Ambionics Security
@ambionics
Followers
2K
Following
47
Media
9
Statuses
81
A @LexfoSecurite service. Ambionics is combining the best of human intelligence and technology to continuously assess the security of your applications.
Paris, France
Joined September 2016
🚀 Huge thanks to @cfreal_ for the threading PR. Lightyear is now faster than ever! We truly appreciate continued contributions. If you haven’t yet, give lightyear a try and see the difference yourself!. #opensource #lightyear #performance #php #pentest #infosec #cybersecurity.
lightyear just got 6 times faster!. Although I now work at @Synacktiv, I proposed a PR for the tool to support threading and compression, greatly reducing the time required to dump a file. Dumping the demo /etc/passwd now takes 48s instead of 5m30.
0
2
10
The discovered chain contains interesting new vectors : Pre-authentication SQLi on the Inventory native feature ->Authentication bypass by fetching api_token or personal_token -> Either plugin command injection through the Marketplace or a new LFI vector via PDF exports->RCE.
0
1
5
GLPI, an open-source IT service management software suite, has released version 10.0.18, addressing two critical vulnerabilities found by our experts : an SQL injection (CVE-2025-24799) and a remote code execution (CVE-2025-24801). Checkout our blog post:
2
22
80
New #PHP research by @ptswarm ! Using our tools wrapwrap ( and our latest one lightyear ( developed by @cfreal_ ! #php #xxe #infosec #CyberSecurity.
github.com
lightyear is a tool to dump files in tedious (blind) conditions using PHP filters - ambionics/lightyear
🔥 The "impossible" XXE in PHP? Not so impossible anymore. Our researcher Aleksandr Zhurnakov discovered an interesting combination of PHP wrappers and a feature of XML parsing in libxml2 to exploit it. Read:
0
5
13
We're proud to announce LIGHTYEAR, a tool that let you dump files, blind, in PHP, based on a new algorithm.
ambionics.io
In this blog post, we describe new techniques to dump files in PHP leveraging filters, and a tool that does it, lightyear.
0
94
248
0
1
9
At long last: Iconv, set the charset to RCE (part 3): in this final part of the iconv series, @cfreal_ demonstrates how you can use CVE-2024-2961 to convert BLIND file reads to RCE.
ambionics.io
In this blog post, we will explore how we can exploit CNEXT, but blind, covering the cases where we have a file read primitive, but cannot get the output.
1
54
145
Iconv, set the charset to RCE (part 2): @cfreal_ exploits direct iconv() calls to hack the PHP engine, and its most popular webmail, @Roundcube (CVE-2024-2961).
ambionics.io
In this blog post, we will explore a new way of exploiting the vulnerability on PHP, using direct calls to iconv(), and illustrate the vulnerability by targeting Roundcube, a popular PHP webmail.
0
66
165
📷 Learn more and contribute: Scalpel is in Alpha and your feedback is valuable. Check the docs and join us on GitHub! .
github.com
Scalpel is a Burp extension for intercepting and rewriting HTTP traffic, either on the fly or in the Repeater using Python 3 scripts. - ambionics/scalpel
0
1
0
📷 Modify the entire traffic with Scalpel. Implement custom logic to manipulate requests globally using the request function:
1
0
0
📷 View and modify encrypted HTTP parameters as plaintext in the Repeater. Using the above code adds new editors to Burp, watch it in action:
1
0
0
🔧 Intercept and rewrite HTTP traffic effortlessly. Implement req_edit_in and req_edit_out hooks to create new editors in Burp's Repeater:
1
0
0
Scalpel is here: this @Burp_Suite extension lets you edit your requests, in Python 3, in the repeater or on-the-fly.
1
16
51
Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961)
ambionics.io
A few months ago, I stumbled upon a 24 years old buffer overflow in the glibc, the base library for linux programs. Despite being reachable in multiple well-known libraries or executables, it proved...
3
126
301
PHPGGC just reached 3000 stars on @github !. In 7 years, it went from a handful of gadget chains to more than 140, with more than 50 contributors. Thank You !
0
4
22
0
2
0
Introducing a new tool for #PHP filters attacks, #wrapwrap: an algorithm to add an arbitrary prefix and suffix to a PHP resource, improving the exploitation of file read and #SSRF vulnerabilities.
ambionics.io
We introduce a tool that uses PHP filters to wrap PHP resources in an arbitrary prefix and suffix.
0
47
136
Learn about the two @Owncloud vulnerabilities CVE-2023-49103 and CVE-2023-49105 in our new blogpost:
ambionics.io
We provide details about CVE-2023-49103 and CVE-2023-49105
0
22
64