### Unattended Installation File Example Source: https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html Example content from an unattended installation file showing autologon credentials and local account creation. Passwords may be base64-encoded or marked as sensitive data. ```xml U2VjcmV0U2VjdXJlUGFzc3dvcmQxMjM0Kgo== true Administrateur *SENSITIVE*DATA*DELETED* administrators;users Administrateur ``` -------------------------------- ### Install and use go-ios for CoreDevice services Source: https://hacktricks.wiki/en/mobile-pentesting/ios-pentesting/ios-pentesting-without-jailbreak.html Install go-ios, start its tunnel, list installed apps, and list files in an app container. Useful for chaining Frida, syslog/oslog, debugserver/LLDB, or file exfiltration from Linux/Windows without Xcode. ```bash npm install -g go-ios sudo ios tunnel start ios apps ios file ls --app --path / ``` -------------------------------- ### Install APK and verify Frida setup Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/frida-tutorial/owaspuncrackable-1.html Install the APK and verify that Frida can see both the device and the package. The Frida client and frida-server must be compatible and the server binary must match the device architecture. ```bash adb install -r UnCrackable-Level1.apk adb shell getprop ro.product.cpu.abi frida --version frida-ps -Uai | grep -i uncrackable ``` -------------------------------- ### Ligolo-ng proxy setup and tunnel establishment Source: https://hacktricks.wiki/en/generic-hacking/tunneling-and-port-forwarding.html Commands to start the Ligolo-ng proxy with self-signed certificates, create a TUN interface, get the certificate fingerprint, start the agent with fingerprint validation, select the agent, start the tunnel, and add a route to the agent's network. ```bash sudo ./proxy -selfcert interface_create --name "ligolo" certificate_fingerprint ./agent -connect :11601 -v -accept-fingerprint session 1 tunnel_start --tun "ligolo" ifconfig interface_add_route --name "ligolo" --route / interface_list ``` -------------------------------- ### Set up and run queue-saquery PoC Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-wifi/wifi-dos-and-management-frame-attacks.html Clone the Wi-Fi Framework and the published queue-state PoC, copy the test script, set up the framework, load the WPA3-Personal/PMF configuration, start the AP, and run the queue-saquery test from a second terminal. The last two commands are separate processes; on real radios use supported interface names, and with mac80211_hwsim create them first with `sudo ./setup/setup-hwsim.sh 4`. ```bash git clone --depth 1 --recursive https://github.com/domienschepers/wifi-framework.git git clone --depth 1 https://github.com/domienschepers/wifi-framing.git cp wifi-framing/framework/test-queue-saquery.py wifi-framework/ cd wifi-framework && ./setup.sh # Load WPA3-Personal/PMF, start the AP, and run queue-saquery from a second terminal. cd setup && ./load-config.sh wpa3-personal-pmf && cd .. ./hostap.py wlan0 --ap ./run.py wlan1 queue-saquery ``` -------------------------------- ### Basic Requests Setup and GET/POST Examples Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/python/web-requests.html Shows how to configure a request with URL, parameters, headers, cookies, and proxies, and demonstrates GET, POST with data, POST with JSON, and file upload. The verify=False disables TLS verification for testing. ```python import random import re import string import requests url = "http://example.com:80/some/path.php" params = {"p1":"value1", "p2":"value2"} headers = {"User-Agent": "fake User Agent", "Fake header": "True value"} cookies = {"PHPSESSID": "1234567890abcdef", "FakeCookie123": "456"} proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'} #Regular Get requests sending parameters (params) gr = requests.get(url, params=params, headers=headers, cookies=cookies, verify=False, allow_redirects=True) code = gr.status_code ret_headers = gr.headers body_byte = gr.content body_text = gr.text ret_cookies = gr.cookies is_redirect = gr.is_redirect is_permanent_redirect = gr.is_permanent_redirect float_seconds = gr.elapsed.total_seconds() #Regular Post requests sending parameters (data) pr = requests.post(url, data=params, headers=headers, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies) #Json Post requests sending parameters(json) pr = requests.post(url, json=params, headers=headers, cookies=cookies, verify=False, allow_redirects=True, proxies=proxies) #Post request sending a file(files) and extra values filedict = {"" : ("filename.png", open("filename.png", 'rb').read(), "image/png")} pr = requests.post(url, data={"submit": "submit"}, files=filedict) #Useful for presenting results in boolean/time based injections print(f"\rflag: {flag}{char}", end="") ``` -------------------------------- ### Objective-C instance creation and method call Source: https://hacktricks.wiki/en/macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html Shows how to create an instance using alloc/init or the new convenience method, and how to call a method with parameters. ```objectivec MyVehicle *newVehicle = [[MyVehicle alloc] init]; MyVehicle *newVehicle = [MyVehicle new]; [newVehicle addWheels:4]; ``` -------------------------------- ### Install Volatility 3 and show help Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/memory-dump-analysis/volatility-cheatsheet.html Install Volatility 3 from source and display its help. Requires Python 3 and git. ```bash git clone https://github.com/volatilityfoundation/volatility3.git cd volatility3 python3 setup.py install python3 vol.py —h ``` -------------------------------- ### Package and activity management commands (pm, am, input) Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/adb-commands.html Commands to be executed inside a shell. Lists installed packages, gets the APK path, starts activities/services/broadcasts, and sends keystrokes. Without options, am commands show the help menu. ```bash pm list packages #List installed packages pm path #Get the path to the apk file of tha package am start [] #Start an activity. Whiout options you can see the help menu am startservice [] #Start a service. Whiout options you can see the help menu am broadcast [] #Send a broadcast. Whiout options you can see the help menu input [text|keyevent] #Send keystrokes to device ``` -------------------------------- ### Bootstrap Mythic with make and mythic-cli start Source: https://hacktricks.wiki/en/windows-hardening/mythic.html Bootstrap Mythic from the Mythic directory. Requires sudo and assumes the Mythic repository is already cloned. ```bash sudo make sudo ./mythic-cli start ``` -------------------------------- ### Install and start rish shell Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/shizuku-privileged-api.html Commands to install rish via wget and start an elevated shell that inherits the Shizuku binder connection. The shell runs as shell user (uid 2000) and does not preserve Termux environment by default. ```bash pkg install wget wget https://rikka.app/rish/latest -O rish && chmod +x rish # start elevated shell (inherits the binder connection) ./rish whoami # -> shell id # uid=2000(shell) gid=2000(shell) groups=... context=u:r:shell:s0 ``` -------------------------------- ### Set up Android SDK and create a debuggable AVD with root access Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.html Sets up Android command-line tools, installs a debuggable x86_64 system image (android-30 google_apis), creates an AVD named PixelRootX86, and launches it with -writable-system and a snapshot. Verifies root access with adb root and adb shell whoami, expecting root. ```bash mkdir -p ~/Android/cmdline-tools/latest # Download commandline tools (Linux) wget https://dl.google.com/android/repository/commandlinetools-linux-13114758_latest.zip -O /tmp/cmdline-tools.zip unzip /tmp/cmdline-tools.zip -d ~/Android/cmdline-tools/latest rm /tmp/cmdline-tools.zip # Env vars (add to ~/.bashrc or ~/.zshrc) export ANDROID_HOME=$HOME/Android export PATH=$ANDROID_HOME/cmdline-tools/latest/bin:$ANDROID_HOME/platform-tools:$ANDROID_HOME/emulator:$PATH # Install core SDK components sdkmanager --install "platform-tools" "emulator" # Install a debuggable x86_64 system image (Android 11 / API 30) sdkmanager --install "system-images;android-30;google_apis;x86_64" # Create an AVD and run it with a writable /system & snapshot name avdmanager create avd -n PixelRootX86 -k "system-images;android-30;google_apis;x86_64" -d "pixel" emulator -avd PixelRootX86 -writable-system -snapshot PixelRootX86_snap # Verify root (debuggable images allow `adb root`) adb root adb shell whoami # expect: root ``` -------------------------------- ### 0.CL to CL.0 double desync request Source: https://hacktricks.wiki/en/pentesting-web/http-request-smuggling/index.html Example of a request that triggers a 0.CL desync when the front-end responds before receiving the body. The second request (starting with 'GET /victim') is appended to the first request's body, which the back-end will interpret as a new request. This is used to convert a 0.CL attack into a CL.0 with a double desync. ```http GET / HTTP/1.1 X: yGET /victim HTTP/1.1 Host: ``` -------------------------------- ### Install punch-q from source Source: https://hacktricks.wiki/en/network-services-pentesting/1414-pentesting-ibmmq.html Clone the punch-q project and install it using pip and setup.py. ```bash pip install -r requirements.txt && python3 setup.py install ``` -------------------------------- ### Install Scapy Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-network/index.html Installs the Scapy library, which is used for crafting and sending network packets in the double tagging attack example. ```bash pip install scapy ``` -------------------------------- ### Compile, load, and run XPC example Source: https://hacktricks.wiki/en/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-ipc-inter-process-communication/macos-xpc/index.html Commands to compile the XPC server and client, copy the server to /tmp, load the LaunchDaemon plist, run the client, and clean up. Requires sudo for loading and unloading the daemon. ```bash # Compile the server & client gcc xpc_server.c -o xpc_server gcc xpc_client.c -o xpc_client # Save the server in its configured location cp xpc_server /tmp # Load daemon sudo cp xyz.hacktricks.service.plist /Library/LaunchDaemons sudo launchctl load /Library/LaunchDaemons/xyz.hacktricks.service.plist # Call client ./xpc_client # Clean sudo launchctl unload /Library/LaunchDaemons/xyz.hacktricks.service.plist sudo rm /Library/LaunchDaemons/xyz.hacktricks.service.plist /tmp/xpc_server ``` -------------------------------- ### Install Wi-Fi Framework and copy Framing Frames tests Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-wifi/wifi-post-association-and-client-isolation-attacks.html Clones the Wi-Fi Framework and the Framing Frames test repository, copies the two official queue tests into the framework directory, runs the setup scripts, and activates the Python virtual environment. Requires root privileges for the hardware simulation setup. ```bash git clone --depth 1 --recursive https://github.com/domienschepers/wifi-framework.git git clone --depth 1 https://github.com/domienschepers/wifi-framing.git cp wifi-framing/framework/test-queue-*.py wifi-framework/ cd wifi-framework ./setup.sh sudo ./setup/setup-hwsim.sh 4 # Activate the framework environment in each terminal used below. sudo -s source setup/venv/bin/activate ``` -------------------------------- ### Start an activity via Drozer Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html Use the Drozer module 'app.activity.start' to start an exported activity, potentially bypassing authorization. The example shows starting the PWList activity of the sieve package. ```text dz> run app.activity.start --component com.mwr.example.sieve com.mwr.example.sieve.PWList ``` -------------------------------- ### Joomla README.txt example Source: https://hacktricks.wiki/en/network-services-pentesting/pentesting-web/joomla.html Example content of README.txt for a Joomla installation. It identifies the package as Joomla! 3.x and provides official links. ```text 1- What is this? * This is a Joomla! installation/upgrade package to version 3.x * Joomla! Official site: https://www.joomla.org * Joomla! 3.9 version history - [https://docs.joomla.org/Special:MyLanguage/Joomla_3.9_version_history](https://docs.joomla.org/Special:MyLanguage/Joomla_3.9_version_history) * Detailed changes in the Changelog: https://github.com/joomla/joomla-cms/commits/staging ``` -------------------------------- ### Install and configure pure-ftp server Source: https://hacktricks.wiki/en/generic-hacking/exfiltration.html Installs pure-ftp and runs a configuration script that creates the FTP user 'fusr' with password 'ftp' and sets up the PureDB authentication. The script must be run after installation. ```bash apt-get update && apt-get install pure-ftp ``` ```bash #Run the following script to configure the FTP server #!/bin/bash groupadd ftpgroup useradd -g ftpgroup -d /dev/null -s /etc ftpuser pure-pwd useradd fusr -u ftpuser -d /ftphome pure-pw mkdb cd /etc/pure-ftpd/auth/ ln -s ../conf/PureDB 60pdb mkdir -p /ftphome chown -R ftpuser:ftpgroup /ftphome/ /etc/init.d/pure-ftpd restart ``` -------------------------------- ### Auto-Frida quick start Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.html Clone the Auto-Frida repository, install its Python dependencies, and run the main script to start the automation workflow. ```bash git clone https://github.com/ommirkute/Auto-Frida.git cd Auto-Frida pip install -r requirements.txt python auto_frida.py ``` -------------------------------- ### Install D-Feet (D-Bus GUI tool) Source: https://hacktricks.wiki/en/linux-hardening/processes-crontab-systemd-dbus/d-bus-enumeration-and-command-injection-privilege-escalation.html Install the D-Feet GUI tool for enumerating and interacting with D-Bus services. Requires sudo privileges. ```bash sudo apt-get install d-feet ``` -------------------------------- ### Get OS Version and Installed Patches Source: https://hacktricks.wiki/en/windows-hardening/basic-powershell-for-pentesters/index.html Retrieves the current OS version, lists all installed patches, and filters for security updates specifically. ```powershell [System.Environment]::OSVersion.Version #Current OS version Get-WmiObject -query 'select * from win32_quickfixengineering' | foreach {$_.hotfixid} #List all patches Get-Hotfix -description "Security update" #List only "Security Update" patches ``` -------------------------------- ### PAM login service configuration example Source: https://hacktricks.wiki/en/linux-hardening/software-information/pam-pluggable-authentication-modules.html Example PAM configuration for the login service, showing typical module lines with control flags and module paths. Use as a reference for understanding PAM stack syntax. ```text auth required /lib/security/pam_securetty.so auth required /lib/security/pam_nologin.so auth sufficient /lib/security/pam_ldap.so auth required /lib/security/pam_unix_auth.so try_first_pass account sufficient /lib/security/pam_ldap.so account required /lib/security/pam_unix_acct.so password required /lib/security/pam_cracklib.so password required /lib/security/pam_ldap.so password required /lib/security/pam_pwdb.so use_first_pass session required /lib/security/pam_unix_session.so ``` -------------------------------- ### Start FTP server with pyftpdlib Source: https://hacktricks.wiki/en/generic-hacking/exfiltration.html Starts a simple FTP server on port 21 using pyftpdlib. Install the package first with pip3. ```bash pip3 install pyftpdlib python3 -m pyftpdlib -p 21 ``` -------------------------------- ### Start Objection on a Rooted Device Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/frida-tutorial/objection-tutorial.html For a rooted device with frida-server, enumerate installed packages and start the Objection REPL. The 'start' syntax is modern; older writeups may use 'explore' or '--gadget'. ```bash frida-ps -Uai objection -n asvid.github.io.fridaapp start ``` -------------------------------- ### Install Suricata on Ubuntu, Debian, and CentOS Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/suricata-and-iptables-cheatsheet.html Package installation commands for Ubuntu, Debian, and CentOS. Distribution-specific and release-specific; follow the official guide for details. ```bash add-apt-repository ppa:oisf/suricata-stable apt-get update apt-get install suricata ``` ```bash echo "deb http://http.debian.net/debian buster-backports main" > \ /etc/apt/sources.list.d/backports.list apt-get update apt-get install suricata -t buster-backports ``` ```bash yum install epel-release yum install suricata ``` -------------------------------- ### Complete Objective-C example with protocol and main Source: https://hacktricks.wiki/en/macos-hardening/macos-security-and-privilege-escalation/macos-basic-objective-c.html Complete example combining a protocol, class interface, implementation, and main function. Compile with gcc -framework Foundation test_obj.m -o test_obj. ```objectivec // gcc -framework Foundation test_obj.m -o test_obj #import @protocol myVehicleProtocol - (void) startEngine; //mandatory @required - (void) addWheels:(int)value; //mandatory @optional - (void) makeLongTruck; //optional @end @interface MyVehicle : NSObject @property int numberOfWheels; - (void)startEngine; - (void)addWheels:(int)value; - (void)makeLongTruck; @end @implementation MyVehicle : NSObject - (void)startEngine { NSLog(@"Engine started"); } - (void)addWheels:(int)value { self.numberOfWheels += value; } - (void)makeLongTruck { _numberOfWheels = +10000; NSLog(@"Number of wheels: %i", self.numberOfWheels); } @end int main(void) { @autoreleasepool { MyVehicle *mySuperCar = [MyVehicle new]; [mySuperCar startEngine]; mySuperCar.numberOfWheels = 4; NSLog(@"Number of wheels: %i", mySuperCar.numberOfWheels); [mySuperCar setNumberOfWheels:3]; NSLog(@"Number of wheels: %i", mySuperCar.numberOfWheels); [mySuperCar makeLongTruck]; } return 0; } ``` -------------------------------- ### Start an exported activity via ADB Source: https://hacktricks.wiki/en/mobile-pentesting/android-app-pentesting/drozer-tutorial/index.html Use the Android Debug Bridge (ADB) 'am start' command to start an exported activity. The example uses a package name of 'com.example.demo' and an activity name of 'com.example.test.MainActivity'. ```text adb shell am start -n com.example.demo/com.example.test.MainActivity ``` -------------------------------- ### Set up Wi-Fi Framework and run SAE flood test Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-wifi/wifi-dos-and-management-frame-attacks.html Sets up the Wi-Fi Framework with four simulated radios, loads the WPA3-Personal/PMF configuration, starts the reference AP, and runs the SAE Commit state-exhaustion test (dos-sae-flood). Requires sudo and a virtual environment activation. ```bash git clone --depth 1 --recursive https://github.com/domienschepers/wifi-framework.git cd wifi-framework ./setup.sh sudo ./setup/setup-hwsim.sh 4 sudo -s source setup/venv/bin/activate # Select the bundled WPA3-Personal/PMF configuration. cd setup && ./load-config.sh wpa3-personal-pmf && cd .. # Start the reference WPA3 AP in the first terminal. ./hostap.py wlan0 --ap # Run the published SAE Commit state-exhaustion test in a second terminal. ./run.py wlan1 dos-sae-flood ``` -------------------------------- ### Build and start wpa_sycophant upstream client Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-wifi/wpa-enterprise-8021x.html Builds the modified wpa_supplicant and starts the upstream client toward the real SSID on a managed-mode interface. The client uses the example configuration and must be started before the rogue AP. ```bash # Build Sycophant's modified supplicant in its checked-out repository. make -C wpa_supplicant # Start the upstream client toward the real SSID on its managed-mode interface. sudo ./wpa_sycophant.sh -c wpa_sycophant_example.conf -i wlan1 ``` -------------------------------- ### Prepare the filesystem for fuzzing Source: https://hacktricks.wiki/en/mobile-pentesting/ios-pentesting/frida-configuration-in-ios.html Creates the required directories and a starting input file for the fuzzer. Run from inside the fpicker clone. ```bash # From inside fpicker clone mkdir -p examples/target-app # Where the fuzzing script will be mkdir -p examples/target-app/out # For code coverage and crashes mkdir -p examples/target-app/in # For starting inputs # Create at least 1 input for the fuzzer echo Hello World > examples/target-app/in/0 ``` -------------------------------- ### Start rogue AP with hostapd and hostapd-mana Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/pentesting-wifi/evil-twin-rogue-ap-and-client-association-attacks.html Start a rogue AP from a hostapd configuration, or start MANA/KARMA behavior from the reviewed hostapd-mana configuration. Use a reviewed configuration file for deterministic AP or MANA setups. ```bash sudo hostapd hostapd.conf ``` ```bash sudo hostapd-mana hostapd-mana.conf ``` -------------------------------- ### Install and use Mosquitto clients to subscribe to MQTT topics Source: https://hacktricks.wiki/en/network-services-pentesting/1883-pentesting-mqtt-mosquitto.html Commands to install mosquitto and mosquitto-clients, then subscribe to a specific topic or all topics using mosquitto_sub. The -v flag enables verbose output. ```bash apt-get install mosquitto mosquitto-clients mosquitto_sub -t 'test/topic' -v #Subscribe to 'test/topic' mosquitto_sub -h -t "#" -v #Subscribe to ALL topics. ``` -------------------------------- ### Run Xplico Services Source: https://hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/pcap-inspection/index.html Start Xplico's services after installation. Restarts Apache and then starts Xplico; access the web interface at 127.0.0.1:9876 with credentials xplico:xplico. ```bash /etc/init.d/apache2 restart /etc/init.d/xplico start ```