Breakpoint

Where we analyze an IoT authentication protocol from 2016 using Verifpal.

Dueling Nexus is a free Yu-Gi-Oh dueling platform, the security of which leaves to be desired.

GRR is a French open-source booking management system.

An analysis of strange statistical mistakes in a biology paper about a randomized controlled trial studying the effect of probiotics on allergic rhinitis.

Let's study a broken password manager to understand some vulnerabilities specific to storage encryption.

Where we find a novel attack against a very very old authentication protocol with the help of Verifpal.

First installment of the Dusty Files series, we look at the discovery and exploitation of a SSRF in Padlet.

The standard D library provides a random UUID implementation that relies on regular pseudo-number generation and is not cryptographically secure.

Crypto is a cryptography library for the D programming language.

Stirling engines are simple, safe and dependable.

Study of a file-based privilege escalation in HPLIP.

Got a 3 or 4 digit combination lock that you can't open?

My web directory bruteforcing tool is finally feature complete after some years of development and professional use.

Determining the right size of hash to use to avoid collisions can be tricky, but it's easier than it sounds with the right mental trick.

Let's raise Github projects back from the dead to take control of hundreds of Dub, Go and AUR packages!

We've lost the habit to perform mental calculations and estimates since working with computers.

Docker is generally presented as a developer tool, but it can be very useful to security professionals too!

Asked to perform an internal pentest with no clue where to start from?

P0wning a Windows box without Powershell?

Let's have a glance at a real although very short D program to discuss some of its features.

How to configure SSL/TLS on your server in order to make it secure?

Julia Evans proposed the simplest database, let's take it down!

How to use sox for something simple and practical: fixing the noise in a youtube video.

Simple demonstration of how an attacker could tamper with an encrypted message to his benefit without ever decrypting it in the absence of message authentication.

Excel formula injections are common in programs generating XLS files, but often considered harmless.

How to identify flawed resource management leading to privilege escalation.

Introduction to the main concepts behind a fast security review.

D's unpredictableSeed is sometimes used to compensate for the lack of a CSPRNG in the standard library.

"A file was encrypted.

Quelqu'un sur irc a proposé hier un petit challenge de steganographie.

Shell streams are the most powerful feature of bash.

Ed est un éditeur puissant mais terriblement déconcertant au premier abord.

Strace est un outil puissant mais qui peut être difficile à manipuler.

What makes an object system tick?

Improvised code review of the Gource git repository viewer.

Une explication détaillée d'exploitation de programme SUID root via une TOCTTOU pour obtenir une élévation de privilège.