RSS Parrot

Why filtering certificates by hash is a really bad idea

https://sylvainpelissier.gitlab.io/posts/2026-10-26-java-certificate-blocklists/

Published: October 26, 2026 00:00

Java has a blocklist for certificates based on their SHA-256 hash. This blog post shows why it is a very bad idea to apply for the recent eMudhra incident. The recent eMudhra incident forced a lot of ecosystems that do not rely on CRLs to update their…

Creating Virtual MQTT devices with MeteoSwiss data

https://sylvainpelissier.gitlab.io/posts/2026-08-28-virtual-mqtt-devices/

Published: August 28, 2026 00:00

Create virtual MQTT devices publishing values from external services. Introduction MQTT is a lightweight machine-to-machine protocol, often used in home automation. It is sometimes used to gather information from sensor devices but not only. I…

Verifying 2D-DOC documents in Python

https://sylvainpelissier.gitlab.io/posts/2026-06-14-verify-2d-doc-documents/

Published: July 27, 2026 00:00

Use tddoc to verify 2D-DOC official documents signature Introduction In France, more and more official documents include a digital seal, a Data Matrix allowing to verify some information of the documents are correctly signed by a trusted…

Black Alps CTF 2025 - CMAC

https://sylvainpelissier.gitlab.io/posts/2025-11-21-black-alps-ctf-cmac/

Published: November 21, 2025 00:00

This is the solution of the “CMAC” challenge of Black Alps 2025 CTF. The challenge was an exploitation of the EntrySign vulnerability. It consisted in finding a RSA public key which would have a CMAC preimage to a known CMAC hash. Details …

What Hacker Yearn CTF Shoe shop

https://sylvainpelissier.gitlab.io/posts/2025-08-11-mch-ctf-shoe-shop/

Published: August 11, 2025 00:00

This is the solution of the two “Shoe shop” challenges of What Hackers Yearn CTF. The first challenge was unprotected access to another cart. The second challenge was a CBC bit flipping attack on the encrypted URL. Description After a security…

What Hacker Yearn CTF Somkracht 65537

https://sylvainpelissier.gitlab.io/posts/2025-08-11-mch-ctf-somkracht65537/

Published: August 11, 2025 00:00

This is the solution of the two “Somkracht 65537” challenge of What Hackers Yearn CTF. The challenge was a modified version of the RSA common modulus attack Description Is this how RSA works? I read something about p and q somewhere. Attachment…

Configuring KOReader on a Kobo device

https://sylvainpelissier.gitlab.io/posts/2025-07-17-configure-koreader-on-kobo/

Published: July 19, 2025 00:00

This is my notes on configuring KOReader to use webDAV and Wallabag on my Kobo device. Introduction I have a Kobo Aura H2O second edition since a long time and I’m very happy with this device. I used Pocket service to save interesting articles…

Google CTF Merkurated

https://sylvainpelissier.gitlab.io/posts/2025-07-01-google-ctf-merkurated/

Published: July 1, 2025 00:00

This is the solution of the “Merkurated” challenge of Google CTF 2025. The challenge was using a sparse Merkle tree using bcrypt as hash function. Since all input bytes after the 72th byte are ignored a collision on the hash function can be created…

HXP 38C3 CTF circus and cccircus

https://sylvainpelissier.gitlab.io/posts/2024-12-28-hxp-38c3-ctf-circus/

Published: December 15, 2024 00:00

This is the solution of the “circus” and “cccircus” challenges of HXP 38C3 CTF 2024. The challenges were a CRC computed over a 128-bit finite field and raised to a power. The solution is found with two queries allowing to recover the correct root and…

LakeCTF 2024 Quals - wild-signatures

https://sylvainpelissier.gitlab.io/posts/2024-12-09-lakectf-wild-signatures/

Published: December 9, 2024 00:00

This is the solution of the “wild-signatures” challenge of LakeCTF 2024 Quals. The challenge has a unintended solution but the intended solution was to solve it using Ed25519 low order public keys. Details Category: Crypto Points: 109…