RandoriSec

[CONFERENCE] Pass the SALT 2026

Fri, 31 Jul 2026 07:00:00 +0000

This year again, RandoriSec was a sponsor of Pass the SALT, a small but high quality conference dedicated to free software and security.

[CONFERENCE] SSTIC 2026

Mon, 08 Jun 2026 12:00:00 +0000

For the 24th edition of the SSTIC conference, a team of seven persons from RandoriSec went to Rennes. As usual, the conference was pleasant, with nice technical talks. In this article, you can read a brief overview of the presentations we enjoyed the most. Thanks for the organizers and the speakers!

[CONFERENCE] OffensiveCon 2026

Fri, 05 Jun 2026 07:00:00 +0000

For the third time, we attended the famous OffensiveCon and, as usual, you can find a quick review of what we liked. We attended the talks and a quite demanding training and we also won the first place of a CTF: a ticket to OffensiveCon 2027. So see you next year OffensiveCon!

RandoriSec obtains PASSI qualification

Tue, 26 May 2026 09:00:00 +0000

RandoriSec has obtained the PASSI qualification from the ANSSI.

For more than ten years, RandoriSec has developed expertise in pentest and security audits across a wide range of environments and technologies. This qualification marks the culmination of several months of work by our teams. The PASSI qualification validates our audit and penetration testing methodology, as well as our organizational rigor, in accordance with ANSSI requirements.

France Cybersecurity Challenge 2026

Mon, 04 May 2026 16:00:00 +0000

The French National Cybersecurity Agency (ANSSI) has been organising the France Cybersecurity Challenge (FCSC) for several years now, a cybersecurity competition open to everyone. The France Cybersecurity Challenge (FCSC) offers young people aged 14 to 25 the chance to test their skills and compete in a wide variety of challenges designed by cybersecurity experts. The FCSC aims to select the best French players to take part in the European Cybersecurity Challenge (ECSC).

[CONFERENCE] GreHack 2025

Fri, 12 Dec 2025 11:00:00 +0000

Like last year, this year’s GreHack edition was split into two days, one for the conference and workshops and the other for the CTF.

[CONFERENCE] UYBHYS 2025

Wed, 10 Dec 2025 07:00:00 +0000

For another year, RandoriSec sponsored the most western cybersecurity event, organized in Brest, to participate in the 10th anniversary of the Unlock Your Brain, Harden Your System (UYBHYS) event. We attended the workshop “DFIR at the speed of a velociraptor” and the conferences the following day.

[CONFERENCE] Objective by the Sea 2025

Thu, 30 Oct 2025 12:00:00 +0000

This year, some of our researchers went to the Objective by the Sea (OBTS) conference which is focused on Apple related security.
As usual, you can find below a quick review of a workshop and of our favorite talks.

Stealing Microsoft Teams access tokens in 2025

Thu, 23 Oct 2025 08:00:00 +0000

From a red team’s perspective, it could be interesting to retrieve access tokens, as they allow the access of confidential information such as Teams chats, emails, SharePoint documents, etc. Moreover, access tokens can also be used to send emails or Teams messages on behalf of the user, which can be leveraged for lateral movement or social engineering attacks.

[CONFERENCE] Hexacon 2025

Wed, 22 Oct 2025 08:00:00 +0000

For the fourth time in a row, RandoriSec sponsored Hexacon, an offensive security event in Paris. Around ten researchers from RandoriSec attended the conference.

[CONFERENCE] RomHack Conference 2025

Tue, 21 Oct 2025 09:00:00 +0000

Our team recently attended the RomHack Conference 2025. In keeping with our tradition, we are pleased to share a review of our favorite presentations from the event.

[CONFERENCE] Pass the SALT 2025

Wed, 23 Jul 2025 07:00:00 +0000

For the fourth time in a row, we’ve followed Pass the SALT, a small but high quality, three days, conference dedicated to free software and security. This edition, that we sponsored, hosted 26 talks covering 9 Security topics (Secure Messaging, DFIR & TI, HW & Embedded, Network etc), but also 6 workshops with top-notch speakers (and attendees of course).

[CONFERENCE] OffensiveCon 2025

Tue, 27 May 2025 10:00:00 +0000

For the second time, we attended the legendary OffensiveCon — top-tier talks, flawless organization, and unforgettable parties. Huge thanks to the organizers; it truly lives up to the hype! You can find a quick review of what we liked the most.

[CONFERENCE] Off-By-One 2025

Mon, 19 May 2025 07:00:00 +0000

For the second edition of Off-By-One, RandoriSec went to Singapore and attended this nice and welcoming conference. Thanks to all those involved in making this great event!

Code execution and SQL injection vulnerabilities in Siemens OZW web servers

Tue, 13 May 2025 14:00:00 +0000

TL; DR

During a penetration test engagement, RandoriSec came across a Siemens OZW772 [0] device exposed on the Internet and decided to study its custom HTTP component. Two critical vulnerabilities were discovered by our team [1], affecting old versions of the firmware:

Recent modifications in FortiGate firmware crypto

Fri, 21 Feb 2025 15:00:00 +0000

Introduction

FortiGate firewalls are first-choice targets for attackers; these devices are widely deployed by companies and are often Internet-facing to provide services such as VPN access. Recent years have shown many critical vulnerabilities affecting this solution, some of them (e.g. CVE-2024-21762, CVE-2023-27997) allowing pre-authentication remote code execution (RCE).

[CONFERENCE] GreHack 2024

Mon, 09 Dec 2024 18:00:00 +0000

This year the GreHack edition was splitted on two days. The first day was related to the conference and the workshops and the second day was dedicated to the CTF. Same as last year, RandoriSec was a proud sponsor of the GreHack conference. Several RandoriSec consultants attended the conference.

[CTF] GreHack 2024 - Babycaller challenge

Mon, 09 Dec 2024 18:00:00 +0000

Here is a writeup of a challenge I have written for Grehack 2024.

Challenge task

Yet another baby challenge…

Provided files

[CTF] ECW CTF 2024 - Windows challenge write-up

Thu, 14 Nov 2024 08:00:00 +0000

Every year, during European Cyber Week (ECW), a preselection phase is organized to qualify for the ECW Capture the Flag (CTF) finals held in Rennes on November 20th this year. Players compete in challenges in the crypto, reverse, pwn, forensics, web and misc categories.

[CONFERENCE] Hexacon 2024

Thu, 10 Oct 2024 12:00:00 +0000

For the third time in a row, RandoriSec sponsored Hexacon, an offensive security event in Paris. A team of a dozen people from RandoriSec attended trainings, workshops and the talks. As usual, you can find a quick review of what we liked the most.

[CONFERENCE] Pass the SALT 2024

Mon, 15 Jul 2024 09:00:00 +0000

For the third time in a row, we’ve followed Pass the SALT, a small but high quality, three days, conference dedicated to free software and security. This edition, that we sponsored, gave 21 talks but also 9 workshops with top-notch speakers (and attendees of course). Here are all the slides and videos of the talks and rumps. And as usual, you can find a quick review of our favourite talks.

[CONFERENCE] WarCon 2024

Mon, 17 Jun 2024 07:00:00 +0000

Earlier in June, we managed to attend WarCon. The place was outstanding in terms of style, yet a little overflowing with the success for attendance. Anyway, TVs were showing slides with audio in a room nearby with chairs and sofas. The organization was great, a big thanks to antisnatchor and h0wl for their work. The event is really cosy and small enough to have a chance to discuss with everyone. Talks are short, so it is easier for attention, and less waiting if the topic is none of your interest; the speakers are really accessible if you want to follow up.

[CTF] Sthack 2024 - WU

Tue, 04 Jun 2024 10:00:00 +0000

Cette année la conférence Sthack a une saveur toute particulière pour nous.

Depuis plusieurs années nous participons avec plaisir à cette conférence qui est devenu un évènement incontournable et un lieu d’échanges et de rencontres précieuses.

[CONFERENCE] Offensive Security Conference 2024

Mon, 13 May 2024 08:00:00 +0000

Earlier in May we had the opportunity to attend to the famous OffensiveCon. To put it simply: it was amazing. The talks were incredible and they covered a wide variety of technical topics. All content was clean and well presented. The organization was great, with great food, and most important: great parties with fancy cocktails in really cool places. All the legends are true, this the best conference in Europe. We cannot wait for next year. Thanks a lot to the organizers of OffensiveCon for such an event.

[CONFERENCE] CoRIIN 2024

Fri, 03 May 2024 08:00:00 +0000

CoRIIN is a French cybersecurity conference and its name means: “Conférence sur la réponse aux incidents & l’investigation numérique”, which can be translated by Incident Response & Digital Forensics Conference. Even if we’ve attended CoRIIN since a few years, it’s the first time that we write a blogpost about it.

[PUBLICATION] Operation triangulation - Keychain module analysis

Wed, 07 Feb 2024 20:00:00 +0000

Our first blogpost of the year is about our analysis of the Operation triangulation spyware. We’ve digged into the keychain module of the spyware and detailed the iOS keychain internals. You can find it here.

[NEWS] Introducing Shindan, your automated smartphone and tablet security analysis solution

Wed, 31 Jan 2024 14:00:00 +0000

An important milestone has been reached at RandoriSec!

Since 2015,we’ve been offering our expertise as cybersecurity consulting services and today we’re launching our first software solution: Shindan

[CONFERENCE] GreHack 2023

Thu, 23 Nov 2023 18:00:00 +0000

This year again we were a sponsor of the GreHack conference. Several consultants from RandoriSec attended the conference. As usual, you can find a quick review of our favorite talks.

[CTF] ECW CTF 2023 - Pwn challenges write-ups

Wed, 08 Nov 2023 08:00:00 +0000

Every year, during European Cyber Week (ECW), a two-week preselection phase is organized to qualify for the ECW Capture the Flag (CTF) finals held in Rennes on November 22 this year. Players compete in challenges from various categories such as: crypto, reverse, pwn, forensics, web and misc. There were five challenges in the pwn category, four of which were developed by the Thalium team. The challenges covered a wide range of topics, including exploiting a game on a Gameboy or taking advantage of a faulty shadow stack implementation. Our security researcher, Express, finished at the first position in the qualifying phase of both the general and student scoreboard. He is the only person to have successfully solved all the pwn challenges and will therefore present the solutions to the Thalium team’s created challenges.

[CONFERENCE] Hexacon 2023

Fri, 20 Oct 2023 07:00:00 +0000

This year again we were a sponsor of Hexacon, the hot new offensive security conference based in Paris. This time four security researchers from the team attended awesome trainings and after that seven consultants from RandoriSec went to the second edition of Hexacon conference. As usual, you can find a quick review of our favorite talks.

Multiple vulnerabilities on Chamilo 1.11.18

Sat, 01 Jul 2023 10:00:00 +0000

Abstract

Chamilo is an e-learning platform, also called Learning Management Systems (LMS). It has been used by more than 30M people worldwide since its inception in 2010. As an LMS, it offers an integrated platform for the administration, documentation, tracking, reporting, and delivery of educational courses, training programs, or learning and development programs. In essence, it provides a digital framework that accommodates various aspects of the learning process, and as such, it plays a vital role in numerous educational and corporate environments.

[CONFERENCE] SSTIC 2023

Wed, 14 Jun 2023 20:00:00 +0000

For the 21st edition of the SSTIC, RandoriSec was represented by 9 people. As usual now, the conference took place at Couvent des Jacobins, in Rennes, from 7 to 9 June 2023.

[CTF] ECW CTF 2022 - Reverse challenges writeup

Fri, 18 Nov 2022 08:00:00 +0000

During the European Cyber Week (ECW), a Capture the Flag (CTF) was organised on November 16th at Rennes in France. A preselection took place from October 14, 2022 to October 30, 2022. Our security researcher Express got to the final round and wrote some write-ups for the reverse-engineering category. The challenges were created by the Thalium team and were interesting to solve.

[CONFERENCE] BSides Lisbon 2022

Tue, 15 Nov 2022 16:00:00 +0000

Finally, the BSides Lisbon conference came back in 2022! The last edition was 3 years ago in 2019! The conference took place on the 10th and 11th November. One day and half of conferences, workshops and a Capture the Flag (CTF).

[CONFERENCE] UYBHYS 2022

Tue, 08 Nov 2022 17:00:00 +0000

RandoriSec was proud to sponsor this year’s edition of Unlock Your Brain, Harden Your System. A security conference that took place on November 4th and 5th 2022 at Brest, France. We have attended the 5-hour workshop on Mobile Reverse Engineering with r2frida, and the conference on the following day.

[CONFERENCE] Hexacon 2022

Thu, 20 Oct 2022 08:00:00 +0000

When Synacktiv contacted us to become a sponsor of a new offensive security conference based in Paris, we quickly agreed with a big YES! A week after the event we can say that it was the right decision to take: the conference was amazing!!!

[CVE-2022-34918] A crack in the Linux firewall

Wed, 20 Jul 2022 09:00:00 +0000

In our previous article Yet another bug into Netfilter, I presented a vulnerability found within the netfilter subsystem of the Linux kernel. During my investigation, I found a weird comparison that does not fully protect a copy within a buffer. It led to a heap buffer overflow that was exploited to obtain root privileges on Ubuntu 22.04.

[CONFERENCE] Pass the SALT 2022

Fri, 15 Jul 2022 09:00:00 +0000

Pass the SALT est une conférence combinant deux domaines : la sécurité informatique et le logiciel libre. La première édition a vu le jour en 2018, et après deux années en mode online, l’évènement revient sur site à Polytech Lille en 2022. Les conférences sont gratuites et anglophones.

Yet another bug into Netfilter

Mon, 13 Jun 2022 07:00:00 +0000

This year, I have done my end-of-study internship at Randorisec, the original purpose of my internship was to study different ways of doing variant analysis on open-sources project but also on closed-source software solutions. The Linux kernel is an attractive target, and so it was chosen as the target of my project. I started scouting for publicly disclosed bugs which could lead to interesting variant patterns. Since the beginning of the year, several bugs have been found and fixed within the kernel component netfilter, such has CVE 2022-1015. In this article, I am going to talk about two bugs I’ve found inside the netfilter kernel section. One of them lead to information leakage, and potentially to a fully functional local privilege escalation (LPE) exploit.

[CONFERENCE] SSTIC 2022

Fri, 10 Jun 2022 13:00:00 +0000

A few people from RandoriSec went in Rennes for the 20 years of SSTIC! As usual now, the conference took place at Couvent des Jacobins from 1 to 3 June 2022. Here is a quick review of the talks that interested us.

[CONFERENCE] Insomni'hack 2022

Fri, 08 Apr 2022 11:00:00 +0000

On this year 2022, some of us have participated to the Insomni’hack conference in Geneva (March 24th & 25th). We were very happy to meet again the infosec community IRL :) Here is a quick review of the talks that interested us.

[NEWS] Hello 2022!!!

Tue, 11 Jan 2022 14:00:00 +0000

We would like to wish you a happy new year 2022! We hope you’re doing well regarding the current situation.

[CTF] Sthack 2021 - Write-up Troll Game (PNG Analyzer)

Thu, 21 Oct 2021 15:00:00 +0000

Voici un compte-rendu du premier challenge de pwn proposé par l’édition 2021 du CTF de la Sthack à Bordeaux. C’est un challenge créé par ghozt et phenol. La particularité de ce challenge est de débuter par une partie web avant d’enchainer sur une partie pwn classique.

[CONFERENCE] Sthack 2021

Wed, 20 Oct 2021 14:00:00 +0000

Depuis 2011, la Sthack est une conférence de sécurité informatique se tenant annuellement à Bordeaux.

D’un simple CTF organisé par des étudiants, elle est devenue au fil des années une conférence accueillant plusieurs présentations tout le long d’une journée. Le CTF est toujours présent et se déroule la nuit qui suit les conférences. Ce cru 2021 a permis également de fêter les 10 ans de la Sthack. Cette année, RandoriSec était sponsor de l’évènement et plusieurs consultants sont venus suivre les conférences et participer au CTF (un billet de blog est en cours de préparation).

[PUBLICATION] Mobile Hacking CheatSheet

Wed, 25 Aug 2021 14:00:00 +0000

Last year, after noticing that no serious cheatsheet about mobile security was around, we’ve published a first attempt to summarise a few interesting basics info regarding tools and commands needed to assess the security of Android and iOS mobile applications.

UDP Technology IP Camera vulnerabilities

Thu, 08 Jul 2021 09:00:00 +0000

At Randorisec, we have been looking at UDP Technology IP Camera firmwares for a long time now.

UDP Technology is providing a firmware for many IP Camera vendors such as:

[TRAINING] Mobile Hacking Online - June 2021

Wed, 07 Apr 2021 14:00:00 +0000

We are pleased to announce that we are going to give a new session of our Mobile Hacking training in an online form!.

[WORKSHOP] BSides Dublin 2021 - Android/iOS Mobile Hacking Workshop

Tue, 30 Mar 2021 07:00:00 +0000

This year, RandoriSec had the chance to deliver a mobile hacking workshop at BSides Dublin. The first two hours of the workshop were dedicated to Android and was delivered by Guillaume Lopes. Then, the second part was focused on iOS and was presented by Davy Douhine.

Setting-up Mobexler with VMWare and Android Studio

Tue, 16 Mar 2021 17:00:00 +0000

Mobexler

Mobexler is a customized virtual machine containing several preinstalled tools such as Android Studio, JADX, apktool and Frida. Its goal is to help pentesters or security researchers to perform security audits on Android and iOS applications with a ready-to-go environment. This virtual machine was designed and published by Enciphers

Donations for OSS

Mon, 18 Jan 2021 08:00:00 +0000

We’ve not been able to sponsor security conferences in 2020 so we’ve decided to donate 10 x 250 EUR/USD to foundations and open source projects. After asking our consultants and on Twitter we’ve received many suggestions. Helping the security community and open source projects is important as without this community and without many open sources tools/documentation we would be unable to do our daily work. If you also want to give a little something you can find here the shorlist we’ve selected with a link for each to donate (if it exists):

Formations Mobile Hacking 2020

Thu, 08 Oct 2020 08:00:00 +0000

Nous intervenons régulièrement lors des conférences internationales et donc en anglais mais nous ne délaissons pas non plus les passionnés français et francophones.

Trainings 2020 - Schedule update

Wed, 07 Oct 2020 10:00:00 +0000

We’re glad to announce that our Mobile Hacking course and workshop will be delivered in a many different infosec conferences in the following weeks: virtually and in english for OWASP AppSec Israel and HITB CyberWeek, in real life but in french for another infosec conference and, also a French school but we’ll make another post for that.

[Publication] Return Oriented Programming 101

Tue, 06 Oct 2020 09:00:00 +0000

Exploiter un débordement de tampon sur la pile, sans protection, ça n’est pas très compliqué. Mais qu’en est-il avec la protection NX/DEP ?

HID ActivID Mobile Soft Token Vulnerabilities

Tue, 01 Sep 2020 08:00:00 +0000

Abstract

Nowadays mobile phones are widely used to enforce multi-factor authentication (MFA) either by receiving a code through SMS or, even better, using a dedicated application as an authenticator. Those applications have to be correctly secured because the final step of authentication will rely on them.

[s05e01] RCE on Geutebruck IP Cameras

Fri, 07 Aug 2020 09:00:00 +0000

Abstract

Those who follow our blog know that we like Geutebruck cameras: we found many trivial RCE on their products since 2016.

[Publication] Contournement de l'API Google Play Billing

Mon, 13 Jul 2020 09:00:00 +0000

L’article concernant le contournement de l’API Google Play Billing vient d’être mis à disposition par les éditions Diamond sous licence Creative Commons (BY-NC-ND). Vous pouvez retrouver également dans ce billet de blog la retranscription de l’article paru dans MISC106. Bonne lecture !

[CONFERENCE] RandoriSec and friends: Enlarge your toolkit!

Wed, 10 Jun 2020 10:00:00 +0000

Two months ago, we organized a small free online security conference. During this event, 6 talks covering different areas (mobile security, SWIFT CSP, security automation and Incident Response) were delivered. The talks are available in our Youtube channel. The event went pretty well with an average of 30 participants but unfortunately for non french speaking people it was in french…

[WORKSHOPS] BSides Budapest 2020 - Android and iOS workshops online

Fri, 29 May 2020 14:00:00 +0000

Last year, at BSides Budapest, we delivered a workshop about Mobile Hacking on Android and iOS.

The idea, we had at this time, was to give a very short introduction of our 3 days training about Mobile Hacking. Note: This training was already delivered at Hack In Paris (2019), at DeepSec (2018 and 2019) and also online (2020). However, we noticed that 2 hours are too short to be able to introduce different concepts in Android and iOS mobile apps…

[TRAINING] Mobile Hacking

Mon, 27 Apr 2020 15:00:00 +0000

Security conferences are an excellent way to access top-notch quality trainings but with all this actual mess they are cancelled or postponed. However, life keeps going and we still need to train in order to improve our skills.

[CONFERENCE] Conférence en ligne - RandoriSec and friends

Mon, 06 Apr 2020 12:00:00 +0000

Toutes les conférences des semaines passées et à venir étant annulées, nous organisons une conférence en français et en ligne autour de trois thèmes :

Trainings 2020 and COVID-19

Thu, 26 Mar 2020 10:00:00 +0000

Hello everyone! We hope everything is going well with you regarding the current situation.

As you already may notice, many infosec events were cancelled or postponed. In our case, we are not going to be able to deliver our Mobile Hacking course in the following events:

Trainings 2020 - Schedule

Thu, 30 Jan 2020 10:00:00 +0000

First of all, we would like to wish you a happy new year 2020! Wishing you all the best. We have some exciting news regarding our training schedule for this year. Our Mobile Hacking course will be delivered in 3 different infosec conferences! If you want to have a preview of the covered subjects, we are going to tweet #mobile #hacking #tips in February.

[CONFERENCE] HACK-IT-N

Thu, 12 Dec 2019 09:00:00 +0000

HACK-IT-N, organisée par TEHTRIS et l’ENSEIRB-MATMECA, est une conférence française annuelle qui aborde la sécurité informatique sous les aspects techniques, organisationnels et également sociétaux. L’édition 2019 a eu lieu mardi 10 décembre 2019 à Bordeaux dans les locaux de l’école d’ingénieurs.

[CONFERENCE] SIGSEGV2

Thu, 05 Dec 2019 09:00:00 +0000

L’événement SIGSEGv2, organisé par l’association [Read The Fancy Manual (RTFM)] (https://rtfm.re) est une conférence française annuelle sur le thème de la sécurité informatique dont le mot d’ordre est de “promouvoir la pratique du hacking sous toutes ses formes”. Cette deuxième édition, pour laquelle Randorisec était sponsor, a eu lieu le samedi 30 novembre 2019 dans les locaux d’Epitech Paris.

[Training/Conference] DeepSec 2019

Mon, 02 Dec 2019 17:30:00 +0000

Training

During the DeepSec event, we gave our Mobile Hacking training (this training was also provided at Hack In Paris).

This training presented the toolset needed when assessing mobile applications (such as adb, Apktool, Jadx, Androguard, Cycript, Frida, Needle and MobSF) and, also, the techniques to help you to work faster and in a more efficient way in the mobile ecosystem. This 2-days training focused on Android and iOS applications. The main topics of the training were:

[SWIFT] Customer Security Programme

Thu, 14 Nov 2019 09:00:00 +0000

Since 2017 and as a result of the Bangladesh Bank cyber heist, SWIFT established a Customer Security Programme which describes a set of mandatory and advisory security controls for participants. All customers need to re-attest and confirm full compliance with the mandatory security controls. As stated by SWIFT’s CEO in May 2016:

[CONFERENCE] CERT-EU 2019 ANNUAL CONFERENCE

Fri, 08 Nov 2019 15:00:00 +0000

RandoriSec was at CERT-EU 2019 Annual Conference. It was our first time attending this conference and probably not the last one as the speakers line-up was impressive ! We cannot share details like we used to do as it was a closed, invitation-only event and many talks had a TLP GREEN, AMBER or even RED but we can give you the agenda excluding for the TLP AMBER and RED talks.

[PUBLICATION] Éprouver la sécurité des applications mobiles

Wed, 30 Oct 2019 08:00:00 +0000

Guillaume et moi-même avons écrit trois articles sur la sécurité des applications mobiles (tout le dossier en fait ;), qui ont été publiés dans le magazine MISC106 de novembre/décembre :

[Conference] Hack.Lu 2019

Mon, 28 Oct 2019 22:30:00 +0000

RandoriSec was at Hack.lu for its 15th edition and as you can imagine it was super interesting.

In addition this year, RandoriSec sponsored the CTF!

Moxa EDR-810 Command Injection and Logs disclosure

Mon, 21 Oct 2019 15:30:00 +0000

Abstract

During an engagement for a client, RandoriSec found 2 vulnerabilities on Moxa EDR-810 Series Secure Routers. The first one is a command injection vulnerability found on the CLI allowing an authenticated user to obtain root privileges. And the other one is an improper access control found on the web server allowing to retrieve log files.

[Publication] Le réel danger des biais cognitifs en cybersécurité

Tue, 15 Oct 2019 08:00:00 +0000

Dans le MISC Hors série n° 20 (octobre / novembre 2019), vous trouverez un article de votre serviteur sur les biais cognitifs et leur importance dans le traitement de la sécurité, en particulier dans les contextes de gestion d’incident majeur ou de crise (l’article reprend la trame de ma master class au FIC 2019).

[Training/Conference] DeepSec 2019 - Mobile Hacking / Abusing Google Play Billing

Tue, 27 Aug 2019 09:00:00 +0000

RandoriSec is going back to DeepSec (Vienna, Austria) this year.

Guillaume Lopes will give a talk about abusing the Google Play Billing API and he’ll give a training with Davy Douhine.

[Training/Conference] Hack In Paris 2019

Tue, 09 Jul 2019 09:46:28 +0000

RandoriSec was at Hack In Paris 2019 and it was wonderful! This 9th edition took place at Maison de la Chimie in Paris (of course;)).

[s04e01] RCE on Geutebruck IP Cameras

Tue, 04 Jun 2019 12:30:34 +0000

Abstract

Those who follow our blog know that we like Geutebruck cameras: we found many trivial RCE on their products since 2016.

[Conference] HITB Amsterdam 2019

Wed, 15 May 2019 12:30:34 +0000

Again, RandoriSec was at Hack In The Box for the 2019 edition in Amsterdam! It was really great!

The first 3 days of the event are dedicated for the trainings. About that, we heard that the training from Nicolas Grégoire (aka @Agarri) was really great and got very good feedback from the attendees. If you want to improve your skills on Burp Suite Pro, you should attend this training.

[Conference] CLUSIF - Gestion des incidents de sécurité : résilience et amélioration

Fri, 26 Apr 2019 10:10:58 +0000

La semaine dernière j’ai participé à la table ronde de la conférence du CLUSIF “Gestion des incidents de sécurité : résilience et amélioration.”

[Publication] Outils (open-source et gratuits) pour l’audit d’intrusions d’applications web

Sun, 14 Apr 2019 11:22:20 +0000

Nous avons écrit un article sur les outils open-source et gratuits pour l’audit d’intrusions d’applications web qui a été publié dans le hors-série n.97 du magazine Linux Magazine sur “Les bonnes pratiques du développement sécurisé” publié l’été dernier. Le magazine vient d’ailleurs d’être réédité. Nous avions opté pour une licence CC dans le but de mettre l’article à disposition de tout le monde dès l’expiration des droits d’auteur. C’est chose faite !

[Conference] BSides Dublin 2019 – Abusing Google Play Billing for fun and unlimited credits!

Wed, 27 Mar 2019 08:20:10 +0000

The March 23th, Guillaume Lopes gave a talk at BSides Dublin about how to bypass the payment on Google Play Billing API.

[PrivExchange] From user to domain admin in less than 60sec !

Mon, 28 Jan 2019 23:15:38 +0000

Dirk-jan Mollema, a pentester working for Foxit, found a very clever attack allowing any user, owning an Exchange mailbox, to obtain Domain Admin privileges.

[Training/Conference] HIP – Mobile Hacking Training (17/18 June)

Mon, 21 Jan 2019 09:46:28 +0000

Guillaume Lopes (@Guillaume_Lopes) and Davy Douhine (@ddouhine), senior pentesters, will share many techniques, tips and tricks to deliver to pentesters, bug bounty researchers or just curious a 100% hands-on 2 days mobile training. Goal is to introduce tools (Adb, Apktool, Jadx, Cycript, Frida, Hopper, Needle, etc.) and techniques to help you to work faster and in a more efficient way in the mobile (Android and iOS) ecosystem. This is the exact training that you would have liked to have before wasting your precious time trying and failing while testing.

Client side validation strikes again: PIN code bypass !

Sat, 22 Dec 2018 18:17:05 +0000

Client side validation

Client side validation is a common weakness found during penetration tests and security audits performed by Randorisec.

[s03e01] RCE on Geutebruck IP Cameras

Tue, 18 Dec 2018 11:31:42 +0000

Abstract

A few weeks ago we came across high-end IP cameras made by Geutebruck, a “leading German manufacturer and developer of high-quality, intelligent video security solutions” and found a RCE affecting version 1.12.0.24 and prior versions of E2 series IP cameras.

Get Freebies by Abusing the Android InApp Billing API

Tue, 11 Dec 2018 21:54:59 +0000

As Google defines it

Google Play Billing is a service that lets you sell digital content from inside an Android app, or in-app.

[Training/Conference] DeepSec – Advanced Penetration Testing in Real World (27/28 November)

Mon, 03 Sep 2018 07:30:58 +0000

RandoriSec is going to provide a training at DeepSec (Vienna, Austria) the 27 and 28 November.

The training Advanced Penetration Testing in Real World is intended for penetration testers and security engineers who would like to improve their penetration testing skills or even to learn how to perform penetration tests from scratch (for motivated people).

[Training/Conférence] Hackfest 2018 - iOS Mobile Application Hacking

Sat, 01 Sep 2018 12:30:23 +0000

Nous sommes très heureux d’annoncer que la formation “iOS Mobile Application Hacking” sera donnée en français à Québec au Canada pour la 10e édition de la conférence Hackfest !

[Conference] SSTIC 2018

Tue, 19 Jun 2018 15:20:02 +0000

RandoriSec was at the SSTIC conference in Rennes, France. SSTIC (Symposium sur la sécurité des technologies de l’information et des communications in French) is an old security conference which started in 2003 and the majority of the presentations are in French! This year it was the 16th (0x10) edition occurring at the Couvent des Jacobins, an old convent.

[Conference] HITB Amsterdam 2018

Thu, 24 May 2018 11:23:34 +0000

RandoriSec was at the Amsterdam 2018 edition of Hack In The Box and… IT WAS A BLAST !

It has been over a month and many tweets, write-ups and even the full slides (https://conference.hitb.org/hitbsecconf2018ams/materials/) have been published so we won’t cover details here but we just wanted to say a few words about it.

[0day] Anonymous RCE on Geutebruck IP Cameras - again

Tue, 20 Mar 2018 21:12:15 +0000

Abstract

A few months ago during a pentest, with Nicolas Mattiocco of Greenlock, we came across high-end IP cameras made by Geutebruck, a “leading German manufacturer and developer of high-quality, intelligent video security solutions” and found 3 RCE: a blind SQL Injection, a SSRF, a CSRF and a stored XSS affecting version 1.12.0.4 and prior versions. We’ve choose to “responsible disclose” these 0day vulnerabilities, directly to Geutebruck and the ICS-CERT (Industrial Control Systems Cyber Emergency Response Team). Since then a new firmware has been released (1.12.0.19) to fix that, ICS-CERT has released an advisory and 6 CVE (CVE-2018-7532 - CVE-2018-7528 - CVE-2018-7524 - CVE-2018-7520 - CVE-2018-7516 - CVE-2018-7512) have been assigned.

[Training] iOS Mobile Application Hacking

Tue, 16 Jan 2018 13:42:16 +0000

L’offre de formation de RandoriSec est enrichie d’un nouveau module de 2j pour apprendre à auditer la sécurité des applications mobiles iOS.

[0day] Digium Asterisk OS Command Injection Vulnerability

Wed, 06 Dec 2017 21:56:05 +0000

Abstract

Last summer during a pentest for a client we came across a product made by an international provider of intercom systems which uses the very popular Asterisk communication software and found a trivial remote command execution vulnerability in its latest GUI (2.1.0).

[Conference] Industrial Hacking at DeepINTEL

Mon, 18 Sep 2017 16:48:36 +0000

We will be speaking about Industrial Hacking at DeepINTEL in Vienna this week!

Here is the pitch:

A few months ago a client asked us to assess the security of the ICS (Industrial Control Systems) of a brand new datacenter. As we were no industrial guys we discovered a whole new world and we tried and failed many times before owning the system. ”Industrial DIY“ tries to show how a small team of pentesters managed to assess the security of industrial systems (ICS/SCADA/BMS) and how to protect these critical infrastructures against a few major threats.

[0day] LogicalDOC - from guest to root

Fri, 28 Jul 2017 22:03:54 +0000

LogicalDOC is a DMS (Document Management System) available either in a community (and free) edition, or in a professional (and expensive) version. This type of product is normally used to share and access doc from « everywhere » as they say on their website: « Your documents – Always accessible, from anywhere, at any time » which means web interfaces widely open on the internet.

[Publication] Auditer les applications iOS avec Needle

Tue, 25 Apr 2017 10:24:07 +0000

Nous avons écrit un article sur Needle, un outil permettant d’auditer la sécurité des applications iOS, qui a été publié dans le magazine MISC de mai/juin 2017. Nous avions opté pour une licence CC dans le but de mettre l’article à disposition de tout le monde dès l’expiration des droits d’auteur. Il est maintenant accessible gratuitement.

TheHive pentest

Thu, 20 Apr 2017 19:57:36 +0000

Do you know TheHive and Cortex?

TheHive is a free and open-source security incident response platform which relies on Cortex to analyze observables (IP, email addresses, domain names, etc…).

[0day] Bull/IBM AIX Clusterwatch/Watchware vulnerabilities

Tue, 07 Mar 2017 17:26:37 +0000

Bull/IBM Clusterwatch/Watchware is a VERY VERY OLD tool used by sysadmins to manage their AIX clusters.

Marble effect in the web banner and questionable font: it smells the 90s !

[0day] Anonymous RCE on Geutebruck IP Cameras

Wed, 15 Feb 2017 10:49:30 +0000

Abstract

Last summer during a pentest for a client we came across high-end IP cameras made by Geutebruck, a “leading German manufacturer and developer of high-quality, intelligent video security solutions” (source: [http://www.sourcesecurity.com/companies/enhanced-company-listing/geutebruck-gmbh.html] (http://www.sourcesecurity.com/companies/enhanced-company-listing/geutebruck-gmbh.html)) and found a trivial remote command execution vulnerability (0day) affecting version 1.11.0.12 and prior versions. We’ve choose to “responsible disclose” it, directly to Geutebruck and the ICS-CERT (Industrial Control Systems Cyber Emergency Response Team). Probably the best option as the Mirai botnet was actively exploiting IP cams at that time. Since then a new firmware has been released (1.11.0.12) to patch that, ICS-CERT has released an advisory and a CVE (CVE-2017-5173) has been assigned.

[0day] Authentication Bypass on Belden Hirschmann GECKO switches

Thu, 02 Feb 2017 13:54:20 +0000

Abstract

Last summer during a pentest for a client we came across industrial switches made by Hirschmann: a Belden Brand, (which) provides the industry with leading Ethernet networking technology and sets the industrial networking standards for quality, reliability and service. (Source: http://www.belden.com/aboutbelden/brands/Hirschmann.cfm ) and found a few unknown vulnerabilities (0day) affecting version 2.0.00 and prior versions. We’ve choose to “responsible disclose” them, directly to Hirschmann and the ICS-CERT (Industrial Control Systems Cyber Emergency Response Team). Since then a new firmware has been released (2.0.01) to patch one of them (the most critical). ICS-CERT has released an advisory and a CVE (CVE-2017-5163) has been assigned.

[Formation] Pentest 101

Tue, 30 Aug 2016 10:13:54 +0000

Randori propose une formation pour découvrir les tests d’intrusion en 3 jours.

Vous voulez réaliser vous-même des tests d’intrusion simples, mieux comprendre les résultats d’audits et de tests de sécurité, vérifier la bonne correction des vulnérabilités ?

[Publication] Les réseaux: toujours sujets à des attaques

Fri, 13 May 2016 17:49:49 +0000

Nous avons co-écrit (avec Nicolas Mattiocco de Green Lock Advisory) un article sur les attaques réseaux qui a été publié dans le magazine MISC de mai/juin 2016. Nous avions opté pour une licence CC dans le but de mettre l’article à disposition de tout le monde dès l’expiration des droits d’auteur. Il est maintenant accessible gratuitement. Il fait partie d’un dossier fort intéressant sur les tests d’intrusion internes dont nous recommandons chaudement la lecture.

Slack session hijacking

Sun, 10 Apr 2016 09:03:28 +0000

[UPDATE]

An excellent article about the same issue has been posted by Detectify a few day after this one.

Unfortunately Detectify was not aware of our post

A few tips on Burp Suite and web application penetration testing

Thu, 31 Mar 2016 16:54:34 +0000

No need to introduce the incredible Burp Suite, THE ultimate tool for web pentests. 12 years ago the first version was born:

Word 2003 XML: another trick to bypass anti-virus

Thu, 21 Jan 2016 17:21:08 +0000

One year ago we found that using the Word 2003 XML format could by very usefull for pentesters/redteamers/attackers as a standard VBA meterpreter payload was scoring 1/57 on VT (instead of 20/57 using the Office OpenXML format). AV vendors made their homeworks, VT score is now 14/54

[Hack] Metasploit: stageless meterpreter

Mon, 06 Jul 2015 17:24:44 +0000

For those who missed that, stageless meterpreter now works with user proxy settings and that rocks ! Why ?

Standard delivery of payloads with metasploit uses a (small) stager that connects to metasploit handler to download and execute the stage (the final payload). It works most of the time but when you try to establish a meterpreter session through a web proxy with anti-malware inspection and/or a restrictive configuration (e.g: do not allow Portable Executable download) it fails because the proxy blocks the download of the stage (which contains metsrv, stdapi and priv libraries). Annoying when your target is on a local network and has a single way out: the corporate proxy. In this case, stageless aka single aka inline is the way to go ! It contains everything to start a session but enough talking, let’s make one.

[Publication] Ramonage de vulns avec mona.py

Tue, 16 Jun 2015 10:21:29 +0000

Nous avons rédigé un article sur mona.py qui a été publié dans le magazine MISC de mai/juin 2015. Nous avions opté pour une licence CC dans le but de mettre l’article à disposition de tout le monde dès l’expiration des droits d’auteur. Il est maintenant accessible gratuitement.

[Publication] Contribuer à Metasploit : guide du débutant

Wed, 27 May 2015 09:36:51 +0000

Nous avons rédigé un article sur Metasploit qui a été publié dans le magazine MISC en fin d’année 2014. Nous avions opté pour une licence CC dans le but de mettre l’article à disposition de tout le monde dès l’expiration des droits d’auteur. Il est maintenant accessible gratuitement.

Bypass AV with XMHELL

Mon, 09 Mar 2015 22:22:02 +0000

Update (2015-07-07)

6 months after submitting our first Word 2003 XML payload on VT, the file now scores 9/53… Still not enough.

RandoriSec

Wed, 31 Dec 2014 10:15:46 +0000

Here at RandoriSec we like hacking and fixing all the things and as we highly promote information sharing we will use this blog to publish our researchs and findings.

Publications

Mon, 01 Jan 0001 00:00:00 +0000

Reports

RandoriSec aims to provide help on some Open Source projects and performed pro-bono security assessments.

In 2017, we performed a security review of The Hive solution. The report can be found below: