Write-ups/CTF & Bug Bounty Zola 2026-06-28T00:00:00+00:00 https://swisskyrepo.github.io/atom.xml 2026-06-28T00:00:00+00:00 2026-06-28T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/payload-plz-reloaded/

<p>Another year, another great challenge from YesWeHack. It was the same rules as last year, find the shortest polyglot payload that triggers in the maximum contexts, but this time we had 22 contexts instead of the 13 of 2025. More than enough to melt my brain again 🤯.</p>

2025-06-29T00:00:00+00:00 2025-06-29T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/payload-plz/

<p>Last weekend, I took part in the LeHack 2025 event in Paris. As always, the challenges hosted by YesWeHack were top-notch and full of valuable learning opportunities. This year's highlight was crafting a polyglot payload capable of triggering in 13 different contexts, including SQL injection, XSS, Bash command execution, and more.</p>

2024-10-02T00:00:00+00:00 2024-10-02T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/pokemon-glitches/

<p>Digging into the anatomy of Pokemon Yellow glitches, or how to impress your school friends during break time.</p> <p><img src="/images/PokemonGlitches/pikachu-yellow.png" alt="" /></p>

2024-06-13T00:00:00+00:00 2024-06-13T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/ssrfmap-axfr/

<p>After reading a great blog post about a CTF challenge where you had to chain several SSRF to get the flag, I took some time to improve SSRFmap, fix the bugs and merge the Pull Requests. Then I implemented a new module called <code>axfr</code> to trigger a DNS zone transfer from the SSRF using the gopher protocol. This blog post is about my journey on implementing it.</p> <p><img src="/images/SSRFmapAXFR/banner_text.png" alt="" /></p>

2024-02-04T00:00:00+00:00 2024-02-04T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/ph0wn-flag-digger/

<p>TLDR: It's never too late to try to solve an old challenge. This blog post is a quick writeup of a challenge from the Ph0wn CTF 2019 where you were given a small chip and you had to extract the flag from it.</p> <p><img src="/images/Ph0wn/ph0wn_chip_dip2deep_min.jpg" alt="" /></p>

2024-01-15T00:00:00+00:00 2024-01-15T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/drink-love-share-rump/

<p>Recently I had the pleasure to give a rump during the "Drink Love Share" meet organized by <a rel="external" href="https://twitter.com/TheLaluka">TheLaluka</a>. This blog post will delve deeper into the topic.</p> <p><img src="/images/DrinkLoveShare24/rump_redteam_dino-0.jpg" alt="" /></p> <p>This rump told the tale of a little Dino starting in the red team industries.</p>

2022-09-30T00:00:00+00:00 2022-09-30T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/auto-obfuscate-strings-with-nim/

<p>TLDR: Use <code>nim-strenc</code>, or read below to discover how to write your own Nim macro.</p> <p></p> <p>Lately I discovered the repository <a rel="external" href="https://github.com/Yardanico/nim-strenc">Yardanico/nim-strenc</a>, you can use it very easily in your Nim code by importing <code>strenc</code>.<br /> Let's try it on this simple example. First you need to install the package using this command: <code>nimble install strenc</code></p>

2022-05-21T00:00:00+00:00 2022-05-21T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/sthack2022/

<ul> <li>Challenge author: ajani</li> <li>Category: <code>web</code>, <code>physical</code></li> </ul> <p>The challenge started with the following Post Card</p> <p></p>

2020-04-26T00:00:00+00:00 2020-04-26T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/fcsc/

<h2 id="fcsc-france-cybersecurity-challenge-2020">FCSC - FRANCE CYBERSECURITY CHALLENGE 2020</h2> <p>Some writeups of severals web challenges from the <a rel="external" href="https://france-cybersecurity-challenge.fr">FCSC 2020</a>.</p> <p><img src="/images/FCSC/2020-fcsc-logo.jpg" alt="https://www.ssi.gouv.fr/uploads/2020/03/2020-fcsc-logo.jpg" /></p>

2019-12-26T00:00:00+00:00 2019-12-26T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/dvid/

<p>Who ever wanted to learn about Hardware Hacking ? I found this small opensource <strong>IoT hacking</strong> learning board while I was in a security event. It is designed by <a rel="external" href="https://twitter.com/vulcainreo/">@vulcainreo</a> and cost around 45€, more than 300 units were shipped around the world.</p> <p>Let's dig into this awesome project and clone the git : <code>https://github.com/Vulcainreo/DVID.git</code> !</p> <p><img src="https://raw.githubusercontent.com/Vulcainreo/DVID/master/kit-contents.jpg" alt="https://raw.githubusercontent.com/Vulcainreo/DVID/master/kit-contents.jpg" /></p>

2019-12-14T00:00:00+00:00 2019-12-14T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/ph0wn-ctf/

<p>Another week another CTF, this time it was the <a rel="external" href="https://ph0wn.org">Ph0wn</a> at Sophia Antipolis (France). I teamed up with members from <a rel="external" href="https://twitter.com/maki_mitz">@Maki</a>, <a rel="external" href="https://twitter.com/iansus">@iansus</a>, <a rel="external" href="https://twitter.com/MansourCyril">@MansourCyril</a> and <a rel="external" href="https://twitter.com/0hax2">@0hax</a>. We reached the <strong>second place</strong> of this IoT/Hardware CTF.</p> <p>{: .center-image }</p> <h2 id="writeups-challenges">Writeups' challenges</h2> <ul> <li><a href="#">Rookie - Sunny day</a></li> <li><a href="#">Hardware - Ant-Maker</a></li> <li><a href="#">Misc - Compromised Sensor</a></li> <li><a href="#">Misc - Domotics</a></li> <li><a href="#">Crypto - Shamir Quest</a></li> </ul>

2019-06-22T00:00:00+00:00 2019-06-22T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/hip19-meetyourdoctor/

<p>Last wednesday I was in the Hack In Paris event for the 3rd time. As always there were some great conferences and challenges, and a new competition called "Hacker Jeopardy" which was very fun! During the Wargame I focused my time on Web challenges based on the <code>graphql</code> technology which was new to me, you will find below my writeups for the <code>Meet Your Doctor</code> challenges.</p> <p>{: .center-image }</p>

2019-06-22T00:00:00+00:00 2019-06-22T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/seamonsterctf/

<p>Last week-end I teamed up with members from <a rel="external" href="https://www.aperikube.fr">Aperikube</a> for an Attack/Defense CTF which took place in Brest - France. In this "small" blog post I will write about this experience, the challenges and our methodology :)</p> <p>{: .center-image }</p>

2018-12-23T00:00:00+00:00 2018-12-23T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/sigsegv-md-auth/

<p>Let's talk about the "MD Auth" challenge, I admit I started with this challenge thinking it would be about "Markdown". I was wrong but it was nonetheless interesting to solve.</p>

2018-08-14T00:00:00+00:00 2018-08-14T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/an-xss-story/

<p>Last night I stumbled across an XSS in a bug bounty program, this was quite fun to exploit.</p>

2018-01-18T00:00:00+00:00 2018-01-18T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/whidinjector/

<p>What is it ? The WHID Injector is USB Key which act as a remote keyboard. Basically it sets up a Wifi Access Point where you can connect and send whatever you want on the machine. It also has a Rubber Ducky payload converter, an exfiltrated data tab and many more.</p> <p>What can I do ? Everything you could do with a keyboard plugged into a computer, for example : using <a rel="external" href="https://github.com/swisskyrepo/WHID_Toolkit">WHID Toolkit</a> you can spawn a reverse-shell :D</p> <p>Where to buy a WHID Injector ? I got mine from <a rel="external" href="https://www.aliexpress.com/item/Cactus-Micro-compatible-board-plus-WIFI-chip-esp8266-for-atmega32u4/32318391529.html">Aliexpress</a>, it's also available on ebay around 15+ $ ;)</p>

2017-11-08T00:00:00+00:00 2017-11-08T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/frenchcroissant/

<p>Last year the first day of my internship I was given a computer and asked to install and secure it for two days. After that delay anyone can try to attack and compromise my machine, and if so I was welcome to buy some "French Croissants" to the team while the attacker explain his method to get access into your computer the next morning. There are some techniques you need to be aware of when you're securing your machine, the list below is not exhaustive.</p>

2017-11-07T00:00:00+00:00 2017-11-07T00:00:00+00:00 Swissky https://swisskyrepo.github.io/blog/ecw-ctf/

<h2 id="challenges-s-writeup-online-prequals">Challenges's Writeup - Online Prequals</h2> <ul> <li><a href="https://swisskyrepo.github.io/blog/ecw-ctf/ECW-CTF/#web-50---hall-of-fame">Web 50 - Hall of Fame</a></li> <li><a href="https://swisskyrepo.github.io/blog/ecw-ctf/ECW-CTF/#web-100---pass-through">Web 100 - Pass Through</a></li> <li><a href="https://swisskyrepo.github.io/blog/ecw-ctf/ECW-CTF/#web-150---goldfish">Web 150 - GoldFish</a></li> <li><a href="https://swisskyrepo.github.io/blog/ecw-ctf/ECW-CTF/#web-175---magic-car">Web 175 - Magic Car</a></li> </ul>