References audit: 50 pages

src/network-services-pentesting/pentesting-web/spring-actuators.md

@@ -70,7 +70,7 @@ Connection: close
 
 ## HeapDump secrets mining (credentials, tokens, internal URLs)
 
-If `/actuator/heapdump` is exposed, you can usually retrieve a full JVM heap snapshot that frequently contains live secrets (DB creds, API keys, Basic-Auth, internal service URLs, Spring property maps, etc.).<sup>[[4]](#references)</sup>
+If `/actuator/heapdump` is exposed, you can usually retrieve a full JVM heap snapshot that frequently contains live secrets (DB creds, API keys, Basic-Auth, internal service URLs, Spring property maps, etc.).<sup>[[1]](#references)[[4]](#references)</sup>
 
 - Download and quick triage:
   ```bash
@@ -82,14 +82,14 @@ If `/actuator/heapdump` is exposed, you can usually retrieve a full JVM heap sna
   ```
 
 - Deeper analysis with VisualVM and OQL:
-  - Open heapdump in VisualVM, inspect instances of `java.lang.String` or run OQL to hunt secrets:
+  - Open heapdump in VisualVM, inspect instances of `java.lang.String` or run OQL to hunt secrets:<sup>[[2]](#references)</sup>
     ```
     select s.toString() 
     from java.lang.String s 
     where /Authorization: Basic|jdbc:|password=|spring\.datasource|eureka\.client|OriginTrackedMapPropertySource/i.test(s.toString())
     ```
 
-- Automated extraction with JDumpSpider:
+- Automated extraction with JDumpSpider:<sup>[[3]](#references)</sup>
   ```bash
   java -jar JDumpSpider-*.jar heapdump
   ```
@@ -136,7 +136,6 @@ Notes:
 - Reset log levels when done: `POST /actuator/loggers/<logger>` with `{ "configuredLevel": null }`.
 - If `/actuator/httpexchanges` is exposed, it can also surface recent request metadata that may include sensitive headers.
 
-
 ## References
 
 - [1] [Exploring Spring Boot Actuator Misconfigurations (Wiz)](https://www.wiz.io/blog/spring-boot-actuator-misconfigurations)

src/network-services-pentesting/pentesting-web/symphony.md

@@ -63,18 +63,18 @@ Symfony is one of the most widely-used PHP frameworks and regularly appears in a
 ### 2. PATH_INFO auth bypass – **CVE-2025-64500** (HttpFoundation)
 * Affects versions below 5.4.50, 6.4.29 and 7.3.7. Path normalization could drop the leading `/`, breaking access-control rules that assume `/admin` etc.
 * Quick test: `curl -H 'PATH_INFO: admin/secret' https://target/index.php` → if it reaches admin routes without auth, you found it.
-* Patch by upgrading `symfony/http-foundation` or the full framework to the fixed patch level.
+* Patch by upgrading `symfony/http-foundation` or the full framework to the fixed patch level.<sup>[[5]](#references)</sup>
 
 ### 3. MSYS2/Git-Bash argument mangling – **CVE-2026-24739** (Process)
 * Affects versions below 5.4.51, 6.4.33, 7.3.11, 7.4.5 and 8.0.5 on Windows when PHP is run from MSYS2 (Git-Bash, mingw). `Process` fails to quote `=` leading to corrupted paths; destructive commands (`rmdir`, `del`) may target unintended dirs.<sup>[[4]](#references)</sup>
 * If you can upload a PHP script or influence Composer/CLI helpers that call `Process`, craft arguments with `=` (e.g. `E:/=tmp/delete`) to cause path re-write.
 
 ### 4. Runtime env/argv injection – **CVE-2024-50340** (Runtime)
-* When `register_argv_argc=On` and using non-SAPI runtimes, crafted query strings could flip `APP_ENV`/`APP_DEBUG` via `argv` parsing. Patched in 5.4.46/6.4.14/7.1.7.
+* When `register_argv_argc=On` and using non-SAPI runtimes, crafted query strings could flip `APP_ENV`/`APP_DEBUG` via `argv` parsing. Patched in 5.4.46/6.4.14/7.1.7.<sup>[[6]](#references)</sup>
 * Look for `/?--env=prod` or similar being accepted in logs.
 
 ### 5. URL validation / open redirect – **CVE-2024-50345** (HttpFoundation)
-* Special characters in the URI were not validated the same way browsers do, enabling redirect to attacker-controlled domains. Fixed in 5.4.46/6.4.14/7.1.7.
+* Special characters in the URI were not validated the same way browsers do, enabling redirect to attacker-controlled domains. Fixed in 5.4.46/6.4.14/7.1.7.<sup>[[7]](#references)</sup>
 
 ### 6. Symfony UX attribute injection – **CVE-2025-47946**
 * `symfony/ux-twig-component` & `symfony/ux-live-component` before **2.25.1** render `{{ attributes }}` without escaping → attribute injection/XSS. If the app lets users define component attributes (admin CMS, email templating) you can chain to script injection.<sup>[[3]](#references)</sup>
@@ -162,5 +162,8 @@ If the rendered output echoes the attribute unescaped, XSS succeeds. Patch to 2.
 - [2] [Symfony Security Advisory – CVE-2024-51736: Command Execution Hijack on Windows Process Component](https://symfony.com/blog/cve-2024-51736-command-execution-hijack-on-windows-with-process-class)
 - [3] [Symfony Blog – CVE-2025-47946: Unsanitized HTML attribute injection in UX components](https://symfony.com/blog/symfony-ux-cve-2025-47946-unsanitized-html-attribute-injection-via-componentattributes)
 - [4] [Symfony Blog – CVE-2026-24739: Incorrect argument escaping under MSYS2/Git Bash](https://symfony.com/blog/cve-2026-24739-incorrect-argument-escaping-under-msys2-git-bash-on-windows-can-lead-to-destructive-file-operations)
+- [5] [Symfony Blog – CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass](https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass)
+- [6] [GitHub Security Advisory – CVE-2024-50340: symfony/runtime allows APP_ENV/APP_DEBUG override via crafted argv parsing](https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j)
+- [7] [GitHub Security Advisory – CVE-2024-50345: symfony/http-foundation improper URI validation enables open redirect](https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp)
 
 {{#include ../../banners/hacktricks-training.md}}

src/network-services-pentesting/pentesting-web/telerik-ui-aspnet-ajax-unsafe-reflection-webresource-axd.md

@@ -202,8 +202,8 @@ GET /Telerik.Web.UI.WebResource.axd?type=iec&dkey=1&prtype=watchTowr.poc,+../../
 
 ## Mitigation
 
-- Patch to Telerik UI for ASP.NET AJAX 2025.1.416 or later.
-- Remove or restrict exposure of Telerik.Web.UI.WebResource.axd where possible (WAF/rewrites).
+- Patch to Telerik UI for ASP.NET AJAX 2025.1.416 or later.<sup>[[1]](#references)</sup>
+- Remove or restrict exposure of Telerik.Web.UI.WebResource.axd where possible (WAF/rewrites).<sup>[[1]](#references)</sup>
 - Ignore or harden prtype handling server-side (upgrade applies proper checks before instantiation).
 - Audit and harden custom AppDomain.AssemblyResolve handlers. Avoid building paths from args.Name without sanitization; prefer strong-named loads or whitelists.
 - Constrain upload/write locations and prevent DLL drops into probed directories.

src/network-services-pentesting/pentesting-web/tomcat/README.md

@@ -23,7 +23,7 @@ This will search for the term "Tomcat" in the documentation index page, revealin
 
 ### **Manager Files Location**
 
-Identifying the exact locations of **`/manager`** and **`/host-manager`** directories is crucial as their names might be altered. A brute-force search is recommended to locate these pages.
+Identifying the exact locations of **`/manager`** and **`/host-manager`** directories is crucial as their names might be altered. A brute-force search is recommended to locate these pages.<sup>[[2]](#references)</sup>
 
 ### **Username Enumeration**
 
@@ -35,7 +35,7 @@ msf> use auxiliary/scanner/http/tomcat_enum
 
 ### **Default Credentials**
 
-The **`/manager/html`** directory is particularly sensitive as it allows the upload and deployment of WAR files, which can lead to code execution. This directory is protected by basic HTTP authentication, with common credentials being:
+The **`/manager/html`** directory is particularly sensitive as it allows the upload and deployment of WAR files, which can lead to code execution. This directory is protected by basic HTTP authentication, with common credentials being:<sup>[[1]](#references)</sup>
 
 - admin:admin
 - tomcat:tomcat
@@ -76,7 +76,7 @@ In order to access to the management web of the Tomcat go to: `pathTomcat/%252E%
 
 ### /examples
 
-Apache Tomcat versions 4.x to 7.x include example scripts that are susceptible to information disclosure and cross-site scripting (XSS) attacks. These scripts, listed comprehensively, should be checked for unauthorized access and potential exploitation. Find [more info here](https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks/)
+Apache Tomcat versions 4.x to 7.x include example scripts that are susceptible to information disclosure and cross-site scripting (XSS) attacks. These scripts, listed comprehensively, should be checked for unauthorized access and potential exploitation. Find [more info here](https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks/)<sup>[[3]](#references)</sup>
 
 - /examples/jsp/num/numguess.jsp
 - /examples/jsp/dates/date.jsp
@@ -260,10 +260,8 @@ Example:
 
 ## References
 
-- [1] [Pentest-Tomcat (simran-sankhala)](https://github.com/simran-sankhala/Pentest-Tomcat)
-- [2] [Nexpose / Metasploitable sample scan report (HackerTarget)](https://hackertarget.com/sample/nexpose-metasploitable-test.pdf)
+- [1] [Nexpose / Metasploitable sample scan report (HackerTarget)](https://hackertarget.com/sample/nexpose-metasploitable-test.pdf)
+- [2] [Pentest-Tomcat (simran-sankhala)](https://github.com/simran-sankhala/Pentest-Tomcat)
+- [3] [Apache Tomcat example scripts information leaks (Rapid7)](https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks/)
 
 {{#include ../../../banners/hacktricks-training.md}}
-
-
-

src/network-services-pentesting/pentesting-web/uncovering-cloudflare.md

@@ -134,7 +134,7 @@ This does **not** reveal the origin IP, but it can bypass **hostname-specific**
 
 ### Cache
 
-Sometimes you just want to bypass Cloudflare to only scrape the web page. There are some options for this:
+Sometimes you just want to bypass Cloudflare to only scrape the web page. There are some options for this:<sup>[[3]](#references)</sup>
 
 - Use Google cache: `https://webcache.googleusercontent.com/search?q=cache:https://www.petsathome.com/shop/en/pets/dog`
 - Use other cache services such as [https://archive.org/web/](https://archive.org/web/)

src/network-services-pentesting/pentesting-web/vmware-esx-vcenter....md

@@ -2,7 +2,6 @@
 
 {{#include ../../banners/hacktricks-training.md}}
 
-
 ## Enumeration
 
 ```bash

src/network-services-pentesting/pentesting-web/vuejs.md

@@ -89,7 +89,7 @@ Vue.filter('run', code => eval(code))   // DANGER
 ## Other Common Vulnerabilities in Vue Projects
 
 ### Prototype pollution in plugins
-Deep-merge helpers in some plugins (e.g., **vue-i18n**) have allowed attackers to write to `Object.prototype`.
+Deep-merge helpers in some plugins (e.g., **vue-i18n**) have allowed attackers to write to `Object.prototype`.<sup>[[4]](#references)</sup>
 
 ```js
 import merge from 'deepmerge'
@@ -128,7 +128,7 @@ Content-Security-Policy: default-src 'self'; script-src 'self';
 ```
 
 ### Supply-chain attacks (node-ipc – March 2022)
-The sabotage of **node-ipc**—pulled by Vue CLI—showed how a transitive dependency can run arbitrary code on dev machines. Pin versions and audit often.
+The sabotage of **node-ipc**—pulled by Vue CLI—showed how a transitive dependency can run arbitrary code on dev machines. Pin versions and audit often.<sup>[[5]](#references)</sup>
 
 ```shell
 npm ci --ignore-scripts   # safer install
@@ -150,5 +150,7 @@ npm ci --ignore-scripts   # safer install
 - [1] [Vue XSS Guide: Examples and Prevention](https://www.stackhawk.com/blog/vue-xss-guide-examples-and-prevention/)
 - [2] [Vue JS Security](https://medium.com/@isaacwangethi30/vue-js-security-6e246a7613da)
 - [3] [Security | Vue.js](https://vuejs.org/guide/best-practices/security)
+- [4] [Vue I18n Allows Prototype Pollution in handleFlatJson (GHSA-p2ph-7g93-hw3m)](https://github.com/advisories/GHSA-p2ph-7g93-hw3m)
+- [5] [Alert: peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine](https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/)
 
 {{#include ../../banners/hacktricks-training.md}}

src/network-services-pentesting/pentesting-web/web-api-pentesting.md

@@ -30,7 +30,7 @@ Pentesting APIs involves a structured approach to uncovering vulnerabilities. Th
 
 ### Apache CXF MTOM/XOP `xop:Include` as file-read / SSRF primitive
 
-If a SOAP service uses **Apache CXF** with **MTOM/XOP** enabled, test whether a parameter accepts an inline `xop:Include` element inside a **`multipart/related`** request whose root part is **`application/xop+xml`**. Apache's advisory for **CVE-2022-46364** states vulnerable versions parse the `href` of `XOP:Include` in MTOM requests and can perform SSRF-style fetches.<sup>[[3]](#references)[[5]](#references)</sup>
+If a SOAP service uses **Apache CXF** with **MTOM/XOP** enabled, test whether a parameter accepts an inline `xop:Include` element inside a **`multipart/related`** request whose root part is **`application/xop+xml`**. Apache's advisory for **CVE-2022-46364** states vulnerable versions parse the `href` of `XOP:Include` in MTOM requests and can perform SSRF-style fetches.<sup>[[3]](#references)[[4]](#references)[[5]](#references)</sup>
 
 Why this matters in practice:
 

src/network-services-pentesting/pentesting-web/werkzeug.md

@@ -161,7 +161,6 @@ This is because, In Werkzeug it's possible to send some **Unicode** characters a
 
 ## Automated Exploitation
 
-
 {{#ref}}
 https://github.com/Ruulian/wconsole_extractor
 {{#endref}}