leHACK 2026 - BRAVE new WORLD

Entra ID & Microsoft 365 Under Siege : Autopsie des Compromissions Cloud Modernes et Stratégies de Riposte – Kondah Hamza

Avril 2026 : Anthropic dévoile Claude Mythos, capable de trouver des 0-days dans tous les OS majeurs, et réserve son accès à 40 organisations triées sur le volet. Faut-il vraiment un frontier model classifié pour faire de la recherche offensive sérieuse en 2026 ?

Ce talk défend l’inverse. DARPA AIxCC l’a prouvé en 2025 : les systèmes battent les modèles. Et en 2026, les modèles ouverts (Gemma 4, Qwen 3.6) atteignent des scores d’orchestration dignes des frontier models, sur du matériel accessible. Les papiers récents valident des workflows spécialisés en synthèse de harness, triage, analyse de protocoles et reverse engineering.

Au programme : ce que Mythos change vraiment, les briques accessibles aujourd’hui, et des cas concrets de recherche offensive sans frontier model.

Patrick Ventuzelo

CEO & Founder of FuzzingLabs (Paris, ~28 people). We’re an offensive cybersecurity company specialized in firmware, binaries, and embedded systems.

10:45 - 11:30

Trust Me, I’m A Shortcut: New LNK Abuse Methods – Wietze Beukema

L'écosystème Microsoft Entra ID et Microsoft 365 est devenu en 2025-2026 l'épicentre des compromissions cloud en entreprise. Les rapports sont unanimes : l'identité est le premier vecteur d'attaque, et les environnements M365 représentent la surface d'attaque la plus convoitée : des APT étatiques aux opérateurs de Phishing-as-a-Service. Le talk couvrira les techniques les plus récentes et impactantes, dont l'abus FOCI (Family of Client IDs), l'extraction de tokens OAuth depuis les caches Windows (TokenBroker, WAM, Azure CLI), le contournement des politiques MFA et Conditional Access, et les angles morts de la détection. En fil rouge, une démonstration live d'OAuthBandit v2, outil open-source de post-exploitation spécialisé dans l'extraction, la validation et l'exploitation de tokens Microsoft OAuth depuis des endpoints compromis : avec le release public de nouvelles fonctionnalités avancées. Cette présentation est un retour terrain brut. Basée sur des cas concrets de réponse à incident et de missions offensives sur des tenants M365 compromis, elle décortique les kill chains modernes observées en production : de l'accès initial par phishing OAuth jusqu'à la prise de contrôle complète du tenant, en passant par le mouvement latéral cloud-to-cloud et la persistence invisible.. ainsi que d’autres surprises ... L'objectif : armer les défenseurs avec la compréhension fine des TTPs modernes sur M365/Entra ID et des stratégies concrètes de détection et de réponse.

Kondah Hamza

Hamza Kondah est ingénieur cybersécurité senior, consultant indépendant et fondateur de Hexadream Academy. Microsoft MVP en Sécurité des Entreprises depuis plus de 13 ans , il intervient quotidiennement sur des missions de réponse à incident, d’audit offensif et de hardening sur des environnements Entra ID, Azure et Microsoft 365. Formateur reconnu avec plus de 13 ans de présence sur le marché, il a formé des milliers de professionnels sur la sécurité des écosystèmes Microsoft.

11:30 - 11:50

RF : une menace invisible ? Le monde caché du TSCM – Stéphane

Windows shortcut (.LNK) files remain a persistent threat vector. While simple bypasses like adding spaces exist, this session reveals undocumented techniques for deceptive payload delivery and execution. We’ll explore why these methods work, the black-box research methodology used to find them, and the defensive implications. We are also introducing an open-source tool for security teams to simulate and defend against these advanced LNK-based attacks.

Wietze Beukema

Wietze has been hacking around with computers for years. Originally from the Netherlands, he currently works as a Lead Threat Detection & Response Engineer in London. As a cyber security enthusiast and threat researcher, he has presented his findings on topics including attacker emulation, PowerShell obfuscation, command-line obfuscation and DLL Hijacking at a variety of security conferences. By sharing his research, publishing related tools and his involvement in the open-source projects such as LOLBAS, HijackLibs and ArgFuscator, he aims to give back to the community he learnt so much from.

11:50 - 12:10

Getting Lost in SAP: From LPE to Remote Memory Corruption – Tao Sauvage

Dans cette conférence, l’intervenant propose une immersion dans un univers rarement visible du grand public : celui de la menace RF, de l’écoute clandestine et des opérations de TSCM. L’objectif est de montrer comment des environnements en apparence ordinaires peuvent dissimuler des risques techniques réels, souvent ignorés jusqu’au dernier moment.
Le talk alterne mise en contexte, lecture opérationnelle du risque et retours d’expérience issus du terrain, afin de rendre concrète une menace souvent perçue comme abstraite. Sans entrer dans la divulgation de procédés sensibles, cette intervention éclaire ce que recouvrent réellement les démarches de contre-mesures électroniques, la détection d’anomalies et l’évaluation de vulnérabilités dans des espaces sensibles.

14:00 - 14:45

Overcast Panda – Jake Lomas & Antoine Vianey-Liaud

SAP is widely used by Fortune 500 companies and often underpins critical business processes, yet its attack surface is difficult to evaluate due to its proprietary nature. In this talk, I retrace how I approached that problem in practice: starting from a single thread and following it through reverse engineering, archive format internals, black-box fuzzing, and exploit development. Along the way, I show how that process led to multiple vulnerabilities across different SAP components, ranging from local privilege escalation to remote unauthenticated memory corruption. I also cover the practical role LLMs played during the research, as a tool for crash triage, root-cause analysis, and exploit development.

Tao Sauvage

Tao Sauvage is Director of Research at Anvil Secure, specializing in vulnerability research, reverse engineering, and offensive security. He has conducted research across mobile, embedded, and industrial systems, leading to multiple CVEs affecting vendors including Google, Garmin, SAP, Okta, ASUS, Antaira, and Linksys.

14:45 - 15:30

The Hidden Agenda: Exposing Qilin Ransomware Operations – Glacius_

Whilst organisations and individuals continue to heavily focus on digital initial access vectors, many continue to overlook physical access. OVERCAST PANDA’s operatives, however, do not discriminate against the physical realm to achieve their targeting objectives.

Jake and Antoine will walk you through real-world intrusions where Chinese state operatives target high-value individuals visiting China and deploy backdoors directly onto their corporate devices. Turning a simple business trip into a full corporate compromise.

Because sometimes the only zero-day you need is a hotel housekeeping schedule.

Jake Lomas

Jake is an Intrusion Analyst in CrowdStrike’s Threat Hunting service, Falcon OverWatch. His work focuses on hunting and disrupting nation state adversarial operations in customer networks. He also previously worked in CrowdStrike’s MDR service, Falcon Complete, where he responded to, contained and remediated a broad range of cyber intrusions.

Antoine Vianey-Liaud

Antoine leads a team of threat hunters at CrowdStrike, finding creative ways to uncover and disrupt sophisticated intrusions on a daily basis.

15:30 - 16:15

Attacking WSO2: 0-Days and N-Day Chains for Pre-Auth RCE on Enterprise Java – Noel MACCARY

Throughout this presentation we’d like to expose Qilin’s methodology, from compromising victims to exfiltration. We’ll also have a look at the infrastructure involved since the TA left a few gifts that most of people will overlook, and the cryptocurrency tracking we’ve done to identify how the core team and its affiliates operate together.

Thibault Seret

Thibault Seret is the Threat Hunting Lead at Stoik’s CERT. He is currently focusing on crimeware and APT analysis and research, reverse engineering, threat intelligence, threat hunting and trying to fight against bad guys. Before joining Stoik, he worked for Team Cymru as a Threat Researcher, also as a threat researcher in McAfee’s ATR team, as a cybercrime analyst in a banking institution with the mission to improve the digital forensics department, and finally as a CERT analyst at an IT services company where he tried to save the world with his teammate. For the Alliance!

16:15 - 16:35

From USB to ESP: Security Vulnerabilities in Espressif Firmware – Maxime Rossi Bellom & Ramtine Tofighi Shirazi

WSO2 products (API Manager, Identity Server) are massively deployed across critical infrastructure (banking, insurance, defense, government) in France and worldwide. During offensive security engagements at Ambionics Security (LEXFO), we discovered over a dozen critical 0-day vulnerabilities in WSO2's shared Java codebase and achieved RCE on dozens of client instances across French organizations. The vulnerabilities span the full spectrum: authentication bypasses via path parameter confusion, full-control SSRF through a 2008-era legacy proxy, systemic CSRF on every SOAP administration service, account takeover via flawed password reset logic, and multiple RCE vectors through Siddhi Streaming SQL, H2 database UDFs, SQLite file-write to JSP webshell, and unsandboxed JavaScript execution in the JVM. But the real challenge came next. Facing a properly hardened deployment (management console firewalled off, no admin ports exposed, zero outbound connectivity), we chained 7 N-days into a single-request unauthenticated RCE through the only reachable endpoint: the API Gateway HTTPS port. The chain combines blind XXE, SSRF relay, HTTP request smuggling via CRLF injection in Axis2 headers, and privilege escalation into a reliable exploit against near-current WSO2 versions. Packed with Java web exploitation tricks, the talk concludes with a live demo: one request, seven vulnerabilities, a reverse shell.

Noel MACCARY

Pentester at Ambionics Security (LEXFO), specializing in web vulnerability research and exploitation on widely deployed enterprise software. Discovered and responsibly disclosed multiple critical 0-day vulnerabilities in WSO2 products (6+ CVEs), resulting in patches across the WSO2 ecosystem.

16:35 - 16:55

Reversense: One Hook, Then the Universe – Georges-Bastien Michel (@FrenchYeti)

Espressif designs small, low-cost system-on-chips primarily intended for wireless connectivity such as Wi-Fi and Bluetooth Low Energy. These SoCs are widely used as the networking and control component in IoT and embedded products, handling external inputs, protocol parsing, and communication with the rest of the system. Espressif has publicly reported cumulative shipments on the order of one billion chips, with hundreds of millions of devices deployed in the field, making vulnerabilities in shared firmware components a product-scale security concern rather than an isolated implementation detail. In this talk, we present a set of real security vulnerabilities identified in Espressif’s software development kit (SDK) and USB stack. Rather than focusing on vulnerability counts, we explain how we deliberately filtered out noise to concentrate on issues that are reachable, cross trust boundaries, and have realistic security impact in shipped products. We briefly introduce the analysis approach that enabled this triage, including graph-based code exploration, backward slicing from security-sensitive operations, reachability and exploitability reasoning, and threat-model awareness. We then deep-dive into a USB vulnerability, walking through the vulnerable code path, violated assumptions, and attacker-controlled inputs. Where available, we present ongoing exploitation work and discuss the practical challenges and constraints of turning such bugs into reliable exploits on embedded targets. Finally, we connect these findings to real-world Espressif-based products, illustrating how low-level firmware vulnerabilities can propagate to product-level security risks. We conclude with lessons learned for embedded developers and security engineers on how to reason about exploitability, prioritization, and impact in modern IoT and embedded software stacks.

Maxime

Maxime Rossi Bellom is a security expert and co-founder of SecMate (https://secmate.dev), a company focused on uncovering security issues from embedded software. He specializes in the hardware and low-level software security of mobile devices and embedded systems, and has extensive experience uncovering real-world vulnerabilities in widely deployed firmware. He enjoys working on secure boot mechanisms and security chips embedded in smartphones.

Ramtine

Ramtine Tofighi Shirazi is a computer scientist and co-founder of SecMate (https://secmate.dev), a company focused on uncovering security issues in embedded software. He specializes in static analysis and automated vulnerability detection, with a focus on bridging the gap between security research and engineering workflows in regulated industries. His work has been published at JLAMP, SPRO, and SSPREW. He holds a PhD in Computer Science.

17:00 - 17:45

The Art of Staying In, Part II: Target Weakening – m101

Est ce que le reverse c’est IDA, R2, Frida, Ghidra, QEMU, et bien d’autres ? Non, c’est tout ça, et tout ça ce n’est pas le secret que l’on veut découvrir, la DRM que l’on veut casser, ce n’est que le moyen. Aujourd’hui, après Dexcalibur, et plus de 5 ans de développement nous libérons en open source Reversense, une plateforme d’automatisation du reverse qui crée une projection de votre application mobile ou votre binaire dans une représentation universelle interrogeable, analysable et exécutable. Reversense offre une interface graphique permettant de naviguer et analyser la projection de l’application, statiquement ou à travers les exécutions, ainsi que de nombreuses fonctionnalités en dehors du champ des outils traditionnels : automatisation du parcours de l’interface, génération et édition automatique des hooks Frida qui vont muter d’une exécution à l’autre, instrumentation cross-process ou cross-device, fuzzing inapp, gestion d’une ferme de téléphones, … Le talk présente l’outil - l’idée et l’usage - mais surtout comment nous avons repensé le métier de reverser à une ère où le binaire est omniprésent, le temps pour reverser toujours plus réduit mais où nous voulons garder du plaisir.

Georges-Bastien Michel (@FrenchYeti)

Georges-Bastien MICHEL – aka @FrenchYeti – is a security researcher, speaker (NorthSec, SSTIC, insomni’hack, …), trainer and OSS developer with a strong experience in de-obfuscation, Android security, and TEE vulnerability assessment. He created Dexcalibur and Interruptor (Frida-based userland syscall tracer), among a long list of OSS projects, and contributed to Frida, R2, APKiD and Ghidra projects. He has been vulnerability researcher and reverse engineer in several  companies including Thales Lab and UL. Since 2020, he has dedicated his time to building Reversense, a mobile reverse engineering platform – which he is releasing as open source. (Github: https://github.com/FrenchYeti)

17:45 - 18:05

Reverse Engineering of FCC Unlocks in DJI Fly clones – Klcium

What if the backdoor phase required no code at all? Last year at leHack, I introduced a framework for reasoning about unconventional persistence — backdoors built from configuration and trust rather than malware. The audience asked for more demos, more operational reality. This talk delivers. Through live demonstrations on realistic environments, we show how subtle, codeless modifications to a system can create invisible conditions for future code execution — triggered later through channels no defender would think to suspect. No binary, no shell, no payload on disk. Just changes that look benign, pass audits, and wait patiently. Built from tested tradecraft, real red team operations, and ongoing research.

m101

18:05 - 18:25

Modified drone companion apps claiming to unlock FCC transmission modes are widely circulated among hobbyist communities, yet their internal mechanisms remain largely undocumented. This talk presents a reverse engineering case study of such a patched Android application, revealing how runtime instrumentation frameworks—specifically Frida—are embedded and abused to dynamically alter application behavior. Through differential APK analysis, deobfuscation of injected JavaScript Frida payloads, and inspection of native libraries, we uncover a full instrumentation pipeline designed to hook critical Java class methods to bypass regulatory constraints. The session concludes with a discussion on technical limitations, potential firmware-level barriers, and implications for mobile app integrity.

Klcium

Pentester working high on the stack by day and exploring low-level systems by night.

18:30 - 19:15

<undisclosed> – x86

From NDH2K11 to LeHack XXVI: A 15 year Retrospective… or Oh my how things (really haven’t) changed!” – Jayson E. Street

Together, we'll explore what lies behind the sale of vulnerability, a reality often far removed from what people imagine (or what's said online). This subject, encompassing legal, ethical, and technical aspects, has generated much discussion, and we'll attempt to shed some light on this rather unique activity.

x86

After playing with the windows kernel and wargames on IRC, he made a few contributions to doar-e before join an australian company as a chrome VR. He later turned exploit seller and party planner.

27/06/2026

10:00 - 10:45

Gestion de crise at scale : le cas Leboncoin – Zak

Fifteen years ago, compromising an organization could be as simple as walking through the front door with confidence, dropping a USB drive in a parking lot, or sending a poorly crafted phishing email. At NDH2K11, Jayson E. Street demonstrated just how easily organizations could be compromised using little more than human trust and a bit of creativity. Fast-forward fifteen years. The technology landscape has transformed—AI-generated voices can impersonate executives, phishing campaigns are automated at scale, and attackers now leverage OSINT and generative technologies that dramatically lower the barrier to entry. Yet despite this technological evolution, one uncomfortable truth remains: the fundamental weaknesses, attackers exploiting humans have not changed. In this retrospective talk, Jayson revisits real examples from his early work compromising banks and organizations through social engineering and physical infiltration, comparing them to modern attacks involving phishing, vishing, and AI-driven deception. Through stories, demonstrations, and lessons learned across more than a decade of adversarial testing, he shows how attackers continue to succeed not because of cutting-edge exploits—but because organizations still rely on the same fragile assumptions about trust, process, and human behavior. The session concludes by challenging the industry’s traditional approach to security validation and introduces a modern framework for adversarial simulation designed to help organizations experience real-world attacks safely before criminals deliver them for real. After fifteen years of evolving tools, tactics, and technology, the biggest lesson may be the simplest one: Attack methods change. Human nature does not.

Jayson E. Street

10:45 - 11:05

Oubliez les communiqués de presse lissés et les présentations institutionnelles : en coulisses, une attaque majeure est tout sauf clinique. Quand des attaquants ont frappé l'écosystème leboncoin, la théorie a volé en éclats pour laisser place à une bataille de terrain intense, chaotique et profondément humaine. Ce talk est un REX, brut et sans filtre (ou presque, on ne veut pas que notre speaker aille en prison non plus). L'objectif ? Dépasser le PR-talk pour vous plonger dans la réalité du Threat Hunting sous pression. Nous détaillerons tout, de la détection de la brèche initiale à la reconstruction chirurgicale du cheminement de l'attaquant, en utilisant un mix de techniques de DFIR traditionnelles et d'outils red team/offensifs.

Zakaria Rachid

J’ai beau arboré le titre de Group CISO depuis quelques années, il ne faut pas s’y tromper : j’ai simplement infiltré le côté obscur du management. Mon ADN est et restera celui d’un hacker. En 20 ans de route, j’ai eu la la chance d’aborder l’infosec sous tous ses angles offensif, défensif et GRC dans différents secteurs “motivants” : Défense, Santé, Tech. Biberonné au libre et à la culture haxor, je milite contre la sécurité de complaisance pour défendre un pragmatisme brut, alliant le mindset de l’attaquant à la dure réalité des défenseurs. Le reste du temps ? I hack stuff.

11:05 - 11:25

Crypto-surprise

n8ive by Design: One Leaked Key, Three Attack Chains – guedou

On va parler crypto, finances, et gros sous. Ce talk ne sera pas enregistré. Pas besoin de compétences techniques. On ne peut pas en dire plus...

Florian BOUDOT

@0xTahiTi Metal enjoyer

Charlie Bromberg

11:30 - 12:15

Physical intrusion: Success and Failure – Joker2a

n8n is an open-source workflow automation platform with AI agents, used by thousands of organizations worldwide. With more than 70,000 publicly accessible instances on Shodan and recent critical CVEs listed in CISA's Known Exploited Vulnerabilities catalog, it has become a high-value target for attackers. This talk first explores what attackers can do with leaked n8n credentials. Starting from real-world n8n JWT tokens exposed on GitHub, we found around 1,300 publicly reachable instances. Among those, 25% authenticated successfully, giving us a live dataset of production n8n instances to answer one question: what can an attacker do once inside? We built three attack chains to find out. First, we demonstrate Remote Code Execution leveraging real-world workflow abuse and existing CVEs, showing how n8n's legitimate execution capabilities turn into a direct shell. Second, we walk through credentials enumeration, extraction, and exfiltration: n8n instances store third-party API keys, OAuth tokens, and database credentials directly in workflows, making a single JWT a skeleton key to an organization's entire integration stack. Third, we reveal original cryptographic weaknesses in n8n's native secret handling, what we call n8ive crypto, exposing design flaws that allow offline secret recovery and privilege escalation. Beyond the practical attacks, this talk raises a broader question: when automation platforms become the central hub of modern infrastructure, an account compromise is now a launchpad for attacks across the entire stack

Guillaume Valadon

Guillaume is a Cybersecurity Researcher at GitGuardian. He holds a PhD in networking. He likes looking at data and crafting packets. He co-maintains Scapy. And he still remembers what AT+MS=V34 means!

14:00 - 14:20

Parcours d’un fraudeur – Cybermoustache

Souvent sous-estimée par les organisations, l’intrusion physique constitue pourtant un vecteur de compromission particulièrement efficace, en dépit des investissements croissants dans les dispositifs techniques et humains. Cette conférence propose une analyse concrète des mécanismes qui mènent au succès ou à l’échec d’une intrusion physique, en s’appuyant sur des retours d’expérience, des cas réels et des missions de red team. Nous examinerons les facteurs clés de réussite, tels que l’ingénierie sociale, les failles organisationnelles ou la surestimation des contrôles techniques, ainsi que les éléments conduisant à l’échec : vigilance du personnel, procédures adaptées, culture de sécurité, ou encore certaines limitations imposées par les clients. L’objectif est de dépasser une vision purement technologique afin de mettre en lumière le rôle central de l’humain et des processus.

Joker2a

Nicolas Aunay, alias Joker2a, est un pentester français, spécialisé dans l’intrusion physique et la sécurité offensive. Il participe à des conférences et ateliers de cybersécurité, comme BSidesLuxembourg ou Le Hack à Paris et partage ses connaissances avec la communauté InfoSec.

14:20 - 14:40

macOS Zero Mercy: Inside the Mind of a Malware Developer – Zoziel Freire

Venez découvrir le quotidien des missions terrain sur la partie fraude documentaire, un entre deux entre le pentest et le redteam!
Dans le domaine de la lutte contre la fraude depuis 2016, Cyber Moustache teste le parcours du fraudeur pour mieux le comprendre et proposer de la remédiation aux sociétés qui l'engagent pour les frauder sous contrat!

Cybermoustache

14:45 - 15:30

Sighax deep dive: breaking the 3DS chain of trust – Cyprien Molinet (@cypelf)

macOS has long been perceived as a low-risk platform, often treated as a secondary concern compared to Windows and Linux. That assumption no longer holds. As MacBooks become increasingly common in corporate environments, adversaries have followed, turning macOS into a viable and attractive target for real-world attacks. This talk presents a practical, research-driven analysis of the recent evolution of macOS malware. Through hands-on experiments and real techniques, it explores how modern threats achieve execution, fileless operation, persistence, and evasion by abusing native macOS components. As organizations continue to expand their macOS footprint, security strategies often lag behind. Many defensive teams remain heavily focused on Windows and Linux, leaving macOS environments under-monitored, under-tested, and misunderstood. In this talk, I will share my journey researching and developing macOS malware from an adversarial perspective. The session focuses on how attackers leverage legitimate macOS mechanisms to achieve: - Initial execution and in-memory (fileless) techniques - Persistence through native system components - Evasion of endpoint security and detection tools Each technique is demonstrated using real experiments, with analysis of macOS internals and the behavior of commonly deployed security solutions. Rather than theoretical concepts, the talk emphasizes how these attacks work in practice, and why many defenses fail to stop them. The presentation also addresses a persistent myth, especially common in the Brazilian security community, that macOS is inherently safer or “immune” to malware. By examining real attack paths and defensive gaps, the session highlights the urgent need for improved detection strategies, visibility, and threat modeling on macOS. Attendees will learn: - How modern malware abuses internal macOS mechanisms - Real-world persistence techniques observed in active threats - How security tools react or fail, when faced with these attacks - Practical mitigation strategies to reduce exposure and improve detection This talk is intended for defenders, red teamers, malware researchers, and anyone interested in understanding how adversaries are actively adapting to the macOS ecosystem.

Zoziel Freire

I have a degree in Information Systems and a postgraduate degree in Forensic Computing, and Cyber Security. With over 16 years of experience in the information technology sector, I have had the opportunity to provide services to several companies across various segments in Brazil and other countries. Throughout my career, I have gained solid experience in Incident Response, Forensic Analysis, Threat Hunting, Penetration Testing, Malware Analysis, Reverse Engineering, and Development. I have also worked on Ransomware incidents, both in Brazil and in other countries. I have actively contributed to the information security community, participating in Brazilian events. Sometimes I spend time bypassing EDR and AntiVirus, and testing operating system gaps. I am passionate about music, especially guitar and piano, and I am a fan of Chaves and Chapolin.

15:30 - 15:50

Warez for the working man : investigations d’une warez des logiciel de contrôle commande industrielle. – biero-el-corridor – l0key

This talk aims at reviewing and explaining in detail the technical Sighax exploit. The Nintendo 3DS, despite having layered security based on a strong chain of trust and a privilege split between two processors ARM11 and ARM9, implements improper validation of the RSA PKCS#1 v1.5 padding in the ARM9 bootrom code. This vulnerability, combined with a custom uncautious ASN.1 parser, makes it possible to bruteforce specific RSA signatures causing the signature's hash to be computed against itself on the stack, allowing to bypass a signature check. We will also discuss how this exploit, coupled with the design of Nintendo's FIRM file format, allows to dump the protected bottom half of the ARM9 bootrom, which is locked away by the time any firmware is loaded. The goal is to provide a clear overview of how a console can go from executing confined userland homebrew to cold boot, pre firmware persistence with full access over the console in just a few mistakes. We will go over the 3DS security architecture with its ARM9 / ARM11, the FIRM boot chain, the RSA PKCS#1 v1.5 padding implementation flaw, the ASN.1 parser mistakes and how "perfect" signatures were bruteforced to take advantage of these issues in order to sign any firmware stored in the console eMMC

Cyprien Molinet (@cypelf)

I began cybersecurity and development in high school for fun, wondering how computers worked. I grew up with Nintendo consoles and I was always curious of how they work internally. I remember hacking my Wii back in 2016, following tutorials on the internet, not understanding what I was doing. It felt like magic, and I found it amazing how people were able to do that. That’s how I first entered cybersecurity. I joined a french community of 3ds hacking, and started making online video tutorials about how to do it myself, for the french audience. As I continued to grow up, I graduated from an engineering school. I worked in apprenticeship at the Ministry of the Interior for one year, then at Synacktiv for 3 years, where I spent two years doing pentests and one year doing security products development. I’m now working as educational lead for development and cybersecurity at Ecole 2600 for the cybersecurity specialized bachelor. During these last few years, I also contributed to the cybersecurity scene through contributions and activity in the Root-Me association, mainly between 2021 and 2024. I spent time creating reverse engineering challenges, including one on a Nintendo Switch homebrew. Among the few talks that I made for the Root-Me organized CTF celebrating the 10k members on the discord server, I gave one specifically on the Fusée Gelée vulnerability found in the Nintendo Switch bootrom USB protocol handling, allowing arbitrary code execution at the highest level of privilege, just like Sighax here for the Nintendo 3DS. At the same time, I also participated in many CTF between 2021 and 2024, and eventually qualified in 2023 at the French CyberSecurity Challenge (FCSC) for the official French CTF team going at the European Cybersecurity Challenge (ECSC). I qualified from my scores at the general scoreboard, in the reverse category, and in the hardware category. From my experience transmitting my knowledge at School 2600, you can be guaranteed the talk will be clear to follow and rich in content! I can also certify my content will be 100% technical, hand made stuff and 0% AI slop. Important point nowadays, after all!

15:50 - 16:10

Pwning bluetooth devices in unexpected ways – Virtualabs

Quand on pense au warez, on pense aux jeux vidéo, à la suite Adobe ou à Microsoft Word. Mais il existe une autre scène, présente elle aussi depuis longtemps : celle des logiciels de contrôle-commande industriels.

Ces logiciels sont les environnements de développement et d'interaction des systèmes de contrôle physique et de programmation des automates industriels. En bref, ce sont les logiciels qui font fonctionner notre monde industriel.

Nous allons tenter de comprendre comment cet écosystème fonctionne et de définir le niveau technique de ses membres.

Nous proposerons ici une approche d'étude de l'écosystème, mais aussi de la capacité offensive de plusieurs de ces opérateurs, ainsi que le niveaux technique des services qu'ils distribuent.

biero-el-corridor

Avec un parcours atypique qui a commencé en boulangerie et qui c’est terminer en master cyber il s’est intéressé au monde de la sécurité des systèmes industrielle après la suivie d’un cours d’un docteur sur le sujet, depuis fin 2022, Actuellement freelance dans ce domaine.

Mayeul Fargier

Après une première année de licence math-info raté je réalise un BTS SN pour ensuite continuer mon master en sécurité offensive à Oteria. Passionné par le reverse engineering et la programmation ainsi tout ce qui touche à la sécu offensive / informatique de près ou de loin, actuellement étudiant en deuxième année de master.

16:15 - 17:00

Le protocole Bluetooth Low Energy et ses vulnérabilités, tout le monde les connaît car elles font régulièrement la une des actualités et 2026 n'a pas dérogé à la régle. Mécanisme d'appaîrage simplifié exploitable par des pirates, communications non-chiffrées laissant fuiter des informations sensibles, robots humanoïdes compromis avec une injection de commande transmise par BLE, injection de flux audio dans des écouteurs, autant de problèmes révélés ces dernières années grâce à de nombreux chercheurs en sécurité et qui mettent à mal l'image ce protocole et des équipements qui l'emploient. Mais connaissez-vous vraiment *tous* les moyens à votre disposition permettant de compromettre de tels équipements ? Dans ce talk, nous allons aborder des aspects moins connus du protocole Bluetooth Low Energy et la manière dont ces derniers peuvent être exploités pour compromettre l'intégrité et la sécurité d'équipements connectés. Certaines de ces techniques ont été découvertes lors de l'analyse de différentes implémentations, voire directement lors de tests effectués sur des équipements domotique ou des smartphones, d'autres sont très peu connues ou n'ont jamais été publiées à ce jour. Si vous êtes expert sur ce protocole de communication ou simple néophyte curieux de découvrir des attaques avancées, ce talk peut vous apprendre des choses assez surprenantes.

virtualabs

Tombé dans la marmite du Bluetooth Low Energy il y a bientôt plus de 10 ans, Virtualabs est l’auteur de plusieurs outils liés à ce protocole de communication et n’a malheureusement pas réussi à tourner la page et s’intéresser à autre chose depuis tout ce temps. Il travaille en tant qu’ingénieur sécurité à Quarkslab depuis 2021, avec un focus particulier sur la rétro-ingérierie matérielle, logicielle, et les protocoles de communication sans-fil.

17:00 - 17:20

R4di0_P1r4cy – Beemo

LeHack 117 : Permis d’illuminer toute la ville – MadSquirrel

Les fréquences radio transportent toutes sortes de données, des communications aériennes aux télécommandes de voiture, et la plupart d'entre elles sont étonnamment faciles à intercepter. Ce talk vous montre comment fonctionne réellement le piratage radio. Pas besoin d'équipement coûteux ni d'années d'expérience. Avec les bons outils et les bonnes connaissances, le spectre devient enfin visible.

Beemo (Noë Flatreaud)

Breaking stuff for fun and profit Hi, I’m Noë Flatreaud. People may call me Beemo I’m an IT Consultant, FOSS Advocate & Cybersecurity Researcher interested in cryptography. Currently living in France, working as an infosec speaker and advisor. I like teaching. I’m a part-time speaker and teacher. I taught Cryptography (MIT 6.875, CYP-01) I taught Incident Response and Cybersecurity. I break things, for fun and profit. I do hardware and software security research, mostly for fun but sometimes for profit. What should you expect here? Mostly short-to-mid length essays about anything that goes through my mind. I thought about doing it consistently, but it’s too much work for a lazy ass like me. How can you contact me ?

17:20 - 17:40

ALL ACCESS AUTHORIZED : How to infiltrate major events for fun and profit

Les applications de “smart city” promettent sécurité, modernité et économies d’énergie. Sur le papier, tout est parfaitement sous contrôle. Dans la réalité… disons que c’est plus lumineux que sécurisé. Cette présentation propose l’analyse d’une application mobile permettant de contrôler l’éclairage public, signaler des zones dangereuses et partager sa position avec des proches. Officiellement, le système est protégé, restreint (et selon son créateur :“impiratable”). Dans les faits, une compréhension même modérée de son fonctionnement permet de contourner les restrictions géographiques et d’activer l’ensemble des lampadaires d’une ville (voire de centaines de communes) sans la moindre authentification. sign Mais ce n’est qu’un début. Des failles critiques permettent également d’identifier des utilisateurs supposément anonymes, de reconstituer leurs habitudes, d’accéder à des événements privés et de manipuler le partage de position en temps réel. À travers une analyse technique rigoureuse et un certain sens de la nuance, ce talk met en lumière une vérité simple : annoncer une sécurité avancée ne suffit pas à la rendre réelle.

MadSquirrel Benoît Forgette

Passionate about how systems work since my childhood and with an initial education in computer science, I gradually moved to the security of these systems and the electronic part of these equipments. Today, I work as a Cybersecurity Engineer in software and hardware reverse engineering at Quarkslab, where my daily work consists in disassembling equipments sent by our clients, then inspecting all their attack surfaces (hardware, radio, software, cloud). Then, we help our clients to find the best way to protect their systems and their equipments. In this work, the part that seems to me the most interesting is the automation/instrumentation/hijacking part. It is fascinating to see how much it is possible to hijack a piece of equipment from its original purpose. This is even more impressive when we talk about physical equipment which has an impact on its environment.

17:45 - 18:30

simple_IMSI-catcher déjà 11 ans! – Oros

Avez-vous déjà tenté de vous infiltrer dans un événement hautement sécurisé ?

Probablement non — nous, si :).

À travers cette conférence, nous verrons comment les dispositifs de sécurité de certains des plus grands événements peuvent être contournés à l’aide de différentes méthodes, outils et techniques, allant de l’OSINT à l’ingénierie sociale.

À partir de cas réels d’intrusions physiques, nous décortiquerons leur architecture : périmètres, zones d’accès, rôles humains, accréditations etc…

Enfin, des démonstrations illustreront comment des dispositifs conçus pour protéger peuvent devenir exploitables dès lors que la validation repose sur des mécanismes humains.

SkyZe

Je suis SkyZe, curieux de nature, j’aime découvrir le fonctionnement des choses, les contourner mais aussi les défendre. C’est pour cela qu’aujourd’hui je suis actuellement Ingénieur Cybersécurité avec une forte passion pour tout ce qui touche de près ou de loin à l’intrusion physique.

18:30 - 18:50

Comment écouter le réseau 3G avec ce que l'on a sous la main ? Avec un récepteur TV, une antenne bricolé, gr-gsm et simple_IMSI-catcher.py !

Oros

Hacker de longue date, je suis membre actif du hacker-space de Rennes. Je touche à tout (électronique, hardware, serveurs, programmation, forensics, pentest, reverse engineering, IA, communications radio).

lelab TRACK View track >

26/06/2026

10:00 - 10:55

BADGE Hackropole – Soudure d'un badge lumineux capacitif Venez découvrir la soudure en assemblant un badge lumineux capacitif. - Soudure d'un microcontrôleur et de 8 LED (composants de surface) au fer à souder, à l'air chaud ou à la plaque chauffante. - Programmation du microcontrôleur avec un micrologiciel WLED pré-configuré. Ce projet de soudure est volontairement gardé simple pour être accessible aux novices.

ATELIER MESURES Découverte et expérimentation autour des instruments de labo : oscilloscope MSO, analyse logique, décodage de protocoles, génération de signaux, glitches, runt pulses, bruit, triggers, radio / signaux numériques selon les envies et le chaos ambiant.

team badge FCSC

The France Cybersecurity Challenge (FCSC) is a CTF organized every year by ANSSI. The FCSC aims to select the best French players to form Team France for the European Cybersecurity Challenge (ECSC).

GadgetMCS

10:05 - 10:55

@RatZillaS will animate a workshop inside the convention center this year!
The theft of hybrid or electric vehicles has increased by 70%, which proves the need to think about the safety of vehicles from their design. The connectivity of these vehicles brings comfort but also new cyber vulnerabilities. These workshops aim to shed light on the state of the threat but also parades to ensure the protection of property, people in and around these vehicles. But no need for a whole vehicule to demonstrate anything when you have a TOYOTA RAMN Board (and skills).

Ratzilla

Hi, I’m RatZillaS aka Gaël Musquet. I’m a Free/Libre Open Source Software/Hardware Westindian Hacker. Hamradio CallID: [FR] F4HXS [US] N6HXS Spokesman of OpenStreetMap France Chairman of HAND – Hackers Against Natural Disasters I’m the founder and CEO of CxLinks a SME specialized in Open[Source|Hardware] embedded systems, part of SmartUp27 hosted by EAC2P, the CIS Unit of French Air Force I love Astronomy, Hamradio, Debian and h4ck1ng stuff. If you would like to get in touch with me for h4ck, crisis management, or hamradio, feel free to send me an email or a tweet. My email address is: gael.musquet -> ratzillas.com GPG:0x76E279EE My Twitter is: @RatZillaS.

11:05 - 11:55

team badge FCSC

The France Cybersecurity Challenge (FCSC) is a CTF organized every year by ANSSI. The FCSC aims to select the best French players to form Team France for the European Cybersecurity Challenge (ECSC).

GadgetMCS

11:05 - 11:55

Ratzilla

12:05 - 12:55

Ratzilla

12:05 - 12:55

WORKSHOP: NFC/RFID Lab

WORKSHOP: Hacking de Tag ESL via esp32

- Installer et utiliser proxmark3
- Utiliser la CLI pour discuter avec un Tag/Lecteur
- Clone de badges (LF, HF)
- Tester les différentes attaques possible en NFC (relay, replay, clone, fuzz…)

Challenge : Cracker plusieurs cibles, à plusieurs niveaux.

Matériel principal : Handheld RFID, Cameleon, Proxmark, Flipper Zero, Cartes Magic, PN532.

Beemo

13:05 - 13:55

- Comprendre le protocole
- Flasher l'esp32 pour interagir avec le tag
- Exploration des différentes fonctionnalités

Matériel principal : Tag ESL, esp32 (M5Stack Cardputer ou C6).

7h30th3r0n3

13:05 - 13:55

Ratzilla

14:05 - 14:55

TALK: IoT Horror Stories: Beneath the Plastic Shell

team badge FCSC

The France Cybersecurity Challenge (FCSC) is a CTF organized every year by ANSSI. The FCSC aims to select the best French players to form Team France for the European Cybersecurity Challenge (ECSC).

GadgetMCS

14:30 - 14:50

For several years now, IoT devices have become part of our daily lives, sometimes even into our most personal spaces. Yet, they are not explored as much as they should be from a security analysis perspective, perhaps due to this plastic shell which could act as a psychological barrier.

"IoT Horror Stories: Beneath the Plastic Shell" offers a hands-on account through a couple of concrete cases, highlighting the horrifying state of security of some low-cost consumer devices (products whose price does not always seem to include security).

Through these examples, this talk also aims to show that this field can be more accessible than one might think. Indeed, the large attack surface of these devices opens up numerous avenues to explore, sometimes without requiring any knowledge of electronics or hardware.

Skander Belabed

15:05 - 15:55

TALK: ESP32 au-delà des limites

team badge FCSC

The France Cybersecurity Challenge (FCSC) is a CTF organized every year by ANSSI. The FCSC aims to select the best French players to form Team France for the European Cybersecurity Challenge (ECSC).

GadgetMCS

15:05 - 15:55

Depuis deux ans et demi, Evil-M5Project transforme les produits M5Stack notament le Cardputer en couteau suisse de la sécurité offensive. 88 modules, 43 000 lignes de C++, 2300+ stars GitHub, le tout sur un ESP32-S3 à 30€ avec clavier, écran et slot SD.
Au menu :

du Wi-Fi avec Evil Twin, Karma Attack, capture de handshakes sur 14 canaux simultanément, Wardriving GPS, Beacon Spam et Deauth
du réseau avec DHCP Starvation, Rogue DHCP, DNS Spoofing, Responder LLMNR/NBNS, WPAD Abuse et crack NTLMv2
du BLE avec Flood, tracking d'AirTags et abuse FindMy
du USB HID avec BadUSB et Mouse Jiggler
de l'IoT avec audit CCTV, toolkit VoIP/SIP, prise de contrôle de vieux drones et interaction avec les étiquettes de prix en infrarouge
et un sniffer EAPOL transformé en IMSI Catcher qui a un peu trop bien fonctionné

Ce talk revient sur le développement du framework, les choix techniques imposés par les contraintes de l'ESP32, et inclut des démonstrations live sur Cardputer. On parlera aussi de comment un simple test Wi-Fi près d'une Freebox a mené à la découverte de la CVE-2025-63292, provoquant la désactivation définitive de FreeWifi_Secure par Free.

7h30th3r0n3

16:05 - 16:55

TALK: Offensive AI on ESP32: Breaking Embedded Limits

team badge FCSC

The France Cybersecurity Challenge (FCSC) is a CTF organized every year by ANSSI. The FCSC aims to select the best French players to form Team France for the European Cybersecurity Challenge (ECSC).

GadgetMCS

16:05 - 16:55

TALK: outil de bypass de protection JTAG (théorie)

Vandal, c'est l'implémentation en pur C d'une plateforme d'analyse RF multi-protocoles basée sur de l'ESP32-S3.

On a soupoudré notre layer-cake cyber avec :
- du WiFi avec injection de trames, deauth, captive_portal, sniffing, scanners et autres surprises
- du Bluetooth BLE 5.0 avec scan de services, monitoring d'attributs et détection de security profile + bruteforce de pin
- du Sub-GHz via CC1101, capture et replay et de beaux waterfall
- du 2.4 GHz via Sx1280 et NRF52840 à venir
- une couche de BadUSB HID ou MSC, complet et pilotable à distance
- une gestion d'ADC 16 bits pour l'attaque physique et l'analyse de signaux
- du messaging juste pour rire ou préparer l'apocalypse
- des stupidités comme une CLI SSH embarquée vu qu'on avait trop de place

Puis on a soupoudré avec du GPS pour le wardriving du pauvre, une SD-Card pour le storage offline — le tout sur un seul SoC, sans laptop hôte, pilotable à distance à l'aide de n'importe quel navigateur web.

Dans ce talk on va aussi parler de stack : pourquoi on a choisi une architecture event-driven autour de l'esp_event_loop, comment s'organise notre code autour de modules et de composants, et pourquoi nous avons choisi une infrastructure clients-serveur.

On terminera par un tour rapide du VANDAL Protocol qu'on s'impose entre les agents et la console. Démos live prévues, et probablement pleins de trucs qui ne fonctionneront pas comme prévu.

x42en

Ben Mz

17:05 - 17:55

Room 3 niveau S3

GotoHack

Croute

17:05 - 17:55

WORKSHOP: Explorer les signaux avec le DigiLab

TALK: KeyProxy : un keylogger physique sécurisé et open-source conçu pour la Red Team

- Installer le DigiLab sur son Flipper Zero
- Tour d'horizon et limitations
- Détecter des grandeurs
- Configurer les retours sensoriels
- Aller plus loin

Matériel nécessaire : Un Flipper Zero par personne, installation propre.

tixlegeek

27/06/2026

10:00 - 10:20

Le keylogger physique est un outil incontournable de l'arsenal Red Team, permettant de profiter d'une intrusion physique réussie afin de collecter facilement des informations sensibles (e.g. mots de passe, noms de serveurs ou d'application critiques, données confidentielles).

Pourtant, les solutions existantes montrent rapidement leurs limites : stockage des logs en clair, Wi Fi impossible à désactiver, nécessité de pré-configurer le mappage clavier et absence de plans de circuit imprimé (e.g. fichiers Gerber) permettant de reproduire le PCB.

Ces limites sont en outre accentuées, pour les produits commerciaux, par un coût d'achat souvent élevé et l'impossibilité d'accéder au code source, rendant impossible l'audit du firmware et l'ajout de nouvelles fonctionnalités. Plusieurs modèles très répandus sont par ailleurs déjà connus, dans la littérature, pour contenir une backdoor non documentée.

Durant ce talk, je proposerai une approche alternative avec KeyProxy, un keylogger physique conçu spécifiquement pour des engagements de Red Team, dont l'objectif est d'être exploitable sur le terrain tout en respectant des contraintes de sécurité fortes (e.g. utilisation de composants facilement accessibles, stockage chiffré des frappes, fonctionnement agnostique du mappage clavier).

Au-delà de l'outil lui-même, ce talk présentera également le fonctionnement du protocole USB HID ainsi qu'un retour d'expérience offensif sur l'usage réel des keyloggers physiques en intrusion.

Rémi GUILLON

10:00 - 10:55

TALK: Getting your first CVE with hardware hacking (the easy way)

team badge FCSC

The France Cybersecurity Challenge (FCSC) is a CTF organized every year by ANSSI. The FCSC aims to select the best French players to form Team France for the European Cybersecurity Challenge (ECSC).

GadgetMCS

10:30 - 10:50

TALK: De la PS Vita au Flipper Zero en quelques milliers de lignes de code

Finding CVEs in open-source projects or bug bounty programs has become extremely competitive. This talk shows an alternative path: hardware and IoT targets that nobody wants to analyze. With minimal budget and basic tools, I will explain how hardware hacking can help you get your first CVE.

Yassine Damiri

11:05 - 11:50

En 2024, un nouvel intérêt spécifique a germé dans mon cerveau : j'adore les consoles de jeux, et j'adore le hacking. Pourquoi n'ai-je jamais exploré le hacking de consoles ?!

J'ai toujours été fasciné par les personnes capables de casser des systèmes de sécurité conçus avec précision par Sony, Microsoft ou Nintendo, et de comprendre leur fonctionnement interne ésotérique au point d'y ajouter, d'y activer ou d'y modifier des fonctionnalités en dehors de ce qui était prévu par le constructeur.

Alors, l'année dernière, j'ai décidé qu'il était enfin temps de contribuer à cette communauté transversale de hackers et de gamers.

Mais trouver de nouvelles façons d'exploiter une console de jeu est à la fois extrêmement chronophage et complexe ; je voulais commencer par quelque chose de réalisable : écrire mon propre logiciel pour une console déjà hackée.

Et quelle meilleure console pour commencer que ma console portable préférée : la PS Vita. Elle dispose d'une superbe communauté de hackers et de développeurs d'homebrews, et même d'un incroyable SDK non officiel !

Alors je sais, c'est une console de jeu ; mais écrire des jeux vidéo c'est un processus incroyablement long et fastidieux. Je voulais quelque chose de simple pour débuter et puisque c'est ce à quoi je consacre une partie non négligeable de mon temps ces jours-ci, j'ai commencé à écrire des outils de hacking et de réseau pour la console, fixant mon premier objectif : un scanner de ports TCP.

Et ensuite, une fois que cela à fonctionné, j'ai visé plus grand.

Ce que je voulais créer, c'était mon propre appareil de type Flipper Zero, via un logiciel intégré dans le corps d'une PlayStation Vita à l'air innocent.

Suivez-moi dans cette aventure, des bases du hacking de consoles PlayStation jusqu'au développement d'outils de sécurité offensive !

Jeremie Amsellem

11:05 - 11:55

TALK: Bootstrapping Kindle research for the lazy attacker

team badge FCSC

The France Cybersecurity Challenge (FCSC) is a CTF organized every year by ANSSI. The FCSC aims to select the best French players to form Team France for the European Cybersecurity Challenge (ECSC).

GadgetMCS

12:05 - 12:50

Room 3 niveau S3

The Kindle is a very popular device with a long history of public jailbreaks. As time went on, Amazon gradually improved the security of its products and jailbreaks became scarcer. This talk presents a new jailbreak, developed to answer a personal question of how to bootstrap research on a closed platform. It targets the latest firmware (at the time of development) and did not rely existing jailbreaks for introspection during development.

The goal of this talk is to provide a window into the thought process of an attacker. Not of the exploitation process itself, but everything around it : why some surface was selected, why some choices were made, why some did not pan out, ... It is oriented towards beginners and towards a wider audience.

Tanguy Dubroca

12:05 - 12:55

WORKSHOP: NFC/RFID Lab

WORKSHOP: Hacking de Tag ESL via esp32

- Installer et utiliser proxmark3
- Utiliser la CLI pour discuter avec un Tag/Lecteur
- Clone de badges (LF, HF)
- Tester les différentes attaques possible en NFC (relay, replay, clone, fuzz…)

Challenge : Cracker plusieurs cibles, à plusieurs niveaux.

Matériel principal : Handheld RFID, Cameleon, Proxmark, Flipper Zero, Cartes Magic, PN532.

Beemo

13:05 - 13:55

- Comprendre le protocole
- Flasher l'esp32 pour interagir avec le tag
- Exploration des différentes fonctionnalités

Matériel principal : Tag pricer, esp32 (M5Stack Cardputer ou C6).

7h30th3r0n3

14:05 - 14:55

team badge FCSC

The France Cybersecurity Challenge (FCSC) is a CTF organized every year by ANSSI. The FCSC aims to select the best French players to form Team France for the European Cybersecurity Challenge (ECSC).

GadgetMCS

14:05 - 14:55

Ratzilla

15:05 - 15:55

team badge FCSC

The France Cybersecurity Challenge (FCSC) is a CTF organized every year by ANSSI. The FCSC aims to select the best French players to form Team France for the European Cybersecurity Challenge (ECSC).

GadgetMCS

15:05 - 15:55

Ratzilla

16:05 - 16:55

Ratzilla

16:05 - 16:55

WORKSHOP: Explorer les signaux avec le DigiLab

team badge FCSC

The France Cybersecurity Challenge (FCSC) is a CTF organized every year by ANSSI. The FCSC aims to select the best French players to form Team France for the European Cybersecurity Challenge (ECSC).

GadgetMCS

17:05 - 17:55

- Installer le DigiLab sur son Flipper Zero
- Tour d'horizon et limitations
- Détecter des grandeurs
- Configurer les retours sensoriels
- Aller plus loin

Matériel nécessaire : Un Flipper Zero par personne, installation propre.

tixlegeek

17:05 - 17:30

WORKSHOP: le top 5 des vulnérabilités IoT est-il réaliste pour un rookie? (DVID)

Ratzilla

18:05 - 20:05

TALK: CyberpunkGuide to hardware hacking

Pendant deux heures, nous explorerons les cinq principales vulnérabilités liées à l'IoT — qu'il s'agisse d'embarqué, de cloud, de mobile, de données ou de processus. L'objectif est de montrer qu'avec très peu de matériel et des compétences de base, il est déjà possible de compromettre un firmware, d'altérer des données ou encore d'élever ses privilèges. La session combinera des apports théoriques, mais fera surtout la part belle à la pratique.

Pré‑requis : Un téléphone et une distribution Linux Kali, accompagnés d'un port USB‑A, devraient suffire pour participer sereinement au workshop.

yggdrasil

18:05 - 18:50

TALK: Offensive AI on ESP32: Breaking Embedded Limits

Vous pouvez tout faire; il suffit d'y passer suffisamment de temps. En attendant, voilà un guide simple pour se lancer dans le hardware.

tixlegeek

19:05 - 19:55

WORKSHOP: Outil de bypass de protection JTAG (pratique)

Vandal, c'est l'implémentation en pur C d'une plateforme d'analyse RF multi-protocoles basée sur de l'ESP32-S3.

On terminera par un tour rapide du VANDAL Protocol qu'on s'impose entre les agents et la console. Démos live prévues, et probablement pleins de trucs qui ne fonctionneront pas comme prévu.

x42en

Ben Mz

20:05 - 20:55

TALK: [>_] Agents in the Basement

Chaque participant démarre avec une plateforme d'attaque et un STM32 vérouillée.

l'objectif : casser la protection RDP et récupérer le firmware en reproduisant des attaques réelles utilisées en laboratoire de sécurité matérielle.

Au programme:

Reverse, protocole SWD et mécanismes internes de la protection RDP ;
Mise en place et calibration de l'attaque F0 : exploitation d'une race condition SWD lors du démarrage à froid ;
Réalisation d'une attaque F1 par glitch d'alimentation afin de provoquer une faute dans l'exécution ;
Injection d'un shellcode en mémoire cible pour contourner les restrictions d'accès ;
Extraction du firmware protégé et analyse des artefacts récupérés ;
Compréhension des primitives d'attaque utilisées dans les laboratoires de hardware hacking et de fault injection.

Pré-requis :

bases de C et Python, curiosité pour le bas niveau. Tout le matériel est fourni. Les squelettes de code sont compilables dans un Docker (kali) ou avec une toolchain arm-none-eabi locale.

Croute

GotoHack

osint TRACK View track >

26/06/2026

10:30 - 11:30

TALK: Sun, Sea, and SQLite: Open-Source Facial Recognition for Fugitive Hunting

AI agents are starting to change OSINT work, not because they replace analysts, but because they can take over parts of the research loop: searching, extracting, comparing sources, drafting briefs, and leaving traces that a human can inspect. This talk presents a practitioner’s view of that shift. It starts with the evolution of cyber horizon scanning from framework-based research and OSINT, to field intelligence and LLM-assisted synthesis, and now to supervised agentic workflows. Using the example of vulnerability research, it will discuss possible architectures built with currently available tools: local agents, web search, controlled tool access, locally hosted language models, cloud model escalation, and evidence traces that support human review. The talk will focus on architecture, token and privacy strategy, local versus cloud model routing, harnesses, evaluation loops, and the limits of automation. It ends with the next question: once agents help govern research workflows, how do we keep human judgment visible and accountable?

Sergio Coronado

Prof Dr Sergio Coronado is an internationally recognised expert in Information Technology and Communications with more than 35 years of experience across IT Strategy, Digital Leadership, Cloud Technologies, Cybersecurity, AI and Education. He is CIO at the NATO Support and Procurement Agency (NSPA) and an Assistant Professor (associé) at the University of Luxembourg, where he teaches Advanced Project Management and Cybersecurity Risk Management. Sergio holds a PhD in Industrial Engineering, an MSc in Software Engineering, a Certificate in Corporate Governance from INSEAD Business School, an MA in Clinical Psychology and Education, and a BSc in Electrical Engineering. In his free time, Sergio contributes to developing Luxembourg’s future digital talent through the Luxembourg Tech School (LTS) non-profit. Since 2016, LTS has grown from 30 students to more than 1.700 today, expanding from a one-year programme to a three-year programme covering Game Development, AI, FinTech, Robotics, Emerging Tech, Creative Coding, Digital Thinking and Interaction Design. The initiative also supports kids and adults with special needs, including autism, mental disabilities and neurodiversity.

11:30 - 12:30

TALK: Needle in a haystack: influence operations hiding in a dataset of 10 million users

This talk will demonstrate a research project focused on transforming everyday tourist videos and walking tours into an automated investigative tool for tracking international fugitives. Attendees will discover how high-definition public footage can be leveraged for open-source intelligence, turning casual holiday backdrops into an effective search mechanism. By attending this session, you will explore a unique proof of concept for a localised facial recognition pipeline designed to scan video content for specific targets. You will walk away with a practical framework for automating target identification, understanding how open-source data can be harnessed to uncover individuals hiding in plain sight.

Joshua Richards

Joshua Richards is the founder of OSINT Praxis, where he specialises in digital footprint management, privacy consulting, and training. With over a decade dedicated to helping individuals and businesses understand their online exposure, Joshua focuses on identifying and fixing the vulnerabilities that most people don’t know exist. His approach combines technical precision with a passion for the human side of security. With experience spanning both the public and private sectors, Joshua brings a grounded and practical perspective to his work. In addition to his consulting, he is a member of the leadership team for the UK OSINT Community, helping to shape the future of the industry through education and collaboration.

13:30 - 14:30

TALK: Decoding China’s OSINT Ecosystem

Analyzing manipulation campaigns on social media is a complex topic, especially when you want to draw an accurate and complete picture of the operation. Inauthentic accounts and posts are diluted in a huge ocean of legitimate content, but what if we had the ability to scan the entire ocean? In this talk, we will demonstrate 4 cases where we managed to uncover influence operations by using algorithms on very large datasets, including our findings on the infamous Russian operation against the 2024 Romanian elections.

Clément Hammel

Clément and Mathis are co-founders of Agoratlas, a French agency specialized in analyzing social media data at very large scales. In collaboration with authorities and press organizations, they have uncovered online campaigns in several countries that were attacking the core of democracy, especially through their elections.

Mathis Hammel

14:30 - 15:30

TALK: Fight for Facts! Investigations at Reporters Without Borders (RSF)

This session dives into China’s OSINT ecosystem: how public and private actors intertwine to equip the Party-state with powerful capabilities to collect and exploit publicly available data. We’ll unpack the tools, workflows, and partnerships that sustain this system, with a particular focus on how information is extracted and processed from Chinese sources

Côme

Côme is the Global Engagement Manager at Tadaweb, the Operating System for OSINT.

15:30 - 16:30

CTF: Tracelabs Search Party

As the mandate of Reporters sans frontières (RSF) has expanded, the organization launched its own investigations desk in 2022. Today, RSF is allocating dedicated resources and building innovative partnerships to take a deep dive into crimes committed against journalists, expose disinformation and propaganda operations, investigate the misuse of surveillance technologies, and shed light on the forces undermining media independence and pluralism. OSINT techniques have become part of RSF’s everyday investigative toolkit. This conference will offer a first glimpse behind the scenes of RSF’s investigative work: how facts are tracked and turned into impactful stories.

Arnaud Froger

Arnaud Froger heads the Investigations Desk at Reporters Without Borders, which he created in 2022 to strengthen RSF’s ability to produce compelling investigations and support the organization’s advocacy strategy. He joined RSF in 2018 as Head of the Africa Desk. Previously, he worked as a reporter for several international news organizations, including RFI and France 24 mainly on the African continent, where he lived for around seven years.

18:00 - 21:00

TALK: From Open Data to Evidence

Help find the missing. Join the Trace Labs Search Party CTF at leHACK! The Trace Labs Search Party is a unique OSINT CTF where participants investigate real missing persons cases using open-source intelligence techniques. The intelligence gathered during the event is shared with partner organizations assisting families and law enforcement. Free and exclusively available to in-person leHACK attendees. Come learn, collaborate, and put your OSINT skills to work for a meaningful cause. A huge thank you to LGDD for supporting the event and serving as Trace Labs Coaches.

TRACELABS

Trace Labs is a nonprofit organization whose mission is to accelerate the family reunification of missing persons while training members in the tradecraft of open source intelligence (OSINT).

27/06/2026

10:30 - 11:30

TALK: The Phisher’s Inbox: Reading Telegram Exfiltration Channels with the Bot Token

Lorand Bodo is an international civil servant at the International, Impartial and Independent Mechanism for Syria (IIIM), where he works as an Internet Resources Analyst. In a personal capacity, Lorand Bodo will discuss the role of open source investigations in accountability efforts at the international level, drawing on practical experience in building investigative capacity, developing analytical workflows, and training initiatives. The talk will highlight how organizations can leverage open sources to support evidence-based investigations.

Lorand Bodo

Lorand Bodo is a multilingual OSINT analyst currently serving as an Internet Resources Analyst with the United Nations. With experience across both the public and private sectors, Lorand has worked on a wide range of thematic areas, including counterterrorism, mis- and disinformation, environmental crime, and currently accountability-related work. In addition, he has been highly actively engaged in the global OSINT community through various initiatives, contributing to knowledge-sharing, training, and the advancement of open source investigative practices.

11:30 - 12:30

TALK: On the information frontline. A human and digital investigation in the Russian-speaking region of Gagauzia (Moldova)

Phishing kits increasingly send stolen credentials straight into Telegram, posting them to a bot the operator controls. That design is also the weakness: anyone holding the bot token reads the same channel the operator does. At scale, that access becomes a view across the whole ecosystem, kept strictly aggregate: which sectors and regions the stolen data concentrates in, how large the victim pools actually are, and what the channels expose about the operators, who range from organized crews to people who plainly do not grasp the tool they deploy and keep treating their exfiltration feed as the private space it never was.

Oleg O.

Oleg O. is a French cyber threat intelligence analyst specializing in Russian-speaking cybercrime and the broader Russian-language cybercriminal ecosystem. His research focuses on all aspects of this underground ecosystem, including ransomware operations, underground forums, bulletproof hosting services (BPH), illicit cryptocurrency exchanges, and money laundering techniques. He is the founder and editor of CybercrimeDiaries.com blog, where he publishes in-depth analyses and case studies based on my investigations. He is also a member of the Curated Intelligence research group, a collective of threat intelligence professionals sharing open-source research.

14:00 - 15:00

TALK: The Digital Armoury; Mapping the Global 3D-Printed Firearms Movement

This study offers a cross-analysis of the circulation and reception of Russian and pro-Russian narratives in Moldova. The country currently serves as a testing ground for Russia to trial new techniques that are subsequently rolled out in other countries. It is also viewed by Moscow as a vulnerability for Europe, given that some of its citizens are able to move freely both within Russian-occupied Transnistria and within the Schengen Area. The investigation focused on Gagauzia, a southern region where a sense of marginalisation vis-à-vis Chișinău and Europe creates fertile ground for the penetration of Russian narratives. It combines ethnographic fieldwork with a digital investigation utilising cyber and OSINT methods, and has enabled us to uncover manoeuvres relying on clandestine broadcasting equipment, as well as Russian, Chinese and possibly even Iranian cybercriminal networks, used to disseminate narratives in Gagauzia.

Kélian Sanz Pascual

Kélian SANZ PASCUAL is head of Russian affairs at Cassini and PhD Student at GEODE. His research focuses on how Russia uses ICT to pursue its imperialist policy. As part of his work at Cassini, he also studies Russian influence operations and networks of actors such as the former Prigozhin ‘galaxy’, the SDA, Russian ‘ANOs’ and the Russian presidential administration.

Kevin Limonier

Kevin Limonier is a professor of geography at the French Institute of Geopolitics (University of Paris 8). He is also deputy director of GEODE, one of two Centres of Excellence selected in 2020 by the Ministry of the Armed Forces to promote the next generation of strategic talent in France.He is also scientific director of the Russian-speaking Infosphere Observatory, a member of the Russia Programme at George Washington University, and a founding partner of the cartography firm Cassini. He lectures on cyber issues at several training programmes (Saint-Cyr Coëtquidan, etc.) and for several years taught geography and geopolitics at the Russian State University for the Humanities (RGGU, Moscow). His research focuses on the development of new methods for mapping cyberspace and digital investigation (OSINT) in the post-Soviet context (Mapping Power in the Digital Age: Investigations and Explorations in Russian Cyberspace, to be published by CNRS Editions in 2026).

15:00 - 16:00

TALK: Hunting spies for a living

The Digital Armoury maps the brief history of the global 3D-printed firearms ecosystem, from designers and design communities to files, distribution platforms, physical objects, end users, and emerging practices. The talk examines how digital designs circulate, evolve, and materialize, and how OSINT can help researchers and security professionals better understand the connection between the online movement and its potential real-world consequences.

Zoltán Füredi

Founder of Deep Layer Lab and veteran aviation security professional focused on the evolving threat of 3D-printed firearms and their adjacent digital ecosystems. Creator of tools supporting the detection, analysis, and structured understanding of emerging additive-manufacturing-related threats.

16:00 - 17:00

How OSINT can help identify Russian spies in journalistic investigations : ethical considerations and real-world examples.

Nicolas Quenel

Nicolas Quenel is a french investigative journalist. He’s been working on russian intelligence activities for six years and had exposed a dozen of spies and operations targeting France and Europe.

17:00 - 19:30

TALK: Rumps

WORKSHOP: GeoGuessr Party

RUMPS are small talk sessions, where you can freely grab the mic to present random speech about hacking without control, censorship, pressure, and inside a 'plausible deniability' setup. No lineup, no recording, no endorsements, anonymity is guaranteed if needed but you bring your own countermeasures (face mask allowed). You take all responsibility for the topic you present, leHACK isn’t responsible for your speech, be wise and don’t break the law. See you on Louis Armand room, on S3 level, starting Saturday 27/06/2026 from 17:00 to 19:30. Format : 5 minutes, ABSOLUTELY NO CAMERA, NO RECORDING! We will enforce this and immediately remove offenders without warning. Send us your speech hints at CFP before Saturday noon !

28/06/2026

01:00 - 02:30

Come learn and show off your GeoGuessr skills at this IRL workshop organized by OpenFacto.

OpenFacto

workshops TRACK View track >

26/06/2026

13:00 - 16:00

Red Team Alliance is coming to LeHack Paris! Ever wondered what physical penetration testers actually do? Come experience it for yourself. Stop by our booth to watch our experts in action and learn how we train the best of the best. Live demonstrations, conversations with the team, and a look inside a profession few people ever get to see. We'll be waiting at LeHack. Come say Hello!

Red Team Alliance

World renowned red team instructors giving world class instruction and providing field-tested tools.

17:00 - 20:00

Red Team Alliance

World renowned red team instructors giving world class instruction and providing field-tested tools.

27/06/2026

13:00 - 16:00

Red Team Alliance

World renowned red team instructors giving world class instruction and providing field-tested tools.

17:00 - 22:00