Charles Fol
@cfreal_
Followers
4K
Following
2K
Media
19
Statuses
269
@Synacktiv – previously @ambionics @LexfoSecurite – blogs: https://t.co/cLoNdCGPU7 https://t.co/JVMLjUzTJU https://t.co/t9a5IcOXSU
Joined July 2018
The first part of the blog series: #Iconv, set the charset to RCE. We'll use #PHP filters and #CVE-2024-2961 to get a very stable code execution exploit from a file read primitive. #cnext
Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961)
8
58
171
🔔 New research from Lexfo on pre- & post-authentication vulnerabilities in WSO2 products — uncovering bypasses, RCE, SSRF, CSRF, and account-takeover risks. See our detail article → https://t.co/1jNmsIhdZl
#cybersecurity #infosec #offensivesecurity #pentest #WSO2
blog.lexfo.fr
Uncovering bypasses, RCE, SSRF, CSRF, and account-takeover vulnerabilities in WSO2 products.
0
15
61
This article by Nicolas Stefanski at Synacktiv provides a high quality technical overview of our hardened_malloc project used in GrapheneOS: https://t.co/VmpQGTZSDE It has great coverage of the memory layout, memory tagging integration, slab quarantines and allocation approach.
synacktiv.com
Exploring GrapheneOS secure allocator: Hardened Malloc
7
70
453
lightyear just got 6 times faster! Although I now work at @Synacktiv, I proposed a PR for the tool to support threading and compression, greatly reducing the time required to dump a file. Dumping the demo /etc/passwd now takes 48s instead of 5m30. https://t.co/d7n4baN12a
github.com
lightyear is a tool to dump files in tedious (blind) conditions using PHP filters - ambionics/lightyear
1
28
106
Check out our first blog post about V8 CVE-2024-12695:
bugscale.ch
Bug 383647255 was reported to the Chromium bug tracker on December 12, 2024. In this article, we will look at the root cause of this vulnerability and walk through how it can be exploited to achieve...
3
50
108
Just finished my talk at #securityfest, you can find all the details in my latest blog post:
1
16
27
🚨 New unauthenticated #RCE module for vBulletin 5.1.0-6.0.3 landed in Metasploit! No CVE assigned, but credit to Egidio Romano (EgiX) for the original write-up: https://t.co/qxmvpU6l43 🔗 PR: https://t.co/j1G7wp2L9Z
1
76
288
Synacktiv is looking for an additional team leader in Paris for its Reverse-Engineering Team! Find out if you are a good candidate by reading our offer (🇫🇷). https://t.co/Djr5KdvCH5
1
22
57
The subtitle of this blog is "a plea to security news outlets to please do their due diligence before slapping 'exploited in the wild' headlines on new CVEs"
rapid7.com
Apache Tomcat CVE-2025-24813: What You Need to Know | Rapid7 Blog
0
11
37
#vulhub #CyberSecurity #opensource #infosec Announcing some exciting news from the Vulhub project! We've been busy making big improvements: 1⃣. Completely rebuilt our website from the ground up! Check it out: https://t.co/fMkOD9YXuL
1
7
37
Passionate about hacking & cybersecurity? Airbus is looking for a Vulnerability Research & Exploitation Specialist in France! 💻 Reverse engineering, Red Teaming ✈️Join a global aerospace & defense leader Apply now! 🚀 https://t.co/wheJECIvtJ
0
13
13
Great new PHP research, especially since it uses both wrapwrap and lightyear!
🔥 The "impossible" XXE in PHP? Not so impossible anymore. Our researcher Aleksandr Zhurnakov discovered an interesting combination of PHP wrappers and a feature of XML parsing in libxml2 to exploit it. Read: https://t.co/GuW2Vf5qLN
0
3
50
🔥 The "impossible" XXE in PHP? Not so impossible anymore. Our researcher Aleksandr Zhurnakov discovered an interesting combination of PHP wrappers and a feature of XML parsing in libxml2 to exploit it. Read: https://t.co/GuW2Vf5qLN
0
113
327
#ten (and thus my exploits) is now compatible with python 3.13. Thanks @acervoise for the heads up.
1
0
12
This year again, I am lucky enough to get nominated twice for the Top Ten Hacking Techniques, for my research on iconv and PHP, and lightyear. This time feels a bit special however, as these are my last blog posts on @ambionics. https://t.co/arnuvdqxCq
https://t.co/8mcXRSfKSt
ambionics.io
In this blog post, we describe new techniques to dump files in PHP leveraging filters, and a tool that does it, lightyear.
Voting is now live for the Top Ten (New) Web Hacking Techniques of 2024! Browse the nominations & cast your votes here:
1
12
89
🧵My latest blog post is live 🔥 Read it to learn what SafeMarshal is and *two* very different ways to escape and get RCE! https://t.co/OxRAkwhFp7
2
28
107
🔐 CVE-2024-50340: Ability to change environment from query ➡️ https://t.co/ittWVy2JjE
#symfony
symfony.com
CVE-2024-50340: Ability to change environment from query
2
19
60
LIGHTYEAR: - Can dump large files, even through a GET parameter - Retrieves characters using dichotomy - Does not cause PHP warnings
We're proud to announce LIGHTYEAR, a tool that let you dump files, blind, in PHP, based on a new algorithm. https://t.co/GG4tSNnUCf
0
7
32
We're proud to announce LIGHTYEAR, a tool that let you dump files, blind, in PHP, based on a new algorithm. https://t.co/GG4tSNnUCf
ambionics.io
In this blog post, we describe new techniques to dump files in PHP leveraging filters, and a tool that does it, lightyear.
0
91
247