HackTricks

https://hacktricks.wiki/en/
Admin
HackTricks is an open-source cybersecurity wiki and knowledge base providing practical penetration...
Tokens:3,253,853
Snippets:24,879
Trust Score:8.6
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Unattended Installation File Example

Source: https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html

Example content from an unattended installation file showing autologon credentials and local account creation. Passwords may be base64-encoded or marked as sensitive data.

```xml
<component name="Microsoft-Windows-Shell-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="amd64">
    <AutoLogon>
     <Password>U2VjcmV0U2VjdXJlUGFzc3dvcmQxMjM0Kgo==</Password>
     <Enabled>true</Enabled>
     <Username>Administrateur</Username>
    </AutoLogon>

    <UserAccounts>
     <LocalAccounts>
      <LocalAccount wcm:action="add">
       <Password>*SENSITIVE*DATA*DELETED*</Password>
       <Group>administrators;users</Group>
       <Name>Administrateur</Name>
      </LocalAccount>
     </LocalAccounts>
    </UserAccounts>
```

--------------------------------

### Install and use go-ios for CoreDevice services

Source: https://hacktricks.wiki/en/mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html

Install go-ios, start its tunnel, list installed apps, and list files in an app container. Useful for chaining Frida, syslog/oslog, debugserver/LLDB, or file exfiltration from Linux/Windows without Xcode.

```bash
npm install -g go-ios
sudo ios tunnel start
ios apps
ios file ls --app <bundle-id> --path /
```

--------------------------------

### Install APK and verify Frida setup

Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.html

Install the APK and verify that Frida can see both the device and the package. The Frida client and frida-server must be compatible and the server binary must match the device architecture.

```bash
adb install -r UnCrackable-Level1.apk
adb shell getprop ro.product.cpu.abi
frida --version
frida-ps -Uai | grep -i uncrackable
```

--------------------------------

### Ligolo-ng proxy setup and tunnel establishment

Source: https://hacktricks.wiki/en/generic-hacking/tunneling-and-port-forwarding.html

Commands to start the Ligolo-ng proxy with self-signed certificates, create a TUN interface, get the certificate fingerprint, start the agent with fingerprint validation, select the agent, start the tunnel, and add a route to the agent's network.

```bash
sudo ./proxy -selfcert
interface_create --name "ligolo"
certificate_fingerprint
./agent -connect <ip_proxy>:11601 -v -accept-fingerprint <fingerprint>
session
1
tunnel_start --tun "ligolo"
ifconfig
interface_add_route --name "ligolo" --route <network_address_agent>/<netmask_agent>
interface_list
```

--------------------------------

### Set up and run queue-saquery PoC

Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-wifi/wifi-dos-and-management-frame-attacks.html

Clone the Wi-Fi Framework and the published queue-state PoC, copy the test script, set up the framework, load the WPA3-Personal/PMF configuration, start the AP, and run the queue-saquery test from a second terminal. The last two commands are separate processes; on real radios use supported interface names, and with mac80211_hwsim create them first with `sudo ./setup/setup-hwsim.sh 4`.

```bash
git clone --depth 1 --recursive https://github.com/domienschepers/wifi-framework.git
git clone --depth 1 https://github.com/domienschepers/wifi-framing.git
cp wifi-framing/framework/test-queue-saquery.py wifi-framework/
cd wifi-framework && ./setup.sh

# Load WPA3-Personal/PMF, start the AP, and run queue-saquery from a second terminal.
cd setup && ./load-config.sh wpa3-personal-pmf && cd ..
./hostap.py wlan0 --ap
./run.py wlan1 queue-saquery
```

--------------------------------

### Basic Requests Setup and GET/POST Examples

Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/python/web-requests.html

Shows how to configure a request with URL, parameters, headers, cookies, and proxies, and demonstrates GET, POST with data, POST with JSON, and file upload. The verify=False disables TLS verification for testing.

```python
import random
import re
import string

import requests

url = "http://example.com:80/some/path.php"
params = {"p1":"value1", "p2":"value2"}
headers = {"User-Agent": "fake User Agent", "Fake header": "True value"}
cookies = {"PHPSESSID": "1234567890abcdef", "FakeCookie123": "456"}
proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}

#Regular Get requests sending parameters (params)
gr = requests.get(url, params=params, headers=headers, cookies=cookies, verify=False, allow_redirects=True)

code = gr.status_code
ret_headers = gr.headers
body_byte = gr.content
body_text = gr.text
ret_cookies = gr.cookies
is_redirect = gr.is_redirect
is_permanent_redirect = gr.is_permanent_redirect
float_seconds = gr.elapsed.total_seconds()

#Regular Post requests sending parameters (data)
pr = requests.post(url, data=params, headers=headers, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies)

#Json Post requests sending parameters(json)
pr = requests.post(url, json=params, headers=headers, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies)

#Post request sending a file(files) and extra values
filedict = {"<FILE_PARAMETER_NAME>" : ("filename.png", open("filename.png", 'rb').read(), "image/png")}
pr = requests.post(url, data={"submit": "submit"}, files=filedict)

#Useful for presenting results in boolean/time based injections
print(f"\rflag: {flag}{char}", end="")
```

--------------------------------

### Objective-C instance creation and method call

Source: https://hacktricks.wiki/en/macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html

Shows how to create an instance using alloc/init or the new convenience method, and how to call a method with parameters.

```objectivec
MyVehicle *newVehicle = [[MyVehicle alloc] init];

MyVehicle *newVehicle = [MyVehicle new];

[newVehicle addWheels:4];
```

--------------------------------

### Install Volatility 3 and show help

Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html

Install Volatility 3 from source and display its help. Requires Python 3 and git.

```bash
git clone https://github.com/volatilityfoundation/volatility3.git
cd volatility3
python3 setup.py install
python3 vol.py —h
```

--------------------------------

### Package and activity management commands (pm, am, input)

Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/adb-commands.html

Commands to be executed inside a shell. Lists installed packages, gets the APK path, starts activities/services/broadcasts, and sends keystrokes. Without options, am commands show the help menu.

```bash
pm list packages #List installed packages
pm path <package name> #Get the path to the apk file of tha package
am start [<options>] #Start an activity. Whiout options you can see the help menu
am startservice [<options>] #Start a service. Whiout options you can see the help menu
am broadcast [<options>] #Send a broadcast. Whiout options you can see the help menu
input [text|keyevent] #Send keystrokes to device
```

--------------------------------

### Bootstrap Mythic with make and mythic-cli start

Source: https://hacktricks.wiki/en/windows-hardening/mythic.html

Bootstrap Mythic from the Mythic directory. Requires sudo and assumes the Mythic repository is already cloned.

```bash
sudo make
sudo ./mythic-cli start
```

--------------------------------

### Install and start rish shell

Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html

Commands to install rish via wget and start an elevated shell that inherits the Shizuku binder connection. The shell runs as shell user (uid 2000) and does not preserve Termux environment by default.

```bash
pkg install wget
wget https://rikka.app/rish/latest -O rish && chmod +x rish

# start elevated shell (inherits the binder connection)
./rish
whoami   # -> shell
id       # uid=2000(shell) gid=2000(shell) groups=... context=u:r:shell:s0
```

--------------------------------

### Set up Android SDK and create a debuggable AVD with root access

Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html

Sets up Android command-line tools, installs a debuggable x86_64 system image (android-30 google_apis), creates an AVD named PixelRootX86, and launches it with -writable-system and a snapshot. Verifies root access with adb root and adb shell whoami, expecting root.

```bash
mkdir -p ~/Android/cmdline-tools/latest

# Download commandline tools (Linux)
wget https://dl.google.com/android/repository/commandlinetools-linux-13114758_latest.zip -O /tmp/cmdline-tools.zip
unzip /tmp/cmdline-tools.zip -d ~/Android/cmdline-tools/latest
rm /tmp/cmdline-tools.zip

# Env vars (add to ~/.bashrc or ~/.zshrc)
export ANDROID_HOME=$HOME/Android
export PATH=$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$ANDROID_HOME/emulator:$PATH

# Install core SDK components
sdkmanager --install "platform-tools" "emulator"

# Install a debuggable x86_64 system image (Android 11 / API 30)
sdkmanager --install "system-images;android-30;google_apis;x86_64"

# Create an AVD and run it with a writable /system & snapshot name
avdmanager create avd -n PixelRootX86 -k "system-images;android-30;google_apis;x86_64" -d "pixel"
emulator -avd PixelRootX86 -writable-system -snapshot PixelRootX86_snap

# Verify root (debuggable images allow `adb root`)
adb root
adb shell whoami  # expect: root
```

--------------------------------

### 0.CL to CL.0 double desync request

Source: https://hacktricks.wiki/en/pentesting-web/http-request-smuggling/index.html

Example of a request that triggers a 0.CL desync when the front-end responds before receiving the body. The second request (starting with 'GET /victim') is appended to the first request's body, which the back-end will interpret as a new request. This is used to convert a 0.CL attack into a CL.0 with a double desync.

```http
GET / HTTP/1.1
X: yGET /victim HTTP/1.1
Host: <redacted>
```

--------------------------------

### Install punch-q from source

Source: https://hacktricks.wiki/en/network-services-pentesting/1414-pentesting-ibmmq.html

Clone the punch-q project and install it using pip and setup.py.

```bash
pip install -r requirements.txt && python3 setup.py install
```

--------------------------------

### Install Scapy

Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-network/index.html

Installs the Scapy library, which is used for crafting and sending network packets in the double tagging attack example.

```bash
pip install scapy
```

--------------------------------

### Compile, load, and run XPC example

Source: https://hacktricks.wiki/en/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html

Commands to compile the XPC server and client, copy the server to /tmp, load the LaunchDaemon plist, run the client, and clean up. Requires sudo for loading and unloading the daemon.

```bash
# Compile the server & client
gcc xpc_server.c -o xpc_server
gcc xpc_client.c -o xpc_client

# Save the server in its configured location
cp xpc_server /tmp

# Load daemon
sudo cp xyz.hacktricks.service.plist /Library/LaunchDaemons
sudo launchctl load /Library/LaunchDaemons/xyz.hacktricks.service.plist

# Call client
./xpc_client

# Clean
sudo launchctl unload /Library/LaunchDaemons/xyz.hacktricks.service.plist
sudo rm /Library/LaunchDaemons/xyz.hacktricks.service.plist /tmp/xpc_server
```

--------------------------------

### Install Wi-Fi Framework and copy Framing Frames tests

Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-wifi/wifi-post-association-and-client-isolation-attacks.html

Clones the Wi-Fi Framework and the Framing Frames test repository, copies the two official queue tests into the framework directory, runs the setup scripts, and activates the Python virtual environment. Requires root privileges for the hardware simulation setup.

```bash
git clone --depth 1 --recursive https://github.com/domienschepers/wifi-framework.git
git clone --depth 1 https://github.com/domienschepers/wifi-framing.git
cp wifi-framing/framework/test-queue-*.py wifi-framework/
cd wifi-framework
./setup.sh
sudo ./setup/setup-hwsim.sh 4

# Activate the framework environment in each terminal used below.
sudo -s
source setup/venv/bin/activate
```

--------------------------------

### Start an activity via Drozer

Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html

Use the Drozer module 'app.activity.start' to start an exported activity, potentially bypassing authorization. The example shows starting the PWList activity of the sieve package.

```text
dz> run app.activity.start --component com.mwr.example.sieve com.mwr.example.sieve.PWList
```

--------------------------------

### Joomla README.txt example

Source: https://hacktricks.wiki/en/network-services-pentesting/pentesting-web/joomla.html

Example content of README.txt for a Joomla installation. It identifies the package as Joomla! 3.x and provides official links.

```text
1- What is this?
    * This is a Joomla! installation/upgrade package to version 3.x
    * Joomla! Official site: https://www.joomla.org
    * Joomla! 3.9 version history - [https://docs.joomla.org/Special:MyLanguage/Joomla_3.9_version_history](https://docs.joomla.org/Special:MyLanguage/Joomla_3.9_version_history)
    * Detailed changes in the Changelog: https://github.com/joomla/joomla-cms/commits/staging
```

--------------------------------

### Install and configure pure-ftp server

Source: https://hacktricks.wiki/en/generic-hacking/exfiltration.html

Installs pure-ftp and runs a configuration script that creates the FTP user 'fusr' with password 'ftp' and sets up the PureDB authentication. The script must be run after installation.

```bash
apt-get update && apt-get install pure-ftp
```

```bash
#Run the following script to configure the FTP server
#!/bin/bash
groupadd ftpgroup
useradd -g ftpgroup -d /dev/null -s /etc ftpuser
pure-pwd useradd fusr -u ftpuser -d /ftphome
pure-pw mkdb
cd /etc/pure-ftpd/auth/
ln -s ../conf/PureDB 60pdb
mkdir -p /ftphome
chown -R ftpuser:ftpgroup /ftphome/
/etc/init.d/pure-ftpd restart
```

--------------------------------

### Auto-Frida quick start

Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html

Clone the Auto-Frida repository, install its Python dependencies, and run the main script to start the automation workflow.

```bash
git clone https://github.com/ommirkute/Auto-Frida.git
cd Auto-Frida
pip install -r requirements.txt
python auto_frida.py
```

--------------------------------

### Install D-Feet (D-Bus GUI tool)

Source: https://hacktricks.wiki/en/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.html

Install the D-Feet GUI tool for enumerating and interacting with D-Bus services. Requires sudo privileges.

```bash
sudo apt-get install d-feet
```

--------------------------------

### Get OS Version and Installed Patches

Source: https://hacktricks.wiki/en/windows-hardening/basic-powershell-for-pentesters/index.html

Retrieves the current OS version, lists all installed patches, and filters for security updates specifically.

```powershell
[System.Environment]::OSVersion.Version #Current OS version
Get-WmiObject -query 'select * from win32_quickfixengineering' | foreach {$_.hotfixid} #List all patches
Get-Hotfix -description "Security update" #List only "Security Update" patches
```

--------------------------------

### PAM login service configuration example

Source: https://hacktricks.wiki/en/linux-hardening/software-information/pam-pluggable-authentication-modules.html

Example PAM configuration for the login service, showing typical module lines with control flags and module paths. Use as a reference for understanding PAM stack syntax.

```text
auth required /lib/security/pam_securetty.so
auth required /lib/security/pam_nologin.so
auth sufficient /lib/security/pam_ldap.so
auth required /lib/security/pam_unix_auth.so try_first_pass
account sufficient /lib/security/pam_ldap.so
account required /lib/security/pam_unix_acct.so
password required /lib/security/pam_cracklib.so
password required /lib/security/pam_ldap.so
password required /lib/security/pam_pwdb.so use_first_pass
session required /lib/security/pam_unix_session.so
```

--------------------------------

### Start FTP server with pyftpdlib

Source: https://hacktricks.wiki/en/generic-hacking/exfiltration.html

Starts a simple FTP server on port 21 using pyftpdlib. Install the package first with pip3.

```bash
pip3 install pyftpdlib
python3 -m pyftpdlib -p 21
```

--------------------------------

### Start Objection on a Rooted Device

Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html

For a rooted device with frida-server, enumerate installed packages and start the Objection REPL. The 'start' syntax is modern; older writeups may use 'explore' or '--gadget'.

```bash
frida-ps -Uai
objection -n asvid.github.io.fridaapp start
```

--------------------------------

### Install Suricata on Ubuntu, Debian, and CentOS

Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/suricata-and-iptables-cheatsheet.html

Package installation commands for Ubuntu, Debian, and CentOS. Distribution-specific and release-specific; follow the official guide for details.

```bash
add-apt-repository ppa:oisf/suricata-stable
apt-get update
apt-get install suricata
```

```bash
echo "deb http://http.debian.net/debian buster-backports main" > \
    /etc/apt/sources.list.d/backports.list
apt-get update
apt-get install suricata -t buster-backports
```

```bash
yum install epel-release
yum install suricata
```

--------------------------------

### Complete Objective-C example with protocol and main

Source: https://hacktricks.wiki/en/macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html

Complete example combining a protocol, class interface, implementation, and main function. Compile with gcc -framework Foundation test_obj.m -o test_obj.

```objectivec
// gcc -framework Foundation test_obj.m -o test_obj
#import <Foundation/Foundation.h>

@protocol myVehicleProtocol
- (void) startEngine; //mandatory
@required
- (void) addWheels:(int)value; //mandatory
@optional
- (void) makeLongTruck; //optional
@end

@interface MyVehicle : NSObject <myVehicleProtocol>

@property int numberOfWheels;

- (void)startEngine;
- (void)addWheels:(int)value;
- (void)makeLongTruck;

@end

@implementation MyVehicle : NSObject

- (void)startEngine {
    NSLog(@"Engine started");
}

- (void)addWheels:(int)value {
    self.numberOfWheels += value;
}

- (void)makeLongTruck {
    _numberOfWheels = +10000;
    NSLog(@"Number of wheels: %i", self.numberOfWheels);
}

@end

int main(void) {
    @autoreleasepool {
        MyVehicle *mySuperCar = [MyVehicle new];
        [mySuperCar startEngine];
        mySuperCar.numberOfWheels = 4;
        NSLog(@"Number of wheels: %i", mySuperCar.numberOfWheels);
        [mySuperCar setNumberOfWheels:3];
        NSLog(@"Number of wheels: %i", mySuperCar.numberOfWheels);
        [mySuperCar makeLongTruck];
    }
    return 0;
}
```

--------------------------------

### Prepare the filesystem for fuzzing

Source: https://hacktricks.wiki/en/mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html

Creates the required directories and a starting input file for the fuzzer. Run from inside the fpicker clone.

```bash
# From inside fpicker clone
mkdir -p examples/target-app # Where the fuzzing script will be
mkdir -p examples/target-app/out # For code coverage and crashes
mkdir -p examples/target-app/in # For starting inputs

# Create at least 1 input for the fuzzer
echo Hello World > examples/target-app/in/0
```

--------------------------------

### Start an exported activity via ADB

Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html

Use the Android Debug Bridge (ADB) 'am start' command to start an exported activity. The example uses a package name of 'com.example.demo' and an activity name of 'com.example.test.MainActivity'.

```text
adb shell am start -n com.example.demo/com.example.test.MainActivity
```

--------------------------------

### Build and start wpa_sycophant upstream client

Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-wifi/wpa-enterprise-8021x.html

Builds the modified wpa_supplicant and starts the upstream client toward the real SSID on a managed-mode interface. The client uses the example configuration and must be started before the rogue AP.

```bash
# Build Sycophant's modified supplicant in its checked-out repository.
make -C wpa_supplicant

# Start the upstream client toward the real SSID on its managed-mode interface.
sudo ./wpa_sycophant.sh -c wpa_sycophant_example.conf -i wlan1

```

--------------------------------

### Set up Wi-Fi Framework and run SAE flood test

Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-wifi/wifi-dos-and-management-frame-attacks.html

Sets up the Wi-Fi Framework with four simulated radios, loads the WPA3-Personal/PMF configuration, starts the reference AP, and runs the SAE Commit state-exhaustion test (dos-sae-flood). Requires sudo and a virtual environment activation.

```bash
git clone --depth 1 --recursive https://github.com/domienschepers/wifi-framework.git
cd wifi-framework
./setup.sh
sudo ./setup/setup-hwsim.sh 4
sudo -s
source setup/venv/bin/activate

# Select the bundled WPA3-Personal/PMF configuration.
cd setup && ./load-config.sh wpa3-personal-pmf && cd ..

# Start the reference WPA3 AP in the first terminal.
./hostap.py wlan0 --ap

# Run the published SAE Commit state-exhaustion test in a second terminal.
./run.py wlan1 dos-sae-flood
```

--------------------------------

### Start rogue AP with hostapd and hostapd-mana

Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-wifi/evil-twin-rogue-ap-and-client-association-attacks.html

Start a rogue AP from a hostapd configuration, or start MANA/KARMA behavior from the reviewed hostapd-mana configuration. Use a reviewed configuration file for deterministic AP or MANA setups.

```bash
sudo hostapd hostapd.conf
```

```bash
sudo hostapd-mana hostapd-mana.conf
```

--------------------------------

### Install and use Mosquitto clients to subscribe to MQTT topics

Source: https://hacktricks.wiki/en/network-services-pentesting/1883-pentesting-mqtt-mosquitto.html

Commands to install mosquitto and mosquitto-clients, then subscribe to a specific topic or all topics using mosquitto_sub. The -v flag enables verbose output.

```bash
apt-get install mosquitto mosquitto-clients
mosquitto_sub -t 'test/topic' -v #Subscribe to 'test/topic'
mosquitto_sub -h <host-ip> -t "#" -v #Subscribe to ALL topics.
```

--------------------------------

### Run Xplico Services

Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html

Start Xplico's services after installation. Restarts Apache and then starts Xplico; access the web interface at 127.0.0.1:9876 with credentials xplico:xplico.

```bash
/etc/init.d/apache2 restart
/etc/init.d/xplico start
```
Tokens:
Raw