References audit: 50 pages

src/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-xpc-mach-services-abuse.md

@@ -4,9 +4,9 @@
 
 ## Basic Information
 
-**XPC** (Cross-Process Communication) is the primary IPC mechanism on macOS. System daemons expose **Mach services** — named ports registered with `launchd` — that other processes can connect to via `NSXPCConnection`.
+**XPC** (Cross-Process Communication) is the primary IPC mechanism on macOS. System daemons expose **Mach services** — named ports registered with `launchd` — that other processes can connect to via `NSXPCConnection`.<sup>[[1]](#references)</sup>
 
-Every **LaunchDaemon** and **LaunchAgent** plist with a `MachServices` key registers one or more named Mach ports. These are system-wide XPC endpoints that any process can attempt to connect to.
+Every **LaunchDaemon** and **LaunchAgent** plist with a `MachServices` key registers one or more named Mach ports. These are system-wide XPC endpoints that any process can attempt to connect to.<sup>[[2]](#references)</sup>
 
 > [!WARNING]
 > XPC Mach services are the **single largest local privilege escalation attack surface** on macOS. Most local root exploits in recent years went through vulnerable XPC services in LaunchDaemons. Every exposed method in a root daemon is a potential escalation vector.
@@ -312,8 +312,8 @@ log stream --predicate 'process == "daemon-name" AND (eventMessage CONTAINS "cra
 | CVE-2021-30657 | Sysmond XPC privilege escalation |
 | CVE-2020-9839 | XPC race condition in system daemon |
 | CVE-2019-8802 | Privileged helper tool missing client verification |
-| CVE-2023-32369 | Migraine — SIP bypass through `systemmigrationd` XPC |
-| CVE-2022-26712 | PackageKit XPC root escalation |
+| CVE-2023-32369 | Migraine — SIP bypass through `systemmigrationd` XPC<sup>[[3]](#references)</sup> |
+| CVE-2022-26712 | PackageKit XPC root escalation<sup>[[4]](#references)</sup> |
 
 ## Enumeration Script
 
@@ -349,7 +349,9 @@ done
 
 - [1] [Apple Developer — XPC Services](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingXPCServices.html)
 - [2] [Apple Developer — Daemons and Services Programming Guide](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/Introduction.html)
-- [3] [Objective-See — XPC Exploitation](https://objective-see.org/blog.html)
-- [4] [OBTS — XPC Attack Surface talks](https://objectivebythesea.org/)
+- [3] [New macOS vulnerability, Migraine, could bypass System Integrity Protection — Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2023/05/30/new-macos-vulnerability-migraine-could-bypass-system-integrity-protection/)
+- [4] [CVE-2022-26712: The POC for SIP-Bypass Is Even Tweetable](https://jhftss.github.io/CVE-2022-26712-The-POC-For-SIP-Bypass-Is-Even-Tweetable/)
+- [5] [Objective-See — XPC Exploitation](https://objective-see.org/blog.html)
+- [6] [OBTS — XPC Attack Surface talks](https://objectivebythesea.org/)
 
 {{#include ../../../banners/hacktricks-training.md}}

src/macos-hardening/macos-security-and-privilege-escalation/macos-protocols.md

@@ -5,7 +5,7 @@
 ## Remote Access Services
 
 These are the common macOS services to access them remotely.\
-You can enable/disable these services in `System Settings` --> `Sharing`
+You can enable/disable these services in `System Settings` --> `Sharing`<sup>[[1]](#references)</sup>
 
 - **VNC**, known as “Screen Sharing” (tcp:5900)
 - **SSH**, called “Remote Login” (tcp:22)
@@ -38,7 +38,7 @@ sudo launchctl print-disabled system | egrep 'com.apple.screensharing|com.apple.
 
 ### Pentesting ARD
 
-Apple Remote Desktop (ARD) is an enhanced version of [Virtual Network Computing (VNC)](https://en.wikipedia.org/wiki/Virtual_Network_Computing) tailored for macOS, offering additional features. A notable vulnerability in ARD is its authentication method for the control screen password, which only uses the first 8 characters of the password, making it prone to [brute force attacks](https://thudinh.blogspot.com/2017/09/brute-forcing-passwords-with-thc-hydra.html) with tools like Hydra or [GoRedShell](https://github.com/ahhh/GoRedShell/), as there are no default rate limits.<sup>[[3]](#references)</sup>
+Apple Remote Desktop (ARD) is an enhanced version of [Virtual Network Computing (VNC)](https://en.wikipedia.org/wiki/Virtual_Network_Computing) tailored for macOS, offering additional features. A notable vulnerability in ARD is its authentication method for the control screen password, which only uses the first 8 characters of the password, making it prone to [brute force attacks](https://thudinh.blogspot.com/2017/09/brute-forcing-passwords-with-thc-hydra.html) with tools like Hydra or [GoRedShell](https://github.com/ahhh/GoRedShell/), as there are no default rate limits.<sup>[[2]](#references)</sup>
 
 Vulnerable instances can be identified using **nmap**'s `vnc-info` script. Services supporting `VNC Authentication (2)` are especially susceptible to brute force attacks due to the 8-character password truncation.
 
@@ -112,8 +112,8 @@ In practice, the abuse case is not limited to Finder. Any **scriptable applicati
 
 | Year | CVE | Component | Impact | Fixed in |
 |------|-----|-----------|--------|----------|
-|2023|CVE-2023-42940|Screen Sharing|Incorrect session rendering could cause the *wrong* desktop or window to be transmitted, resulting in leakage of sensitive information|macOS Sonoma 14.2.1 (Dec 2023) |
-|2024|CVE-2024-44248|Screen Sharing Server|A user with screen sharing access may be able to view **another user's screen** because of a state-management issue|macOS Ventura 13.7.2 / Sonoma 14.7.2 / Sequoia 15.1 (Oct-Dec 2024) |
+|2023|CVE-2023-42940|Screen Sharing|Incorrect session rendering could cause the *wrong* desktop or window to be transmitted, resulting in leakage of sensitive information|macOS Sonoma 14.2.1 (Dec 2023) <sup>[[3]](#references)</sup>|
+|2024|CVE-2024-44248|Screen Sharing Server|A user with screen sharing access may be able to view **another user's screen** because of a state-management issue|macOS Ventura 13.7.2 / Sonoma 14.7.2 / Sequoia 15.1 (Oct-Dec 2024) <sup>[[7]](#references)</sup>|
 
 **Hardening tips**
 
@@ -250,8 +250,8 @@ For broader **mDNS spoofing, impersonation, and cross-subnet discovery** techniq
 
 | Year | CVE | Severity | Issue | Patched in |
 |------|-----|----------|-------|------------|
-|2024|CVE-2024-44183|Medium|A logic error in *mDNSResponder* allowed a crafted packet to trigger a **denial-of-service**|macOS Ventura 13.7 / Sonoma 14.7 / Sequoia 15.0 (Sep 2024) |
-|2025|CVE-2025-31222|High|A correctness issue in *mDNSResponder* could be abused for **local privilege escalation**|macOS Ventura 13.7.6 / Sonoma 14.7.6 / Sequoia 15.5 (May 2025) |
+|2024|CVE-2024-44183|Medium|A logic error in *mDNSResponder* allowed a crafted packet to trigger a **denial-of-service**|macOS Ventura 13.7 / Sonoma 14.7 / Sequoia 15.0 (Sep 2024) <sup>[[4]](#references)</sup>|
+|2025|CVE-2025-31222|High|A correctness issue in *mDNSResponder* could be abused for **local privilege escalation**|macOS Ventura 13.7.6 / Sonoma 14.7.6 / Sequoia 15.5 (May 2025) <sup>[[5]](#references)</sup>|
 
 **Mitigation guidance**
 
@@ -275,14 +275,15 @@ sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.p
 ## References
 
 - [1] [The Mac Hacker's Handbook](https://www.amazon.com/-/es/Charlie-Miller-ebook-dp-B004U7MUMU/dp/B004U7MUMU/ref=mt_other?_encoding=UTF8&me=&qid=)
-- [2] [The Art of Mac Malware, Volume I: Analysis - Patrick Wardle](https://taomm.org/vol1/analysis.html)
-- [3] [LockBoxx - macOS Red Teaming 206: ARD (Apple Remote Desktop Protocol)](https://lockboxx.blogspot.com/2019/07/macos-red-teaming-206-ard-apple-remote.html)
-- [4] [NVD – CVE-2023-42940](https://nvd.nist.gov/vuln/detail/CVE-2023-42940)
-- [5] [NVD – CVE-2024-44183](https://nvd.nist.gov/vuln/detail/CVE-2024-44183)
+- [2] [LockBoxx - macOS Red Teaming 206: ARD (Apple Remote Desktop Protocol)](https://lockboxx.blogspot.com/2019/07/macos-red-teaming-206-ard-apple-remote.html)
+- [3] [NVD – CVE-2023-42940](https://nvd.nist.gov/vuln/detail/CVE-2023-42940)
+- [4] [NVD – CVE-2024-44183](https://nvd.nist.gov/vuln/detail/CVE-2024-44183)
+- [5] [NVD – CVE-2025-31222](https://nvd.nist.gov/vuln/detail/CVE-2025-31222)
 - [6] [Palo Alto Unit 42 - Lateral Movement on macOS: Unique and Popular Techniques and In-the-Wild Examples](https://unit42.paloaltonetworks.com/unique-popular-techniques-lateral-movement-macos/)
 - [7] [Apple Support - About the security content of macOS Sonoma 14.7.2](https://support.apple.com/en-us/121840)
 - [8] [Apple Screen Sharing Pre-Auth RCE](https://warez.sl0p.foo/apple-screensharing-rce/)
 - [9] [Apple Support - About the security content of macOS Tahoe 26.6](https://support.apple.com/en-us/128067)
 - [10] [RFC 5054 - Using the Secure Remote Password (SRP) Protocol for TLS Authentication](https://www.rfc-editor.org/rfc/rfc5054)
+- [11] [The Art of Mac Malware, Volume I: Analysis - Patrick Wardle](https://taomm.org/vol1/analysis.html)
 
 {{#include ../../banners/hacktricks-training.md}}

src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/README.md

@@ -149,4 +149,3 @@ T
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-

src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-amfi-applemobilefileintegrity.md

@@ -163,6 +163,3 @@ In iOS and jailbreak research you'll still find the traditional model of **loada
 - [6] [Apple Platform Security Guide — Trust caches](https://support.apple.com/guide/security/trust-caches-sec7d38fbf97/web)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
-
-

src/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-authorizations-db-and-authd.md

@@ -89,4 +89,5 @@ That will fork and exec `/usr/libexec/security_authtrampoline /bin/ls` as root,
 
 - [1] [authenticate-admin-nonshared - Overview of the macOS Authorization Right](https://www.dssw.co.uk/reference/authorization-rights/authenticate-admin-nonshared/)
 
+
 {{#include ../../../banners/hacktricks-training.md}}

src/mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.md

@@ -46,7 +46,7 @@ Flags: `--skip-build` (patch only), `--skip-clone`, `--arch`, `--ndk-path`, `--t
 Many apps only look for obvious indicators (su/Magisk paths/getprop). DenyList often neutralizes naive checks.<sup>[[1]](#references)</sup>
 
 References:
-- Magisk (Zygisk & DenyList): https://github.com/topjohnwu/Magisk
+- Magisk (Zygisk & DenyList): https://github.com/topjohnwu/Magisk<sup>[[9]](#references)</sup>
 
 ### Play Integrity / Zygisk detections (post‑SafetyNet)
 
@@ -70,9 +70,9 @@ Example:
 frida -U -f com.example.app -l anti-frida-detection.js
 ```
 
-These typically stub Java root/debug checks, process/service scans, and native ptrace(). Useful on lightly protected apps; hardened targets may need tailored hooks.
+These typically stub Java root/debug checks, process/service scans, and native ptrace(). Useful on lightly protected apps; hardened targets may need tailored hooks.<sup>[[1]](#references)[[2]](#references)</sup>
 
-- Codeshare: https://codeshare.frida.re/
+- Codeshare: https://codeshare.frida.re/<sup>[[2]](#references)</sup>
 
 ## Automate with Medusa (Frida framework)
 
@@ -129,7 +129,7 @@ If this works, keep the session stable and proceed to map and stub checks.
 
 ## Step 4 — Map detection logic via Jadx and string hunting
 
-Static triage keywords in Jadx:<sup>[[1]](#references)</sup>
+Static triage keywords in Jadx:<sup>[[1]](#references)[[5]](#references)</sup>
 - "frida", "gum", "root", "magisk", "ptrace", "su", "getprop", "debugger"
 
 Typical Java patterns:
@@ -177,7 +177,7 @@ Java.perform(() => {
 });
 ```
 
-Quick root detection stub example (adapt to target package/class names):
+Quick root detection stub example (adapt to target package/class names):<sup>[[12]](#references)</sup>
 
 ```js
 Java.perform(() => {
@@ -202,7 +202,7 @@ Java.perform(() => {
 
 ## Bypass emulator/VM detection (Java stubs)
 
-Common heuristics: Build.FINGERPRINT/MODEL/MANUFACTURER/HARDWARE containing generic/goldfish/ranchu/sdk; QEMU artifacts like /dev/qemu_pipe, /dev/socket/qemud; default MAC 02:00:00:00:00:00; 10.0.2.x NAT; missing telephony/sensors.
+Common heuristics: Build.FINGERPRINT/MODEL/MANUFACTURER/HARDWARE containing generic/goldfish/ranchu/sdk; QEMU artifacts like /dev/qemu_pipe, /dev/socket/qemud; default MAC 02:00:00:00:00:00; 10.0.2.x NAT; missing telephony/sensors.<sup>[[12]](#references)</sup>
 
 Quick spoof of Build fields:
 ```js
@@ -219,7 +219,7 @@ Complement with stubs for file existence checks and identifiers (TelephonyManage
 
 ## SSL pinning bypass quick hook (Java)
 
-Neutralize custom TrustManagers and force permissive SSL contexts:
+Neutralize custom TrustManagers and force permissive SSL contexts:<sup>[[12]](#references)</sup>
 ```js
 Java.perform(function(){
   var X509TrustManager = Java.use('javax.net.ssl.X509TrustManager');
@@ -248,7 +248,7 @@ For **mTLS** apps, `SSLContext.init(KeyManager[], TrustManager[], SecureRandom)`
 - **`TrustManager[]`** validates the **server** certificate.
 - **`KeyManager[]`** presents the **client** certificate/private key.
 
-If you replace **both** arrays with a generic “trust all” hook, the app may accept Burp's certificate but **stop sending its client certificate**, so the handshake still fails. In mTLS scenarios, keep the original `KeyManager[]` and replace **only** `TrustManager[]`.<sup>[[17]](#references)</sup>
+If you replace **both** arrays with a generic “trust all” hook, the app may accept Burp's certificate but **stop sending its client certificate**, so the handshake still fails. In mTLS scenarios, keep the original `KeyManager[]` and replace **only** `TrustManager[]`.<sup>[[17]](#references)[[18]](#references)</sup>
 
 ```js
 Java.perform(function () {
@@ -274,7 +274,7 @@ A common Android mTLS pattern is:
 2. store the private key + issued client cert in **PKCS12** (`.p12`), often with a runtime-derived password,
 3. reload that keystore on every request to build a `KeyManager`.
 
-That password can be strong at rest and still be useless during runtime: the app must eventually call `KeyStore.load(...)`, `getCertificate(...)`, and `getKey(alias, password)` in-process. Hook the method/constructor that receives the **decrypted `KeyStore`**, alias, and password (often a custom `KeyManager` wrapper) and dump the live material instead of brute-forcing the `.p12` offline.<sup>[[17]](#references)</sup>
+That password can be strong at rest and still be useless during runtime: the app must eventually call `KeyStore.load(...)`, `getCertificate(...)`, and `getKey(alias, password)` in-process. Hook the method/constructor that receives the **decrypted `KeyStore`**, alias, and password (often a custom `KeyManager` wrapper) and dump the live material instead of brute-forcing the `.p12` offline.<sup>[[17]](#references)[[18]](#references)</sup>
 
 Quick triage:
 - `privateKey.getEncoded()` returns **bytes** → software/JCE key, usually exportable.
@@ -317,7 +317,7 @@ Useful extra hook points when Frida is attached **before enrollment**:
 
 ### OkHttp4 / gRPC / Cronet pinning (2024+)
 
-Modern stacks pin inside newer APIs (OkHttp4+, gRPC over Cronet/BoringSSL). Add these hooks when the basic SSLContext hook hangs:
+Modern stacks pin inside newer APIs (OkHttp4+, gRPC over Cronet/BoringSSL). Add these hooks when the basic SSLContext hook hangs:<sup>[[14]](#references)</sup>
 
 ```js
 Java.perform(() => {
@@ -368,8 +368,8 @@ strings -n 6 libfoo.so | egrep -i 'frida|ptrace|gum|magisk|su|root'
 ```
 
 Interactive/native reversing:
-- Ghidra: https://ghidra-sre.org/
-- r2frida: https://github.com/nowsecure/r2frida
+- Ghidra: https://ghidra-sre.org/<sup>[[6]](#references)</sup>
+- r2frida: https://github.com/nowsecure/r2frida<sup>[[7]](#references)</sup>
 
 Example: neuter ptrace to defeat simple anti‑debug in libc:
 
@@ -396,17 +396,17 @@ objection patchapk --source app.apk
 ```
 
 Notes:
-- Requires apktool; ensure a current version from the official guide to avoid build issues: https://apktool.org/docs/install
+- Requires apktool; ensure a current version from the official guide to avoid build issues: https://apktool.org/docs/install<sup>[[8]](#references)</sup>
 - Gadget injection enables instrumentation without root but can still be caught by stronger init‑time checks.
 
-Optionally, add LSPosed modules and Shamiko for stronger root hiding in Zygisk environments, and curate DenyList to cover child processes.
+Optionally, add LSPosed modules and Shamiko for stronger root hiding in Zygisk environments, and curate DenyList to cover child processes.<sup>[[12]](#references)</sup>
 
 For a complete workflow including script-mode Gadget configuration and bundling your Frida 17+ agent into the APK, see:
 
 [Frida Tutorial — Self-contained agent + Gadget embedding](frida-tutorial/README.md)
 
 References:
-- Objection: https://github.com/sensepost/objection
+- Objection: https://github.com/sensepost/objection<sup>[[3]](#references)</sup>
 
 ## Step 8 — Fallback: Patch TLS pinning for network visibility
 
@@ -417,7 +417,7 @@ apk-mitm app.apk
 # Then install the patched APK and proxy via Burp/mitmproxy
 ```
 
-- Tool: https://github.com/shroudedcode/apk-mitm
+- Tool: https://github.com/shroudedcode/apk-mitm<sup>[[4]](#references)</sup>
 - For network config CA‑trust tricks (and Android 7+ user CA trust), see:
 
   {{#ref}}
@@ -557,4 +557,5 @@ Notes
 - [16] [Weaponizing LSPosed: Remote SMS Injection and Identity Spoofing in Modern Payment Ecosystems](https://www.cloudsek.com/blog/weaponizing-lsposed-remote-sms-injection-and-identity-spoofing-in-modern-payment-ecosystems-2)
 - [17] [How to Bypass mTLS on Android with Frida](https://kiratliygt.medium.com/how-to-bypass-mtls-on-android-with-frida-45c5e71373e8)
 - [18] [Demo-mTLS- lab app/server](https://github.com/YigitK-1/Demo-mTLS-)
+
 {{#include ../../banners/hacktricks-training.md}}

src/mobile-pentesting/android-app-pentesting/android-application-level-virtualization.md

@@ -7,7 +7,7 @@ Application-level virtualization (aka app cloning/container frameworks such as D
 ## Baseline install/launch vs virtualized execution
 
 - **Normal install**: Package Manager extracts APK → `/data/app/<rand>/com.pkg-<rand>/base.apk`, assigns a **unique UID**, and Zygote forks a process that loads `classes.dex`.
-- **Dex load primitive**: `DexFile.openDexFile()` delegates to `openDexFileNative()` using absolute paths; virtualization layers commonly hook/redirect this to load guest dex from host-controlled paths.
+- **Dex load primitive**: `DexFile.openDexFile()` delegates to `openDexFileNative()` using absolute paths; virtualization layers commonly hook/redirect this to load guest dex from host-controlled paths.<sup>[[1]](#references)</sup>
 - **Virtualized launch**: Host starts a process under **its UID**, loads the guest’s `base.apk`/dex with a custom loader, and exposes lifecycle callbacks via Java proxies. Guest storage API calls are remapped to host-controlled paths.<sup>[[1]](#references)</sup>
 
 ## Abuse patterns

src/mobile-pentesting/android-app-pentesting/android-enterprise-work-profile-bypass.md

@@ -28,7 +28,7 @@ adb install --user 1 legit.apk
 # java.lang.SecurityException: Shell does not have permission to access user 1
 ```
 
-* You must have **temporary physical access to an unlocked BYOD** to enable Developer Options + USB debugging.
+* You must have **temporary physical access to an unlocked BYOD** to enable Developer Options + USB debugging.<sup>[[1]](#references)</sup>
 * Identify the **package name** of a Work-Profile app marked as *required* (e.g. `com.workday.workdroidapp`).
 
 ## Weaponising the Android Studio multi-user installer