HackTricks

What is HackTricks?

HackTricks is a free, community-driven encyclopedia of pentesting and ethical hacking techniques created by Carlos Polop, who also wrote the linPEAS and winPEAS privilege escalation scripts (the PEASS-ng project). It takes the form of a web book and collects, organised by topic, methodologies, commands, tricks and references for almost any situation you might hit during an assessment or a CTF: network services by port, web vulnerabilities, Linux and Windows privilege escalation, Active Directory, containers and much more. There is also a companion book, HackTricks Cloud, dedicated to AWS, Azure, GCP, Kubernetes and CI/CD environments.

The content is mainly in English and its source lives on GitHub, where the community submits improvements and new techniques.

What HackTricks is used for

• A reference during a pentest: when you hit a service you do not know, it tells you what to check and with which tools.
• A methodology checklist: its enumeration and privilege escalation pages work as checklists so nothing slips through.
• Preparing hands-on certifications such as OSCP or the eJPT, where systematic enumeration is everything.
• Solving CTFs and machines on HackTheBox or TryHackMe when you are stuck on a specific step.
• Learning new techniques: reading whole sections out of curiosity is a great way to grow your toolkit.

As with any offensive material, only use it against labs, CTFs, your own systems or environments you have written authorisation to test.

Getting started with HackTricks

There is nothing to install: it is a freely accessible website. Just search for "HackTricks" and open the book. To get value from day one:

1. Read the general pentesting methodology page, which outlines the phases (recon, enumeration, exploitation, post-exploitation) and links out to each section.
2. Get to know the sidebar layout: generic techniques, network pentesting by service, web pentesting, Linux, Windows and Active Directory.
3. Use the built-in search: look things up by service name, port number or vulnerability name.

If you want it offline, for example during an exam or on an isolated network, you can clone its GitHub repository (carlospolop/hacktricks) and search the Markdown files directly:

git clone --depth 1 https://github.com/carlospolop/hacktricks.git
grep -ril "rpcclient" hacktricks/ | head

How to use HackTricks: practical examples

From port scan to the right page

The typical flow starts with a scan in your lab:

nmap -sC -sV -oN scan.txt 10.10.10.10

If port 445 is open, look up the SMB pentesting page on HackTricks. It tells you what to enumerate and how, with commands such as:

smbclient -L //10.10.10.10 -N
nxc smb 10.10.10.10 -u '' -p '' --shares

Repeat for every service: FTP, SSH, HTTP, LDAP, MSSQL, Redis… Each page usually covers basic enumeration, default credentials, known vulnerabilities and references.

Linux privilege escalation

Once you have a foothold on a lab machine, the Linux privilege escalation page works as a checklist: kernel version, sudo rights, SUID binaries, cron jobs, capabilities, passwords in config files… A few of the commands it suggests:

sudo -l
find / -perm -4000 -type f 2>/dev/null
getcap -r / 2>/dev/null

To automate that review, linPEAS (by the same author) walks through much of the checklist and highlights the most promising findings. Reading its output with HackTricks open alongside is a very effective combo.

Web vulnerabilities

The web section explains each bug class (SSRF, SSTI, deserialisation, file upload, XXE…) with theory, payloads and filter-bypass techniques. It is perfect to keep open while testing with Burp Suite.

Active Directory

The Active Directory methodology chains enumeration, Kerberos attacks (such as Kerberoasting or AS-REP Roasting), lateral movement and persistence. It is one of the most visited sections among people preparing for certifications with domain environments.

Pro tips

• Do not copy-paste blindly: understand what each command does before running it. Some are noisy or can knock a service over.
• Build your own notes from HackTricks, with the commands you use most adapted to your workflow.
• Cross-check: it is a community wiki and some pages lag behind newer tool versions.
• Pair it with other references: GTFOBins for abusing Unix binaries, LOLBAS for Windows binaries and PayloadsAllTheThings for payload lists.
• Learn the theory elsewhere: HackTricks is a brilliant cheat sheet, but to truly understand a web vulnerability the Web Security Academy is better.

Pros and cons

Pros	Cons
Free with huge coverage	Can overwhelm beginners
Organised by service and by phase	Some pages go out of date
Ready-to-use commands	Explains the "how" better than the "why"
Kept up to date by the community	Easy to fall into copy-paste habits

HackTricks alternatives

• PayloadsAllTheThings: a repository of payloads and bypasses organised by vulnerability type.
• GTFOBins and LOLBAS: focused references for abusing legitimate binaries on Unix and Windows.
• OWASP Web Security Testing Guide: a formal methodology for web assessments.
• PortSwigger Web Security Academy: in-depth web theory and labs.

Frequently asked questions

Is HackTricks free?

Yes, the book is freely accessible. The project also sells training and certifications, mainly in cloud security, but you do not need them to use the wiki.

Is HackTricks available in other languages?

The original content is written in English. If technical English is a struggle, it is worth working on: most security documentation is in English.

Can I use HackTricks during the OSCP exam?

Exam rules change, so always check the current official rules. Generally, consulting public documentation is allowed, while automated tools face more restrictions.

Is HackTricks good for beginners?

Yes as a reference, but not as a course. Learn the fundamentals on guided platforms first, and turn to HackTricks when you need to know what to do with a specific service or situation.

If you want to nail Linux and command-line fundamentals before tackling a full methodology, practise at the Hackers en Acción Academy.