xanhacks @xanhacks

infosec @HeroCTF @flag4jobs xanhacks.xyz 🇫🇷 Joined August 2016

Tweets

4K
Followers

1K
Following

621
Likes

15K

xanhacks @xanhacks

6 days ago

I made a new challenge where you need to steal the admin password by: 🪲Chaining multiple design flaws in a Java RMI app 🔒Exploiting a crypto misconfiguration

Flag4jobs @flag4jobs

6 days ago

I made a new challenge where you need to steal the admin password by: 🪲Chaining multiple design flaws in a Java RMI app 🔒Exploiting a crypto misconfiguration

1 0 1 530 0

Download Image

0 0 9 487 1

HeroCTF @HeroCTF

6 days ago

🔥HeroCTF v7 is back at the end of November! 🚩You can now register your team on CTFtime 🔗 ctftime.org/event/2869 More information to come soon.

1 11 27 1K 4

Download Gif

Suraj @PwnFunction

2 months ago

new post! How Docker Works Internally pwnfunction.com/$/docker-inter…

3 54 282 19K 233

Download Image

The part about the 0day I used on the TrackDb web challenge for the FCSC2025 has just been disclosed in the writeup, you can read it here: worty.fr/post/writeups/… Please note that this vulnerability is not patched (see the end of the writeup for explanations).

Worty @_Worty

4 months ago

13 24 149 16K 34

Download Image

0 24 87 10K 23

Mrinal @Hi_Mrinal

2 months ago

Wrote a blog on vector database 101, link in the comments :)

18 72 592 31K 595

Download Image

Sicarius @ElS1carius

2 months ago

There we go, after 3 years of work, endless nights of dev and a truckload of coffee. We are finally releasing the biggest project we've done in our entire life. I hope you will like it !

Profundis.io @profundisio

2 months ago

There we go, after 3 years of work, endless nights of dev and a truckload of coffee. We are finally releasing the biggest project we've done in our entire life. I hope you will like it !

4 26 136 82K 138

9 9 65 5K 9

0xdf @0xdf_

3 months ago

Checker from @hackthebox_eu has some really complex exploitation steps. There's SQLI in Teampass, SSRF to file read in BookStack using a blind PHP filter oracle, and shared memory abuse. 0xdf.gitlab.io/2025/05/31/htb…

0 21 92 4K 16

Kévin GERVOT (Mizu) @kevin_mizu

4 months ago

I've released my CTF bot template! :D It's not a big deal, but it comes with a heavily hardened Docker setup. The bot also sends a lot of debugging information over the TCP socket (console logs, navigation), which makes remote debugging much easier! 🔎 👉github.com/kevin-mizu/bot…

0 19 121 6K 39

Download Image

Kévin GERVOT (Mizu) @kevin_mizu

4 months ago

The #FCSC2025 ended yesterday, and my write-ups are now available here 👇 mizu.re/post/fcsc-2025… Btw, like every year, all the challenges have also been added to hackropole.fr! 🚩 1/2

Kévin GERVOT (Mizu) @kevin_mizu

5 months ago

The #FCSC2025 ended yesterday, and my write-ups are now available here 👇 mizu.re/post/fcsc-2025… Btw, like every year, all the challenges have also been added to hackropole.fr! 🚩 1/2 https://t.co/TBSdfFgtXu

1 7 94 8K 19

Download Image

2 20 90 5K 36

Download Image

0xReverse @0xreversecom

5 months ago

🔥 Understanding Alcatraz ~ Obfuscator Analysis by @rhotav - Analysis of Alcatraz Passes with IDA - OEP Finder with @qiling_io - Scripting with IDAPython 0xreverse.com/understanding-…

0 46 108 12K 49

Jorian @J0R1AN

2 years ago

I almost can't believe it, but I am finally releasing my Gitbook about CTF and Hacking, which is a year in the making. It contains many tricks, explanations, and resources from my experience and research. I hope it becomes a valuable resource for everyone! book.jorianwoltjer.com//

2 28 137 9K 93

adragos @adragos_

5 months ago

I'm releasing fontleak: a new CSS injection technique to quickly exfiltrate text nodes (and yes, that includes inline scripts). Works on Chrome/Firefox and Safari*. You can use it to escalate the impact of your HTML injection payloads and to solve CTF challenges.

3 41 217 15K 137

Download Video

Agoratlas @agoratlas

6 months ago

Quelques semaines après la vaste campagne de manipulation autour de la rencontre Trump-Zelensky, nous revenons en détail sur nos découvertes et notre méthodologie d'enquête. À retrouver sur le blog Agoratlas : agoratlas.com/blog/rencontre…

Agoratlas @agoratlas

6 months ago

123 955 2K 312K 419

Download Image

0 3 19 2K 4

bearstech @bearstech

6 months ago

Docs : une alternative Open Source à Notion ou Outline. (P) Ce projet est le fruit d'une collaboration entre les gouvernements français (la DINUM) et allemand (ZenDiS). 👉 Le projet : github.com/suitenumerique… 👉 En savoir plus : docs.numerique.gouv.fr/login/

4 55 184 12K 188

Download Image

Benasin @Benasin3

6 months ago

🚨HTTP Request Smuggling in lua-nginx-module!🚨 This affects major proxies like Kong GW, OpenResty, Apache APISIX and many more👀 Check it out: benasin.space/2025/03/18/Ope… Big thanks to @albinowax for his awesome research and for answering all my questions! #bugbounty #bugbountytips

8 73 267 20K 151

Worty @_Worty

6 months ago

With @FlatNetworkOrg we took part in the @1ns0mn1h4ck finals and we ended up in second place. The Insotransfer challenge was about an RCE on a FastAPI readonly docker instance, enjoy the read :) worty.fr/post/writeups/…

4 14 90 5K 17

Worty @_Worty

6 months ago

My writeup for the KalmarCTF challenge "no sqli" is out, covering the exploitation of CVE-2024-6382, an integer overflow in the Rust's MongoDB library. A very interesting challenge, enjoy! :) worty.fr/post/writeups/…

2 36 171 12K 66

Eurosport France @Eurosport_FR

6 months ago

WOW ! 😨 La chute incroyable de Charles Gamel-Seigneur 🇫🇷, qui parvient à se rattraper après être tombé sur la tête ! Suivez le meilleur du ski alpin sur Eurosport et Max

99 891 8K 2.4M 782

Download Video

Kévin GERVOT (Mizu) @kevin_mizu

6 months ago

For this challenge, it was necessary to abuse a discrepancy between the DOM and the rendered page in Firefox's cache handling 💽 👉 bugzilla.mozilla.org/show_bug.cgi?i… This allows to shift iframe rendering from one to another leading to a sandbox bypass 🔥 👉 mizu.re/post/an-18-yea…