Vozec
@Vozec1
Followers
669
Following
983
Media
5
Statuses
64
20ns🎉 Etudiant à l'ESNA / Pentester chez ACCEIS / Président de l'association ESN'HACK | Bug hunter
Joined March 2022
Here are the technical details of my first 0day, found in collaboration with @TheLaluka ! 🩵 PreAuth on 🌟Spip CMS 🌟<= 4.3.1: - https://t.co/5rzRo7luI5 Ref: -
3
14
64
@Formation_bzh annule à J-15 la 1re année BTS SIO SLAM (11 admissibles). Une honte ! Pour les jeunes : nouvelle école à trouver, alternance, logements... Traitement inhumain de ses jeunes considérés comme des lignes d'un tableau excel. On attend des réponses. #ESNA #UIMM
1
13
29
Guillaume Chouquet, fondateur et directeur de l'ESNA, viré de sa propre école par l'@Formation_bzh !!! Je suis consterné et en colère. C'est affligeant de prendre une telle décision quand on sait tout ce que le bonhomme a fait pour l'école et les alternants !
14
44
107
My writeup for the KalmarCTF challenge "no sqli" is out, covering the exploitation of CVE-2024-6382, an integer overflow in the Rust's MongoDB library. A very interesting challenge, enjoy! :) https://t.co/2ilHVAZXmr
2
35
171
Merkle & Hellman partent en vacances🏝️🎒lequel optimise son sac à dos ? Les deux 😁@Vozec1 te présente leur cryptosystème et te propose aussitôt de le casser💥Une attaque #ManInTheMiddle et deux attaques par réseaux euclidiens. https://t.co/tAAYF8MKil
#Cryptologie #Cybersécurité
0
2
6
Hello dear Hackers, 🧙♂️ After our 1st Spip Challenge ended, @Vozec1 wanted to push the adventure further and found a new Post-Auth RCE ! 🎉😉 I then turned it into an Unauth-RCE 💣 We even managed to make some bucks with it 😏 Today's article is this story & write-up, enjoy! 💌
0
13
30
🎉 Annonce du nouveau bureau de l'ESN'HACK 2024 ! 🎉 Nous sommes ravis de vous présenter notre nouvelle équipe pour l'année à venir. N'hestiez pas à rejoindre notre serveur discord, une annonce relative au SteakOverflow arrive très prochainement. 👀🍖 https://t.co/F3fyfXJarv
0
8
20
La team CTF ACCEIS fait sa rentrée avec le #CTF @_barbhack_ , une belle première place 🥇 pour l'équipe pioupiou complétée avec @TheLaluka (Offenskill), @kevin_mizu (bsecure) et @Ooggle_
#Barbhack24
1
5
34
Hi Dear Infosec, @vozec1 & I are thrilled to release our new Spip Exploit Challenge, and start the school-year on an explosive note! 💣 You guessed it, we want you to find our... Unauth RCE on SPIP 4.3.1 🔥 This new challenge starts TODAY, here are the rules: - The challenge
1
11
36
🎉RCE Pre-Auth sur SPIP <= 4.3.2 🎊 Trouvée en collab avec @TheLaluka il y a quelques jours ! Ref: - https://t.co/BTqioYSFP3 -
blog.spip.net
Suite au signalement d'une faille critique de sécurité, qui affecte toutes les versions de SPIP depuis la 4.0, nous publions les versions SPIP 4.3.2, SPIP 4.2.16, SPIP 4.1.18. Un grand merci à Laluka…
4
16
82
Everyone knows that the RFCs for email addresses are crazy. This post will show without doubt that you should not be following the RFC. https://t.co/HL0g9f7QEA
portswigger.net
Some websites parse email addresses to extract the domain and infer which organisation the owner belongs to. This pattern makes email-address parser discrepancies critical. Predicting which domain an
11
154
434
I wrote a small blog post about a specific error I encountered while coding a custom windows authentication package. It’s mainly about windows login setup and some ACL, nothing new but could be helpful https://t.co/j6p3n9MXPZ
1
10
18
Great research from @scryh_! I was keeping it for a CTF challenge, but it's probably too late now :p This trick is so powerful that it can be used to bypass most (if not all) server-side HTML sanitizers in the absence of a charset within the Content-Type response header 🤯
🔥 XSS on any website with missing charset information? 😳 Attackers may leverage the ISO-2022-JP character encoding to inject arbitrary JavaScript code into a website. Read more in our latest blog post: https://t.co/Ji3V0fK5b6
#appsec #security #vulnerability
2
67
325
A few weeks ago, I wanted to learn more about XS-Leaks. This ended in a vulnerability in CTFd that was exploitable with a new technique to detect status codes! The following post goes through my process of finding it and the proof of concept exploits: https://t.co/JHjYqKQFgL
jorianwoltjer.com
Due to an XS-Leak vulnerability I found in CTFd versions 3.7.2 and below, it was possible to leak flags from admins. Using a novel technique abusing browser history and CSS it could be completely...
5
22
118
hi, just wrote my first post on the exploitation of a random github VM, let me know what you think :) https://t.co/C6HHAx4zXM
numb3rs.re
Recently I’ve become a bit fed up with CTF’s and wanted to test my skills on real targets. I tried finding bugs in popular softwares such as Filezilla but I hit the wall every single time. Instead of...
3
17
73