# HackTricks

## Docs

- [HackTricks](https://mintlify.wiki/HackTricks-wiki/hacktricks/index.md): The ultimate cybersecurity knowledge base — tricks, techniques, and methodologies from CTFs, real-world apps, and security research.
- [About the Author](https://mintlify.wiki/HackTricks-wiki/hacktricks/welcome/about-the-author.md): Learn about Carlos Polop, creator of HackTricks and PEASS-ng, and how to follow and contribute to the project.
- [HackTricks Values & FAQ](https://mintlify.wiki/HackTricks-wiki/hacktricks/welcome/hacktricks-values-and-faq.md): The core values of the HackTricks project, frequently asked questions, license information, and disclaimer.
- [Pentesting Methodology](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-methodologies/pentesting-methodology.md): A structured, step-by-step approach to conducting professional penetration tests, from initial access to post-exploitation and pivoting.
- [External Recon Methodology](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-methodologies/external-recon.md): Comprehensive guide to discovering company assets, domains, subdomains, cloud resources, emails, and credential leaks from the outside.
- [Pentesting Network](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-methodologies/pentesting-network.md): Techniques for host discovery, port scanning, traffic sniffing, LAN attacks, VLAN hopping, spoofing, and protocol-level network exploitation.
- [Pentesting WiFi](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-methodologies/pentesting-wifi.md): Comprehensive guide to WiFi security testing including WEP/WPA/WPA2/WPA3 attacks, Evil Twin, KARMA/MANA, WPS exploitation, and Enterprise EAP attacks.
- [Phishing Methodology](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-methodologies/phishing-methodology.md): Complete guide to planning and executing phishing campaigns, from domain setup and GoPhish configuration to MFA bypass, AI-enhanced phishing, and detection evasion.
- [Basic Forensic Methodology](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-methodologies/basic-forensic-methodology.md): Structured approach to digital forensics covering image acquisition, malware analysis, filesystem inspection, memory dumps, pcap analysis, and anti-forensic awareness.
- [Threat Modeling](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-methodologies/threat-modeling.md): A structured guide to threat modeling methodologies (STRIDE, DREAD, PASTA, VAST, OCTAVE), the CIA Triad, and tools like OWASP Threat Dragon and Microsoft Threat Modeling Tool.
- [Brute Force CheatSheet](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-hacking/brute-force.md): Comprehensive brute-force reference for dozens of services, default credentials, custom wordlist generation, hash cracking, and tools like Hydra, Hashcat, Medusa, and Legba.
- [Reverse Shells](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-hacking/reverse-shells.md): Reference for obtaining reverse shells on Linux and Windows, MSFVenom payloads, upgrading to full TTYs, and online shell generators.
- [Exfiltration](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-hacking/exfiltration.md): Techniques and tools for transferring files and data out of compromised environments using HTTP, SMB, FTP, DNS, ICMP, and collaboration platform webhooks.
- [Tunneling and Port Forwarding](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-hacking/tunneling-and-port-forwarding.md): Comprehensive reference for SSH tunnels, SOCKS proxies, Chisel, Ligolo-ng, Socat, reGeorg, ngrok, Cloudflared, FRP, DNS/ICMP tunneling, and covert QEMU-based tunnels.
- [Search Exploits](https://mintlify.wiki/HackTricks-wiki/hacktricks/generic-hacking/search-exploits.md): Tools and databases for finding known exploits and vulnerabilities for services, software versions, and CVEs — from searchsploit to Shodan, Sploitus, and more.
- [Linux Basics](https://mintlify.wiki/HackTricks-wiki/hacktricks/linux-hardening/linux-basics.md): Foundational Linux concepts, system enumeration, and privilege escalation checklist for penetration testers
- [Linux Privilege Escalation](https://mintlify.wiki/HackTricks-wiki/hacktricks/linux-hardening/privilege-escalation.md): Comprehensive techniques for escalating privileges on Linux systems, from initial enumeration to root access
- [Docker Security](https://mintlify.wiki/HackTricks-wiki/hacktricks/linux-hardening/docker-security.md): Docker security architecture, container isolation mechanisms, breakout techniques, and hardening best practices
- [Bypass Linux Restrictions](https://mintlify.wiki/HackTricks-wiki/hacktricks/linux-hardening/bypass-restrictions.md): Techniques to bypass bash restrictions, escape jails, evade WAFs, and work around limited shell environments
- [Useful Linux Commands](https://mintlify.wiki/HackTricks-wiki/hacktricks/linux-hardening/useful-commands.md): Essential Linux commands for penetration testing: file manipulation, network enumeration, grep patterns, iptables, eBPF hunting, and log analysis
- [Linux Post-Exploitation](https://mintlify.wiki/HackTricks-wiki/hacktricks/linux-hardening/post-exploitation.md): Post-exploitation techniques on Linux: credential harvesting, PAM backdoors, GPG decryption, persistence, and process masquerading
- [macOS Security Overview](https://mintlify.wiki/HackTricks-wiki/hacktricks/macos-hardening/macos-security-overview.md): Overview of macOS security architecture, attack surface, file permissions, TCC/SIP privilege escalation, and MDM management
- [macOS Privilege Escalation](https://mintlify.wiki/HackTricks-wiki/hacktricks/macos-hardening/macos-privilege-escalation.md): macOS-specific privilege escalation techniques including sudo hijacking, dock impersonation, LaunchDaemon abuse, and recent CVEs
- [macOS Security Protections](https://mintlify.wiki/HackTricks-wiki/hacktricks/macos-hardening/macos-security-protections.md): Deep dive into macOS security mechanisms: Gatekeeper, SIP, Sandbox, TCC, Launch Constraints, MRT, and Background Task Management
- [macOS Red Teaming](https://mintlify.wiki/HackTricks-wiki/hacktricks/macos-hardening/macos-red-teaming.md): Red team techniques for macOS environments: MDM abuse, JAMF compromise, Active Directory integration, Kerberos attacks, and keychain access
- [macOS Useful Commands](https://mintlify.wiki/HackTricks-wiki/hacktricks/macos-hardening/macos-useful-commands.md): Essential macOS commands for penetration testing: system enumeration, process analysis, network profiling, and automated discovery tools
- [Windows Local Privilege Escalation](https://mintlify.wiki/HackTricks-wiki/hacktricks/windows-hardening/windows-privilege-escalation.md): Comprehensive Windows local privilege escalation techniques: services, registry, credentials, DLL hijacking, AlwaysInstallElevated, and more
- [Active Directory Methodology](https://mintlify.wiki/HackTricks-wiki/hacktricks/windows-hardening/active-directory-methodology.md): Complete Active Directory attack methodology: unauthenticated recon, authenticated enumeration, Kerberoasting, delegation abuse, DCSync, Golden/Silver tickets, and domain trust escalation
- [Windows Lateral Movement](https://mintlify.wiki/HackTricks-wiki/hacktricks/windows-hardening/lateral-movement.md): Windows lateral movement techniques: PsExec, WMI, WinRM, DCOM, SMBExec, RDP, scheduled tasks, and credential reuse
- [Stealing Windows Credentials](https://mintlify.wiki/HackTricks-wiki/hacktricks/windows-hardening/stealing-credentials.md): Windows credential theft techniques: Mimikatz, LSASS dumping, SAM extraction, NTDS.dit, DPAPI, and advanced SSP-based dumping
- [Antivirus and EDR Bypass](https://mintlify.wiki/HackTricks-wiki/hacktricks/windows-hardening/antivirus-bypass.md): Techniques for bypassing Windows Defender, AMSI, EDR solutions, and SmartScreen including DLL sideloading, obfuscation, BYOVD, and ETW patching
- [PowerShell for Pentesters](https://mintlify.wiki/HackTricks-wiki/hacktricks/windows-hardening/powershell-for-pentesters.md): Essential PowerShell techniques for penetration testing: download and execute, AMSI bypass, enumeration, credential handling, network scanning, and evasion
- [Web Vulnerabilities Methodology](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/web-vulnerabilities-methodology.md): A comprehensive checklist for web penetration testing covering proxies, user input vectors, HTTP headers, authentication bypasses, structured objects, file operations, and more.
- [XSS (Cross-Site Scripting)](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/xss.md): Complete guide to identifying and exploiting Cross-Site Scripting vulnerabilities across reflected, stored, DOM-based, and universal XSS types.
- [SQL Injection](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/sql-injection.md): Comprehensive guide to identifying, exploiting, and bypassing defenses for SQL injection vulnerabilities across union-based, blind, error-based, and time-based techniques.
- [SSRF (Server-Side Request Forgery)](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/ssrf.md): Guide to identifying and exploiting Server-Side Request Forgery vulnerabilities, including protocol abuse, cloud metadata access, DNS rebinding, and blind SSRF techniques.
- [SSTI (Server-Side Template Injection)](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/ssti.md): Detection and exploitation of Server-Side Template Injection vulnerabilities across Jinja2, Twig, FreeMarker, Velocity, Smarty, ERB, Razor, Mako, and other template engines.
- [File Inclusion / Path Traversal](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/file-inclusion.md): Techniques for exploiting Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities, PHP wrappers, LFI-to-RCE chains, and path traversal bypasses.
- [File Upload Vulnerabilities](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/file-upload.md): Methodology for bypassing file upload restrictions, abusing upload functionality for RCE, and chaining file uploads with other vulnerabilities.
- [Command Injection](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/command-injection.md): Techniques for identifying and exploiting OS command injection vulnerabilities, including context-aware payloads, filter bypasses, and blind exfiltration methods.
- [Deserialization Vulnerabilities](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/deserialization.md): Exploiting insecure deserialization in PHP, Python, Java, .NET, and Node.js, including gadget chain discovery, payload generation tools, and prevention strategies.
- [XXE (XML External Entity)](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/xxe.md): Exploiting XML External Entity vulnerabilities for file read, SSRF, blind data exfiltration, error-based extraction, DoS, and bypassing protections via various DTD techniques.
- [CSRF (Cross-Site Request Forgery)](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/csrf.md): Exploiting Cross-Site Request Forgery vulnerabilities, bypassing CSRF protections including tokens, SameSite cookies, and Referer checks, with ready-to-use PoC templates.
- [CORS Misconfigurations & Bypass](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/cors.md): Exploiting Cross-Origin Resource Sharing misconfigurations including reflected Origin, null origin, regex bypasses, DNS rebinding, and cache poisoning techniques.
- [JWT Vulnerabilities](https://mintlify.wiki/HackTricks-wiki/hacktricks/pentesting-web/jwt-vulnerabilities.md): Attacking JSON Web Tokens: algorithm confusion, none algorithm, brute-force secrets, JWKS spoofing, kid injection, embedded JWK attacks, and token forgery techniques.
- [80, 443 - Web Service Pentesting Methodology](https://mintlify.wiki/HackTricks-wiki/hacktricks/network-services-pentesting/pentesting-web-methodology.md): Step-by-step methodology for pentesting HTTP/HTTPS web services: technology fingerprinting, spidering, directory brute-forcing, vulnerability checking, and automated scanning.
- [21 - Pentesting FTP](https://mintlify.wiki/HackTricks-wiki/hacktricks/network-services-pentesting/pentesting-ftp.md): FTP enumeration, anonymous login, brute force, FTP bounce attacks, configuration review, and post-exploitation techniques for the File Transfer Protocol.
- [22 - Pentesting SSH/SFTP](https://mintlify.wiki/HackTricks-wiki/hacktricks/network-services-pentesting/pentesting-ssh.md): SSH enumeration, brute force, key-based attacks, Kerberos/GSSAPI auth, MitM techniques, SFTP misconfigurations, and critical vulnerabilities including CVE-2024-6387 regreSSHion.
- [25, 465, 587 - Pentesting SMTP](https://mintlify.wiki/HackTricks-wiki/hacktricks/network-services-pentesting/pentesting-smtp.md): SMTP enumeration, user enumeration techniques, email spoofing, SPF/DKIM/DMARC analysis, open relay testing, SMTP smuggling, and phishing infrastructure assessment.
- [53 - Pentesting DNS](https://mintlify.wiki/HackTricks-wiki/hacktricks/network-services-pentesting/pentesting-dns.md): DNS enumeration, zone transfer attacks, subdomain brute-forcing, DNS recursion DDoS, reverse DNS lookups, DNSSEC auditing, and post-exploitation techniques.
- [139, 445 - Pentesting SMB](https://mintlify.wiki/HackTricks-wiki/hacktricks/network-services-pentesting/pentesting-smb.md): SMB enumeration, share discovery, credential attacks, NTLM relay, pass-the-hash, command execution via psexec/wmiexec/atexec, and BloodHound share mapping.
- [3389 - Pentesting RDP](https://mintlify.wiki/HackTricks-wiki/hacktricks/network-services-pentesting/pentesting-rdp.md): Remote Desktop Protocol enumeration, password spraying, session hijacking, RDP shadowing, virtual channel tunneling, sticky keys backdoors, and process injection.
- [389, 636, 3268, 3269 - Pentesting LDAP](https://mintlify.wiki/HackTricks-wiki/hacktricks/network-services-pentesting/pentesting-ldap.md): LDAP enumeration, anonymous bind exploitation, authenticated data extraction, password modification, Kerberos authentication, and post-exploitation techniques.
- [Pentesting Databases (MySQL, MSSQL, PostgreSQL)](https://mintlify.wiki/HackTricks-wiki/hacktricks/network-services-pentesting/pentesting-databases.md): Comprehensive guide to enumerating and exploiting MySQL, Microsoft SQL Server, and PostgreSQL databases: enumeration commands, privilege escalation, RCE techniques, and credential extraction.
- [Android APK Pentesting Checklist](https://mintlify.wiki/HackTricks-wiki/hacktricks/mobile-pentesting/android-checklist.md): A comprehensive checklist for Android APK security assessments, covering fundamentals, static analysis, dynamic analysis, and modern attack vectors.
- [Android Application Pentesting](https://mintlify.wiki/HackTricks-wiki/hacktricks/mobile-pentesting/android-app-pentesting.md): Comprehensive guide to pentesting Android applications — covering the security model, static analysis, dynamic analysis, Frida, and automated tooling.
- [Android Frida Tutorial](https://mintlify.wiki/HackTricks-wiki/hacktricks/mobile-pentesting/android-frida-tutorial.md): Hands-on guide to instrumenting Android applications with Frida — installation, server vs. Gadget modes, hooking patterns, DEX dumping, and fuzzing.
- [Android Reversing — Smali & APK Decompilers](https://mintlify.wiki/HackTricks-wiki/hacktricks/mobile-pentesting/android-reversing.md): Guide to decompiling Android APKs, modifying Smali bytecode, recompiling and signing modified APKs, and understanding the Dalvik instruction set.
- [iOS Pentesting Checklist](https://mintlify.wiki/HackTricks-wiki/hacktricks/mobile-pentesting/ios-pentesting-checklist.md): Structured checklist for iOS application security assessments — covering data storage, keyboards, logs, backups, memory, cryptography, IPC, and network communication.
- [iOS Pentesting](https://mintlify.wiki/HackTricks-wiki/hacktricks/mobile-pentesting/ios-pentesting.md): Comprehensive iOS application security testing guide — IPA structure, static and dynamic analysis, data storage, local authentication, network security, and memory analysis.
- [iOS Frida Configuration](https://mintlify.wiki/HackTricks-wiki/hacktricks/mobile-pentesting/ios-frida-configuration.md): Complete guide to installing and using Frida on iOS — jailbroken and non-jailbroken setups, tracing, Objective-C hooking, Swift ABI, LLDB integration, and Frida-based fuzzing.
- [iOS WebViews](https://mintlify.wiki/HackTricks-wiki/hacktricks/mobile-pentesting/ios-webviews.md): Security testing guide for iOS WebViews — UIWebView, WKWebView, and SFSafariViewController, including JavaScript settings, file access, native bridges, and debugging techniques.
- [Hardware & Physical Access](https://mintlify.wiki/HackTricks-wiki/hacktricks/hardware-physical-access/overview.md): Overview of hardware and physical security testing — BIOS/UEFI attacks, DMA exploitation, BadUSB implants, physical bypass techniques, and kiosk escapes.
- [Firmware Analysis](https://mintlify.wiki/HackTricks-wiki/hacktricks/hardware-physical-access/firmware-analysis.md): Methodology for acquiring, extracting, and analyzing embedded device firmware — including filesystem extraction, static/dynamic analysis, emulation, downgrade attacks, and IoT credential harvesting.
- [Hardware Hacking Tools & Bootloader Testing](https://mintlify.wiki/HackTricks-wiki/hacktricks/hardware-physical-access/hardware-hacking-tools.md): Reference guide to hardware hacking tools, U-Boot exploitation, UEFI/BIOS assessment, SoC ROM recovery modes, network-boot surface testing, and kiosk escape techniques.
- [Binary Exploitation Overview](https://mintlify.wiki/HackTricks-wiki/hacktricks/binary-exploitation/overview.md): Introduction to binary exploitation techniques, common memory protections, and the methodology used to find and exploit vulnerabilities in compiled programs.
- [Stack Overflow](https://mintlify.wiki/HackTricks-wiki/hacktricks/binary-exploitation/stack-overflow.md): How stack-based buffer overflows work, how to find and measure them, and the exploitation techniques that flow from controlling the saved return address.
- [Return-Oriented Programming (ROP)](https://mintlify.wiki/HackTricks-wiki/hacktricks/binary-exploitation/return-oriented-programming.md): Build exploit payloads from existing code fragments to bypass NX/DEP. Covers gadget finding, x86/x64 calling conventions, ROP chains, and advanced techniques such as ret2lib, ret2syscall, and JOP.
- [Heap Exploitation](https://mintlify.wiki/HackTricks-wiki/hacktricks/binary-exploitation/heap-exploitation.md): Understand glibc heap internals — chunks, bins, arenas — and the attack primitives built on top of them: use-after-free, double-free, tcache poisoning, and House-of-X techniques.
- [Reversing Overview](https://mintlify.wiki/HackTricks-wiki/hacktricks/reversing/overview.md): Introduction to reverse engineering: goals, common targets, and a structured methodology for analysing compiled binaries, malware, and obfuscated code.
- [Reversing Tools](https://mintlify.wiki/HackTricks-wiki/hacktricks/reversing/reversing-tools.md): Practical guide to the most important reversing tools: disassemblers, debuggers, shellcode analysis, decompilers for specific languages, and SMT solvers.
- [Common Vulnerabilities in Reversing](https://mintlify.wiki/HackTricks-wiki/hacktricks/reversing/common-vulnerabilities.md): Patterns to look for when reversing malware or CTF binaries: malware APIs, injection techniques, hooking, anti-analysis, and obfuscation.
- [Cryptography Overview](https://mintlify.wiki/HackTricks-wiki/hacktricks/crypto/overview.md): Practical cryptography for security research and CTFs: how to classify primitives, identify weaknesses, and apply known attacks to symmetric ciphers, hashes, and public-key schemes.
- [Cipher Block Chaining (CBC)](https://mintlify.wiki/HackTricks-wiki/hacktricks/crypto/cipher-block-chaining.md): Deep dive into AES-CBC: how chaining works, why it is malleable, bit-flipping attacks, and the relationship between CBC mode and padding oracle vulnerabilities.
- [Padding Oracle Attacks](https://mintlify.wiki/HackTricks-wiki/hacktricks/crypto/padding-oracle-attacks.md): How CBC padding oracle attacks work, step-by-step byte recovery, encryption forgery, practical tooling with PadBuster, and defences.
- [AI Security Overview](https://mintlify.wiki/HackTricks-wiki/hacktricks/ai-security/overview.md): Introduction to the threat landscape around AI and machine learning systems: attack surface, key risk frameworks, and the major vulnerability classes in LLMs, model files, and agentic pipelines.
- [Prompt Injection](https://mintlify.wiki/HackTricks-wiki/hacktricks/ai-security/prompt-injection.md): Complete guide to prompt injection attacks against LLMs: direct injection, indirect injection, jailbreaks, prompt leaking, and defences for each technique.
- [LLM Attacks](https://mintlify.wiki/HackTricks-wiki/hacktricks/ai-security/llm-attacks.md): Advanced LLM attack techniques: jailbreaks, WAF bypasses, model RCE via malicious checkpoints, agentic pipeline exploitation, and supply chain attacks against ML frameworks.
- [Blockchain & Cryptocurrencies Overview](https://mintlify.wiki/HackTricks-wiki/hacktricks/blockchain/overview.md): Fundamentals of blockchain technology, Bitcoin and Ethereum mechanics, privacy attacks, consensus mechanisms, and an introduction to Web3 security.
- [Smart Contract Security](https://mintlify.wiki/HackTricks-wiki/hacktricks/blockchain/smart-contract-security.md): Common smart contract vulnerabilities, auditing methodology, mutation testing with Slither, and how to identify reentrancy, access control, and logic flaws in Solidity.
- [Web3 Red Teaming](https://mintlify.wiki/HackTricks-wiki/hacktricks/blockchain/web3-red-teaming.md): Value-centric red teaming methodology for Web3 and DeFi: mapping attack surfaces, DeFi exploit chains, oracle manipulation, bridge attacks, signing workflow compromise, and AMM precision abuse.

## OpenAPI Specs

- [openapi](https://mintlify.wiki/HackTricks-wiki/hacktricks/api-reference/openapi.json)