No results

Hacktricks 179 Best May 2026

Port 179 is the default for BGP (Border Gateway Protocol), the system that routes traffic across the internet. In the context of HackTricks, security professionals focus on exploiting misconfigurations to intercept data or disrupt networks. 🔍 Key BGP Vulnerabilities (Port 179)

Attackers look for these specific weaknesses when assessing a BGP implementation:

Open Exposure: The port is accessible to the public internet instead of being restricted to trusted peers.

Lack of Authentication: Many sessions do not use MD5 passwords, making them vulnerable to session hijacking or packet injection.

No RPKI Validation: Routes are not cryptographically verified, allowing attackers to claim ownership of IP ranges they don't own.

Missing Prefix Filtering: Routers accept any route updates without validating if the peer is authorised to advertise them. 🛠️ Common Attack Vectors

These techniques are documented in resources like HackTricks and Bishop Fox for offensive security testing:

BGP Hijacking: Announcing a more specific route (longer prefix) to force traffic through an attacker-controlled router for interception.

DoS Attacks: Flooding the router with spoofed BGP OPEN or UPDATE packets to saturate the CPU or exhaust memory.

MD5 Cracking: If MD5 authentication is used, attackers can capture the TCP handshake and use tools like bgpcrack to brute-force the password.

Session Resetting: Sending spoofed TCP RST (Reset) packets to drop the connection between two legitimate peers, causing a network outage. 🛡️ Recommended Security Best Practices

To defend against these "HackTricks" style exploits, follow these industry standards:

GTSM (Generalized TTL Security Mechanism): Drop packets from peers that aren't physically or logically "close" to the router.

Access Control Lists (ACLs): Only allow Port 179 traffic from the specific IP addresses of known peering partners.

Route Filtering: Implement strict filters to ignore bogons (invalid IPs) and unauthorized prefix advertisements.

Encryption: Use IPsec to tunnel BGP traffic, providing confidentiality that BGP lacks by default. I can provide more detail if you tell me: Are you prepping for a CTF or a real-world audit?

Possible explanations

  1. “HackTricks” is a well-known, open-source cybersecurity knowledge base maintained by the user Carlos Polop (and contributors). It covers pentesting, CTF techniques, privilege escalation, and hacking tricks. The content is hosted at book.hacktricks.xyz and also on GitHub. hacktricks 179 best

  2. “179 best” does not match any known HackTricks page, chapter, or section number. It’s possible that:

    • You saw a reference to a list titled “179 best [something]” that someone compiled from HackTricks.
    • It’s a misremembered title or number (e.g., “179” could refer to a command, a line number in a script, or a specific technique index).
    • It comes from a different platform (GitHub gist, Telegram channel, or forum post) that aggregated “top 179 tricks” from HackTricks.

  3. No breach or leak — There is no verified story about a “HackTricks 179 best” leak, hack, or incident. HackTricks is a legitimate educational resource, not a hacking group or malicious tool.

5. Container & Cloud (Top 15)

| # | Trick | Technique | |---|-------|------------| | 111 | Kubernetes hostPath escape | volumeMounts → hostPath: / → write SSH key | | 112 | Docker socket (DIND) | curl -XPOST --unix-socket /var/run/docker.sock ... | | 113 | AWS metadata credentials | curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ | | 114 | GCP metadata SSH keys | curl -H "Metadata-Flavor: Google" http://metadata.google.internal/... | | 115 | Azure Managed Identity | curl -H Metadata:true "http://169.254.169.254/metadata/identity/..." | | 116 | ECR pull from compromised pod | aws ecr get-login-password → docker pull | | 117 | Kubernetes RBAC abuse | kubectl auth can-i create pods --all-namespaces | | ... | ... | ... | | 125 | Exposed kubeconfig | find / -name *.kubeconfig 2>/dev/null |

61–80: Network attacks & defenses evasion

  1. ARP poisoning / MITM (mitmproxy, Bettercap)

    • Enable IP forwarding and route traffic through attacker box for inspection.

  2. DNS spoofing / poisoned responses

    • Use dnsspoof or Bettercap; craft fake responses for targeted hosts.

  3. WPA/WPA2 Wi‑Fi attack basics (handshake capture)

    • Use aircrack-ng suite: airodump-ng, aireplay-ng, aircrack-ng.

  4. Evil Twin / captive portal attacks

    • Host open AP, intercept traffic, present fake login.

  5. Deauth attacks to capture WPA handshakes

    • aireplay-ng --deauth 0 -a -c wlan0mon

  6. Bluetooth Low Energy reconnaissance

    • Use bluetoothctl, gatttool, bettercap BLE modules.

  7. IPv6 attack surface and SLAAC abuse

    • Check for exposed IPv6 services and transition mechanisms.

  8. MAC flooding / switch CAM overflow

    • Simulate many MAC addresses to force fallback to hub behavior.

  9. DNS tunneling for data exfiltration

    • Use iodine or dnscat2 to tunnel traffic over DNS.

  10. Covert channels using ICMP, HTTP, or DNS

    • Exfiltrate small data with base64 over ICMP or DNS TXT records.

  11. BGP hijacking basics (overview)

    • Monitor routing announcements for suspicious origin AS; advanced attacks require infra.

  12. Wireless WPA3 downgrade vectors (if misconfigured)

    • Check implementations for downgrade to WPA2.

  13. Evading IDS/IPS with fragmentation and obfuscation Port 179 is the default for BGP (Border

    • Fragment packets, alter payloads, randomize timing.

  14. Tunneling via HTTPS (stunnel, nginx reverse proxy)

    • Wrap traffic in TLS to blend with normal traffic.

  15. Using ICMP for tunneling and command-and-control

    • Implement c2 channels over ICMP for stealth.

  16. ARP cache poisoning detection evasion

    • Maintain proper timing and ARP responses to avoid detection noise.

  17. IPv4 fragmentation-based evasion for signature detection

    • Break exploit payloads across fragments.

  18. SMB relay to escalate access on Windows networks

    • Use ntlmrelayx.py with relay to SMB/HTTP endpoints.

  19. Exploiting UPnP and SSDP devices on LAN

    • Use upnpc and search for exposed devices to pivot.

  20. Passive network sniffing (tshark, tcpdump)

    • Capture and analyze traffic for credentials and tokens.

21–40: Web application testing — common vulnerabilities

  1. SQL Injection (basic GET/POST)

    • Test with ' OR '1'='1' -- ; use sqlmap: sqlmap -u "http://t/?id=1" --batch

  2. Blind SQLi (time-based)

    • Use sleep-based payloads or sqlmap --technique=T

  3. NoSQL Injection (MongoDB)

    • Test payloads: "$ne": null, use Burp intruder or NoSQLMap.

  4. Command injection (OS)

    • Test ; ls -la, && whoami; use burp and parameterized payloads.

  5. SSTI (Server-Side Template Injection)

    • Try 77, $77, and payloads for Jinja, Twig, etc. Use Tplmap.

  6. XSS (Stored, Reflected, DOM)

    • Test common payloads , DOM-based using DOM analyzer.

  7. CSRF testing

    • Check for missing CSRF tokens on state-changing requests; attempt forged requests.

  8. IDOR / Insecure Direct Object Reference

    • Iterate numeric IDs, attempt access to other users' data.

  9. Authentication bypass (logic flaws)

    • Test password reset flows, enumable tokens, privileged endpoint access.

  10. Session fixation and session hijacking

    • Test cookie attributes (HttpOnly, Secure, SameSite) and session token predictability.

  11. File upload vulnerabilities (unrestricted)

    • Upload webshells, bypass extension checks with polyglot GIF-PHP, double extensions.

  12. Insecure deserialization

    • Test for serialized PHP/Java objects; use ysoserial for Java gadgets.

  13. SSRF (Server-Side Request Forgery)

    • Attempt internal endpoint access (http://127.0.0.1:80), metadata IPs, gopher payloads.

  14. Rate limiting abuse / brute-force

    • Test authentication endpoints for lockout and implement exponential backoff.

  15. Business logic flaws

    • Try price manipulation, coupon stacking, workflow bypass.

  16. Clickjacking vulnerability check

    • Check X-Frame-Options header; attempt framing attack.

  17. Remote file inclusion (RFI/LFI)

    • LFI string traversal (../../etc/passwd), RFI via file:// or http:// URL in include.

  18. XML External Entity (XXE)

    • Send XML with external entities to read files or SSRF out.

  19. Cache poisoning / HTTP request smuggling

    • Test ambiguous Content-Length and Transfer-Encoding headers.

  20. OAuth & SSO misconfigurations

    • Check redirect_uri whitelist, token leakage, open redirects.

Finding Specific Content on Hacktricks

If you're looking for information on a specific topic like "179 best," here are a few suggestions on how to approach your search:

  1. Direct Search: Use the search function on the Hacktricks website. There is likely a search bar where you can type in keywords related to your topic of interest.

  2. Browse Categories: Hacktricks organizes content into categories. You can browse through these sections to find information related to your interests. Categories might include topics like "Web Exploitation," "Mobile Hacking," "Network Hacking," and more.

  3. Community Forums: Many platforms like Hacktricks have community forums or discussion boards. You can post a question about your specific topic to see if other users or experts can provide guidance or point you in the right direction.

  4. Check for Guides and Tutorials: Hacktricks often features detailed guides and tutorials. Look for content labeled as "guides" or "tutorials" related to your area of interest. Possible explanations

3. Web Application Specifics (The 40 SQLi & SSRF)

Web hacking can be infinite, but the "179 best" list focuses on high-impact, low-hanging fruit.

1. Linux Privilege Escalation (The first 50)

The bulk of the "179 best" focuses on moving from www-data to root. These are the commands that HackTricks lists as "Highest Probability."