References audit: 50 pages

src/network-services-pentesting/pentesting-irc.md

@@ -82,6 +82,3 @@ nmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,66
 - `looking up your hostname`
 
 {{#include ../banners/hacktricks-training.md}}
-
-
-

src/network-services-pentesting/pentesting-iso-8583-payment-sockets.md

@@ -84,7 +84,7 @@ Capture a valid financial request and replay it:
 - after the deduplication/cache window expires
 - with the same **DE11** and **DE37**
 
-Weak processors only cache duplicates briefly and later re-accept the same frame as a new charge. Persistent duplicate detection should bind at least merchant, terminal, amount, card, STAN, RRN, and transaction lifecycle.
+Weak processors only cache duplicates briefly and later re-accept the same frame as a new charge. Persistent duplicate detection should bind at least merchant, terminal, amount, card, STAN, RRN, and transaction lifecycle.<sup>[[1]](#references)</sup>
 
 ### Cross-merchant / object-ownership flaws
 
@@ -105,7 +105,7 @@ If the terminal locally blocks a void/refund because the wrong card was inserted
 
 ### Business-logic mutations
 
-High-value mutations include:
+High-value mutations include:<sup>[[1]](#references)</sup>
 
 - increase **DE4** above the original amount
 - zero amount `000000000000`

src/network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md

@@ -9,7 +9,7 @@ JDWP exploitation hinges on the **protocol's lack of authentication and encrypti
 
 In terms of process identification, searching for the string "jdwk" in Java processes can indicate an active JDWP session.
 
-The go-to tool is [jdwp-shellifier](https://github.com/hugsy/jdwp-shellifier). You can use it with different parameters:
+The go-to tool is [jdwp-shellifier](https://github.com/hugsy/jdwp-shellifier). You can use it with different parameters:<sup>[[2]](#references)</sup>
 
 ```bash
 ./jdwp-shellifier.py -t 192.168.2.9 -p 8000 #Obtain internal data
@@ -25,7 +25,7 @@ I found that the use of `--break-on 'java.lang.String.indexOf'` makes the exploi
 
 1. **JDWP Overview**:
 
-   - It's a packet-based network binary protocol, primarily synchronous.
+   - It's a packet-based network binary protocol, primarily synchronous.<sup>[[3]](#references)</sup>
    - Lacks authentication and encryption, making it vulnerable when exposed to hostile networks.
 
 2. **JDWP Handshake**:
@@ -34,18 +34,18 @@ I found that the use of `--break-on 'java.lang.String.indexOf'` makes the exploi
 
 3. **JDWP Communication**:
 
-   - Messages have a simple structure with fields like Length, Id, Flag, and CommandSet.
+   - Messages have a simple structure with fields like Length, Id, Flag, and CommandSet.<sup>[[11]](#references)</sup>
    - CommandSet values range from 0x40 to 0x80, representing different actions and events.
 
 4. **Exploitation**:
 
-   - JDWP allows loading and invoking arbitrary classes and bytecode, posing security risks.
+   - JDWP allows loading and invoking arbitrary classes and bytecode, posing security risks.<sup>[[12]](#references)</sup>
    - The article details an exploitation process in five steps, involving fetching Java Runtime references, setting breakpoints, and invoking methods.
 
 5. **Real-Life Exploitation**:
 
-   - Despite potential firewall protections, JDWP services are discoverable and exploitable in real-world scenarios, as demonstrated by searches on platforms like ShodanHQ and GitHub.
-   - The exploit script was tested against various JDK versions and is platform-independent, offering reliable Remote Code Execution (RCE).
+   - Despite potential firewall protections, JDWP services are discoverable and exploitable in real-world scenarios, as demonstrated by searches on platforms like ShodanHQ and GitHub.<sup>[[5]](#references)[[8]](#references)</sup>
+   - The exploit script was tested against various JDK versions and is platform-independent, offering reliable Remote Code Execution (RCE).<sup>[[7]](#references)</sup>
 
 6. **Security Implications**:
    - The presence of open JDWP services on the internet underscores the need for regular security reviews, disabling debug functionalities in production, and proper firewall configurations.
@@ -65,7 +65,4 @@ I found that the use of `--break-on 'java.lang.String.indexOf'` makes the exploi
 - [11] [Java(tm) Debug Wire Protocol](http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp/jdwp-protocol.html)
 - [12] [jdwp-exec NSE script — Nmap Scripting Engine documentation](http://nmap.org/nsedoc/scripts/jdwp-exec.html)
 
-
 {{#include ../banners/hacktricks-training.md}}
-
-

src/network-services-pentesting/pentesting-kerberos-88/README.md

@@ -76,20 +76,12 @@ Tips:
 
 The MS14-068 flaw permits an attacker to tamper with a legitimate user's Kerberos login token to falsely claim elevated privileges, such as being a Domain Admin. This counterfeit claim is mistakenly validated by the Domain Controller, enabling unauthorized access to network resources across the Active Directory forest.
 
-
 {{#ref}}
 https://adsecurity.org/?p=541
 {{#endref}}
 
 Other exploits: [https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek](https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS14-068/pykek)
 
-## References
-
-- [1] [NetExec (CME) wiki – Kerberos and krb5.conf generation](https://www.netexec.wiki/)
-- [2] [OpenSSH GSSAPIAuthentication](https://man.openbsd.org/ssh_config#GSSAPIAuthentication)
-- [3] [MIT Kerberos – Using Kerberos on UNIX](https://web.mit.edu/kerberos/krb5-1.12/doc/user/user_config.html)
-- [4] [0xdf – HTB: TheFrizz](https://0xdf.gitlab.io/2025/08/23/htb-thefrizz.html)
-
 ## HackTricks Automatic Commands
 
 ```
@@ -122,4 +114,12 @@ Entry_4:
   Command: GetUserSPNs.py -request -dc-ip {IP} active.htb/svc_tgs
 ```
 
+## References
+
+- [1] [NetExec (CME) wiki – Kerberos and krb5.conf generation](https://www.netexec.wiki/)
+- [2] [OpenSSH GSSAPIAuthentication](https://man.openbsd.org/ssh_config#GSSAPIAuthentication)
+- [3] [MIT Kerberos Documentation – For users (ticket management: kinit/klist)](https://web.mit.edu/kerberos/krb5-1.22/doc/user/index.html)
+- [4] [0xdf – HTB: TheFrizz](https://0xdf.gitlab.io/2025/08/23/htb-thefrizz.html)
+- [5] [MIT Kerberos – Using Kerberos on UNIX](https://web.mit.edu/kerberos/krb5-1.12/doc/user/user_config.html)
+
 {{#include ../../banners/hacktricks-training.md}}

src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-linux.md

@@ -32,7 +32,7 @@ The combination of `klist`, `keyctl`, and `/proc` inspection quickly reveals whe
 
 ### Extracting Credentials
 
-The 2017 paper, [**Kerberos Credential Thievery (GNU/Linux)**](https://www.delaat.net/rp/2016-2017/p97/report.pdf), outlines methods for extracting credentials from keyrings and processes, emphasizing the Linux kernel's keyring mechanism for managing and storing keys.<sup>[[4]](#references)</sup>
+The 2017 paper, [**Kerberos Credential Thievery (GNU/Linux)**](https://web.archive.org/web/20210721113019/https://www.delaat.net/rp/2016-2017/p97/report.pdf), outlines methods for extracting credentials from keyrings and processes, emphasizing the Linux kernel's keyring mechanism for managing and storing keys.<sup>[[4]](#references)</sup>
 
 #### Keyring Extraction Overview
 
@@ -49,7 +49,7 @@ $ keyctl pipe <serial> > /tmp/ccache_dump  # write raw blob to disk
 $ KRB5CCNAME=/tmp/ccache_dump klist        # validate the stolen cache
 ```
 
-If multiple principals are stored, repeat the `keyctl pipe` step per serial, then convert the extracted ccache to a Windows-friendly `.kirbi`/`.ccache` using tooling such as `kerbtool` (see below) or `ticketConverter.py` before replaying it from other machines.
+If multiple principals are stored, repeat the `keyctl pipe` step per serial, then convert the extracted ccache to a Windows-friendly `.kirbi`/`.ccache` using tooling such as `kerbtool` (see below) or `ticketConverter.py` before replaying it from other machines.<sup>[[5]](#references)</sup>
 
 #### File/DIR Cache Theft Quick Wins
 
@@ -104,9 +104,11 @@ Having both tickey and kerbtool on your implant host lets you move seamlessly be
 
 ## References
 
-- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/)
+- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/blog/how-to-attack-kerberos/)
 - [2] [KCM server for SSSD](https://docs.pagure.org/sssd.sssd/design_pages/kcm.html)
 - [3] [kerbtool](https://github.com/jfjallid/kerbtool)
-- [4] [Kerberos Credential Thievery (GNU/Linux)](https://www.delaat.net/rp/2016-2017/p97/report.pdf)
+- [4] [Kerberos Credential Thievery (GNU/Linux)](https://web.archive.org/web/20210721113019/https://www.delaat.net/rp/2016-2017/p97/report.pdf)
+- [5] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/)
+- [6] [Kerberos Credential Thievery (GNU/Linux)](https://www.delaat.net/rp/2016-2017/p97/report.pdf)
 
 {{#include ../../banners/hacktricks-training.md}}

src/network-services-pentesting/pentesting-kerberos-88/harvesting-tickets-from-windows.md

@@ -2,7 +2,7 @@
 
 {{#include ../../banners/hacktricks-training.md}}
 
-Tickets in Windows are managed and stored by the **lsass** (Local Security Authority Subsystem Service) process, responsible for handling security policies. A non-administrative user can usually only access their own logon session, while an administrator (or `SYSTEM`) can enumerate and extract tickets across the host. On modern Windows builds, **LSA Protection** and **Credential Guard** frequently make old "just dump LSASS" tradecraft less reliable, so combine quick native triage, targeted dumping, and offline parsing instead of assuming a single command will always return every ticket.
+Tickets in Windows are managed and stored by the **lsass** (Local Security Authority Subsystem Service) process, responsible for handling security policies. A non-administrative user can usually only access their own logon session, while an administrator (or `SYSTEM`) can enumerate and extract tickets across the host. On modern Windows builds, **LSA Protection** and **Credential Guard** frequently make old "just dump LSASS" tradecraft less reliable, so combine quick native triage, targeted dumping, and offline parsing instead of assuming a single command will always return every ticket.<sup>[[3]](#references)</sup>
 
 ### Native triage
 
@@ -93,7 +93,8 @@ On recent Windows 11 / Server 2025 estates, **LSASS protected process** and **Cr
 
 ## References
 
-- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/)
+- [1] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/blog/how-to-attack-kerberos/)
 - [2] [Rubeus Overview](https://docs.specterops.io/ghostpack-docs/Rubeus-mdx/overview)
+- [3] [Kerberos (II): How to attack Kerberos?](https://www.tarlogic.com/en/blog/how-to-attack-kerberos/)
 
 {{#include ../../banners/hacktricks-training.md}}

src/network-services-pentesting/pentesting-web/golang.md

@@ -10,7 +10,7 @@ In the Go programming language, a common practice when handling HTTP requests, s
 - Paths containing directory traversal sequences such as `/../flag` are simplified and redirected to `/flag`.
 - Paths with a trailing period as in `/flag/.` are also redirected to the clean path `/flag`.
 
-However, an exception is observed with the use of the `CONNECT` method. Unlike other HTTP methods, `CONNECT` does not trigger the path normalization process. This behavior opens a potential avenue for accessing protected resources. By employing the `CONNECT` method alongside the `--path-as-is` option in `curl`, one can bypass the standard path normalization and potentially reach restricted areas.
+However, an exception is observed with the use of the `CONNECT` method. Unlike other HTTP methods, `CONNECT` does not trigger the path normalization process. This behavior opens a potential avenue for accessing protected resources. By employing the `CONNECT` method alongside the `--path-as-is` option in `curl`, one can bypass the standard path normalization and potentially reach restricted areas.<sup>[[1]](#references)</sup>
 
 The following command demonstrates how to exploit this behavior:
 
@@ -20,7 +20,8 @@ curl --path-as-is -X CONNECT http://gofs.web.jctf.pro/../flag
 
 [https://github.com/golang/go/blob/9bb97ea047890e900dae04202a231685492c4b18/src/net/http/server.go\#L2354-L2364](https://github.com/golang/go/blob/9bb97ea047890e900dae04202a231685492c4b18/src/net/http/server.go#L2354-L2364)
 
-{{#include ../../banners/hacktricks-training.md}}
-
+## References
 
+- [1] [Go net/http source — `ServeMux.Handler`: "CONNECT requests are not canonicalized"](https://github.com/golang/go/blob/9bb97ea047890e900dae04202a231685492c4b18/src/net/http/server.go#L2354-L2364)
 
+{{#include ../../banners/hacktricks-training.md}}

src/network-services-pentesting/pentesting-web/grafana.md

@@ -59,7 +59,7 @@ curl -s http://grafana.target/api/plugins | jq '.[].id'
 
 ## CVE-2024-9264 – SQL Expressions (DuckDB shellfs) post-auth RCE / LFI
 
-Grafana’s experimental SQL Expressions feature can evaluate DuckDB queries that embed user-controlled text. Insufficient sanitization allows attackers to chain DuckDB statements and load the community extension shellfs, which exposes shell commands via pipe-backed virtual files.<sup>[[1]](#references)</sup>
+Grafana’s experimental SQL Expressions feature can evaluate DuckDB queries that embed user-controlled text. Insufficient sanitization allows attackers to chain DuckDB statements and load the community extension shellfs, which exposes shell commands via pipe-backed virtual files.<sup>[[1]](#references)[[6]](#references)</sup>
 
 Impact
 - Any authenticated user with VIEWER or higher can get code execution as the Grafana OS user (often grafana; sometimes root inside a container) or perform local file reads.<sup>[[1]](#references)</sup>
@@ -96,7 +96,7 @@ Embed that as CMD in the first query while you have a listener: `nc -lnvp 443`.
 
 Automated PoC
 - Public PoC (built on cfreal’s ten framework):<sup>[[7]](#references)[[8]](#references)</sup>
-  - [https://github.com/nollium/CVE-2024-9264](https://github.com/nollium/CVE-2024-9264)
+  - [https://github.com/nollium/CVE-2024-9264](https://github.com/nollium/CVE-2024-9264)<sup>[[7]](#references)</sup>
 
 Usage example
 ```bash
@@ -123,13 +123,13 @@ The 2025 Grafana client-side traversal and open-redirect chain is already docume
 
 ## References
 
-- [Grafana Advisory – CVE-2024-9264 (SQL Expressions RCE/LFI)](https://grafana.com/security/security-advisories/cve-2024-9264/)
-- [Grafana docs – Add authentication for data source plugins (`jsonData`, `secureJsonData`, `window.grafanaBootData`)](https://grafana.com/developers/plugin-tools/how-to-guides/data-source-plugins/add-authentication-for-data-source-plugins)
-- [Grafana docs – Configure database encryption](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/)
-- [Grafana docs – Provision Grafana](https://grafana.com/docs/grafana/latest/administration/provisioning/)
-- [Cycode – One Plugin Away: Breaking Into Grafana from the Inside](https://cycode.com/blog/one-plugin-away-breaking-into-grafana-from-the-inside/)
-- [DuckDB shellfs community extension](https://duckdb.org/community_extensions/extensions/shellfs.html)
-- [nollium/CVE-2024-9264 PoC](https://github.com/nollium/CVE-2024-9264)
-- [cfreal/ten framework](https://github.com/cfreal/ten)
+- [1] [Grafana Advisory – CVE-2024-9264 (SQL Expressions RCE/LFI)](https://grafana.com/security/security-advisories/cve-2024-9264/)
+- [2] [Grafana docs – Add authentication for data source plugins (`jsonData`, `secureJsonData`, `window.grafanaBootData`)](https://grafana.com/developers/plugin-tools/how-to-guides/data-source-plugins/add-authentication-for-data-source-plugins)
+- [3] [Grafana docs – Configure database encryption](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-database-encryption/)
+- [4] [Grafana docs – Provision Grafana](https://grafana.com/docs/grafana/latest/administration/provisioning/)
+- [5] [Cycode – One Plugin Away: Breaking Into Grafana from the Inside](https://cycode.com/blog/one-plugin-away-breaking-into-grafana-from-the-inside/)
+- [6] [DuckDB shellfs community extension](https://duckdb.org/community_extensions/extensions/shellfs.html)
+- [7] [nollium/CVE-2024-9264 PoC](https://github.com/nollium/CVE-2024-9264)
+- [8] [cfreal/ten framework](https://github.com/cfreal/ten)
 
 {{#include ../../banners/hacktricks-training.md}}

src/network-services-pentesting/pentesting-web/h2-java-sql-database.md

@@ -41,3 +41,4 @@ In [**this post**](https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/)
 - [2] [Chaining our way to Pre-Auth RCE in Metabase (CVE-2023-38646)](https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/)
 
 {{#include ../../banners/hacktricks-training.md}}
+