HackTricks-wiki · carlospolop · Aug 5, 2026 · Aug 5, 2026
diff --git a/src/network-services-pentesting/11211-memcache/README.md b/src/network-services-pentesting/11211-memcache/README.md
@@ -67,7 +67,7 @@ In the realm of memcache, a protocol that assists in organizing data by slabs, s
 2. A limit exists of one page per slab class, equating to 1MB of data.
 3. This feature is unofficial and may be discontinued at any time, as discussed in [community forums](https://groups.google.com/forum/?fromgroups=#!topic/memcached/1-T8I-RVGKM).
 
-The limitation of only being able to dump 1MB from potentially gigabytes of data is particularly significant. However, this functionality can still offer insights into key usage patterns, depending on specific needs. For those less interested in the mechanics, a visit to the [tools section](https://lzone.de/cheat-sheet/memcached#tools) reveals utilities for comprehensive dumping. Alternatively, the process of using telnet for direct interaction with memcached setups is outlined below.
+The limitation of only being able to dump 1MB from potentially gigabytes of data is particularly significant. However, this functionality can still offer insights into key usage patterns, depending on specific needs. For those less interested in the mechanics, a visit to the [tools section](https://lzone.de/cheat-sheet/memcached#tools) reveals utilities for comprehensive dumping. Alternatively, the process of using telnet for direct interaction with memcached setups is outlined below.<sup>[[1]](#references)</sup>
 
 ### **How it Works**
 
@@ -140,7 +140,7 @@ echo 'lru_crawler metadump all' | nc 127.0.0.1 11211 | grep ee6ba58566e234ccbbce
 
 ### **DUMPING TOOLS**
 
-Table [from here](https://lzone.de/blog).
+Table [from here](https://lzone.de/blog).<sup>[[2]](#references)</sup>
 
 | Programming Languages | Tools                                                                                                                             | Functionality                                                                                                                                                          |                                                                            |         |
 | --------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | ------- |
@@ -155,13 +155,13 @@ Table [from here](https://lzone.de/blog).
 
 ### 1MB Data Limit <a href="#1mb-data-limit" id="1mb-data-limit"></a>
 
-Note that prio to memcached 1.4 you cannot store objects larger than 1MB due to the default maximum slab size.
+Note that prio to memcached 1.4 you cannot store objects larger than 1MB due to the default maximum slab size.<sup>[[1]](#references)</sup>
 
 ### Never Set a Timeout > 30 Days! <a href="#never-set-a-timeout--30-days" id="never-set-a-timeout--30-days"></a>
 
 If you try to “set” or “add” a key with a timeout bigger than the allowed maximum you might not get what you expect because memcached then treats the value as a Unix timestamp. Also if the timestamp is in the past it will do nothing at all. Your command will silently fail.
 
-So if you want to use the maximum lifetime specify 2592000. Example:
+So if you want to use the maximum lifetime specify 2592000. Example:<sup>[[1]](#references)</sup>
 
 ```
 set my_key 0 2592000 1
@@ -170,11 +170,11 @@ set my_key 0 2592000 1
 
 ### Disappearing Keys on Overflow <a href="#disappearing-keys-on-overflow" id="disappearing-keys-on-overflow"></a>
 
-Despite the documentation saying something about wrapping around 64bit overflowing a value using “incr” causes the value to disappear. It needs to be created using “add”/”set” again.
+Despite the documentation saying something about wrapping around 64bit overflowing a value using “incr” causes the value to disappear. It needs to be created using “add”/”set” again.<sup>[[1]](#references)</sup>
 
 ### Replication <a href="#replication" id="replication"></a>
 
-memcached itself does not support replication. If you really need it you need to use 3rd party solutions:
+memcached itself does not support replication. If you really need it you need to use 3rd party solutions:<sup>[[1]](#references)</sup>
 
 - [repcached](http://repcached.lab.klab.org/): Multi-master async replication (memcached 1.2 patch set)
 - [Couchbase memcached interface](http://www.couchbase.com/memcached): Use CouchBase as memcached drop-in
@@ -195,7 +195,8 @@ memcache-commands.md
 
 ## References
 
-- [https://lzone.de/cheat-sheet/memcached](https://lzone.de/cheat-sheet/memcached)
+- [1] [Memcached Cheat Sheet - LZone](https://lzone.de/cheat-sheet/memcached)
+- [2] [LZone DevOps Blog](https://lzone.de/blog)
 
 {{#include ../../banners/hacktricks-training.md}}
 

diff --git a/src/network-services-pentesting/11211-memcache/memcache-commands.md b/src/network-services-pentesting/11211-memcache/memcache-commands.md
@@ -5,7 +5,7 @@
 
 ## Commands Cheat-Sheet
 
-**From** [**https://lzone.de/cheat-sheet/memcached**](https://lzone.de/cheat-sheet/memcached)
+**From** [**https://lzone.de/cheat-sheet/memcached**](https://lzone.de/cheat-sheet/memcached)<sup>[[1]](#references)</sup>
 
 The supported commands (the official ones and some unofficial) are documented in the [doc/protocol.txt](https://github.com/memcached/memcached/blob/master/doc/protocol.txt) document.
 
@@ -105,7 +105,7 @@ STAT total_malloced 3145436
 END
 ```
 
-If you are unsure if you have enough memory for your memcached instance always look out for the “evictions” counters given by the “stats” command. If you have enough memory for the instance the “evictions” counter should be 0 or at least not increasing.
+If you are unsure if you have enough memory for your memcached instance always look out for the “evictions” counters given by the “stats” command. If you have enough memory for the instance the “evictions” counter should be 0 or at least not increasing.<sup>[[1]](#references)</sup>
 
 #### Which Keys Are Used? <a href="#which-keys-are-used" id="which-keys-are-used"></a>
 
@@ -127,8 +127,11 @@ STAT items:2:age 1405
 END
 ```
 
-This at least helps to see if any keys are used. To dump the key names from a PHP script that already does the memcache access you can use the PHP code from [100days.de](http://100days.de/serendipity/archives/55-Dumping-MemcacheD-Content-Keys-with-PHP.html).
+This at least helps to see if any keys are used. To dump the key names from a PHP script that already does the memcache access you can use the PHP code from [100days.de](http://100days.de/serendipity/archives/55-Dumping-MemcacheD-Content-Keys-with-PHP.html).<sup>[[1]](#references)</sup>
 
+## References
+
+- [1] [memcached cheat sheet](https://lzone.de/cheat-sheet/memcached)
 
 {{#include ../../banners/hacktricks-training.md}}
 

diff --git a/src/network-services-pentesting/12346-udp-pentesting-cisco-sd-wan-control-plane.md b/src/network-services-pentesting/12346-udp-pentesting-cisco-sd-wan-control-plane.md
@@ -4,7 +4,7 @@
 
 ## Basic Information
 
-Cisco Catalyst SD-WAN controllers expose a **DTLS control-plane service on UDP/12346** (`vdaemon`). This service should be treated like a routing-adjacency surface: if an attacker can become an authenticated peer, they may be able to pivot into the overlay fabric.
+Cisco Catalyst SD-WAN controllers expose a **DTLS control-plane service on UDP/12346** (`vdaemon`). This service should be treated like a routing-adjacency surface: if an attacker can become an authenticated peer, they may be able to pivot into the overlay fabric.<sup>[[1]](#references)</sup>
 
 `vdaemon` uses a **12-byte header** where the **high nibble** of `device_info` encodes the claimed device role:
 
@@ -17,7 +17,7 @@ Cisco Catalyst SD-WAN controllers expose a **DTLS control-plane service on UDP/1
 | `5` | vManage |
 | `6` | ZTP |
 
-The DTLS handshake is not enough to authenticate a peer by itself. Peer trust is finalized later during control-plane bootstrap messages such as `CHALLENGE_ACK`.
+The DTLS handshake is not enough to authenticate a peer by itself. Peer trust is finalized later during control-plane bootstrap messages such as `CHALLENGE_ACK`.<sup>[[1]](#references)</sup>
 
 **Default port:** 12346/udp
 
@@ -45,7 +45,7 @@ ssh -p 830 <user>@<IP>
 
 ### Pre-auth Role Confusion
 
-`CHALLENGE_ACK` (**message type `9`**) is reachable before authentication because it is part of the control-plane bootstrap allowlist. In CVE-2026-20182, Rapid7 showed that `vbond_proc_challenge_ack()` verified some roles (`vEdge`, `vSmart`, `vManage`) but had no verification branch for claimed role `2` / vHub.
+`CHALLENGE_ACK` (**message type `9`**) is reachable before authentication because it is part of the control-plane bootstrap allowlist. In CVE-2026-20182, Rapid7 showed that `vbond_proc_challenge_ack()` verified some roles (`vEdge`, `vSmart`, `vManage`) but had no verification branch for claimed role `2` / vHub.<sup>[[1]](#references)[[2]](#references)</sup>
 
 Because the function later fell through to `peer->authenticated = 1`, an attacker could:
 
@@ -58,7 +58,7 @@ This is a useful bug pattern to hunt in proprietary control planes: attacker-con
 
 ### Post-auth Pivot
 
-Once treated as an authenticated peer, the controller accepted `MSG_VMANAGE_TO_PEER` (**message type `14`**) and appended attacker-controlled data to `/home/vmanage-admin/.ssh/authorized_keys`.
+Once treated as an authenticated peer, the controller accepted `MSG_VMANAGE_TO_PEER` (**message type `14`**) and appended attacker-controlled data to `/home/vmanage-admin/.ssh/authorized_keys`.<sup>[[1]](#references)</sup>
 
 This turns a control-plane foothold into persistent NETCONF over SSH access on TCP/830 as `vmanage-admin`.
 
@@ -87,7 +87,7 @@ Review similar appliances for post-auth messages that write SSH keys, API tokens
 
 ## References
 
-- [Rapid7: CVE-2026-20182 - Critical authentication bypass in Cisco Catalyst SD-WAN Controller](https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/)
-- [Cisco Security Advisory: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW)
+- [1] [Rapid7: CVE-2026-20182 - Critical authentication bypass in Cisco Catalyst SD-WAN Controller](https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/)
+- [2] [Cisco Security Advisory: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md
@@ -100,13 +100,13 @@ with socket.create_connection(("10.10.11.131",24007)) as s:
     s.send(struct.pack("!L", len(p.get_buffer())|0x80000000))
     s.send(p.get_buffer())
 ```
-Running the script crashes `glusterfsd` < 11.0.
+Running the script crashes `glusterfsd` < 11.0.<sup>[[2]](#references)</sup>
 
 ---
 
 ## Hardening & Detection
 
-* **Upgrade** – current LTS is 11.1 (July 2025).  All CVEs above are fixed.
+* **Upgrade** – current LTS is 11.1 (July 2025).  All CVEs above are fixed.<sup>[[1]](#references)</sup>
 * Enable **TLS** for every brick:
 
   ```bash
@@ -127,6 +127,7 @@ Running the script crashes `glusterfsd` < 11.0.
 
 ## References
 
-* [GlusterFS security advisories](https://docs.gluster.org/en/latest/release-notes/#security)  
-* [CVE-2023-26253 PoC – github.com/tinynetwork/gluster-notify-crash](https://github.com/tinynetwork/gluster-notify-crash)
+- [1] [GlusterFS security advisories](https://docs.gluster.org/en/latest/release-notes/#security)
+- [2] [CVE-2023-26253 PoC (tinynetwork/gluster-notify-crash)](https://github.com/tinynetwork/gluster-notify-crash)
+
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/27017-27018-mongodb.md b/src/network-services-pentesting/27017-27018-mongodb.md
@@ -81,7 +81,7 @@ grep "auth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#\|noauth" #Not
 
 ## Mongo Objectid Predict
 
-Example [from here](https://techkranti.com/idor-through-mongodb-object-ids-prediction/).
+Example [from here](https://techkranti.com/idor-through-mongodb-object-ids-prediction/).<sup>[[6]](#references)</sup>
 
 Mongo Object IDs are **12-byte hexadecimal** strings:
 
@@ -104,11 +104,11 @@ If you are root you can **modify** the **mongodb.conf** file so no credentials a
 
 ## MongoBleed zlib Memory Disclosure (CVE-2025-14847)
 
-A widespread unauthenticated memory disclosure ("MongoBleed") impacts MongoDB 3.6–8.2 when the **zlib network compressor is enabled**. The `OP_COMPRESSED` header trusts an attacker-supplied `uncompressedSize`, so the server allocates a buffer of that size and copies it back into responses even though only a much smaller compressed payload was provided. The extra bytes are **uninitialized heap data** from other connections, `/proc`, or the WiredTiger cache. Attackers then omit the expected **BSON `\x00` terminator** so MongoDB’s parser keeps scanning that oversized buffer until it finds a terminator, and the error response echoes both the malicious document and the scanned heap bytes **pre-auth** on TCP/27017.
+A widespread unauthenticated memory disclosure ("MongoBleed") impacts MongoDB 3.6–8.2 when the **zlib network compressor is enabled**. The `OP_COMPRESSED` header trusts an attacker-supplied `uncompressedSize`, so the server allocates a buffer of that size and copies it back into responses even though only a much smaller compressed payload was provided. The extra bytes are **uninitialized heap data** from other connections, `/proc`, or the WiredTiger cache. Attackers then omit the expected **BSON `\x00` terminator** so MongoDB’s parser keeps scanning that oversized buffer until it finds a terminator, and the error response echoes both the malicious document and the scanned heap bytes **pre-auth** on TCP/27017.<sup>[[1]](#references)[[2]](#references)</sup>
 
 ### Exposure requirements & quick checks
 
-- Server version must be within the vulnerable ranges (3.6, 4.0, 4.2, 4.4.0–4.4.29, 5.0.0–5.0.31, 6.0.0–6.0.26, 7.0.0–7.0.27, 8.0.0–8.0.16, 8.2.0–8.2.2).
+- Server version must be within the vulnerable ranges (3.6, 4.0, 4.2, 4.4.0–4.4.29, 5.0.0–5.0.31, 6.0.0–6.0.26, 7.0.0–7.0.27, 8.0.0–8.0.16, 8.2.0–8.2.2).<sup>[[3]](#references)</sup>
 - `net.compression.compressors` or `networkMessageCompressors` must include `zlib` (default on many builds). Check it from the shell with:
 
 ```javascript
@@ -122,17 +122,17 @@ db.adminCommand({getParameter: 1, networkMessageCompressors: 1})
 1. Initiate the wire-protocol handshake advertising `compressors:["zlib"]` so the session uses zlib.
 2. Send `OP_COMPRESSED` frames whose declared `uncompressedSize` is far larger than the real decompressed payload to force **oversized heap allocation full of old data**.
 3. Craft the embedded BSON **without a final `\x00`** so the parser walks past attacker-controlled data into the oversized buffer while looking for a terminator.
-4. MongoDB emits an error that includes the original message plus whatever heap bytes were scanned, leaking memory. Repeat with varying lengths/offsets to aggregate secrets (creds/API keys/session tokens), WiredTiger stats, and `/proc` artifacts.
+4. MongoDB emits an error that includes the original message plus whatever heap bytes were scanned, leaking memory. Repeat with varying lengths/offsets to aggregate secrets (creds/API keys/session tokens), WiredTiger stats, and `/proc` artifacts.<sup>[[1]](#references)</sup>
 
-The public PoC automates the probing offsets and carving of the returned fragments:
+The public PoC automates the probing offsets and carving of the returned fragments:<sup>[[5]](#references)</sup>
 
 ```bash
 python3 mongobleed.py --host <target> --max-offset 50000 --output leaks.bin
 ```
 
 ### Detection noise signal (high-rate connections)
 
-The attack usually generates many short-lived requests. Watch for spikes of inbound connections to `mongod`/`mongod.exe`. Example XQL hunt (>500 connections/min per remote IP, excluding RFC1918/loopback/link-local/mcast/broadcast/reserved ranges by default):
+The attack usually generates many short-lived requests. Watch for spikes of inbound connections to `mongod`/`mongod.exe`.<sup>[[1]](#references)</sup> Example XQL hunt (>500 connections/min per remote IP, excluding RFC1918/loopback/link-local/mcast/broadcast/reserved ranges by default):
 
 <details>
 <summary>Cortex XQL high-velocity Mongo connections</summary>
@@ -164,11 +164,12 @@ dataset = xdr_data
 
 ## References
 
-- [Unit 42 – Threat Brief: MongoDB Vulnerability (CVE-2025-14847)](https://unit42.paloaltonetworks.com/mongobleed-cve-2025-14847/)
-- [Tenable – CVE-2025-14847 (MongoBleed): MongoDB Memory Leak Vulnerability Exploited in the Wild](https://www.tenable.com/blog/cve-2025-14847-mongobleed-mongodb-memory-leak-vulnerability-exploited-in-the-wild)
-- [MongoDB Security Advisory SERVER-115508](https://jira.mongodb.org/browse/SERVER-115508)
-- [Censys – MongoBleed Advisory](https://censys.com/advisory/cve-2025-14847)
-- [MongoBleed PoC (joe-desimone/mongobleed)](https://github.com/joe-desimone/mongobleed)
+- [1] [Unit 42 – Threat Brief: MongoDB Vulnerability (CVE-2025-14847)](https://unit42.paloaltonetworks.com/mongobleed-cve-2025-14847/)
+- [2] [Tenable – CVE-2025-14847 (MongoBleed): MongoDB Memory Leak Vulnerability Exploited in the Wild](https://www.tenable.com/blog/cve-2025-14847-mongobleed-mongodb-memory-leak-vulnerability-exploited-in-the-wild)
+- [3] [MongoDB Security Advisory SERVER-115508](https://jira.mongodb.org/browse/SERVER-115508)
+- [4] [Censys – MongoBleed Advisory](https://censys.com/advisory/cve-2025-14847)
+- [5] [MongoBleed PoC (joe-desimone/mongobleed)](https://github.com/joe-desimone/mongobleed)
+- [6] [IDOR through MongoDB Object IDs Prediction](https://techkranti.com/idor-through-mongodb-object-ids-prediction/)
 
 ---