Hugo Sibony
Ethical hacker, cybersecurity student, CTF player.
Featured
EpiRootkit
A Linux rootkit for kernel 5.4
AnalysisThe XZ backdoor (CVE-2024-3094)
A two-year supply-chain operation hid a remote-code-execution backdoor in OpenSSH via the xz compression library. A half-second slowdown on ssh logins caught it days before it would have shipped to every Linux server.
Open sourceasmlings
A Rustlings-inspired x86-64 assembly learning tool with interactive exercises
Articles and Writeups
- How DNS works, end to end
DNS 101: why it exists, the domain namespace, the recursive lookup through root, TLD, and authoritative servers, and caching. Part 1 of a DNS series.
Read more - Inside a DNS packet
The DNS message format field by field: the 12-byte header and its flags, the question, the answer records, and EDNS. Plus the record types a domain actually holds. Part 2 of a DNS series.
Read more - Encrypting DNS: DoH, DoT, and DoQ
Plain DNS is cleartext on port 53. How DoT, DoH, and DoQ encrypt it, how DoH rides HTTPS, and exactly what your ISP can still see. Part 3 of a DNS series.
Read more - How malware abuses DNS
DNS tunnelling, command-and-control, domain generation algorithms, exfiltration, fast flux, and DoH abuse, with real campaigns and how defenders catch them. Part 4 of a DNS series.
Read more - Watermarking an ID: what actually leaves your device
France's official watermarking tool uploads your document before stamping it. The network trace, and a browser-only alternative that sends nothing.
Read more - DNS: 1.1.1.1, 8.8.8.8 or 9.9.9.9, which to choose?
Pick a public DNS resolver, set it, prove it works.
Read more - RIPOSTE
Le Cube de Kociemba est de mauvaise humeur. Il n'a pas envie d'être résolu, et il riposte.
Read more - RISCy Business
Un processeur volé dont le jeu d'instructions change à chaque démarrage. Écrire l'émulateur du caméléon : 3000 programmes, 60 secondes.
Read more - Je Check Lundi
Un dev pousse un fix vendredi soir en notant "je check lundi", puis le repo fuite. Le fix n'a jamais été déployé : l'admin se trouve dans l'historique git.
Read more - The XZ backdoor (CVE-2024-3094)
A two-year supply-chain operation hid a remote-code-execution backdoor in OpenSSH via the xz compression library. A half-second slowdown on ssh logins caught it days before it would have shipped to every Linux server.
Read more - Connect to the IONIS (eduroam) WiFi on Linux, Android, and iOS
Set up EPITA's IONIS network (eduroam) with PEAP/MSCHAPv2 and no CA certificate: GUI, nmcli, iwd, and netctl.
Read more - Root persistence for Attack/Defense CTFs
Two root-persistence tricks for Attack/Defense CTFs: a hidden SUID bash, and a login backdoor that survives new users.
Read more - Message lointain
Deciphering an extraterrestrial message encoded with a simple modular exponentiation.
Read more - Problèmeuh
A Diophantine puzzle involving linear equations, perfect squares, and a Pell equation.
Read more - Analyse mémoire 1/5 - Exfiltration
Analyse d'une capture mémoire pour identifier un malware exfiltrant des données.
Read more - Analyse mémoire 2/5 - Origine de la menace
Identification du processus ayant chargé le malware en mémoire.
Read more - iForensics - Backdoor
Analyse d'un backup iOS pour identifier une backdoor dans une application.
Read more - iForensics - iTreasure
Analyse d'un backup iOS pour retrouver un trésor caché dans les messages.
Read more - Signal sur chat
Décodage de signaux DSSS avec codes de Gold dans un fichier audio contenant du bruit de chat.
Read more - Mechanical Display
Décodage d'un flag transmis via un servomoteur contrôlé par un signal PWM capturé dans un fichier VCD.
Read more - Le calme avant la tempest
Reconstruction d'un signal vidéo PAL composite à partir d'un flux échantillonné à 20 MHz
Read more - babyfuscation
Reverse engineering challenge involving a binary with obfuscated function names and custom string comparison.
Read more - iForensics - iCrash
Retrouver le SSID, le BSSID et le compte iCloud à partir d'un backup et d'un sysdiagnose iOS.
Read more - Voilà
Identify a song using audio fingerprinting from a misconfigured MPD server.
Read more - ja4a4a4do0o0re SSH!
Identifier la session SSH interactive d'un attaquant et extraire les cookies SSH d'une capture réseau.
Read more - Stabilize a reverse shell
Turn a raw netcat shell into a full interactive TTY: job control, arrow keys, tab-completion, and a working Ctrl+C.
Read more - AI Gaslighting
Mission 1: Trick the AI chatbot to give the leaked data key
Read more - Document Tracker
Mission 4: Intrude the application to get the attack plans
Read more - PW Crack 1
Simple password cracking - reading a hardcoded password from Python source.
Read more - PW Crack 2
Password check bypass - extracting a hashed comparison value from Python.
Read more - PW Crack 3
Brute-forcing a password from a small candidate list against a hash check.
Read more - PW Crack 4
Scripted brute-force over a larger password list with hash verification.
Read more - PW Crack 5
Dictionary attack with custom hash - optimizing search over a large wordlist.
Read more - Tux Fan Club: Chasse au Trésor Pirate
Une chasse au trésor pirate impliquant des fichiers cachés et de la stéganographie
Read more