Date Tue 15 July 2025
Author Mathieu Farrell
Category Vulnerability

A technical exploration of Local Privilege Escalation Vulnerability in ControlPlane on macOS.

Date Thu 03 July 2025
Author YV
Category Pentest

During a Red Team engagement, we compromised an AWS account containing a Confluence instance hosted on an EC2 virtual machine. Although we fully compromised the machine hosting the Confluence instance, we did not have valid credentials to log in but were able to interact with the underlying database. This led us to study the structure of the Confluence database and the mechanism for generating API tokens.

Date Tue 10 June 2025
Author Benoit Girard
Category Software

An introduction to Wirego, a tool for Wireshark plugin development

Date Tue 29 April 2025
Author Alexandre Nesic
Category Pentest

During an assumed breach ops via a virtual desktop interface, we discovered a wildcard allow firewall rule for the Azure Blob Storage service. We proved that even with restrictions in place, it was still possible to reach the Internet. Afterwards, we thought of abusing this firewall misconfiguration (recommended by Microsoft) in a much more useful way. To demonstrate that I built a SOCKS5 proxy that uses blobs to tunnel traffic to the target's internal network.

Date Tue 22 April 2025
Author Mathieu Farrell
Category Pentest

The following article explains how, during an audit, we examined Moodle (v4.4.3) and found ways of bypassing all the restrictions preventing SSRF vulnerabilities from being exploited.


The Open Source Technology Improvement Fund, Inc, thanks to funding provided by Sovereign Tech Fund, engaged with Quarkslab to perform a security audit of PHP-SRC, the interpreter of the PHP language.

Date Tue 08 April 2025
Author Jérémy Jourdois
Category Android

A signature verification bypass in a function that verifies the integrity of ZIP archives in the AOSP framework

Date Tue 25 March 2025
Author Mathieu Farrell
Category Vulnerability

A technical exploration of a trivial Local Privilege Escalation Vulnerability in CCleaner <= v1.18.30 on macOS.

Date Fri 21 March 2025
Authors Célian Glénaz, Dahmun Goudarzi, Julio Loayza Meneses
Category Cryptography

Following the introduction of crypto-condor and differential fuzzing in earlier blogposts, we showcase a use case where Quarsklab's automated test suite for cryptographic implementations allowed us to improve the reference implementation of the recently standardized HQC scheme.

Date Tue 11 March 2025
Author Alexandre Nesic
Category Pentest

A technical exploration of modern phishing tactics, from basic HTML pages to advanced MFA-bypassing techniques, with analysis of infrastructure setup and delivery methods used by phishers in 2025.