book.hacktricks.xyz Open in urlscan Pro
172.64.151.31  Public Scan

Form analysis
0 forms found in the DOM

Text Content

HackTricks
HackTricks CloudTwitchYoutubeTwitter
Search
⌃K

Links
👾
Welcome!
HackTricks
About the author
Getting Started in Hacking
🤩
Generic Methodologies & Resources
Pentesting Methodology
External Recon Methodology

Pentesting Network

Pentesting Wifi

Phishing Methodology

Basic Forensic Methodology

Brute Force - CheatSheet
Python Sandbox Escape & Pyscript

Exfiltration
Tunneling and Port Forwarding
Search Exploits
Shells (Linux, Windows, MSFVenom)

🐧
Linux Hardening
Checklist - Linux Privilege Escalation
Linux Privilege Escalation

Useful Linux Commands
Bypass Linux Shell Restrictions

Linux Environment Variables
Linux Post-Exploitation

FreeIPA Pentesting
🍏
MacOS Hardening
MacOS Security & Privilege Escalation

🪟
Windows Hardening
Checklist - Local Windows Privilege Escalation
Windows Local Privilege Escalation

Active Directory Methodology

Windows Security Controls

NTLM

Lateral Movement

Pivoting to the Cloud

Stealing Windows Credentials

Basic Win CMD for Pentesters
Basic PowerShell for Pentesters

AV Bypass
📱
Mobile Pentesting
Android APK Checklist
Android Applications Pentesting

iOS Pentesting Checklist
iOS Pentesting

👽
Network Services Pentesting
Pentesting JDWP - Java Debug Wire Protocol
Pentesting Printers

Pentesting SAP
Pentesting Remote GdbServer
7/tcp/udp - Pentesting Echo
21 - Pentesting FTP

22 - Pentesting SSH/SFTP
23 - Pentesting Telnet
25,465,587 - Pentesting SMTP/s

43 - Pentesting WHOIS
49 - Pentesting TACACS+
53 - Pentesting DNS
69/UDP TFTP/Bittorrent-tracker
79 - Pentesting Finger
80,443 - Pentesting Web Methodology

88tcp/udp - Pentesting Kerberos

110,995 - Pentesting POP
111/TCP/UDP - Pentesting Portmapper
113 - Pentesting Ident
123/udp - Pentesting NTP
135, 593 - Pentesting MSRPC
137,138,139 - Pentesting NetBios
139,445 - Pentesting SMB

143,993 - Pentesting IMAP
161,162,10161,10162/udp - Pentesting SNMP

194,6667,6660-7000 - Pentesting IRC
264 - Pentesting Check Point FireWall-1
389, 636, 3268, 3269 - Pentesting LDAP
500/udp - Pentesting IPsec/IKE VPN
502 - Pentesting Modbus
512 - Pentesting Rexec
513 - Pentesting Rlogin
514 - Pentesting Rsh
515 - Pentesting Line Printer Daemon (LPD)
548 - Pentesting Apple Filing Protocol (AFP)
554,8554 - Pentesting RTSP
623/UDP/TCP - IPMI
631 - Internet Printing Protocol(IPP)
873 - Pentesting Rsync
1026 - Pentesting Rusersd
1080 - Pentesting Socks
1098/1099/1050 - Pentesting Java RMI - RMI-IIOP
1433 - Pentesting MSSQL - Microsoft SQL Server

1521,1522-1529 - Pentesting Oracle TNS Listener

1723 - Pentesting PPTP
1883 - Pentesting MQTT (Mosquitto)
2049 - Pentesting NFS Service
2301,2381 - Pentesting Compaq/HP Insight Manager
2375, 2376 Pentesting Docker
3128 - Pentesting Squid
3260 - Pentesting ISCSI
3299 - Pentesting SAPRouter
3306 - Pentesting Mysql
3389 - Pentesting RDP
3632 - Pentesting distcc
3690 - Pentesting Subversion (svn server)
3702/UDP - Pentesting WS-Discovery
4369 - Pentesting Erlang Port Mapper Daemon (epmd)
4786 - Cisco Smart Install
5000 - Pentesting Docker Registry
5353/UDP Multicast DNS (mDNS) and DNS-SD
5432,5433 - Pentesting Postgresql
5439 - Pentesting Redshift
5555 - Android Debug Bridge
5601 - Pentesting Kibana
5671,5672 - Pentesting AMQP
5800,5801,5900,5901 - Pentesting VNC
5984,6984 - Pentesting CouchDB
5985,5986 - Pentesting WinRM
5985,5986 - Pentesting OMI
6000 - Pentesting X11
6379 - Pentesting Redis
8009 - Pentesting Apache JServ Protocol (AJP)
8086 - Pentesting InfluxDB
8089 - Pentesting Splunkd
8333,18333,38333,18444 - Pentesting Bitcoin
9000 - Pentesting FastCGI
9001 - Pentesting HSQLDB
9042/9160 - Pentesting Cassandra
9100 - Pentesting Raw Printing (JetDirect, AppSocket, PDL-datastream)
9200 - Pentesting Elasticsearch
10000 - Pentesting Network Data Management Protocol (ndmp)
11211 - Pentesting Memcache

15672 - Pentesting RabbitMQ Management
24007,24008,24009,49152 - Pentesting GlusterFS
27017,27018 - Pentesting MongoDB
44134 - Pentesting Tiller (Helm)
44818/UDP/TCP - Pentesting EthernetIP
47808/udp - Pentesting BACNet
50030,50060,50070,50075,50090 - Pentesting Hadoop
🕸
Pentesting Web
Web Vulnerabilities Methodology

Reflecting Techniques - PoCs and Polygloths CheatSheet

2FA/OTP Bypass
Account Takeover
Bypass Payment Process
Captcha Bypass
Cache Poisoning and Cache Deception
Clickjacking
Client Side Template Injection (CSTI)
Client Side Path Traversal
Command Injection
Content Security Policy (CSP) Bypass

Cookies Hacking

CORS - Misconfigurations & Bypass
CRLF (%0D%0A) Injection
Cross-site WebSocket hijacking (CSWSH)
CSRF (Cross Site Request Forgery)
Dangling Markup - HTML scriptless injection
Dependency Confusion
Deserialization

Domain/Subdomain takeover
Email Injections
File Inclusion/Path traversal

File Upload

Formula/CSV/Doc/LaTeX Injection
HTTP Connection Contamination
HTTP Connection Request Smuggling
HTTP Request Smuggling / HTTP Desync Attack

HTTP Response Smuggling / Desync
Upgrade Header Smuggling
hop-by-hop headers
IDOR
Integer Overflow
JWT Vulnerabilities (Json Web Tokens)
LDAP Injection
Login Bypass

NoSQL injection
OAuth to Account takeover

Open Redirect
Parameter Pollution
Phone Number Injections
PostMessage Vulnerabilities

Race Condition
Rate Limit Bypass
Registration & Takeover Vulnerabilities
Regular expression Denial of Service - ReDoS
Reset/Forgotten Password Bypass
SAML Attacks

Server Side Inclusion/Edge Side Inclusion Injection
SQL Injection

SSRF (Server Side Request Forgery)

SSTI (Server Side Template Injection)

Reverse Tab Nabbing
Unicode Injection

Web Tool - WFuzz
XPATH injection
XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations)
XXE - XEE - XML External Entity
XSS (Cross Site Scripting)

XSSI (Cross-Site Script Inclusion)
XS-Search/XS-Leaks

⛈
Cloud Security
Pentesting Kubernetes

Pentesting Cloud (AWS, GCP, Az...)

Pentesting CI/CD (Github, Jenkins, Terraform...)

😎
Hardware/Physical Access
Physical Attacks
Escaping from KIOSKs

Firmware Analysis

🦅
Reversing & Exploiting
Reversing Tools & Basic Methods

Common API used in Malware
Word Macros
Linux Exploiting (Basic) (SPA)

Exploiting Tools

Windows Exploiting (Basic Guide - OSCP lvl)
🔮
Crypto & Stego
Cryptographic/Compression Algorithms

Certificates
Cipher Block Chaining CBC-MAC
Crypto CTFs Tricks
Electronic Code Book (ECB)
Hash Length Extension Attack
Padding Oracle
RC4 - Encrypt&Decrypt
Stego Tricks
Esoteric languages
Blockchain & Crypto Currencies
🧐
External Platforms Reviews/Writeups
BRA.I.NSMASHER Presentation

INE Courses and eLearnSecurity Certifications Reviews
🦂
C2
Merlin
Empire
Salseo
ICMPsh
Cobalt Strike
✍
TODO
Other Big References
Rust Basics
More Tools
MISC
Pentesting DNS
Hardware Hacking

Radio Hacking

Burp Suite
Other Web Tricks
Interesting HTTP
Emails Vulnerabilities
Android Forensics
TR-069
6881/udp - Pentesting BitTorrent
CTF Write-ups

1911 - Pentesting fox
Online Platforms with API
Stealing Sensitive Information Disclosure from a Web
Post Exploitation
Powered By GitBook


HACKTRICKS


Welcome to the page where you will find each hacking trick/technique/whatever I
have learnt from CTFs, real life apps, reading researches, and news.

Welcome to the page where you will find each hacking trick/technique/whatever I
have learnt from CTFs, real life apps, reading researches, and news.
Here you can find a little introduction:
PENTESTING METHODOLOGY

Here you will find the typical flow that you should follow when pentesting one
or more machines.
Click on the title to start!
CORPORATE SPONSORS

STM CYBER


STM Cyber is a great cybersecurity company whose slogan is HACK THE UNHACKABLE.
They perform their own research and develop their own hacking tools to offer
several valuable cybersecurity services like pentesting, Red teams and training.
You can check their blog in https://blog.stmcyber.com
STM Cyber also support cybersecurity open source projects like HackTricks :)
ROOTEDCON


RootedCON is the most relevant cybersecurity event in Spain and one of the most
important in Europe. With the mission of promoting technical knowledge, this
congress is a boiling meeting point for technology and cybersecurity
professionals in every discipline.
RootedCON
RootedCON
INTIGRITI


Intigriti is the Europe's #1 ethical hacking and bug bounty platform.
Bug bounty tip: sign up for Intigriti, a premium bug bounty platform created by
hackers, for hackers! Join us at https://go.intigriti.com/hacktricks today, and
start earning bounties up to $100,000!
Register - Intigriti
Register - Intigriti
TRICKEST


Use Trickest to easily build and automate workflows powered by the world's most
advanced community tools.
Get Access Today:
Workflow-powered solution for Bug Bounty, Pentesting, SecOps | Trickest
Trickest
HACKENPROOF


Follow HackenProof to learn more about web3 bugs
🐞 Read web3 bug tutorials
🔔 Get notified about new bug bounties
💬 Participate in community discussions
---
WEBSEC


WebSec is a professional cybersecurity company based in Amsterdam which helps
protecting businesses all over the world against the latest cybersecurity
threats by providing offensive-security services with a modern approach.
WebSec is an all-in-one security company which means they do it all; Pentesting,
Security Audits, Awareness Trainings, Phishing Campagnes, Code Review, Exploit
Development, Security Experts Outsourcing and much more.
Another cool thing about WebSec is that unlike the industry average WebSec is
very confident in their skills, to such an extent that they guarantee the best
quality results, it states on their website "If we can't hack it, You don't pay
it!". For more info take a look at their website and blog!
In addition to the above WebSec is also a committed supporter of HackTricks.

SYN CUBES


Security Skills as a Service platform bridges the current skill set gap by
combining global offensive security talent with smart automation, providing
real-time data you need to make informed decisions.
Security Skills as a Service | Syn Cubes
LICENSE

Copyright © Carlos Polop 2023. Except where otherwise specified (the external
information copied into the book belongs to the original authors), the text on
HACK TRICKS by Carlos Polop is licensed under the Attribution-NonCommercial 4.0
International (CC BY-NC 4.0). If you want to use it with commercial purposes,
contact me.
DISCLAIMER

This book, 'HackTricks,' is intended for educational and informational purposes
only. The content within this book is provided on an 'as is' basis, and the
authors and publishers make no representations or warranties of any kind,
express or implied, about the completeness, accuracy, reliability, suitability,
or availability of the information, products, services, or related graphics
contained within this book. Any reliance you place on such information is
therefore strictly at your own risk.
The authors and publishers shall in no event be liable for any loss or damage,
including without limitation, indirect or consequential loss or damage, or any
loss or damage whatsoever arising from loss of data or profits arising out of,
or in connection with, the use of this book.
Furthermore, the techniques and tips described in this book are provided for
educational and informational purposes only, and should not be used for any
illegal or malicious activities. The authors and publishers do not condone or
support any illegal or unethical activities, and any use of the information
contained within this book is at the user's own risk and discretion.
The user is solely responsible for any actions taken based on the information
contained within this book, and should always seek professional advice and
assistance when attempting to implement any of the techniques or tips described
herein.
By using this book, the user agrees to release the authors and publishers from
any and all liability and responsibility for any damages, losses, or harm that
may result from the use of this book or any of the information contained within
it.
HackTricks in 🐦 Twitter 🐦 - 🎙️ Twitch Wed - 18.30(UTC) 🎙️ - 🎥 Youtube 🎥

Do you work in a cybersecurity company? Do you want to see your company
advertised in HackTricks? or do you want to have access to the latest version of
the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Discover The PEASS Family, our collection of exclusive NFTs
Get the official PEASS & HackTricks swag
Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦
@carlospolopm.
Share your hacking tricks by submitting PRs to the hacktricks repo and
hacktricks-cloud repo.

Next - Welcome!
About the author

Last modified 22d ago
Was this page helpful?

Copy link
Edit on GitHub
On this page
Pentesting Methodology
Corporate Sponsors
STM Cyber
RootedCON
Intigriti
Trickest
HACKENPROOF
WebSec
SYN CUBES
License
Disclaimer
Cookies
This site uses cookies to deliver its service and to analyse traffic. By
browsing this site, you accept the cookie policy.
Reject all


👾
Welcome!
HackTricks
About the author
Getting Started in Hacking
🤩
Generic Methodologies & Resources
Pentesting Methodology
External Recon Methodology

Pentesting Network

Pentesting Wifi

Phishing Methodology

Basic Forensic Methodology

Brute Force - CheatSheet
Python Sandbox Escape & Pyscript

Exfiltration
Tunneling and Port Forwarding
Search Exploits
Shells (Linux, Windows, MSFVenom)

🐧
Linux Hardening
Checklist - Linux Privilege Escalation
Linux Privilege Escalation

Useful Linux Commands
Bypass Linux Shell Restrictions

Linux Environment Variables
Linux Post-Exploitation

FreeIPA Pentesting
🍏
MacOS Hardening
MacOS Security & Privilege Escalation

🪟
Windows Hardening
Checklist - Local Windows Privilege Escalation
Windows Local Privilege Escalation

Active Directory Methodology

Windows Security Controls

NTLM

Lateral Movement

Pivoting to the Cloud

Stealing Windows Credentials

Basic Win CMD for Pentesters
Basic PowerShell for Pentesters

AV Bypass
📱
Mobile Pentesting
Android APK Checklist
Android Applications Pentesting

iOS Pentesting Checklist
iOS Pentesting

👽
Network Services Pentesting
Pentesting JDWP - Java Debug Wire Protocol
Pentesting Printers

Pentesting SAP
Pentesting Remote GdbServer
7/tcp/udp - Pentesting Echo
21 - Pentesting FTP

22 - Pentesting SSH/SFTP
23 - Pentesting Telnet
25,465,587 - Pentesting SMTP/s

43 - Pentesting WHOIS
49 - Pentesting TACACS+
53 - Pentesting DNS
69/UDP TFTP/Bittorrent-tracker
79 - Pentesting Finger
80,443 - Pentesting Web Methodology

88tcp/udp - Pentesting Kerberos

110,995 - Pentesting POP
111/TCP/UDP - Pentesting Portmapper
113 - Pentesting Ident
123/udp - Pentesting NTP
135, 593 - Pentesting MSRPC
137,138,139 - Pentesting NetBios
139,445 - Pentesting SMB

143,993 - Pentesting IMAP
161,162,10161,10162/udp - Pentesting SNMP

194,6667,6660-7000 - Pentesting IRC
264 - Pentesting Check Point FireWall-1
389, 636, 3268, 3269 - Pentesting LDAP
500/udp - Pentesting IPsec/IKE VPN
502 - Pentesting Modbus
512 - Pentesting Rexec
513 - Pentesting Rlogin
514 - Pentesting Rsh
515 - Pentesting Line Printer Daemon (LPD)
548 - Pentesting Apple Filing Protocol (AFP)
554,8554 - Pentesting RTSP
623/UDP/TCP - IPMI
631 - Internet Printing Protocol(IPP)
873 - Pentesting Rsync
1026 - Pentesting Rusersd
1080 - Pentesting Socks
1098/1099/1050 - Pentesting Java RMI - RMI-IIOP
1433 - Pentesting MSSQL - Microsoft SQL Server

1521,1522-1529 - Pentesting Oracle TNS Listener

1723 - Pentesting PPTP
1883 - Pentesting MQTT (Mosquitto)
2049 - Pentesting NFS Service
2301,2381 - Pentesting Compaq/HP Insight Manager
2375, 2376 Pentesting Docker
3128 - Pentesting Squid
3260 - Pentesting ISCSI
3299 - Pentesting SAPRouter
3306 - Pentesting Mysql
3389 - Pentesting RDP
3632 - Pentesting distcc
3690 - Pentesting Subversion (svn server)
3702/UDP - Pentesting WS-Discovery
4369 - Pentesting Erlang Port Mapper Daemon (epmd)
4786 - Cisco Smart Install
5000 - Pentesting Docker Registry
5353/UDP Multicast DNS (mDNS) and DNS-SD
5432,5433 - Pentesting Postgresql
5439 - Pentesting Redshift
5555 - Android Debug Bridge
5601 - Pentesting Kibana
5671,5672 - Pentesting AMQP
5800,5801,5900,5901 - Pentesting VNC
5984,6984 - Pentesting CouchDB
5985,5986 - Pentesting WinRM
5985,5986 - Pentesting OMI
6000 - Pentesting X11
6379 - Pentesting Redis
8009 - Pentesting Apache JServ Protocol (AJP)
8086 - Pentesting InfluxDB
8089 - Pentesting Splunkd
8333,18333,38333,18444 - Pentesting Bitcoin
9000 - Pentesting FastCGI
9001 - Pentesting HSQLDB
9042/9160 - Pentesting Cassandra
9100 - Pentesting Raw Printing (JetDirect, AppSocket, PDL-datastream)
9200 - Pentesting Elasticsearch
10000 - Pentesting Network Data Management Protocol (ndmp)
11211 - Pentesting Memcache

15672 - Pentesting RabbitMQ Management
24007,24008,24009,49152 - Pentesting GlusterFS
27017,27018 - Pentesting MongoDB
44134 - Pentesting Tiller (Helm)
44818/UDP/TCP - Pentesting EthernetIP
47808/udp - Pentesting BACNet
50030,50060,50070,50075,50090 - Pentesting Hadoop
🕸
Pentesting Web
Web Vulnerabilities Methodology

Reflecting Techniques - PoCs and Polygloths CheatSheet

2FA/OTP Bypass
Account Takeover
Bypass Payment Process
Captcha Bypass
Cache Poisoning and Cache Deception
Clickjacking
Client Side Template Injection (CSTI)
Client Side Path Traversal
Command Injection
Content Security Policy (CSP) Bypass

Cookies Hacking

CORS - Misconfigurations & Bypass
CRLF (%0D%0A) Injection
Cross-site WebSocket hijacking (CSWSH)
CSRF (Cross Site Request Forgery)
Dangling Markup - HTML scriptless injection
Dependency Confusion
Deserialization

Domain/Subdomain takeover
Email Injections
File Inclusion/Path traversal

File Upload

Formula/CSV/Doc/LaTeX Injection
HTTP Connection Contamination
HTTP Connection Request Smuggling
HTTP Request Smuggling / HTTP Desync Attack

HTTP Response Smuggling / Desync
Upgrade Header Smuggling
hop-by-hop headers
IDOR
Integer Overflow
JWT Vulnerabilities (Json Web Tokens)
LDAP Injection
Login Bypass

NoSQL injection
OAuth to Account takeover

Open Redirect
Parameter Pollution
Phone Number Injections
PostMessage Vulnerabilities

Race Condition
Rate Limit Bypass
Registration & Takeover Vulnerabilities
Regular expression Denial of Service - ReDoS
Reset/Forgotten Password Bypass
SAML Attacks

Server Side Inclusion/Edge Side Inclusion Injection
SQL Injection

SSRF (Server Side Request Forgery)

SSTI (Server Side Template Injection)

Reverse Tab Nabbing
Unicode Injection

Web Tool - WFuzz
XPATH injection
XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations)
XXE - XEE - XML External Entity
XSS (Cross Site Scripting)

XSSI (Cross-Site Script Inclusion)
XS-Search/XS-Leaks

⛈
Cloud Security
Pentesting Kubernetes

Pentesting Cloud (AWS, GCP, Az...)

Pentesting CI/CD (Github, Jenkins, Terraform...)

😎
Hardware/Physical Access
Physical Attacks
Escaping from KIOSKs

Firmware Analysis

🦅
Reversing & Exploiting
Reversing Tools & Basic Methods

Common API used in Malware
Word Macros
Linux Exploiting (Basic) (SPA)

Exploiting Tools

Windows Exploiting (Basic Guide - OSCP lvl)
🔮
Crypto & Stego
Cryptographic/Compression Algorithms

Certificates
Cipher Block Chaining CBC-MAC
Crypto CTFs Tricks
Electronic Code Book (ECB)
Hash Length Extension Attack
Padding Oracle
RC4 - Encrypt&Decrypt
Stego Tricks
Esoteric languages
Blockchain & Crypto Currencies
🧐
External Platforms Reviews/Writeups
BRA.I.NSMASHER Presentation

INE Courses and eLearnSecurity Certifications Reviews
🦂
C2
Merlin
Empire
Salseo
ICMPsh
Cobalt Strike
✍
TODO
Other Big References
Rust Basics
More Tools
MISC
Pentesting DNS
Hardware Hacking

Radio Hacking

Burp Suite
Other Web Tricks
Interesting HTTP
Emails Vulnerabilities
Android Forensics
TR-069
6881/udp - Pentesting BitTorrent
CTF Write-ups

1911 - Pentesting fox
Online Platforms with API
Stealing Sensitive Information Disclosure from a Web
Post Exploitation
Powered By GitBook