SpawnZii retweeted
I'm happy that my first article as part of the @SLCyberSec research team is finally out! 😁
It covers an interesting ImageMagick race condition that I found back in June, which, combined with a polyglot payload, allowed me to achieve file read/RCE on Discourse. This should resonate with those who've seen the recent @HacktronAI research.
I hope you'll enjoy it! 👇
Our research team discovered two vulnerabilities in Discourse: a pre-authentication cache poisoning to sitewide XSS (CVE-2026-55674), and an arbitrary file read (RCE) chaining a JPEG race condition with ImageMagick and Ghostscript (CVE-2026-55420). You can read more here:
ALT https://www.slcyber.io/research/a-jpeg-a-race-and-a-ghost-breaking-discourses-image-pipeline
SpawnZii retweeted
Heyo ! 🍺
Prochain stream demain Mardi 11 Fev à 21h !
Au programme :
- Intro Actus & Mini Techno-Watch
- Then GestSup Pwning avec @_Worty & @SpawnZii 🧨
See you there !
➡️ twitch.tv/thelaluka
SpawnZii retweeted
Just published a quick blogpost about my failing journey trying to get a valid entry for this edition.
link.medium.com/AJgtsUo2MNb
I'll keep trying until I succeed!
In the meantime I wish good luck to all participants and may the demo God be with you 🤘
Registration for #Pwn2Own Ireland is officially closed!! We officially have a plethora of attempts, which means a lot to us. Tune in for the drawing for order next Monday, Oct 20, 14:30 Cork time (GMT+1) youtube.com/live/Km4nRs9HexM…
SpawnZii retweeted
🎵 Please don't pwn the music 🎵
Who could say no to a party before a #LHE? Not our bug hunters! They joined our pre-hack party last Friday after an exciting 1st day at @_leHACK_. With fresh beer, great music & amazing people, it was surely a night to remember!
#HackThePlanet
SpawnZii retweeted
Awesome work from @aituglo !
Try hackyx.io for learning, find way to exploit vulnerabilities, read write up. It’s a real game changer and it’s free !
Send us your suggestions for data to scrape or feel free to contribute to the github repo. 😁
Hackyx now fully has filters to easily find anything !
hackyx.io
Also a big thanks to @Wlayzz for adding huntr.dev/ reports
SpawnZii retweeted
I've stumbled upon another security issue with macro execution in @LibreOffice! 😅
SpawnZii retweeted
Our ninja @_Worty in collaboration with @SpawnZii (from @Bzhunt1) found 5 vulnerabilities allowing to compromise accounts and execute arbitrary commands on GestSup. Update to 3.2.45 and read the security details in the technical advisory: synacktiv.com/advisories/mul…
SpawnZii retweeted
Our ninja @_Worty identified a remote code execution from a privileged user in Cisco Access Point WAP371. This vulnerability referenced as CVE-2024-20287 will not be patched, apply network restrictions to protect your appliances.
synacktiv.com/advisories/rem…
SpawnZii retweeted
In September, I looked into mlflow, and found several critical vulnerabilities 😁
Most of these reports are now patched and publicly available here: huntr.com/users/kevin-mizu
My favorite one involves a fully controlled file write via a custom rogue FTP 👇huntr.com/bounties/029a3824-…
SpawnZii retweeted
📣 Give it up to the brave survivors of Brains & Bytes 📣
#UniversityCTF23 has come to an end, and these are its champions:
🥇 @GCC_ENSIBS
🥈 @EsnaBretagne
🥉 @Phreaks2600
Thank you, everyone, for participating in the epic #CTF, and of course, stay tuned for more to come 😉
#HackTheBox #HTB #Cybersecurity #CaptureTheFlag
SpawnZii retweeted
Un immense merci à l'organisation du @HeroCTF pour son infra et ses challenges d'une qualité exceptionnelle ! 👏
Bravo à tous les participants et félicitations à nos joueurs @0xItarow @shinji_01h @Gaburall @SpawnZii @Atlas453_ pour leur performance ! 🔥🔥
End of the CTF ! 🔥
The writeups will be available shortly: github.com/HeroCTF/HeroCTF_v…
GG to everyone and to the winners @MedusHack !
Many thanks to our sponsors 🙏
Really hope you enjoyed😄
SpawnZii retweeted
End of the CTF ! 🔥
The writeups will be available shortly: github.com/HeroCTF/HeroCTF_v…
GG to everyone and to the winners @MedusHack !
Many thanks to our sponsors 🙏
Really hope you enjoyed😄
SpawnZii retweeted
Très fier de finir à la première place avec les potes de l’ @EsnaBretagne :)
Gg a vous @Atlas453_ @DinerHell @0xItarow @Gaburall @SpawnZii @iHuggsy @D1n0x0r & d’autres :)
Huge play aux potes de @gcc_ensibs , on a eu chaud vous étiez bouillant :p
Voici le classement complet de cette #EC2 2023 ! 🏆
Un grand bravo aux ESNARCOTRAFIQUANTS pour leur victoire ! 👏
ALT Classement final de l'EC2 2023
SpawnZii retweeted
CVE-2022-37155 RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via a GET parameter cve.mitre.org/cgi-bin/cvenam…
SpawnZii retweeted
Hi again!
Here's the form you can all fill to give me insights on what you want to break, and in which conditions! ;)
Game's ON!
forms.gle/uB3u1aUDe4cb89F96
SpawnZii retweeted
This weekend i've played the @hackthebox_eu university CTF ! We finish in second place with the same number of points as the first ones !
Here is the writeup of the challenge "Spell Orsterra", which was a really hard one !
github.com/W0rty/HTB-Univ-Sp…
SpawnZii retweeted
I hope I am not spoiling anything but there is a box on @tryhackme where you may have to bruteforce a MyBB login panel. Maybe this tool I just released could help you 👀
github.com/0xSysR3ll/mybb-br…
SpawnZii retweeted
Happy to share a new technique with @podalirius_ to coerce an SMB authentication on Windows SQL Server as the machine account ! :)
Check it out here : github.com/p0dalirius/MSSQL-…
SpawnZii retweeted
Who said open redirect should not be report (in bbounty) unless you have an SSRF 👀👀
Here it is used for a nice phishing attempt!
Oh on dirait une belle arnaque sur le dos de La Posre (@lisalaposte comment on fait?. Reçu dans ma boîte. Très facile d’y croire et finir par donner ses infos de carte de crédit !
