update 20/01/2012 18:45 CET: Peter Hutterer, an X.org developer, posted an interesting article about this.
Hi,
I recently stumbled upon a funny bug^Wfeature in the Xorg server that could allow attackers with physical access to a machine to bypass the screensaver/screen locker program.
Most people use those programs to lock their computer when they are away. On Gnome, gnome-screensaver is responsible for this. On KDE, kscreenlocker is. There is a wide variety of smaller tools doing the same thing, e.g. slock, slimlock, i3lock...
All these tools work more or less the same way ...
It's fall again, and like every year, many CTF are happening in those few months.
Earlier this week I participated in the hack.lu CTF. A CTF organized by the FluxFingers team as a part
of the hack.lu conference in luxembourg. It was a pretty cool CTF with interesting challenges to solve.
I'm not going to do any writeup since there was really nothing interesting to say about the challenges I worked on.
You can always find writeups on the web if you're interested. There are a few on shell-storm.org.
I also participated in the ...
june 2011: This is an article I originally posted on the nibbles microblog on july 3rd 2010, but the blog went down (permanently ?) a few days ago so i decided to re-post it here. Thanks again to everyone who contributed to this article (real, myst and others).
Hello everyone !
Today, i'm going to talk about the latest PHP vulnerability discovered by Stefan Esser and published on the 25 of june. You can read the advisory here. Esser did not publish many informations regarding this new vulnerability because of its "dangerous nature", and probably the fact that it's still ...
Hello,
This writeup will cover a 300points web mission we solved during PlaidCTF 2011.
We had access to a simple guestbook with a form. We tried to trigger a bug unsuccessfully.
At first, we thought the vulnerability might be a flaw in csrf handling because of the advisory published last february.
The app was reacting strangely to the csrf cookie, (re)setting it multiple times, but then the organizers removed the csrf check altogether.
We were stuck at this point until a hint was given: django settings file contained a reference to a memcached server. We hadn't tried to ...
Hackito Ergo Sum 2011
Par
Gu1 le 12/04/2011 à 22:16
tags:
conference,
writeup.
Salut,
J'étais au Hackito Ergo Sum 2011 le week end dernier. Je n'avais pas eu l'opportunité d'écrire
d'article sur la précédente édition de cette conférence car mon blog était plus ou moins mort/fermé
donc je vais me rattraper en vous parlant du contenu de cette année.
Le niveau des talks était très bon et l'ambiance plus "cosmopolite" que certaines autres confs françaises.
Le programme est disponible par là. Tous les talks avaient l'air intéressants, même si j'en
ai manqué certains, notamment celui sur le DWARF, après être parti me mesurer au ...
