**Ad-hoc signing** (`CS_ADHOC`) creates a code signature with **no certificate chain** — it's a hash of the code with no developer identity verification. The binary's origin cannot be traced to any developer or organization.[[1]](#references)[[4]](#references)
 
 On Apple Silicon Macs, all executables require at minimum an ad-hoc signature. This means you'll find ad-hoc signatures on many development tools, Homebrew packages, and third-party utilities.