HackTricks

The ultimate cybersecurity knowledge base — tricks, techniques, and methodologies from CTFs, real-world apps, and security research.

Pentesting Methodology

Start with a structured approach to penetration testing engagements

Web Vulnerabilities

XSS, SQLi, SSRF, SSTI, deserialization and more

Linux Privilege Escalation

Techniques to escalate from low-privilege to root on Linux systems

Active Directory

Complete methodology for attacking Windows AD environments

What is HackTricks?

HackTricks is a comprehensive, community-driven cybersecurity knowledge base that documents hacking techniques, pentesting methodologies, and security research findings. Originally built from CTF experience and real-world penetration testing, it has grown into one of the most referenced resources in offensive security.

HackTricks covers everything from beginner-friendly Linux basics to advanced kernel exploitation, covering web, network, mobile, hardware, and cloud security domains.

Explore by Domain

OS Security

Linux, macOS, and Windows privilege escalation and hardening

Web & Network

Web application attacks and network service exploitation

Mobile

Android and iOS application pentesting

Binary Exploitation

Stack overflows, ROP chains, heap exploitation

Cryptography

Padding oracles, CBC bit flipping, hash attacks

AI Security

LLM prompt injection and AI system attacks

Key Topics

Pentesting Methodologies

Structured frameworks for conducting professional penetration tests — covering external recon, network enumeration, lateral movement, and reporting. Includes methodology for web apps, APIs, mobile apps, and network infrastructure.

Privilege Escalation

Comprehensive guides for escalating privileges on Linux (SUID, capabilities, sudo misconfigurations, kernel exploits), macOS (TCC, SIP bypasses, XPC vulnerabilities), and Windows (token abuse, ACL attacks, service misconfigs, Active Directory attacks).

Web Application Security

In-depth coverage of OWASP Top 10 and beyond — XSS, SQL Injection, SSRF, SSTI, XXE, CSRF, deserialization, file upload bypass, command injection, and advanced techniques like HTTP request smuggling and cache poisoning.

Network Services

Attack guides for 100+ network protocols — from common services (SSH, FTP, SMB, RDP) to industrial protocols (Modbus, BACnet, OPC-UA) and database services (MySQL, MSSQL, MongoDB, Redis, Elasticsearch).

Active Directory & Windows

Complete AD attack methodology including Kerberoasting, AS-REP Roasting, Pass-the-Hash, Pass-the-Ticket, DCSync, Golden/Silver Tickets, BloodHound enumeration, and certificate-based attacks (ESC1-ESC13).

Run HackTricks Locally

Clone the repository and run with Docker to get a local copy with full search:

git clone https://github.com/HackTricks-wiki/hacktricks
export LANG="master"  # or language code: es, fr, de, zh, ja...

docker run -d --rm --platform linux/amd64 \
  -p 3337:3000 \
  --name hacktricks \
  -v $(pwd)/hacktricks:/app \
  ghcr.io/hacktricks-wiki/hacktricks-cloud/translator-image \
  bash -c "cd /app && MDBOOK_PREPROCESSOR__HACKTRICKS__ENV=dev mdbook serve --hostname 0.0.0.0"

Your local copy will be available at http://localhost:3337 after a short build time.

Community & Contributions

HackTricks is open-source and community-driven. Contributions are welcome — new techniques, bug fixes, and translations are all appreciated.

GitHub Repository

Star the repo, submit PRs, or report issues

HackTricks Cloud

Cloud and infrastructure pentesting (AWS, Azure, GCP, K8s)