Knowledge-base

Files

knowledge-base

blockchain

python

analyzing rpc

Interacting with contract

crypto

AES

ChaCha20

Elliptische Kurven

RSA

Chinesischer Restsatz

Fermat Faktorisierung

RSA

ChaCha20

Chinesischer Restsatz

Fermat Faktorisierung

Hash Length Extension

LFSR

Linear Congruential Generator

Definitions

Hacking

fuzzing

libtiff

setup

README

leaks

links

onions

hacking

osint

domains

crt.sh

dnsdumpster

google dorks

untested

untested raw

other

Custom TLDs

post exploitation

persistence

Windows persistence

programming

python

examples

PyRSA

rust

crates

clap

cute

regex

Arrays

Cargo

Enums

Files

Hashmap

Loops

Strings

Structs

reversing

java

Via IntelliJ IDEA CE

windows

ASLR

theory

hacktricks

AI-llm-architecture

0.-basic-llm-concepts

1.-tokenizing

2.-data-sampling

3.-token-embeddings

4.-attention-mechanisms

5.-llm-architecture

6.-pre-training-and-loading-models

7.0.-lora-improvements-in-fine-tuning

7.1.-fine-tuning-for-classification

7.2.-fine-tuning-to-follow-instructions

README

AI-Deep-Learning

AI-MCP-Servers

AI-Model-Data-Preparation-and-Evaluation

AI-Models-RCE

AI-Prompts

AI-Reinforcement-Learning-Algorithms

AI-Risk-Frameworks

AI-Supervised-Learning-Algorithms

AI-Unsupervised-Learning-Algorithms

README

banners

hacktricks-training

binary-exploitation

arbitrary-write-2-exec

aw2exec-__malloc_hook

aw2exec-got-plt

aw2exec-sips-icc-profile

README

www2exec-.dtors-and-.fini_array

www2exec-atexit

basic-stack-binary-exploitation-methodology

tools

pwntools

README

elf-tricks

README

common-binary-protections-and-bypasses

aslr

README

ret2plt

ret2ret

pie

bypassing-canary-and-pie

README

stack-canaries

bf-forked-stack-canaries

print-stack-canary

README

cet-and-shadow-stack

libc-protections

memory-tagging-extension-mte

no-exec-nx

README

relro

format-strings

format-strings-arbitrary-read-example

format-strings-template

README

libc-heap

heap-memory-functions

free

heap-functions-security-checks

malloc-and-sysmalloc

README

unlink

use-after-free

first-fit

README

bins-and-memory-allocations

double-free

fast-bin-attack

heap-overflow

house-of-einherjar

house-of-force

house-of-lore

house-of-orange

house-of-rabbit

house-of-roman

house-of-spirit

large-bin-attack

off-by-one-overflow

overwriting-a-freed-chunk

README

tcache-bin-attack

unlink-attack

unsorted-bin-attack

rop-return-oriented-programing

ret2lib

rop-leaking-libc-address

README

rop-leaking-libc-template

one-gadget

README

ret2lib-+-printf-leak-arm64

rop-syscall-execv

README

ret2syscall-arm64

srop-sigreturn-oriented-programming

README

srop-arm64

README

ret2csu

ret2dlresolve

ret2esp-ret2reg

ret2vdso

stack-overflow

ret2win

README

ret2win-arm64

stack-shellcode

README

stack-shellcode-arm64

pointer-redirecting

README

stack-pivoting-ebp2ret-ebp-chaining

uninitialized-variables

array-indexing

common-exploiting-problems

integer-overflow

ios-exploiting

windows-exploiting-basic-guide-oscp-lvl

blockchain

blockchain-and-crypto-currencies

README

crypto-and-stego

cryptographic-algorithms

README

unpacking-binaries

blockchain-and-crypto-currencies

certificates

cipher-block-chaining-cbc-mac-priv

crypto-ctfs-tricks

electronic-code-book-ecb

esoteric-languages

hash-length-extension-attack

padding-oracle-priv

rc4-encrypt-and-decrypt

stego-tricks

generic-hacking

reverse-shells

expose-local-to-the-internet

full-ttys

linux

msfvenom

README

windows

brute-force

exfiltration

search-exploits

tunneling-and-port-forwarding

generic-methodologies-and-resources

basic-forensic-methodology

memory-dump-analysis

README

volatility-cheatsheet

partitions-file-systems-carving

file-data-carving-recovery-tools

README

pcap-inspection

dnscat-exfiltration

README

suricata-and-iptables-cheatsheet

usb-keystrokes

wifi-pcap-analysis

wireshark-tricks

specific-software-file-type-tricks

browser-artifacts

desofuscation-vbs-cscript.exe

local-cloud-storage

office-file-analysis

pdf-file-analysis

png-tricks

README

video-and-audio-file-analysis

zips-tricks

windows-forensics

interesting-windows-registry-keys

README

anti-forensic-techniques

docker-forensics

file-integrity-monitoring

image-acquisition-and-mount

linux-forensics

malware-analysis

README

external-recon-methodology

github-leaked-secrets

README

wide-source-code-search

pentesting-network

dhcpv6

eigrp-attacks

glbp-and-hsrp-attacks

ids-evasion

lateral-vlan-segmentation-bypass

network-protocols-explained-esp

nmap-summary-esp

pentesting-ipv6

README

spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks

spoofing-ssdp-and-upnp-devices

webrtc-dos

pentesting-wifi

evil-twin-eap-tls

README

phishing-methodology

clone-a-website

detecting-phising

discord-invite-hijacking

phishing-documents

README

python

bypass-python-sandboxes

load_name-load_const-opcode-oob-read

README

basic-python

bruteforce-hash-few-chars

class-pollution-pythons-prototype-pollution

pyscript

python-internal-read-gadgets

README

venv

web-requests

pentesting-methodology

threat-modeling

hardware-physical-access

firmware-analysis

bootloader-testing

firmware-integrity

README

escaping-from-gui-applications

physical-attacks

linux-hardening

bypass-bash-restrictions

bypass-fs-protections-read-only-no-exec-distroless

ddexec

README

linux-post-exploitation

pam-pluggable-authentication-modules

README

privilege-escalation

docker-security

docker-breakout-privilege-escalation

docker-release_agent-cgroups-escape

README

release_agent-exploit-relative-paths-to-pids

sensitive-mounts

namespaces

cgroup-namespace

ipc-namespace

mount-namespace

network-namespace

pid-namespace

README

time-namespace

user-namespace

uts-namespace

abusing-docker-socket-for-privilege-escalation

apparmor

authz-and-authn-docker-access-authorization-plugin

cgroups

docker-privileged

README

seccomp

weaponizing-distroless

interesting-groups-linux-pe

lxd-privilege-escalation

README

cisco-vmanage

containerd-ctr-privilege-escalation

d-bus-enumeration-and-command-injection-privilege-escalation

electron-cef-chromium-debugger-abuse

escaping-from-limited-bash

euid-ruid-suid

ld.so.conf-example

linux-active-directory

linux-capabilities

logstash

nfs-no_root_squash-misconfiguration-pe

payloads-to-execute

README

runc-privilege-escalation

selinux

socket-command-injection

splunk-lpe-and-persistence

ssh-forward-agent-exploitation

wildcards-spare-tricks

write-to-root

freeipa-pentesting

linux-environment-variables

linux-privilege-escalation-checklist

useful-linux-commands

macos-hardening

macos-red-teaming

macos-mdm

enrolling-devices-in-other-organisations

macos-serial-number

README

macos-keychain

README

macos-security-and-privilege-escalation

mac-os-architecture

macos-ipc-inter-process-communication

README

macos-iokit

macos-kernel-extensions

macos-kernel-vulnerabilities

macos-system-extensions

README

macos-apps-inspecting-debugging-and-fuzzing

arm64-basic-assembly

introduction-to-x64

objects-in-memory

README

macos-files-folders-and-binaries

macos-bundles

macos-installers-abuse

macos-memory-dumping

macos-sensitive-locations

README

universal-binaries-and-mach-o-format

macos-proces-abuse

macos-ipc-inter-process-communication

macos-xpc

macos-xpc-connecting-process-check

macos-pid-reuse

macos-xpc_connection_get_audit_token-attack

README

macos-mig-mach-interface-generator

macos-thread-injection-via-task-port

README

macos-library-injection

macos-dyld-hijacking-and-dyld_insert_libraries

macos-dyld-process

README

macos-.net-applications-injection

macos-chromium-injection

macos-dirty-nib

macos-electron-applications-injection

macos-function-hooking

macos-java-apps-injection

macos-perl-applications-injection

macos-python-applications-injection

macos-ruby-applications-injection

README

macos-security-protections

macos-fs-tricks

macos-xattr-acls-extra-stuff

README

macos-sandbox

macos-sandbox-debug-and-bypass

macos-office-sandbox-bypasses

README

macos-default-sandbox-debug

README

macos-tcc

macos-tcc-bypasses

macos-apple-scripts

README

macos-apple-events

macos-tcc-payloads

README

macos-amfi-applemobilefileintegrity

macos-authorizations-db-and-authd

macos-code-signing

macos-dangerous-entitlements

macos-gatekeeper

macos-launch-environment-constraints

macos-macf-mandatory-access-control-framework

macos-sip

README

macos-applefs

macos-basic-objective-c

macos-bypassing-firewalls

macos-defensive-apps

macos-dyld-hijacking-and-dyld_insert_libraries

macos-file-extension-apps

macos-gcd-grand-central-dispatch

macos-privilege-escalation

macos-protocols

macos-users

README

macos-auto-start-locations

macos-useful-commands

mobile-pentesting

android-app-pentesting

drozer-tutorial

exploiting-content-providers

README

frida-tutorial

frida-tutorial-1

frida-tutorial-2

objection-tutorial

owaspuncrackable-1

README

adb-commands

android-applications-basics

android-task-hijacking

apk-decompilers

avd-android-virtual-device

bypass-biometric-authentication-android

content-protocol

exploiting-a-debuggeable-applciation

flutter

google-ctf-2018-shall-we-play-a-game

install-burp-certificate

intent-injection

make-apk-accept-ca-certificate

manual-deobfuscation

react-native-application

README

reversing-native-libraries

smali-changes

spoofing-your-location-in-play-store

tapjacking

webview-attacks

ios-pentesting

basic-ios-testing-operations

burp-configuration-for-ios

extracting-entitlements-from-compiled-application

frida-configuration-in-ios

ios-app-extensions

ios-basics

ios-custom-uri-handlers-deeplinks-custom-schemes

ios-hooking-with-objection

ios-pentesting-without-jailbreak

ios-protocol-handlers

ios-serialisation-and-encoding

ios-testing-environment

ios-uipasteboard

ios-universal-links

ios-webviews

README

android-checklist

cordova-apps

ios-pentesting-checklist

xamarin-apps

network-services-pentesting

1521-1522-1529-pentesting-oracle-listener

README

11211-memcache

memcache-commands

README

pentesting-ftp

ftp-bounce-attack

ftp-bounce-download-2oftp-file

README

pentesting-kerberos-88

harvesting-tickets-from-linux

harvesting-tickets-from-windows

README

pentesting-mssql-microsoft-sql-server

README

types-of-mssql-users

pentesting-smb

README

rpcclient-enumeration

pentesting-smtp

README

smtp-commands

smtp-smuggling

pentesting-snmp

cisco-snmp

README

snmp-rce

pentesting-voip

basic-voip-protocols

README

sip-session-initiation-protocol

README

pentesting-web

buckets

firebase-database

README

drupal

drupal-rce

README

electron-desktop-apps

electron-contextisolation-rce-via-electron-internal-code

electron-contextisolation-rce-via-ipc

electron-contextisolation-rce-via-preload-code

README

php-tricks-esp

php-useful-functions-disable_functions-open_basedir-bypass

disable_functions-bypass-dl-function

disable_functions-bypass-imagick-less-than-3.3.0-php-greater-than-5.4-exploit

disable_functions-bypass-mod_cgi

disable_functions-bypass-php-4-greater-than-4.2.0-php-5-pcntl_exec

disable_functions-bypass-php-5.2-fopen-exploit

disable_functions-bypass-php-5.2.3-win32std-ext-protections-bypass

disable_functions-bypass-php-5.2.4-and-5.2.5-php-curl

disable_functions-bypass-php-7.0-7.4-nix-only

disable_functions-bypass-php-fpm-fastcgi

disable_functions-bypass-php-less-than-5.2.9-on-windows

disable_functions-bypass-php-perl-extension-safe_mode-bypass-exploit

disable_functions-bypass-php-safe_mode-bypass-via-proc_open-and-custom-environment-exploit

disable_functions-bypass-via-mem

disable_functions-php-5.2.4-ioncube-extension-exploit

disable_functions-php-5.x-shellshock-exploit

README

php-rce-abusing-object-creation-new-usd_get-a-usd_get-b

php-ssrf

README

tomcat

README

403-and-401-bypasses

aem-adobe-experience-cloud

angular

apache

artifactory-hacking-guide

bolt-cms

cgi

code-review-tools

django

dotnetnuke-dnn

flask

git

golang

grafana

graphql

h2-java-sql-database

iis-internet-information-services

imagemagick-security

jboss

jira

joomla

jsp

laravel

moodle

nextjs

nginx

nodejs-express

prestashop

put-method-webdav

python

README

rocket-chat

ruby-tricks

special-http-headers

spring-actuators

symphony

uncovering-cloudflare

vmware-esx-vcenter...

vuejs

web-api-pentesting

werkzeug

wordpress

7-tcp-udp-pentesting-echo

43-pentesting-whois

49-pentesting-tacacs+

69-udp-tftp

113-pentesting-ident

135-pentesting-msrpc

137-138-139-pentesting-netbios

512-pentesting-rexec

515-pentesting-line-printer-daemon-lpd

554-8554-pentesting-rtsp

584-pentesting-afp

623-udp-ipmi

700-pentesting-epp

873-pentesting-rsync

1026-pentesting-rusersd

1080-pentesting-socks

1099-pentesting-java-rmi

1414-pentesting-ibmmq

1521-1522-1529-pentesting-oracle-listener

1723-pentesting-pptp

1883-pentesting-mqtt-mosquitto

2375-pentesting-docker

3128-pentesting-squid

3260-pentesting-iscsi

3299-pentesting-saprouter

3632-pentesting-distcc

3690-pentesting-subversion-svn-server

3702-udp-pentesting-ws-discovery

4369-pentesting-erlang-port-mapper-daemon-epmd

4786-cisco-smart-install

4840-pentesting-opc-ua

5000-pentesting-docker-registry

5353-udp-multicast-dns-mdns

5439-pentesting-redshift

5555-android-debug-bridge

5601-pentesting-kibana

5671-5672-pentesting-amqp

5984-pentesting-couchdb

5985-5986-pentesting-omi

5985-5986-pentesting-winrm

6000-pentesting-x11

6379-pentesting-redis

8009-pentesting-apache-jserv-protocol-ajp

8086-pentesting-influxdb

8089-splunkd

8333-18333-38333-18444-pentesting-bitcoin

9000-pentesting-fastcgi

9001-pentesting-hsqldb

9100-pjl

9200-pentesting-elasticsearch

10000-network-data-management-protocol-ndmp

15672-pentesting-rabbitmq-management

24007-24008-24009-49152-pentesting-glusterfs

27017-27018-mongodb

44134-pentesting-tiller-helm

44818-ethernetip

47808-udp-bacnet

50030-50060-50070-50075-50090-pentesting-hadoop

cassandra

ipsec-ike-vpn-pentesting

nfs-service-pentesting

pentesting-264-check-point-firewall-1

pentesting-631-internet-printing-protocol-ipp

pentesting-compaq-hp-insight-manager

pentesting-dns

pentesting-finger

pentesting-imap

pentesting-irc

pentesting-jdwp-java-debug-wire-protocol

pentesting-ldap

pentesting-modbus

pentesting-mysql

pentesting-ntp

pentesting-pop

pentesting-postgresql

pentesting-rdp

pentesting-remote-gdbserver

pentesting-rlogin

pentesting-rpcbind

pentesting-rsh

pentesting-sap

pentesting-ssh

pentesting-telnet

pentesting-vnc

pentesting-web

browser-extension-pentesting-methodology

browext-clickjacking

browext-permissions-and-host_permissions

browext-xss-example

README

cache-deception

cache-poisoning-to-dos

cache-poisoning-via-url-discrepancies

README

content-security-policy-csp-bypass

csp-bypass-self-+-unsafe-inline-with-iframes

README

dangling-markup-html-scriptless-injection

README

ss-leaks

deserialization

nodejs-proto-prototype-pollution

client-side-prototype-pollution

express-prototype-pollution-gadgets

prototype-pollution-to-rce

README

basic-.net-deserialization-objectdataprovider-gadgets-expandedwrapper-and-json.net

basic-java-deserialization-objectinputstream-readobject

exploiting-__viewstate-knowing-the-secret

exploiting-__viewstate-parameter

java-dns-deserialization-and-gadgetprobe

java-jsf-viewstate-.faces-deserialization

java-transformers-to-rutime-exec-payload

jndi-java-naming-and-directory-interface-and-log4shell

php-deserialization-+-autoload-classes

python-yaml-deserialization

README

ruby-_json-pollution

ruby-class-pollution

file-inclusion

lfi2rce-via-compress.zlib-+-php_stream_prefer_studio-+-path-disclosure

lfi2rce-via-eternal-waiting

lfi2rce-via-nginx-temp-files

lfi2rce-via-php-filters

lfi2rce-via-phpinfo

lfi2rce-via-segmentation-fault

lfi2rce-via-temp-file-uploads

phar-deserialization

README

via-php_session_upload_progress

file-upload

pdf-upload-xxe-and-cors-bypass

README

hacking-with-cookies

cookie-bomb

cookie-jar-overflow

cookie-tossing

README

http-request-smuggling

browser-http-request-smuggling

README

request-smuggling-in-http-2-downgrades

pocs-and-polygloths-cheatsheet

README

web-vulns-list

postmessage-vulnerabilities

blocking-main-page-to-steal-postmessage

bypassing-sop-with-iframes-1

bypassing-sop-with-iframes-2

README

steal-postmessage-modifying-iframe-location

saml-attacks

README

saml-basics

sql-injection

mysql-injection

mysql-ssrf

README

postgresql-injection

big-binary-files-upload-postgresql

dblink-lo_import-data-exfiltration

network-privesc-port-scanner-and-ntlm-chanllenge-response-disclosure

pl-pgsql-password-bruteforce

rce-with-postgresql-extensions

rce-with-postgresql-languages

README

sqlmap

README

second-order-injection-sqlmap

cypher-injection-neo4j

ms-access-sql-injection

mssql-injection

oracle-injection

README

sqlmap

ssrf-server-side-request-forgery

cloud-ssrf

README

ssrf-vulnerable-platforms

url-format-bypass

ssti-server-side-template-injection

el-expression-language

jinja2-ssti

README

unicode-injection

README

unicode-normalization

web-vulnerabilities-methodology

README

xs-search

css-injection

css-injection-code

README

connection-pool-by-destination-example

connection-pool-example

cookie-bomb-+-onerror-xs-leak

event-loop-blocking-+-lazy-images

javascript-execution-xs-leak

performance.now-+-force-heavy-task

performance.now-example

url-max-length-client-side

xss-cross-site-scripting

abusing-service-workers

chrome-cache-to-xss

debugging-client-side-js

dom-clobbering

dom-invader

dom-xss

iframes-in-xss-and-csp

integer-overflow

js-hoisting

other-js-tricks

pdf-injection

README

server-side-xss-dynamic-pdf

shadow-dom

sniff-leak

some-same-origin-method-execution

steal-info-js

xss-in-markdown

2fa-bypass

abusing-hop-by-hop-headers

account-takeover

bypass-payment-process

captcha-bypass

clickjacking

client-side-path-traversal

client-side-template-injection-csti

command-injection

cors-bypass

crlf-0d-0a

csrf-cross-site-request-forgery

dapps-DecentralizedApplications

dependency-confusion

domain-subdomain-takeover

email-injections

formula-csv-doc-latex-ghostscript-injection

grpc-web-pentest

h2c-smuggling

hacking-jwt-json-web-tokens

http-connection-contamination

http-connection-request-smuggling

http-response-smuggling-desync

idor

iframe-traps

json-xml-yaml-hacking

ldap-injection

nosql-injection

oauth-to-account-takeover

open-redirect

orm-injection

parameter-pollution

phone-number-injections

proxy-waf-protections-bypass

race-condition

rate-limit-bypass

registration-vulnerabilities

regular-expression-denial-of-service-redos

reset-password

reverse-tab-nabbing

rsql-injection

server-side-inclusion-edge-side-inclusion-injection

timing-attacks

uuid-insecurities

web-tool-wfuzz

web-vulnerabilities-methodology

websocket-attacks

xpath-injection

xslt-server-side-injection-extensible-stylesheet-language-transformations

xssi-cross-site-script-inclusion

xxe-xee-xml-external-entity

reversing

cryptographic-algorithms

README

reversing-tools

README

reversing-tools-basic-methods

angr

angr-examples

README

blobrunner

cheat-engine

README

satisfiability-modulo-theories-smt-z3

common-api-used-in-malware

word-macros

windows-hardening

active-directory-methodology

acl-persistence-abuse

BadSuccessor

README

shadow-credentials

ad-certificates

account-persistence

certificate-theft

domain-escalation

domain-persistence

README

abusing-ad-mssql

ad-certificates

ad-dns-records

ad-information-in-printers

asreproast

bloodhound

constrained-delegation

custom-ssp

dcshadow

dcsync

diamond-ticket

dsrm-credentials

external-forest-domain-one-way-outbound

external-forest-domain-oneway-inbound

golden-ticket

kerberoast

kerberos-authentication

kerberos-double-hop-problem

laps

over-pass-the-hash-pass-the-key

pass-the-ticket

password-spraying

printers-spooler-service-abuse

printnightmare

privileged-groups-and-token-privileges

rdp-sessions-abuse

README

resource-based-constrained-delegation

security-descriptors

sid-history-injection

silver-ticket

skeleton-key

unconstrained-delegation

authentication-credentials-uac-and-efs

README

uac-user-account-control

basic-powershell-for-pentesters

powerview

README

lateral-movement

atexec

dcomexec

psexec-and-winexec

rdpexec

README

scmexec

winrm

wmiexec

ntlm

places-to-steal-ntlm-creds

README

stealing-credentials

credentials-mimikatz

credentials-protections

README

wts-impersonator

windows-local-privilege-escalation

dll-hijacking

README

writable-sys-path-+dll-hijacking-privesc

privilege-escalation-abusing-tokens

README

access-tokens

acls-dacls-sacls-aces

appenddata-addsubdirectory-permission-over-service-registry

com-hijacking

create-msi-with-wix

dll-hijacking

dpapi-extracting-passwords

from-high-integrity-to-system-with-name-pipes

integrity-levels

juicypotato

leaked-handle-exploitation

msi-wrapper

named-pipe-client-impersonation

privilege-escalation-abusing-tokens

privilege-escalation-with-autorun-binaries

README

roguepotato-and-printspoofer

sedebug-+-seimpersonate-copy-token

seimpersonate-from-high-to-system

windows-c-payloads

authentication-credentials-uac-and-efs

av-bypass

basic-cmd-for-pentesters

checklist-windows-privilege-escalation

cobalt-strike

mythic

README

SUMMARY

Network

Network-Attacks

Tools

tools

aflplusplus

symcc

bloodhound

Install

canvas

cobalt strike

Covenant

empire

Impact

MacC2

merlin

Metasploit

Mythic

posh

pupy

saint

silent trinity

sliver

trevorc2

exposing

localhost.run

Forensics

volatility3

ghidra

extensions

GhidraBoy

Ghidra

impacket

GetNPUsers

getTGT

GetUserSPNs

lookupsid

rpcdump

smbexec

smbserver

linux

find

grep

socat

network

cpscam

nmap

p0f

responder

TrevorSpray

yersinia

yersinia 1

passwords

Name-That-Hash

post-exploitation

chisel

ConPtyShell

HTTPUploadExfil

PowerView

PSRemote

RunasCs

web

feroxbuster

ffuf

gobuster

wfuzz

windows

bloodhound

bloodhound-python

Bloodhound

SharpHound

Untitled

impacket

GetNPUsers

GetUserSPNs

lookupsid

smbexec

smbserver

post-exploitation

ligolo-ng

autobloody

bloodyAD

Certify

certipy

evil-winrm

kerbrute

ldapsearch

mssql

netexec

nxc

powershell

PowerView

PSRemote

ridenum

setdllcharacteristics

smbmap

targetedKerberoast

feroxbuster

ffuf

gobuster

grep

ligolo-ng

setdllcharacteristics

socat

username-anarchy

wfuzz

Options

Orphans

Graph

Linked mentions

Content

Tags

Graph