// HackTricks · CC BY-NC 4.0
Linux
69 pages · adapted from upstream with source attribution on every page.
001 LinuxAndroid Rooting Frameworks (KernelSU/Magisk) Manager Auth Bypass & Syscall Hook Abuse software-information002 LinuxAppArmor protections003 LinuxArbitrary File Write to Root interesting-files-permissions004 LinuxAssessment And Hardening container-security005 LinuxBypass FS protections: read-only / no-exec / Distroless bypass-fs-protections-read-only-no-exec-distroless006 LinuxBypass Linux Restrictions bypass-linux-restrictions007 Linuxcgroup Namespace namespaces008 Linuxcgroups protections009 LinuxCisco - vmanage network-information010 LinuxContainer Protections Overview protections011 LinuxContainer Runtimes, Engines, Builders, And Sandboxes container-security012 LinuxContainer Security container-security013 LinuxContainerd (ctr) Privilege Escalation containers-namespaces014 LinuxCopy Fail: AFALG + splice page-cache overwrite (CVE-2026-31431) kernel-lpe-cves015 LinuxD-Bus Enumeration & Command Injection Privilege Escalation processes-crontab-systemd-dbus016 LinuxDDexec / EverythingExec bypass-fs-protections-read-only-no-exec-distroless017 LinuxDistroless Containers container-security018 LinuxEscaping From --privileged Containers container-security019 LinuxEscaping from Jails main-system-information020 Linuxeuid, ruid, suid user-information021 LinuxFilesystem, Inodes and Recovery main-system-information022 LinuxFreeIPA Pentesting software-information023 LinuxImage Security, Signing, And Secrets container-security024 LinuxInteresting Groups - Linux Privesc interesting-groups-linux-pe025 LinuxIPC Namespace namespaces026 LinuxKernel Modules and modprobe Abuse main-system-information027 Linuxld.so privesc exploit example interesting-files-permissions028 LinuxLinux Active Directory user-information029 LinuxLinux Capabilities interesting-files-permissions030 LinuxLinux Capabilities In Containers protections031 LinuxLinux Environment Variables linux-basics032 LinuxLinux Post-Exploitation linux-post-exploitation033 LinuxLinux Privilege Escalation linux-privilege-escalation034 LinuxLinux Privilege Escalation Checklist main-system-information035 LinuxLinux ptrace exit-race pidfdgetfd() FD theft kernel-lpe-cves036 LinuxLocal Network and Socket Triage network-information037 LinuxLogstash Privilege Escalation software-information038 Linuxlxd/lxc Group - Privilege escalation interesting-groups-linux-pe039 LinuxMasked Paths protections040 LinuxMount Namespace namespaces041 LinuxNamespaces namespaces042 LinuxNetwork Namespace namespaces043 LinuxNFS No Root Squash Misconfiguration Privilege Escalation interesting-files-permissions044 LinuxNode inspector/CEF debug abuse software-information045 Linuxnonewprivs protections046 LinuxPAM - Pluggable Authentication Modules software-information047 LinuxPayloads to execute processes-crontab-systemd-dbus048 LinuxPID Namespace namespaces049 LinuxPOSIX CPU Timers TOCTOU race (CVE-2025-38352) kernel-lpe-cves050 LinuxRead-Only System Paths protections051 LinuxRunC Privilege Escalation containers-namespaces052 LinuxRuntime API And Daemon Exposure container-security053 LinuxRuntime Authorization Plugins container-security054 Linuxseccomp protections055 LinuxSELinux protections056 LinuxSELinux interesting-files-permissions057 LinuxSensitive Host Mounts container-security058 LinuxSocket Command Injection network-information059 LinuxSplunk LPE and Persistence software-information060 LinuxSSH Agent Forwarding Exploitation user-information061 LinuxSudo Command Abuse main-system-information062 LinuxSUID Shared Library and Linker Abuse interesting-files-permissions063 LinuxTime Namespace namespaces064 LinuxTrojanized System Daemons and Reverse Proxies linux-post-exploitation065 LinuxUseful Linux Commands linux-basics066 LinuxUser Namespace namespaces067 LinuxUTS Namespace namespaces068 LinuxVMware Tools service discovery LPE (CWE-426) via regex-based binary discovery (CVE-2025-41244) kernel-lpe-cves069 LinuxWildcards Spare Tricks interesting-files-permissions