Resources
2023
Advisory | Security advisory for Virtuozzo SSH Gate , Security advisory for Virtuozzo SSH Gate - Raphaël Lob , Jean Bonnevie
Advisory | Security advisory for Danfoss Storeview Web for SM800 and SC255 , Security advisory for Danfoss Storeview Web - Florent Sicchio
Advisory | Authentication bypass in Danfoss Storeview Web for SM800 and SC255 versions <= 3.2.6 , Security advisory for Danfoss Storeview Web - Florent Sicchio
Advisory | Arbitrary email forgery in Webflow , Security advisory for Webflow - Antoine Carrincazeaux
Conference | DMA practical attacks , Sthack 2023 - Antoine Cervoise , Jean-Christophe Delaunay
Conference | DLP bypass for Boomers , Sthack 2023 (Rump) - Antoine Cervoise
Advisory | Multiple vulnerabilities in n8n <= 0.215.2 , CVE-2023-27562, CVE-2023-27563 and CVE-2023-27564. - Antoine Cervoise , Jérôme Mampianinazakason
Conference | A study on Windows authentication over HTTP & Prox-Ez ( video ) , THCON 2023 - Pierre Milioni , Geoffrey Bertoli
Conference | The Android Security Model , THCON 2023 - Jean-Baptiste Cayrou
Conference | Automating the extraction of secrets stored inside CI/CD systems ( video ) , THCON 2023 - Hugo Vincent , Théo Louis-Tisserand
Advisory | Stored Cross-Site Scripting (XSS) in Zimbra version 8.8.15_GA_4059 , CVE-2022-41348 - Kevin Tellier , Guillaume Jacques , Melvil Guillaume
Conference | Fouillons les poubelles ! , HackSecuReims 2023 - Antoine Cervoise
Advisory | Remote Code Execution in Supermicro SuperDoctor5 version < 5.14.0 , Security advisory for Supermicro SuperDoctor 5 - Aymeric Palhière , Gaetan Ferry
Advisory | Improper Privilege Management in Grails Spring Security Core <= 5.1.0 , CVE-2022-41923 - Benjamin Sepe , Adrien Peter
Advisory | Remote code execution in BIRT Viewer ≤ 4.12.0 , CVE-2023-0100 - Louis Wolfers
Conference | Attaques DMA , NoLimitSecu - Antoine Cervoise , Jean-Christophe Delaunay
Advisory | XXE vulnerability in IBM Tivoli Workload Scheduler , CVE-2022-38389 - Geoffrey Bertoli
Advisory | Multiple vulnerabilities in Nokia Airscale ASIKA , CVE-2023-25185, CVE-2023-25186, CVE-2023-25187, CVE-2023-25188 - Lena David , Geoffrey Bertoli
Advisory | Multiple vulnerabilities in Dell Unisphere for PowerMax vApp, VASA Provider vApp and Solutions Enabler vApp , CVE-2022-45103 and CVE-2022-45104 - Antoine Carrincazeaux
Advisory | Multiple vulnerabilities in BMC Control-M < 9.0.20.214 , Security advisory for BMC Control-M - Guillaume Jacques
Advisory | Authentication Bypass in Izanami Docker image 1.10.22 , CVE-2023-22495 - Raphaël Lob
Advisory | Lack of access control in Oracle Hyperion Provider Services APS/JAPI version 11.1.2.5 , CVE-2021-2435 - Paul Barbé , Guillaume Jacques , Théo Louis-Tisserand
Advisory | Multiple vulnerabilities in Oracle EAS Console version 11.1.2.0 , CVE-2021-35651, CVE-2021-35652, CVE-2021-35653, CVE-2021-35654 and CVE-2021-35655 - Paul Barbé , Guillaume Jacques , Théo Louis-Tisserand
Advisory | Multiple vulnerabilities in Oracle EPM Workspace version 11.2.3.0.0.05 , CVE-2021-2347, CVE-2021-2439 and CVE-2021-2445 - Paul Barbé , Guillaume Jacques , Théo Louis-Tisserand
Advisory | Multiple vulnerabilities in UCOPIA 5.1 and 6.0.2 , Security advisory for UCOPIA - Tawfik Bakache
Advisory | Privilege escalation vulnerability in FortiManager version 6.4.5 , CVE-2022-26118 - Clément Amic , Pierre Milioni , Adrien Peter
Advisory | Mutliple vulnerabilities in ManageEngine ADSelfService Plus , Security advisory for ManageEngine ADSelfService Plus. - Antoine Cervoise , Wilfried Bécard
Advisory | Sudoedit bypass in Sudo <= 1.9.12p1 , CVE-2023-22809 - Matthieu Barjole , Victor Cutillas
2022
Advisory | Multiple Stored Cross-Site Scripting vulnerabilities in Sage Enterprise Intelligence , CVE-2022-34322 - Mickaël Benassouli , Antoine Gicquel
Advisory | Multiple Cross-Site Scripting vulnerabilities in Sage XRT Business Exchange , CVE-2022-34323 - Mickaël Benassouli , Antoine Gicquel
Advisory | Multiple authenticated blind SQL Injections in Sage XRT Business Exchange application , CVE-2022-34324 - Mickaël Benassouli , Antoine Gicquel
Advisory | Raft Remote Code Execution , Raft Survival game Remote Code Execution - Thomas Bouzerar
Advisory | integer overflow in VLC < 3.0.18 , CVE-2022-41325 - Kevin Denis
Advisory | Unrestricted file upload in Rocket TRUfusion Enterprise <= 7.9.6.0 , CVE-2022-36431 - Mehdi Elyassa , Kevin Tellier
Advisory | Cross-Site Scripting vulnerabilities in CodeIgniter ≤ 3.1.13 , Security advisory for CodeIgniter - Antoine Cervoise , Maxime Rinaudo
Advisory | Multiple vulnerabilities in H2O ≤ 3.32.1.3 , Security advisory for H2O - Clément Amic , Lena David
Conference | A journey to pwn and own the Sonos One Speaker , Blackalps 2022 - David Berard
Conference | The printer goes brrrrr , BlackAlps 2022 - Mehdi Talbi , Rémi Jullian , Thomas Jeunet
Conference | Attacking Safari in 2022 , Hexacon 2022 - Quentin Meffre
Advisory | Weak private key generation in SSH.NET <= 2020.0.1 , CVE-2022-29245 - Guillaume André
Conference | I feel a draft. Opening the doors and windows: 0-click RCE on the Tesla Model3 , Hexacon 2022 - David Berard , Vincent Dehors
Conference | Croissantez vos collègues avec adb , BeeRump 2022 - Clément Berthaux
Conference | Pwn2Own Vancouver 2022 , NoLimitSecu - David Berard , Vincent Dehors
Conference | Faire bonne impression à pwn2own: RCE sur imprimantes HP et Lexmark , Barbhack 2022 - David Berard , Vincent Fargues , Thomas Imbert
Conference | Dissecting NTLM EPA & building a MitM proxy ( video ) , PassTheSalt 2022 - Pierre Milioni
Conference | Finding Java deserialization gadgets with CodeQL ( video ) , PassTheSalt 2022 - Hugo Vincent
Conference | MobSF for penetration testers ( video ) , PassTheSalt 2022 - Antoine Cervoise , Mickaël Benassouli
Conference | Pwning a Netgear router from WAN - MitM style , LeHack 2022 - Kevin Denis , Antide Petit
Conference | An Apple a day keeps the exploiter away ( vidéo , article ) , SSTIC 2022 - Eloi Benoist-Vanderbeken , Fabien Perigaud
Conference | Ica2Tcp : Un proxy SOCKS pour Citrix ( vidéo , article ) , SSTIC 2022 - Hugo Clout
Conference | Suprême TTD - That's my PPL ( vidéo ) , SSTIC 2022 - Lucas Georges
Conference | Surface d’attaque des solutions Active Directory Self-Service ( vidéo ) , SSTIC 2022 - Antoine Cervoise , Wilfried Bécard
Conference | Fouillons les poubelles ! , ESE 2022 - Antoine Cervoise
Conference | Rooting Samsung Q60T Smart TV , STHACK2022 - Vincent Fargues , Jérémie Boutoille
Conference | Real hackers don't leave dtrace ( video ) , Sthack 2022 - Eloi Benoist-Vanderbeken
Conference | The printer goes brrrrr , CanSecWest 2022 - Mehdi Talbi , Thomas Jeunet , Rémi Jullian
Conference | Pwn2Owning the TPLINK Archer A7 , THCON2022 - Kevin Denis
Conference | Android Encryption , THCON 2022 - Jean-Baptiste Cayrou
Advisory | FortiManager 6.4.5 - Multiple Vulnerabilities , CVE-2021-32587, CVE-2021-32597, CVE-2021-32598, CVE-2021-32603 - Adrien Peter , Clément Amic , Pierre Milioni
Advisory | Unsafe Object Deserialization in Html2Pdf <= 5.2.3 ( Html2Pdf library ) , CVE-2021-45394 - Clément Amic , Antoine Gicquel
2021
Conference | Synacktalk #3 (video) ( download ) , Webinar - feedbacks on pwn2own - Elodie Grisé , Benoît Lamiré , David Berard , Etienne Helluy-Lafont , Rémi Jullian
Conference | AEGE Presentation , AEGE 2021 - Arnaud Pilon
Conference | Cannibal Hacking , Hack In Paris 2021 - Kevin Denis
Conference | Rooting Samsung Q60T Smart TV , GreHack 2021 - Vincent Fargues , Jérémie Boutoille
Advisory | Cisco Nexus 9000 ACI mode 14.2(7f) - Multiple Vulnerabilities , CVE-2021-1583, CVE-2021-1584 - Clément Amic , Pierre Milioni , Adrien Peter
Advisory | Cisco APIC 4.2(7f) - Multiple Cross-Site Scripting , CVE-2021-1582 - Clément Amic , Pierre Milioni , Guillaume Jacques , Adrien Peter
Advisory | Cisco SD WAN IOS XE routers command injection #2 , CVE-2021-1529 - Julien Legras
Advisory | Authentication bypass in Jeedom , CVE-2021-42557 - Maxime Rinaudo , Antoine Cervoise
Conference | Jailbreak detection mechanisms and how to bypass them , Sthack 2021 - Eloi Benoist-Vanderbeken
Conference | Discovering and exploiting a kernel pool overflow on modern Windows 10 , Sthack 2021 - Fabien Perigaud
Advisory | Multiple vulnerabilities in Nagios XI < 5.8.6 , Security advisory for Nagios XI - Guillaume André
Advisory | Cross-Site Scripting in Cookiebot WordPress plugin , Security advisory for Cookiebot WordPress plugin - Antoine Cervoise
Conference | Pwn2Own'ing the TP-Link Archer A7 , Barbhack 2021 - Kevin Denis , Thomas Chauchefoin
Conference | HPE iLO 5 security: Go home cryptoprocessor, you’re drunk! ( video ) , BlackHat USA 2021 - Fabien Perigaud
Advisory | Multiple vulnerabilities in Centreon < 20.04.13, 20.10.7 & 21.04.2 , Security advisory for Centreon - Guillaume André , Théo Louis-Tisserand
Advisory | Reflected XSS in Enfold < 4.8.2 , Security advisory - Julien Legras , Guillaume André
Conference | AppFailLauncher , Bière Sécu Toulouse - Thomas Imbert
Conference | Slides - Jailbreak detection mechanisms and how to bypass them ( video ) , Pass The Salt 2021 - Eloi Benoist-Vanderbeken
Magazine | How security experts break through digital vaults , Online article - The Team
Advisory | WordPress AryoActivityLog vulnerability , Security advisory - Jérôme Mampianinazakason
Conference | Zombies ate my printer’s ink , THCON 2021 - Rémi Jullian
Advisory | Local privilege escalation in Cisco SD-WAN < 20.4 and 20.5 , CVE-2021-1528 - Julien Legras
Advisory | Cisco SD-WAN Multiple vulnerabilities in vManage < 20.5.1 , CVE-2021-1481, CVE-2021-1482, CVE-2021-1483, CVE-2021-1484 - Julien Legras , Théo Louis-Tisserand
Conference | Synacktalk #2 (slides) ( video ) , Webinar - Elodie Grisé , Benoît Lamiré , Tiphaine Romand-Latapie
Conference | The security of SD-WAN: the Cisco case ( video , whitepaper ) , SSTIC 2021 - Julien Legras
Conference | HPE iLO 5 security: Go home cryptoprocessor, you’re drunk! ( video , whitepaper ) , SSTIC 2021 - Fabien Perigaud
Conference | Vous avez obtenu un trophée : PS4 jailbreaké ( video , whitepaper ) , SSTIC 2021 - Mehdi Talbi , Quentin Meffre
Conference | Manger mes dossiers par la racine ( video ) , Hack-it-n - Lucas Georges
Tool | HopLa , Autocompletion support and useful payloads in Burp Suite - Alexis Danizan
Conference | Synacktalk #1 (slides) ( video ) , Webinar - Aymeric Palhière , Renaud Feil , Renaud Dubourguais
Advisory | WordPress AjaxSearchPro vulnerability , Security advisory for a wordpress plugin - Julien Egloff , Jérôme Mampianinazakason
Advisory | Use After Free in CyberArk Digital Vault , Security advisory - Julien Boutet
Advisory | GLPI FusionInventory 9.5.0 SQL Injection , Security advisory - Alexis Danizan , Hugo Vincent
Tool | .NIET , IDA Pro plugin for .NET Native symbols resolution - Jean-Christophe Delaunay
Conference | Pourquoi la cybersécurité a radicalement changé ? , Seald - Renaud Dubourguais
Conference | Panorama des postes et compétences attendus , Cyber & Bretagne - Renaud Feil
Advisory | Evolution CMS unauthenticated SQLI and user enumeration , Security advisory - Thomas Etrillard , Nicolas Biscos
Advisory | YouPHPTube/AVideo multiple vulnerabilities , Security advisory for YouPHPTube/AVideo - Maxime Rinaudo
Advisory | Code Injection in the J-Web component of Junos OS , Security advisory for the J-Web component of Juniper's Junos OS - Lena David , Geoffrey Bertoli
Conference | Product security - From the dark side to the light , Live Embedded Event - Tiphaine Romand-Latapie
2020
Conference | No lightsaber is needed to break the Wookey , Live Embedded Event - David Berard
Conference | This is for the pwners - exploiting a webkit 0-day in Playstation 4 ( video ) , BlackHat Europe 2020 - Quentin Meffre , Mehdi Talbi
Conference | Tout faire à l’envers , If This Then Dev - Tiphaine Romand-Latapie
Conference | No lightsaber is needed to break the Wookey ( video ) , Grehack 2020 - David Berard
Conference | Say hello to my little shell ! ( video ) , Unlock your brain, Harden your system 2020 - Lucas Georges
Advisory | Centile Istra - SQL injection , Centile Istra - SQL injectioni - Thibault Guittet , Julien Clergue
Conference | Interview Renaud Feil , NoLimitSecu - Renaud Feil
Conference | Comment promouvoir la place des femmes dans le milieu de la cybersécurité ? , BFMTV - Tiphaine Romand-Latapie
Conference | SpeedPwning VMware Workstation , Ekoparty 2020 - Bruno Pujos , Corentin Bayet
Conference | IOMMU and DMA attacks , NorthSec 2020 - Jean-Christophe Delaunay
Advisory | SQL injection in LearnPress <= 3.2.7.2 , Security advisory for LearnPress WordPress plugin. - Wilfried Bécard
Conference | Speedpwning VMware Workstation ( video ) , Ekoparty 2020 - Corentin Bayet , Bruno Pujos
Advisory | Local Privilege Escalation in Fortinet SSL VPN for Linux , Security advisory for Fortinet SSL VPN for Linux - Thomas Chauchefoin
Advisory | Insecure password reset in Sulu < 1.6.35, 2.0.10 & 2.1.1 , Security advisory for Sulu framework - Julien Legras
Conference | [SECHebdo] 28 juillet 2020 , Le Comptoir Sécu - Tiphaine Romand-Latapie
Magazine | Popular Chinese-Made Drone Is Found to Have Security Weakness , The New York Times - The Team
Conference | The art of cyber crime, Windows Pools and Windows ARM64 exploitation (from 1:20:55) , OPCDE - Corentin Bayet , Paul Fariello
Conference | Scoop the Windows 10 Pool! ( video , whitepaper ) , SSTIC 2020 - Corentin Bayet , Paul Fariello
Conference | How to design a baseband debugger ( video , whitepaper ) , SSTIC 2020 - David Berard , Vincent Fargues
Conference | RDP security: intercepting NLA authentication using CredSSPy ( video , whitepaper ) , SSTIC 2020 - Geoffrey Bertoli
Conference | NorthSec 2020 , IOMMU and DMA attacks - Jean-Christophe Delaunay
Advisory | Cisco SD WAN IOS XE routers command injection , CVE-2019-16011 - Thomas Etrillard , Julien Legras
Advisory | Android Monospace - Writing and Notes 2.6.3 , Broken Encryption Feature - Lena David
Advisory | Cisco Viptela vManage neo4j injection and stored XSS , CVE-2019-16010 and CVE-2019-16012 - Thomas Etrillard , Julien Legras
Conference | Binder and its vulnerabilities , THCON 2020 - Jean-Baptiste Cayrou
Magazine | Classification of browser vulnerabilities , MISC Magazine 108 - Quentin Meffre
Magazine | In-depth security measures of Safari in iOS , MISC Magazine 108 - Fabien Perigaud
Magazine | Source code assessment during Red Teams? , MISC Magazine 108 - Julien Szlamowicz
Conference | Using static and dynamic binary analysis with ret-sync , Bière Sécu Bordeaux - Jean-Christophe Delaunay
Conference | Modern PHP security , Sec4Dev 2020 - Thomas Chauchefoin , Lena David
Conference | With Machoc and victorious weapons, using CFG hashing for the lazy reverser , Bière Sécu Lyon - Tristan Pourcelot
Conference | Exploitation of the FreeBSD kernel vulnerability CVE-2019-5602 , Bière Sécu Lyon - Mehdi Talbi
Conference | Pwn2Own Miami Day 3 Final Results (from 2:56) , Pwn2Own Miami - Lucas Georges
Other | 3 Windows kernel exploitation challenges on Root-Me , Root-Me Windows kernel challenges - Rémi Jullian
Advisory | MaarchCourrier 19.04, 18.10, 18.04, 17.06 OS Command injection , MaarchCourrier Security Advisory - Tawfik Bakache , Thomas Etrillard
2019
Conference | Reversing the firmware of an e-cigarette , Bière Sécu Toulouse - Samuel Chevet
Conference | IOMMU and DMA attacks ( whitepaper ) , C&ESAR conference - , Jean-Christophe Delaunay
Conference | Through the SMM-Glass , Bière Sécu Toulouse - Bruno Pujos
Magazine | A look inside Raspberry Pi hardware decoders licenses , Paged Out! #2 - Fabien Perigaud
Magazine | Privilege escalation on macOs with CVE-2018-4193 , MISC Magazine 106 - Eloi Benoist-Vanderbeken
Tool | IDA Plugin: VMX Intrinsics , IDA plugin - Samuel Chevet
Conference | V2G Injector - Whispering to cars and charging units through the Power-Line (extended version) , t2.fi infosec - Sébastien Dudek
Conference | Time-travel Debugging , Rump'in Rennes 2019 - Samuel Chevet
Conference | SF30th Hacking Edition : A journey into Moo , R2CON 2019 - Nicolas Correia
Conference | Kerberos Unconstrained Delegation , Bière Sécu Toulouse - Nicolas Biscos
Conference | The return of FAIFA and HomePlugPWN: Make Power-Line Communication hacks great again! , leHack 2019 - Sébastien Dudek
Advisory | Arbitrary File Disclosure in Ad Inserter (< 2.4.9) , Security advisory - Wilfried Bécard
Advisory | Unsafe password reset in GLPI <= 9.4.0 , CVE-2019-13240 - Julien Legras
Advisory | Stored XSS in GLPI <= 9.4.2 , CVE-2019-13239 - Julien Legras
Conference | Time-efficient assessment of open-source projects for Red Teamers , Pass the SALT 2019 - Thomas Chauchefoin , Julien Szlamowicz
Conference | DLL shell game and other misdirections ( video , whitepaper ) , SSTIC 2019 - Lucas Georges
Conference | SSTIC 2019 challenge conception , SSTIC 2019 - David Berard , Vincent Fargues
Conference | Wild pentesting - When a reverser does pentest... ( video ) , SSTIC 2019 - Fabien Perigaud
Conference | V2G Injector - Whispering to cars and charging units through the Power-Line ( video , whitepaper ) , SSTIC 2019 - Sébastien Dudek
Conference | WEN ETA JB? A 2 million dollars problem ( video , whitepaper ) , SSTIC 2019 - Eloi Benoist-Vanderbeken , Fabien Perigaud
Other | SSRF, reflected XSS and cryptographic signature bypass in w3-total-cache , Patch - Thomas Chauchefoin
Conference | Exploring the Limitations of 802.1x and Beyond , Infosecurity Europe - Florian Guilbert
Tool | V2G Injector , Software to monitor and test Vehicle-to-Grid (V2G) systems like vehicles' ECU and charging station - Sébastien Dudek
Advisory | Pre-authenticated SQL injection in GLPI <= 9.3.3 (CVE-2019-10232) , Security advisory - Thomas Chauchefoin
Advisory | GLPI 9.4.0 Type juggling authentication bypass (CVE-2019-10231) , Security advisory - Damien Picard , Julien Szlamowicz
Advisory | GLPI 9.4.0 Timing attack user enumeration (CVE-2019-10233) , Security advisory - Damien Picard , Julien Szlamowicz
Advisory | GLPI 9.4.0 FusionInventory plugin RCE (CVE-2019-10477) , Security advisory - Damien Picard , Julien Szlamowicz
Conference | Modmobtools and tricks to assess devices using the mobile network (GPRS, UMTS and LTE) , Troopers NGI 2019, Research and Tinkering - Sébastien Dudek
Advisory | Unsafe deserialization in Sitecore CMS leading to RCE (CVE-2019-9874 and CVE-2019-9875) , Security advisory - Julien Legras , Adrien Peter
Advisory | Local file disclosure in mysqljs package 2.17.1 , Security advisory - Julien Legras
Conference | Android software KeyStore decryption (French) , Inter-CESTI - Thomas Etrillard , Julien Legras
Conference | Riding the lightning: iLO 4&5 BMC security wrap-up , 1ns0mn1h4ck 2019 - Fabien Perigaud
Tool | Metasploit module for CVE-2019-8942 , WordPress Arbitrary Code Execution - Wilfried Bécard
Conference | Modmobtools internals, updates, and more on tools used to assess mobile devices , Troopers Telco Sec Day 2019 - Sébastien Dudek
Tool | Kerberos TGS Rep enctype 17 (AES128-CTS-HMAC-SHA1-96) and enctype 18 (AES256-CTS-HMAC-SHA1-96) implementation ( Twitter ) , Hashcat - Jean-Christophe Delaunay
Advisory | TIBCO JasperReports Server XML Entity Expansion Vulnerability (CVE-2019-8986) , Security advisory - Sébastien Dudek , Julien Szlamowicz
Advisory | Huawei ManageOne ServiceCenter ACL Bypass , Security advisory - Sébastien Dudek , Julien Legras
Advisory | IPv6 fragmentation vulnerability in OpenBSD Packet Filter (CVE-2019-5597) , Security advisory - Corentin Bayet , Nicolas Collignon , Luca Moro
Advisory | Command Execution in elFinder's < 2.1.48 PHP connector (CVE-2019-9194) , Security advisory - Thomas Chauchefoin
Advisory | Path traversal in BlueMind 4.0 < beta3 and 3.5.x < 3.5.11-7 (CVE-2019-9563) , Security advisory - Damien Picard , Julien Szlamowicz
Conference | macOS: how to gain root with CVE-2018-4193 in < 10s ( exploit code ) , OffensiveCon 2019 - Eloi Benoist-Vanderbeken
Conference | Bypassing SMM-EP , Lightning talks at LSE - Bruno Pujos
Magazine | Attacking mobile devices from GPRS to LTE , MISC Magazine HS 19 - Sébastien Dudek
Advisory | Multiple vulnerabilities in Jenkins Job Import <= 2.1 ( vendor announcement ) , Security advisory - Thomas Chauchefoin , Julien Szlamowicz
Other | Defeating NotPetya from your iLO4 , Defeating NotPetya from your iLO4 - Fabien Perigaud
Advisory | Livebox 3 - Weak password reset procedure , Security advisory - Gaetan Ferry , Julien Szlamowicz
2018
Conference | Code Obfuscation 10**2+(2*a+3)%2, , JSecIN 2018 - Gaetan Ferry
Conference | Turning your BMC into a revolving door , Zeronights 2018 - Fabien Perigaud
Conference | PentHertz: The use of radio attacks during Red Team and pentests , Security PWNing 2018 - Sébastien Dudek
Advisory | Critical vulnerabilities in PineApp Mail Secure 5.1 , Security advisory - Thomas Chauchefoin , Gaetan Ferry
Advisory | Multiple vulnerabilities in Vectra Cognito: CVE-2018-14889, CVE-2018-14890 and CVE-2018-14891 , Security advisory - Julien Egloff , Thibault Guittet
Conference | Heapple Pie: macOS and iOS default heap , Sthack 2018 - Eloi Benoist-Vanderbeken
Advisory | Cisco Nexus 9000 Series Fabric Switches ACI Mode Shell Escape (CVE-2019-1591) , Security advisory - Nicolas Biscos , Gaetan Ferry
Advisory | Arbitrary code execution in Duplicator Pro < 1.2.42 , Security advisory - Thomas Chauchefoin , Julien Legras
Advisory | SQL injection in Image Intense , Security advisory - Thomas Chauchefoin , Julien Legras
Tool | search_offsets_DMA.py , Script to extract the offsets needed to unlock Windows with a DMA attack - Jean-Christophe Delaunay
Tool | Modmobjam , Perfoms smart-jamming attacks on specific mobile cells - Sébastien Dudek
Advisory | Multiple buffer overflows in Visual TOM <= 5.7.4 , Security advisory - Julien Egloff , Florian Guilbert
Advisory | SQL injection in FlySpray <= v1.0-rc6 , Security advisory - Thomas Chauchefoin , Bastien Faure
Conference | Modmobjam, smart jamming with Software-Defined Radio , RUMPS SSTIC 2018 - Sébastien Dudek
Conference | Backdooring your server through its BMC: the HPE iLO4 case , SSTIC 2018 - Fabien Perigaud
Tool | Modmobmap , Collects 2G/3G and 4G mobile cells information - Sébastien Dudek
Conference | Organisation of the SSTIC security challenge , SSTIC 2018 - Lucas Arrivé , Clément Berthaux
Conference | Modmobmap, the modest mobile networks mapping tool , BeeRumP 2018 - Sébastien Dudek
Conference | iOS/macOS 0-day^w48-hours , BeeRumP 2018 - Eloi Benoist-Vanderbeken
Advisory | Cross-Site Scripting in Zend Server < 9.1.3 ( CVE-2018-10230 ) , Security advisory - Thomas Chauchefoin , Julien Egloff
Conference | Introduction to CTF competitions ( video ) , 42Born2Code - Lucas Arrivé , Corentin Bayet
Tool | Publication of AJPy in Debian repositories , AJPy - Julien Legras
Advisory | Missing XML Validation vulnerability in SAP Control Center and SAP Cockpit Framework , SAP Patch - Thomas Chauchefoin , Sébastien Dudek
Advisory | CVE-2018-9325 ( CVE-2018-9326 , CVE-2018-9327 , CVE-2018-9845 ) , Multiple arbitrary code execution and information leaks in the project Etherpad - Thomas Chauchefoin
Magazine | Red Team: think like an attacker! , Global Security Mag (page 18) - Renaud Feil
Magazine | Exploitation of a vulnerability in Linux's implementation of the waitid syscall (CVE-2017-5123) , MISC Magazine 96 - Thomas Chauchefoin , Julien Egloff
Conference | Subverting your server through its BMC: the HPE iLO4 case , Recon Brussels 2018 - Fabien Perigaud
Advisory | Multiple vulnerabilities in WordPress Health Check & Troubleshooting , Security advisory - Julien Legras
2017
Conference | TSIGKILL: Bypassing dynamic DNS updates authentication through signature forgery , GreHack 2017 - Clément Berthaux
Conference | Cracking password hashes with Kraqozorus , OSSIR 2017 - Renaud Feil
Magazine | Radio communication penetration testing , MISC Magazine HS 16 - Sébastien Dudek
Magazine | Vault 7: analysis of Marble, the CIA code obfuscation framework , MISC Magazine 93 - Thomas Chauchefoin
Magazine | Exploiting Django template injections , MISC Magazine 93 - Clément Berthaux
Tool | Juniper decrypt , Script to decrypt Juniper screenOS encrypted passwords and keys - Fabien Perigaud
Advisory | TSIG authentication bypass through signature forgery in ISC BIND (CVE-2017-3143) , Security advisory - Clément Berthaux
Advisory | TSIG authentication bypass for zone transfer operations in ISC BIND (CVE-2017-3142) , Security advisory - Clément Berthaux
Magazine | Frida: the swiss-knife of multi-platform dynamic analysis , MISC Magazine 92 - Eloi Benoist-Vanderbeken
Tool , Advisory | CVE-2017-6008 exploit , Multiple vulnerabilities in the security solution HitmanPro of Sophos: CVE-2017-6007, CVE-2017-6008 and CVE-2017-7441 - Corentin Bayet
Conference | Windows 10 Pool Party, exploitation of a Kernel Pool buffer overflow on the last version of Windows 10 ( details ) , Nuit du Hack 2017 - Corentin Bayet
Advisory | TSIG authentication bypass through signature forgery in Knot DNS , Security advisory - Clément Berthaux
Conference | Study of an unknown CPU , BeeRumP 2017 - Fabien Perigaud
Tool | Hashcat , Support for cracking DPAPI masterkey files from Windows XP to Windows 10 - Jean-Christophe Delaunay
Conference | Psychological profiling and LinkedIn passwords , SSTIC 2017 - Jean-Christophe Delaunay
Conference | Out-of-control cars! , SSTIC 2017 - Sébastien Dudek
Conference | BeeRumP announcement , SSTIC 2017 - Eloi Benoist-Vanderbeken
Conference | IDASuckLess ( Website ) , SSTIC 2017 - Eloi Benoist-Vanderbeken
Conference | IoT Hacking - the case of Intercoms (with little updates since 33C3) , OSSIR afterwork - Sébastien Dudek
Conference | Tools and techniques to remotely compromise and spy workstations , Ecole de Guerre Economique - Renaud Feil
Conference | Turning a GPS-based dating application into a tracking system , ESIEA Secure Edition 2017 - Julien Legras , Julien Szlamowicz
Tool | eBPF IDA , an IDA processor for eBPF bytecode - Clément Berthaux
Conference | DPAPI exploitation during a pentest and password cracking , Univershell 2017 - Jean-Christophe Delaunay
Tool | John The Ripper , Support for cracking DPAPI masterkey files from Windows XP to Windows 10 - Jean-Christophe Delaunay
Other | Write-up of the SSTIC 2017 challenge , SSTIC 2017 - Clément Berthaux
Conference | How to develop an unpacker: the StarForce case , Sthack 2017 - Eloi Benoist-Vanderbeken
Conference | DPAPI exploitation during a pentest , Sthack 2017 - Jean-Christophe Delaunay
Conference | Offline extraction of DPAPI-protected secrets , JSSI OSSIR 2017 - Jean-Christophe Delaunay
Conference | WordPress security: hunting security bugs in a supermarket , Security Day 2017 - Thomas Chauchefoin
Conference , Tool | Presentation of our pentesting toolkit ( Disconet , Houdini , Kraqozorus , Oursin ) , FIC 2017 - Nicolas Collignon , Renaud Feil
2016
Conference | Intercoms Hackings, when frontdoors become backdoors - more detailed ( video ) , 33C3 Hamburg - Sébastien Dudek
Tool | Hashcat , Kerberos TGS Rep enctype 23, AxCrypt, AxCrypt in-memory secrets and Keepass version 1 and version 2 with or without "keyfile" implementations - Jean-Christophe Delaunay
Conference | Challenge resolution and solution presentation , Grehack 2016 - Fabien Perigaud
Conference | House intercoms attacks, when frontdoors become backdoors - including progress on 3G intercoms ( video ) , Hack.lu 2016 - Sébastien Dudek
Advisory | CVE-2016-1470 ( CVE-2016-1471 , CVE-2016-1472 , CVE-2016-1473 ) , Multiple vulnerabilities in Cisco Switch SG220 - Nicolas Collignon , Renaud Dubourguais
Magazine | Bypassing AppLocker using Powershell , MISC Magazine 87 - Damien Picard
Conference | House intercoms attacks, when frontdoors become backdoors ( paper , video jamming , video spamming ) , Nuit du Hack 2016 - Sébastien Dudek
Conference | Turning a GPS-based dating application into a tracking system , Nuit du Hack 2016 - Julien Legras , Julien Szlamowicz
Tool | AJPy , AJP python library - Julien Legras
Conference | Kerberom , BeeRumP 2016 - Jean-Christophe Delaunay
Conference | Cache attack, ECC, FRP256v1, backdoor, NIST, end of the world , BeeRumP 2016 - Eloi Benoist-Vanderbeken
Conference | Switching to insecurity , BeeRumP 2016 - Nicolas Collignon
Conference | UDP Just Opened , BeeRumP 2016 - Renaud Dubourguais
Conference | Hacking your printer , BeeRumP 2016 - Jean-Christophe Delaunay
Conference | Frida: How does it work? How to use it? ( video - french ) , OSSIR 2016 - Eloi Benoist-Vanderbeken
Conference | Mobile communications: practical attacks using cheap equipment , Business France 2016 - Sébastien Dudek
Conference | AJPy: AJP python library , SSTIC 2016 - Julien Legras
Conference | Near-Field Beer , SSTIC 2016 - Fabien Perigaud
Conference | Challenge resolution and solution presentation , SSTIC 2016 - Fabien Perigaud
Tool | AxSuite , retrieve in-memory secrets saved by AxCrypt - Jean-Christophe Delaunay
Tool | Kerberom , retrieve ARC4-HMAC'ed encrypted Tickets Granting Service (TGS) of accounts having a Service Principal Name (SPN) within an Active Directory - Jean-Christophe Delaunay
Tool | Cisco ACS Repo Decrypt , decrypt Cisco ACS repository passwords - Nicolas Collignon
Tool | des26 SAP ITS Decrypt , decrypt des26 SAP ITS (Internet Transaction Server) passwords - Eloi Benoist-Vanderbeken
Tool | VanDyke SecureCRT Decrypt , decrypt SSH passwords stored in VanDyke SecureCRT session files - Eloi Benoist-Vanderbeken
Conference | Podcast about Red Team penetration testing , NoLimitSecu 2016 - Renaud Feil
Magazine | Attacking a Windows network with Responder , MISC Magazine 85 - Gaetan Ferry
Conference | Just you, PowerShell and the target? Challenge accepted ( demo ) , Sthack 2016 - Damien Picard
Conference | Tools and techniques to compromise workstations , GS Days 2016 - Clément Berthaux , Renaud Feil
Conference | Offensive use of PowerShell ( demo ) , GS Days 2016 - Damien Picard
Tool | John The Ripper ( extractor ) , Keepass key-files support and extractor - Jean-Christophe Delaunay
Advisory | Multiple vulnerabilities in Citrix Provisioning Services (CVE-2016-9676, CVE-2016-9677, CVE-2016-9678, CVE-2016-9679, CVE-2016-9680) , Security advisories - Fabien Perigaud
Advisory | Sensitive information disclosure in the RESTX framework , Security advisory - Julien Legras
Conference | Feedback after 10 years of security audits , JSSI OSSIR 2016 - Renaud Feil
Other | Authenticated Remote Code Execution in Sentry , Security vulnerability - Clément Berthaux
Advisory | Multiple vulnerabilities in Oracle ECB and COM products (CVE-2016-3513, CVE-2016-3514, CVE-2016-3515 and CVE-2016-3516) ( #1 , #2 , #3 , #4 ) , Security advisories - Nicolas Collignon , Sébastien Dudek
Tool | John The Ripper ( extractor ) , AxCrypt support and extractor - Jean-Christophe Delaunay
2015
Advisory | CVE-2015-6409: Cisco Jabber STARTTLS Downgrade Vulnerability , Security advisory - Renaud Dubourguais , Sébastien Dudek
Advisory | Security Researcher Acknowledgments for Microsoft Online Services , Security advisory - Jan Kopec
Magazine | Packers and anti-virus , MISC Magazine HS 12 - Eloi Benoist-Vanderbeken
Magazine | Red Team penetration tests: evolution and challenge , MISC Magazine HS 12 - Renaud Feil
Magazine | Techniques and tools to compromise desktops , MISC Magazine HS 12 - Clément Berthaux
Magazine | Physical and logical penetration testing , MISC Magazine 80 - Renaud Feil
Magazine | Discovery and reliable exploitation of an XXE vulnerability in the Drupal Services module , MISC Magazine 80 - Renaud Dubourguais
Conference | The Internet of Things is bad , SSTIC 2015 - Eloi Benoist-Vanderbeken
Conference | HQL to SQL evasion ( video ) , SSTIC 2015 - Renaud Dubourguais
Conference | Vulnerability research in embedded systems , ESIEA Secure Edition 2015 - Eloi Benoist-Vanderbeken
Magazine | PlugX: analysis of a RAT , MISC Magazine 79 - Fabien Perigaud
Advisory | Pre-authentication XXE vulnerability in the Services Drupal module , Security advisory - Renaud Dubourguais
Magazine | Crack user data on the Blackphone , 01net - Sébastien Dudek
Magazine | Using reverse engineering skills during a penetration test: practical cases , MISC Magazine 78 - Eloi Benoist-Vanderbeken
Magazine | Using a password cracking tool: John the Ripper , GNU/Linux Magazine HS 76 - Julien Legras
2014
Conference | G-Jacking AppEngine-based applications , NoSuchCon 2014 - Nicolas Collignon
Conference | Advanced password breaking (FR) , JSSI Rouen 2014 - Julien Legras
Conference | HomePlugAV PLC: Practical attacks and backdooring , NoSuchCon 2014 - Sébastien Dudek
Conference | NoSuchCon 2014 challenge , NoSuchCon 2014 - Eloi Benoist-Vanderbeken , Nicolas Collignon
Conference | Bypassing IDS/IPS with the TCP Fast Open option ( PoC ) , SSTIC 2014 - Nicolas Collignon , Renaud Dubourguais
Conference | Android 0dayz hunting, again , SSTIC 2014 - Fabien Perigaud
Conference | G-Jacking AppEngine-based Applications , HITB Amsterdam 2014 - Nicolas Collignon , Samir Megueddem
Other | Writeup for dosfun4u , DEFCON CTF quals 2014 - Eloi Benoist-Vanderbeken
Advisory | Reverse engineering of the Sercomm feature to reactivate the TCP/32764 backdoor on several routers ( PoC ) , Security vulnerability - Eloi Benoist-Vanderbeken
Tool | Ethercomm , PoC to reactivate the TCP/32764 backdoor - Eloi Benoist-Vanderbeken
Advisory | Arbitrary code execution to escape the Google App Engine Python sandbox , Security vulnerability - Nicolas Collignon
Conference | Tools and techniques for Red-Team penetration tests , JSSI OSSIR 2014 - Renaud Feil
Advisory | Cross-Site Scripting in the Converse.js XMPP/Jabber client , Security advisory - Renaud Dubourguais
Advisory | Discovery and patching of a Remote Code Execution in the WP-Filebase plugin , Security advisory - Samir Megueddem
Advisory | Detection and exploitation of a race condition based arbitrary file upload leading to remote code execution (CVE-2014-2223) , Security advisory - Bastien Faure
Tool | SAP SecStore Decrypt , SAP SecStore decryption - Nicolas Collignon
Other | The Eye of the Tiger , Whitepaper on an APT - Fabien Perigaud
Advisory | Remote code execution in Cisco Jabber for Windows (CVE-2014-0666) , Security advisory - Fabien Perigaud
Advisory , Tool | Discovery of a backdoor on Linksys routers , Description and PoC - Eloi Benoist-Vanderbeken
Magazine | Discovery and exploitation of a vulnerability in Windows XP USB stack , MISC Magazine 71 - Fabien Perigaud
Tool | Dissipe , Sage ERP X3 internal passwords decryption - Nicolas Collignon
2013
Advisory | OWASP ESAPI library HMAC validation bypass , Security advisory - Renaud Dubourguais , Renaud Feil
Other | JSF ViewState upside-down , Whitepaper - Nicolas Collignon , Renaud Dubourguais
Tool | InYourFace , JSF ViewState tampering - Renaud Dubourguais , Nicolas Collignon
Conference | Oracle TNS protocol hijacking , SSTIC 2013 - Nicolas Collignon
Magazine | Pentesting JBoss AS in 2013 , MISC Magazine 67 - Renaud Dubourguais
Magazine | MySQL DBMS memory exploitation (CVE-2012-5611) , MISC Magazine 67 - Samir Megueddem
Tool | jimmix , remote administration tool for JBoss AS using the JMXInvoker - Renaud Dubourguais
Conference | WAF contest , JSSI OSSIR 2013 - Renaud Dubourguais , Renaud Feil
2012
Conference | J2EE frameworks security: the birth of Expression Language injections , JSSI Rouen 2012 - Renaud Dubourguais
Conference | Fuzzing the GSM Protocol Stack , Hack.lu 2012 - Sébastien Dudek
Other | Solution for the ESET BlackHat US Challenge , Whitepaper - Eloi Benoist-Vanderbeken
Magazine | Applicative security in Linux , MISC Magazine 62 - Sébastien Dudek
Conference | Criterium attack / QR-bit flip , SSTIC 2012 - Nicolas Collignon
Conference | The DevMode flag in Struts 2 , SSTIC 2012 - Renaud Dubourguais
Conference | Android 0dayz hunting , SSTIC 2012 - Fabien Perigaud
Other | Solving the SSTIC challenge , SSTIC 2012 - Eloi Benoist-Vanderbeken
Conference | Hacking (and securing) JBoss AS , Security Day 2012 - Renaud Dubourguais
Magazine | Android local root: stable exploitation of the CVE-2011-3874 vulnerability , MISC Magazine 61 - Fabien Perigaud
2011
Tool | BlueBerry , BlackBerry Enterprise Server passwords decryption - Nicolas Collignon
Conference | Pentests: exposing real world attacks , Security Day 2011 - Renaud Dubourguais
Advisory | Discovery and patching of SQL injections in the WordPress wp-polls plugin , Security advisory - Renaud Feil
Conference | Control-flow flattening and symbolic execution ( whitepaper ) , SSTIC 2011 - Eloi Benoist-Vanderbeken
Other | Hackito Ergo Sum Crackme , Hackito Ergo Sum 2011 - Eloi Benoist-Vanderbeken
2010
Tool | rdp2tcp , TCP tunneling over RDP - Nicolas Collignon
Conference | Introduction to USRP: hardware, radio, digital processing, and GnuRadio , HackerzVoice 2010 - Sébastien Dudek
Other | In memory extraction of SSL keys , Whitepaper - Nicolas Collignon
Conference | TCP tunneling over RDP , SSTIC 2010 - Nicolas Collignon
Conference | Exploiting and securing JBoss AS , SSTIC 2010 - Renaud Dubourguais
Conference | Feedback on enterprise applications security , NetFocus - Nicolas Collignon
Advisory | MS10-025 Remote code execution in Microsoft Windows Media Services (CVE-2010-0478) , Security advisory - Fabien Perigaud
Conference | Forensic and Software (Un)obfuscation , ECIW 2010 - Eloi Benoist-Vanderbeken
2009
Conference | Webshells: how to have your network wide open , GS-Days 2009 - Renaud Dubourguais
Conference | Shell over DTMF , SSTIC 2009 - Nicolas Collignon
2007
Conference | Feedback on PHP code audits , Forum PHP 2007 - Nicolas Collignon
Magazine | Evolution of Cross Site Request Forgery attacks , Journal In Computer Virology - Renaud Feil
Conference | Encrypting hostile web content over HTTP , SSTIC 2007 - Renaud Feil
Conference | Evolution of CSRF attacks , SSTIC 2007 - Renaud Feil
Conference | Discovering IPv6 networks , SSTIC 2007 - Nicolas Collignon
Conference | Web 2.0: more ergonomic... and less secure? , JSSI OSSIR 2007 - Renaud Feil
2006
Conference | Client-side vulnerabilities , SSTIC 2006 - Renaud Feil
Conference | Impacts and threats around the IPv6 protocol , OSSIR 2006 - Nicolas Collignon
Conference | IPv6: network security threats , IPv6 Worldwide Summit 2006 - Nicolas Collignon