Personal blog of Julien (jvoisin) Voisin

(Ethically). Here's how I did it.

TL;DR: Basically, all multipart/form-data parsers fail to fully comply with the RFC, and when it comes to validating filenames or content uploaded by users, there are always numerous ways to bypass validation. We'll test various bypass techniques against…

Welcome to BestShop! Our AI-powered ecommerce platform offers the best prices on a wide variety of products, all while providing a smart shopping experience that's tailored to your needs. Shop with confidence and find the best deals today at BestShop.

This is a blog post for my presentation at the conference POC2024. The slides are uploaded here.

Project post by the Falco Team and Nigel Douglas Falco achieved CNCF Graduation status on February 29, 2024. Following the celebration of this significant milestone at KubeCon EU in Paris earlier this…

Microsoft Bookings introduces a significant security risk by allowing end users to create fully functional Entra accounts without administrative oversight. These accounts, tied to shared Booking pages, can be exploited for impersonation, phishing, and email…

This blog post explores how agentic AI systems, specifically the "Computer Use" feature, can be manipulated through prompt injections and phishing techniques to execute arbitrary commands.

The Tales of the Crimson Foes
A compilation of red team and pentest stories

Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.

In this 2-part “Everyday Ghidra” series post, we’ll walk through creating custom Ghidra data types by parsing C header files. In Everyday…

Recraft's image generation service uses a unique architecture combining an LLM (Claude) with a diffusion model. Learn what led to the discovery that carefully crafted prompts could expose the system's internal instructions.

Well, we’re back again, with yet another fresh-off-the-press bug chain (and associated Interactive Artifact Generator). This time, it’s in Citrix’s “Virtual Apps and Desktops” offering.

This is a tech stack that enables end-users (and likely, your friendly…

Probely has been acquired by Snyk, an industry leader in developer security. Learn more about the acquisition in this article.

On September 10th, 2024, a critical security flaw was disclosed in the Ruby-SAML and OmniAuth-SAML libraries, exposing a vulnerability that allows complete authentication bypass. This flaw, CVE-2024-45409, earned the highest possible score of 10 on GitHub's…

Intro This series of articles describes fault injection attack techniques in order to understand their real potential by testing their […]

Team82 researched the security of the OvrC cloud platform, which is used by businesses and consumers to remotely manage IoT devices. We uncovered 10 different vulnerabilities that, when chained, allow attackers to execute code on OvrC cloud-connected devices…