Worty

Organizer of @HeroCTF || ctf w/ @FlatNetworkOrg || TeamFR 2021, 2022 & 2025 🇫🇷 || Breaking stuff @ Depi

[nol @nol_tech]

This is my talk :D

[Lupin @0xLupin]

I managed to RCE Fortune 500 companies and made over $50,000 with this technique.

A new npm supply chain technique we just disclosed. The trick is dumb-simple.

We call it npx Confusion.

🧵

[Lupin @0xLupin]

People are always talking about npm and pypi. Wait to see how insane are the other ecosystems too

[Orange Tsai 🍊 @orange_8361]

That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉

[YesWeHack ⠵ @yeswehack]

Missed the latest #TalkiePwnii? Now’s your chance 👀

@pwnwithlove breaks down a wildcard argument injection exploit on a @zerodaygym Dojo challenge - from initial discovery to full exploitation 👇

https://t.co/n1fXGPsv6a

[YesWeHack ⠵ @yeswehack]

SSRF turns a server’s own outbound requests into your weapon against its internal network 🌐

From a single callback to full cloud account takeover, the escalation path is wild when you know the tricks 🔥

Full guide on hunting SSRF 👇
https://t.co/YHoZatQ6bs

[pwnii @pwnwithlove]

last month I reported a critical SSRF that led to JS execution in a headless Chrome ദ്ദി・ᴗ・)✧

if you're curious, I wrote a full article on @yeswehack! :p

[Bleizack @bleizack]

Les inscriptions UDG#2 se terminent très prochainement, nous vous partageons le teasing des confs.

Cette fois-ci, rendez-vous dans le centre de Rennes, à 7 minutes à pied de Sainte-Anne (adresse précise communiquée lors de la réception de votre place).

> https://t.co/tEwrYvXdUg

[YesWeHack ⠵ @yeswehack]

If you haven't seen it yet, the latest #TalkiePwnii is out and @pwnwithlove shows how to abuse wildcards for argument injection on a @zerodaygym Dojo challenge 👀

Check it out 👇
https://t.co/n1fXGPsv6a

[Worty @_Worty]

The #FCSC2026 ended today, my write-ups are now available on my website https://t.co/PbzPBa4dpX, don't hesitate to check them !

[Worty @_Worty]

For this year’s FCSC, I’m proud to have had the opportunity to develop four web challenges:
- Shellfish Say
- FCSC Aquarium
- Secure Mood Notes (Part 1 & 2)

There are many more challenges available (created by @kevin_mizu and @BitK_), so don’t hesitate to give them a try! :)

[Kévin GERVOT (Mizu) @kevin_mizu]

I'm happy to release the first version of my DOMLogger++ plugin for @CaidoIO! 🔎

It improves the browser extension in several ways:
• Persistent, per-project storage
• Temporary session recording
• AI support
• Stack trace reconstitution
• ...

👉 https://t.co/tj72KXjAN9

[Worty @_Worty]

@_Euzebius @voydstack @kevin_mizu @BitK_ At least 2 web challenges have 0 solve for now :D

[Worty @_Worty]

For this year’s FCSC, I’m proud to have had the opportunity to develop four web challenges:
- Shellfish Say
- FCSC Aquarium
- Secure Mood Notes (Part 1 & 2)

There are many more challenges available (created by @kevin_mizu and @BitK_), so don’t hesitate to give them a try! :)

[Kévin GERVOT (Mizu) @kevin_mizu]

This year again, with @BitK_ and @_Worty, we've made the Web challenges 🚩

The CTF is solo and lasts 10 days, if you have some time, please give it a look 😁

Even if you're not doing Web challenges, there are challenges in various categories, you should find something you like!

[Lupin @0xLupin]

Her first week at Lupin & Holmes ? Garance compromised an npm package with 40M weekly downloads 🔥

Depi flagged a dangerous workflow in @ img/colour. She turned Dependabot into the trigger, got the workflow to run, and reached package write access.

40M weekly downloads. Week one. Garance rocks 🤟

https://t.co/qkEiGnbPBG

[Worty @_Worty]

@OliviaGalluccii @Synacktiv @0xLupin Thanks a lot !

[Worty @_Worty]

Today was my last day at @Synacktiv as a pentester, I want to thank all the people I've worked with in this company, such amazing and skilled people, I will cherish those memories

I’m joining @0xLupin at Lupin&Holmes to break more stuff with some others talented people😎

[Worty @_Worty]

@Blaklis_ @Synacktiv @0xLupin Thanks a lot Blaklis ❤️

[Worty @_Worty]

@warthogtk @kevin_mizu @Synacktiv @0xLupin Ahaha merci bcp🔥

[Worty @_Worty]

@SpawnZii @rayanlecat @Synacktiv @0xLupin Merci bg ❤️

[Worty @_Worty]

@lxt33r @rayanlecat @Synacktiv @0xLupin Merci :)