Tag: 2025

15 articles
Date Wed 26 February 2025
Author Mathieu Farrell
Category Pentest

In this series of articles we describe how, during an "assumed breach" security audit, we compromised multiple web applications on our client's network to carry out a watering hole attack by installing fake Single Sign-On pages on compromised servers. In our second episode we take a look at SOPlanning, a project management application that we encountered during the audit.

Date Tue 25 February 2025
Author Mathieu Farrell
Category Pentest

The following article describes how, during an "assumed breach" security audit, we compromised multiple web applications on our client's network in order to carry out a watering hole attack by installing fake Single Sign-On pages on the compromised servers. This article is the first of a two-part series and explains why it is not enough to just check for CVEs, and why we should dive deep into the code to look for new vulnerabilities in old code bases. We will take phpMyAdmin version 2.11.5 as an example, as this is the version we encountered during the audit.

Date Fri 14 February 2025
Author Loïc Buckwell
Category Vulnerability

Apple released iOS 18.3.1 (build 22D72) to patch a vulnerability tied to the Accessibility framework and reported by Citizen Lab. Let's analyze it!

Date Tue 11 February 2025
Author Gwaby
Category Exploitation

In this blog post we explain the consequences of asking our R&D boss for a Steam Deck as a Christmas gift. It involves a couple of vulnerabilities, limited primitives, challenging exploitation and a long disclosure process.

Date Tue 21 January 2025
Authors Dahmun Goudarzi, Sebastien Rolland, Ramtine Tofighi Shirazi
Category Software

The OSTIF engaged with Quarkslab to perform a security audit of the Notary project, focused on new features.