<h1>Introduction</h1>
<p>In the <a href="https://kernelpanic.cryptid.fr/en/blog/nonsense-mayhem-samesite-cors-and-csrf">last blog post</a>, we detailed the various conditions necessary to <strong>perform a successful CSRF attack</strong>, considering today's browser security. I mentioned that it was mostly written out of frustration, as I received numerous erroneous pentest reports regarding CSRF... Well, it see...</p>
16
Mar
Nonsense, mayhem, browser security, CSRF, and CORS - Part 1
<img alt="" src="/images/c/1/f/a/b/c1fab89834ebd42c91e95e4a61d6a15d29665da2-csrf.png" />
<h1>Introduction</h1>
<p>A couple of years ago, <strong>CORS misconfigurations</strong> were the hot stuff for Bug Bounty hunters. Now, the vulnerability has made its way to penetration tests reports, along with <strong>CSRF</strong> and other <strong>self-XSS</strong> poor man's security issues.
The thing is, the state of the art of security for browse...</p>
25
Nov
DVID (Damn Vulnerable IoT Device) Bluetooth write up
<img alt="" src="/images/c/1/5/d/b/c15db6746f8c0577787cc53f91b6f93baf922f98-nicolas-thomas-3gzi6opsdcy-unsplash.jpg" />
<h1>Render unto Caesar the things that are Caesar's...</h1>
<p>Or more exactly to Vulcainreo (Arnaud Courty), who develops an opensource IoT learning board. You can acquire it for less than 40€, which I did myself at <a href="https://grehack.fr">Grehack</a>, on the good advice of my awesome colleagues <a href="https://blog.ghozt.ninja/">ghozt</a> and <a href="https://shoxxdj.fr">shoxx</a>. <a href="http://dvid.eu">DVID</a> aims to fa...</p>
11
Sep
Cloning Mifare tags with a low budget in 2019
<img alt="" src="/images/2/d/a/c/0/2dac06127719ff87856ecd8c9fc3200080c1f922-badgeentree.jpg" />
<h1>TL;DR it was more tedious than expected</h1>
<p>As a proud owner of an ACR122U NFC reader, I periodically try to read the content of my own cards, out of interest. This device can only work on the 13.56 MHz and is fairly limited compared to a Proxmark3, but is much cheaper, which is also an important fact...</p>
26
May
Privilege escalation on OPNsense / pfSense, or why code review is necessary (CVE-2019-11816)
<img alt="" src="/images/5/3/b/4/8/53b4876d428a5665f0ea0ec1d796ff80d1f0f791-programming-18738541280.png" />
<h1>When pentests are not enough</h1>
<p>I am not a devoted adept of sytematic code reviews, and find that most of the time, penetration tests cover 80% of the vulnerabilities in a much shorter timeframe. Let's face it : usually, the return on investment is just much better. However, for complex pieces of sof...</p>
29
Aug
Setting up remote ZFS root filesystem decryption on Arch Linux
<img alt="" src="/images/5/7/2/2/b/5722b63efdb6c52b670a6aec680f37ff37a97532-pexels-photo-792031.jpeg" />
<h1>Apologies</h1>
<p>Dear readers, I apologize sincerely. This blog was supposed to be about security, however my first post will be related to system administration.
That said, let's get our hands dirty!</p>