The Curious Engineer

All blogs / Security

Last Blog Article

synacktiv.com/.html

Synacktiv - IT Security expertise - Penetration tests, Security audits, Code review, Training, Consulting, Vulnerability research

SecurityReverse engineeringWindows internalsLinux / Unix

’17’18’19’20’21’22’23’24’25’26
Posts
268 from 9 Dec 2017 to 13 Oct 2026
Posting
weekly (63 in the last year)
Kind
company blog
Language
French
Feed
https://www.synacktiv.com/feed/lastblog.xml

2026 50

  1. UFC 666 : Frontkick vs Rikugan
  2. UFC 666 : Frontkick vs Rikugan
  3. Le problème Unicode de SQL Server : pourquoi vos données ne sont peut-être pas ce que vous croyez qu'elles sont ?
  4. Le problème Unicode de SQL Server : pourquoi vos données ne sont peut-être pas ce que vous croyez qu'elles sont ?
  5. Simuler des services Active Directory légitimes sur un réseau interne : le cas de l’exploitation de GPO
  6. Simuler des services Active Directory légitimes sur un réseau interne : le cas de l’exploitation de GPO
  7. Forensic AWS EKS : sources de données et méthodes d'investigation
  8. Forensic AWS EKS : sources de données et méthodes d'investigation
  9. Exploiting Titan Quest
  10. Exploiting Titan Quest
  11. Compléter la conformité par la preuve : une approche bottom-up pour NIS2, DORA et le Cyber Resilience Act
  12. Compléter la conformité par la preuve : une approche bottom-up pour NIS2, DORA et le Cyber Resilience Act
  13. Charting your way in: Injection de templates Helm
  14. Charting your way in: Injection de templates Helm
  15. AWS Forensics : What you need to know
  16. AWS Forensics : What you need to know
  17. KYC : Contourner la vérification d'âge avec des modèles génératifs vidéo
  18. KYC : Contourner la vérification d'âge avec des modèles génératifs vidéo
  19. Make it Blink : Compromission à distance du bridge Philips Hue
  20. Make it Blink : Compromission à distance du bridge Philips Hue
  21. Survivre à la déferlante de LPE Linux : la défense en profondeur n'est pas morte !
  22. Survivre à la déferlante de LPE Linux : la défense en profondeur n'est pas morte !
  23. Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part ②
  24. Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part ②
  25. Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part 1
  26. Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part 1
  27. Dites bonjour à Pike!
  28. Dites bonjour à Pike!
  29. Hooking Windows Named Pipes
  30. Hooking Windows Named Pipes
  31. Kubernetes forensics 1/3 : what the container ?
  32. Kubernetes forensics 1/3 : what the container ?
  33. Exploiter la RBCD en environnements cross-domain & cross-forest
  34. Exploiter la RBCD en environnements cross-domain & cross-forest
  35. Grand saut dans le déploiement sur site d'un serveur LLM à moindres privilèges
  36. Grand saut dans le déploiement sur site d'un serveur LLM à moindres privilèges
  37. 2025 winter challenge writeup
  38. 2025 winter challenge writeup
  39. Exploiter la RBCD en environnements cross-domain & cross-forest : partie 2
  40. Exploiter la RBCD en environnements cross-domain & cross-forest : partie 2
  41. mitmproxy for fun and profit: Interception et analyse de flux applicatifs
  42. mitmproxy for fun and profit: Interception et analyse de flux applicatifs
  43. Au-delà des ACL : Cartographier les chemins d'élévation de privilèges Windows avec BloodHound
  44. Au-delà des ACL : Cartographier les chemins d'élévation de privilèges Windows avec BloodHound
  45. On the clock: Escaping VMware Workstation at Pwn2Own Berlin 2025
  46. On the clock: Escaping VMware Workstation at Pwn2Own Berlin 2025
  47. Wireless-(in)Fidelity: Pentest Wi-Fi en 2025
  48. Wireless-(in)Fidelity: Pentest Wi-Fi en 2025
  49. Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL
  50. Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL

2025 40

  1. Livewire : exécution de commandes à distance via unmarshaling
  2. Livewire : exécution de commandes à distance via unmarshaling
  3. Exploiting Anno 1404
  4. Exploiting Anno 1404
  5. ActivID administrator account takeover : the story behind HID-PSA-2025-002
  6. ActivID administrator account takeover : the story behind HID-PSA-2025-002
  7. 2025 summer challenge writeup
  8. Outils open-source des attaquants exploitant Ivanti CSA
  9. Breaking the BeeStation: Inside Our Pwn2Own 2025 Exploit Journey
  10. Extraction des archives chiffrées Synology - Pwn2Own Irlande 2024
  11. La réflexion NTLM est morte, vive la réflexion NTLM ! – Analyse approfondie de la CVE-2025-33073
  12. Construire un binaire Rust "Two-Face" pour Linux
  13. Paint it blue: Attacking the bluetooth stack
  14. Transition post-quantique : L’hybridation des échanges de clés
  15. LinkPro : analyse d'un rootkit eBPF
  16. Let Me Cook You a Vulnerability: Exploitation du Thermomix TM5
  17. Laravel: Analyse de fuite d'APP_KEY
  18. Exploiting Heroes of Might and Magic V
  19. iOS 18.4 - dlsym considered harmful
  20. Exploiting Neverwinter Nights
  21. Transition post-quantique : L’hybridation des signatures
  22. appledb_rs, un outil d'aide à la recherche sur plateformes Apple
  23. L’Extension fantôme : Infiltrer Chrome par des voies inexplorées
  24. Exploring GrapheneOS secure allocator: Hardened Malloc
  25. Dissecting DCOM partie 1
  26. LLM Poisoning [1/3] - Lire les pensées d'un Transformer
  27. Faut-il faire confiance au zero trust ? Contourner les contrôles de posture Zscaler
  28. From cheap IoT toy to your smartphone: Getting RCE by leveraging a companion app
  29. Analyse d'un décodeur TNT
  30. 2025 Summer Challenge: OCInception
  31. Attaque du Tesla Wall connector depuis le port de charge
  32. Site Unseen : Énumérer et attaquer les sites Active Directory
  33. Etude de cas : Comment Hunters International et ses affiliés ciblent vos hyperviseurs
  34. CVE-2025-23016 - Exploiter la bibliothèque FastCGI
  35. Taking the relaying capabilities of multicast poisoning to the next level: tricking Windows SMB clients into falling back to WebDav
  36. LSA Secrets: revisiting secretsdump
  37. Que pourrait-il arriver de dangereux lorsque le mode SQL strict de MySQL est désactivé ?
  38. Abusing multicast poisoning for pre-authenticated Kerberos relay over HTTP with Responder and krbrelayx
  39. 2025 Winter Challenge: Quinindrome
  40. 2025 Winter Challenge: Quinindrome

2024 38

  1. Diving into ADB protocol internals (2/2)
  2. Diving into ADB protocol internals (1/2)
  3. Relaying Kerberos over SMB using krbrelayx
  4. Quantum readiness: Lattice-based PQC
  5. Exploiting a Blind Format String Vulnerability in Modern Binaries: A Case Study from Pwn2Own Ireland 2024
  6. Forensic analysis of bitwarden self-hosted server
  7. GitHub Actions exploitation: repo jacking and environment manipulation
  8. Fuzzing confused dependencies with Depfuzzer
  9. Defend against vampires with 10 gbps network encryption
  10. Using Veeam metadata for efficient extraction of Backup artefacts (2/3)
  11. Quantum readiness: Hash-based signatures
  12. LAPSUS$ is dead, long live HexaLocker?
  13. SCCMSecrets.py: exploiting SCCM policies distribution for credentials harvesting, initial access and lateral movement
  14. Arlo: I'm watching you
  15. Using Veeam metadata for efficient extraction of Backup artefacts (1/3)
  16. Exploring Counter-Strike: Global Offensive Attack Surface
  17. Battle of the parsers: PEG vs combinators
  18. Injecting Java in-memory payloads for post-exploitation
  19. GitHub Actions exploitation: self hosted runners
  20. GitHub Actions exploitation: introduction
  21. Automated Network Security with Rust: Detecting and Blocking Port Scanners
  22. GitHub Actions exploitation: Dependabot
  23. Understanding and evading Microsoft Defender for Identity PKINIT detection
  24. Inside the iOS bug that made deleted photos reappear
  25. Hijacking GitHub runners to compromise the organization
  26. WHFB and Entra ID : Say Hello to your new cache flow
  27. Leveraging Binary Ninja IL to Reverse a Custom ISA: Cracking the “Pot of Gold” 37C3
  28. iOS: a journey in the USB networking stack
  29. 👻 Souls without bodies, phantom types shenanigans 👻
  30. So I became a node: exploiting bootstrap tokens in Azure Kubernetes Service
  31. OUned.py: exploiting hidden Organizational Units ACL attack vectors in Active Directory
  32. Quantum readiness: Introduction to Modern Cryptography
  33. Entra ID Banned Password Lists: password spraying optimizations and defenses
  34. Exploiting American Conquest
  35. VMware ESXi Forensic with Velociraptor
  36. Java deserialization tricks
  37. GitHub Actions exploitation: untrusted input
  38. KrustyLoader - Rust malware linked to Ivanti ConnectSecure compromises

2023 34

  1. Writing a decent win32 keylogger [1/3]
  2. Writing a decent win32 keylogger [2/3]
  3. Writing a decent win32 keylogger [3/3]
  4. Frinet: reverse-engineering made easier
  5. WordPress for Security Audit
  6. Finding a POP chain on a common Symfony bundle: part 1
  7. The printer goes brrrrr, again!
  8. Pcapan: a PCAP analysis helper
  9. How to voltage fault injection
  10. Magento Template Engine, a story of CVE-2022-24086
  11. Finding a POP chain on a common Symfony bundle : part 2
  12. EVM unravelled: recovering ABI from bytecode
  13. Legitimate exfiltration tools : summary and detection for incident response and threat hunting
  14. Introducing ntdissector, a swiss army knife for your NTDS.dit files
  15. Presentation of the Pentest Team
  16. Forensic Aspects of Microsoft Remote Access VPN
  17. systemd hardening made easy with SHH
  18. Using ntdissector to extract secrets from ADAM NTDS files
  19. Web Architect - An Introduction
  20. Magento for Security Audit
  21. A study on Windows HTTP authentication (Part II)
  22. Exploring Android Heap allocations in jemalloc 'new'
  23. Behind the Shield: Unmasking Scudo's Defenses
  24. Credential Stuffing: Speeding up massive leaks databases
  25. Windows secrets extraction: a summary
  26. I hack, U-Boot
  27. GPOddity: exploiting Active Directory GPOs through NTLM relaying, and more!
  28. Escaping from bhyve
  29. PHP filter chains: file read from error-based oracle
  30. Hardware investigation of wireless keyloggers
  31. Exploiting a remote heap overflow with a custom TCP stack
  32. Building a io_uring based network scanner in Rust
  33. Old bug, shallow bug: Exploiting Ubuntu at Pwn2Own Vancouver 2023
  34. CI/CD secrets extraction, tips and tricks

2022 20

  1. Exploiting CVE-2022-24816: A code injection in the jt-jiffle extension of GeoServer
  2. A dive into Microsoft Defender for Identity
  3. Legitimate RATs: a comprehensive forensic analysis of the usual suspects
  4. PHP filters chain: What is it and how to use it
  5. Persistent PHP payloads in PNGs: How to inject PHP code in an image – and keep it there !
  6. Traces of Windows remote command execution
  7. Ready For IT 2022: Back to attacks on new digital uses
  8. Heap tricks never get old - Insomni'hack teaser 2022
  9. CVE-2022-31813: Forwarding addresses is hard
  10. CCleaner forensics
  11. Cool vulns don't live long - Netgear and Pwn2Own
  12. The printer goes brrrrr!!!
  13. PrideLocker - a new fork of Babuk ESX encryptor
  14. Présentation de l'équipe Reverse
  15. elFinder: The story of a repwning
  16. Pwn2Own Austin 2021 : Defeating the Netgear R6700v3
  17. Finding gadgets like it's 2022
  18. Unransomware
  19. Captain Hook - How (not) to look for vulnerabilities in Java applications
  20. Dissecting NTLM EPA with love & building a MitM proxy

2021 26

  1. Yet another BEC investigation on M365
  2. Exploiting CVE-2021-25770: A Server-Side Template Injection in YouTrack
  3. Finding gadgets like it's 2015: part 2
  4. Car hijacking swapping a single bit
  5. Finding gadgets like it's 2015: part 1
  6. Analysis and exploitation of the iOS kernel vulnerability CVE-2021-1782
  7. Is it post quantum time yet?
  8. Cracking Radmin Server 3 passwords
  9. Dumping the Sonos One smart speaker
  10. macOS XPC Exploitation - Sandbox Share case study
  11. Writing a (toy) symbolic interpreter, and solving challenges, part 4
  12. Writing a (toy) symbolic interpreter, and solving challenges, part 3
  13. Writing a (toy) symbolic interpreter, and solving challenges, part 2
  14. Writing a (toy) symbolic interpreter, and solving challenges, part 1
  15. Exploitation of a double free vulnerability in Ubuntu shiftfs driver (CVE-2021-3492)
  16. Playing with ImageTragick like it's 2016
  17. RM -RF IS THE ROOT OF ALL EVIL
  18. Pentesting Cisco ACI: LLDP mishandling
  19. How to exploit CVE-2021-40539 on ManageEngine ADSelfService Plus
  20. Kubernetes namespaces isolation - what it is, what it isn't, life, universe and everything
  21. GPGme used confusion, it's super effective !
  22. Your vulnerability is in another OEM!
  23. HTB Business CTF Write-ups
  24. An Interesting Feature in the Samsung DSP Driver
  25. Baking Mojolicious cookies
  26. Pwn2Own Tokyo 2020: Defeating the TP-Link AC1750

2020 30

  1. Unleash the dino: Time-based strategies to improve password cracking
  2. Typo3: leak to Remote code execution.
  3. Investigating IDA Lumina feature
  4. SharkyCTF - EZDump writeups / Linux Forensics introduction
  5. I'm SMBGhost, daba dee daba da
  6. Don't fear the bark, ts_rewrite to dodge the mark
  7. Treasure Chest Party Quest: From DOOM to exploit
  8. This is for the Pwners: Exploiting a WebKit 0-day in PlayStation 4
  9. Pull up your bootloader
  10. Cisco ISE < 1.5 Passwords decryption
  11. A journey in reversing UEFI Lenovo Passwords Management
  12. Izi Izi, Pwn2Own ICS Miami
  13. DJI Android GO 4 application security analysis
  14. Pentesting Cisco SD-WAN Part 2: Breaking routers
  15. Return of the iOS sandbox escape: lightspeed's back in the race!!
  16. Rulesfinder, automatically create good password cracking rulesets
  17. Bypassing Naxsi filtering engine
  18. Advent ctf 2019 overthewire - day2 writeup
  19. Looting Symfony with EOS
  20. Azure AD introduction for red teamers
  21. DJI Pilot Android Application Security Analysis
  22. Memory leak and Use After Free in Squid
  23. How to exploit Liferay CVE-2020-7961 : quick journey to PoC
  24. Pentesting Cisco SD-WAN Part 1: Attacking vManage
  25. Ubuntu ppp's CVE-2020-15704 wrap-up
  26. The fix for CVE-2020-9859 and the lightspeed vulnerability
  27. Binder - Analysis and exploitation of CVE-2020-0041
  28. Azure DevOps Build Agent analysis
  29. Through the SMM-class and a vulnerability found there.
  30. iOS 1-day hunting: uncovering and exploiting CVE-2020-27950 kernel memory leak

2019 11

  1. FIC2020 prequals CTF write-up
  2. Pwning an outdated Kibana with not so sad vulnerabilities
  3. Binder Secctx Patch Analysis
  4. BFS 2019 Exploitation Challenge
  5. "No grave but the SIP": Reversing a VoIP phone firmware
  6. Scraps of Notes on Exploiting Exim Vulnerabilities
  7. 2019 summer challenge writeup
  8. Exploiting a No-Name FreeBSD Kernel Vulnerability
  9. 2019 summer challenge: Alonzo!
  10. icmp-reachable
  11. rutorrent code review

2018 16

  1. Using your BMC as a DMA device: plugging PCILeech to HPE iLO 4
  2. Code Check(mate) in SMM
  3. Binder transactions in the bowels of the Linux Kernel
  4. Grehack 2018 qualification challenge
  5. LightSpeed, a race for an iOS/MacOS sandbox escape!
  6. Kinibi TEE: Trusted Application exploitation
  7. Hunting mobile devices endpoints - the RF and the Hard way
  8. ColdFusion CFMX_COMPAT lolcryption
  9. 2018 summer challenge: MetroCross
  10. 2018 Summer Challenge Writeup
  11. HP iLO talk at Recon Brx 2018
  12. Practical DMA attack on Windows 10
  13. Breaking namespace isolation with PF_RING before 7.0.0
  14. netdata apps.plugin security fixes
  15. E-ink maiden: Bring your reader to the reverser
  16. iOS12 Kernelcache Laundering

2017 1

  1. RCE vulnerability in HP iLO

Undated 2

  1. Exploitation du Tesla Wall Connector depuis le connecteur de charge - Partie 2 : contournément de l'anti-downgrade
  2. Exploitation du Tesla Wall Connector depuis le connecteur de charge - Partie 2 : contournément de l'anti-downgrade