Europe’s most successful ethical hackers and an iconic luxury fashion house proved an irresistible combination for our most glamorous Live Bug Bounty yet.

From the Paris headquarters of Louis Vuitton, around 40 high-ranking hunters deployed their eclectic skills to produce an impressive variety of findings at the second edition of YesWeHack’s ‘Hack Me I'm Famous’.

Louis Vuitton has declared itself delighted with the results – a reflection of the calibre of the hunters, the time (30 hours) and productive setting for hunting, and the target’s commitment to making its internet-facing applications as secure as possible.

YesWeHack keeps Live Bug Bounty targets under wraps until the last-possible moment. This prevents hunters performing pre-event reconnaissance on the targets to get a head start.

On day one, the hunters were kitted out in stylish, baseball-style jackets customised with their hacker alias, before being led to the mystery venue. En route, some excitedly speculated, aided by Google Maps, which nearby organisation might be welcoming them. A famous company? A government agency?

It was no anticlimax when Louis Vuitton’s impressive headquarters heaved into view.

Founded in 1854, Louis Vuitton’s clothing, bags, jewellery, perfume and other fashion items are instantly recognisable worldwide via its iconic LV monogram. The haute couture pioneer is part of LVMH group, the world’s largest luxury fashion multinational.

If the Live Bug Bounty target excels in its field, then so too do the hunters carefully handpicked for the occasion. Ten of YesWeHack’s all-time top 25 performers were enlisted, although hunters were chosen not just for their leaderboard ranking, but also for the relevance of their skillset to the scopes at hand.

Louis Vuitton was a tantalising target – and not only because of the lustre of the brand itself.

Unusually in its industry (and most industries), Louis Vuitton develops most of its digital assets internally. Adding to the anticipation for the Live Bug Bounty was an API among the scopes that had not been part of the private Bug Bounty Program.

Partly thanks to some participants’ familiarity with the scopes via the private program, the reports started rolling in relatively early. Vulnerabilities were surfaced throughout, with the final report submitted in the last few seconds of the competition.

Just 30 minutes later the Louis Vuitton team had, with YesWeHack’s support, reproduced and assessed all vulnerabilities.

The hackers seemed particularly laser-focused as they hacked for 30 hours with infrequent breaks for food, socialising and sleep.

And yet, they were still happy to take time out to patiently explain their findings to Louis Vuitton security teams during their event. There were also ‘show and tell’ presentations of the most significant vulnerabilities at the end.

“What makes this type of event unique is the intense interaction and collaboration that we saw between the researchers and Louis Vuitton security teams,” said Adrien Jeanneau, head of security analysts and researcher enablement. “We saw some great exchanges between them, and everyone appreciated it! The hunters and security teams delved deep into technical discussions about the findings, even though time was limited.” 

Alongside the hacking event, staff from various departments attended demonstrations and interactive workshops about the Live Bug Bounty, phishing attacks and protecting the brand’s global internet assets, among other things.

This, and the attentive engagement throughout of Louis Vuitton’s CIO and CISO, revealed a corporate culture that takes security very seriously – organisation-wide.

 were occupied by a Spanish trio who collaborated throughout the event and notched 26 bugs and 23 rewards apiece. Collectively the hunters reported 133 bugs in total.

YesWeHack and Louis Vuitton created special awards for notable achievements at the Live Bug Bounty, with the winners taking home YesWeHack souvenirs created for the event. Congratulations to the winners:

🧥 Shellcode Stylist (1st place): Diego Bernal Adelantado aka GoDiego

🧵 Exploit Tailor (2nd place): Diego Jurado Pallarés aka djurado

🎀 Pwnage Designer (3rd place): Carlos Rivero Molina aka hipotermia

🧶 Patchwork Pwners (team with highest points): GoDiego, djurado and hipotermia

💎 Best-Dressed Bug (biggest impact): HakuPiku

👜 Bug Trend-Setter (first valid bug): GoDiego

Christophe Plouseau, Chief Information Officer (CIO) of Louis Vuitton, said:

“This is the very first time a luxury brand has organised such an event, so I am very proud of LV_NEO Teams [Louis Vuitton’s tech team]. We were already in the forefront of cybersecurity and this event is testament that we take cybersecurity and cyber threats seriously, especially in the context of the Paris Olympic Games coming soon, where French firms will be the main target of hackers.

“This was also a tremendous opportunity to have the crème de la crème of hackers with us, to share with all LV employees tips and tricks for what they should do in their personal and professional life to mitigate cyber risk, and share what Louis Vuitton does to protect the company’s assets and information systems.”

The hunters also offered their thoughts on the event:

“The experience has been top-notch. I believe we found good bugs… the Louis Vuitton team are great. I would like to thank the YesWeHack team again for the great facilitation of the event, the rewards, the communication.”

“The office is extremely huge and beautiful so we were all looking [forward] to hunt in this place. I really enjoyed the event, honestly. I have the luck to hunt with a lot of friends.”

“This is my first experience with a live hacking event and it is an amazing event. It was possible to improve my knowledge. The place is very beautiful. Nice food, nice scope, very nice people. Fantastic hackers and friends.”

“I knew that they had a quite huge scope. So it was a great feeling knowing there is going to be a lot to hack on, probably not as many duplicates. I’d like to thank YesWeHack for inviting me to this very exclusive event and I want to thank Louis Vuitton for hosting us here at their headquarters.”

And finally, from YesWeHack: a big thank you to all participating hunters, Louis Vuitton and all partners for making this event a such as huge success.

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

Having access to your target’s source code is obviously an invaluable advantage of white-box penetration testing.

This article will help you leverage that benefit in the context of PHP applications and using the Xdebug PHP debugger.

Specifically, you will learn how to set up a PHP web application within a docker environment; how to set up 

; how to detect PHP vulnerabilities using Xdebug; common PHP vulnerabilities; and how to leverage your white-box pentest findings to enhance future black-box testing.

Follow these steps to not only unearth vulnerabilities during white-box engagements, but to also craft custom payloads you can unleash to great effect in future black-box tests.

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

CWE-624: Executable Regular Expression Error

CWE-434: Unrestricted Upload of File with Dangerous Type

Improve future black-box testing with code analysis

Visual Studio Code (VS Code) (or your preferred IDE)

Once you have installed Visual Studio Code, you can install the Xdebug extension from the extension tab on the left-hand side. Simply search for "

For our demonstration, we will use a vulnerable PHP code snippet from YesWeHack’s 

 Github repository (which also contains snippets written in a variety of other programming languages).

If you are completely new to using Xdebug, we recommend using the same snippet: 

. Otherwise, feel free to take a different code snippet that better suits your preferences.

Our project will use the following file structure: 

Certain files are extra-important and must be added or modified, including:

This will be the Xdebug listener configuration that is used inside Visual Studio Code on our host system.

This file contains the configurations for our vulnerable web application, which is running inside a docker container.

As well as building the docker image, the Dockerfile installs and activates PHP Xdebug inside the docker container.

To this file we will add our host’s hostname to enable our docker container to communicate with Xdebug, which will be hosted by our host system in Visual Studio Code.

 folder provided, we will create a new file in 

, we will add the code below immediately under the first line (which is: 

). This will allow us to install and enable Xdebug in our vulnerable docker container.

 file will be used to set up services for the docker container to run and make the PHP web application accessible via port 

 parameter and the value we give it is used to enable the docker container to communicate with our host system, where the Xdebug listener is running in our Visual Studio Code IDE.

Take note that we added two final lines to the 

Now our setup is ready, we can start debugging our vulnerable web application.

To make sure our debugger works, we will open Visual Studio Code on our host system and set a couple of breakpoints in the vulnerable code snippet. You can do this by simply clicking on the left side of the line number identifiers. This will make red dots appear, as you can see in the image below. This red dot represents a breakpoint that our debugger will stop at.

When a HTTP request is sent by a client to the vulnerable web application, our debugger will stop at our first breakpoint (

) and display all necessary debugging information.

We can trigger the Xdebug listener in Visual Studio Code by sending a HTTP request to our vulnerable web application with curl:

If you want to debug a HTTP request in Visual Studio Code, make sure you include the cookie 

 before you send it. This tells our Xdebug listener to start debugging. It will stop debugging at the first breakpoint, which is triggered by our HTTP request.

Xdebug is a great tool to use both for development and white box penetration testing. By providing a detailed overview of debugging results generated from each code section encountered, this utility means you, as a penetration tester, can more easily see where your input is used and how the payload is modified.

By using our previously described setup (see ‘

’), we can now start analysing our vulnerable code.

Let’s start by sending another HTTP request with curl, this time with a simple SQL injection payload (

After sending this HTTP request we can see that it hit our source code and, in the left sidebar, that our 

 parameter’s value has been determined by our payload.

Next, by pressing the curved blue arrow (second blue icon from the left) in the debug bar (on the top-left of Visual Studio Code by default), we will jump to the second breakpoint we set in the source code.

Continue pressing the arrow until you reach line 

 as shown in the image below. Then right click on the 

Once added to the Watch section, these two variables will appear at the bottom left under the debug sidebar.

We are now monitoring these two variables because 

 is the character to be escaped. If our payload contains the value presented in the variable 

, a backslash will be added before all characters within the payload (this backslash is the 

Continue pressing the blue debug arrow until the 

). This indicates that this character should be escaped in the next loop, and our payload should be modified by the filter.

Press the blue debug arrow again and you will see that our payload was modified by the filter, as shown in the image below:

 character, which it just used to escape our single quote (

) character. This means that, for the next loop, it should escape the backslash character in our payload.

As you can see below, this is exactly what happens. The backslash character 

 replace the backslash character that was previously used to escape our single quote. This makes our current backslash escape itself in the payload, leaving the single quote character unescaped.

By pressing the blue debug arrow one more time, we can see that we have jumped outside the filter and that our final payload remains as:

Finally, we stop the debugging process by pressing the red square in the debug field. We can then see that our curl contains the results from the 

Below are three of the most common weaknesses associated with the PHP programming language.

: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

The application uses input data that can be controlled by the user. This input value is then later used within an include, require or similar function. 

An attacker can exploit this by creating a specific value that dupes the application into including an unintended file, which can then be used to obtain arbitrary file reads or, in most cases, a remote code execution (RCE). This vulnerability is mainly known as Local/Remote File Inclusion.

In PHP below version 7 the regex modifier 

 was supported. This regex modifier made it possible to execute pure PHP code. As an example, this vulnerable code snippet below (if it's running a PHP version below 7) would be vulnerable to a code injection vulnerability.

White-box penetration testing with Xdebug: Debugging for PHP vulnerabilities

The world’s largest cosmetics and personal care company is the latest illustrious brand to enjoy the benefits of a live Bug Bounty with YesWeHack.

Websites, APIs and mobile apps belonging to L'Oréal are now significantly hardened thanks to the discovery of 71 vulnerabilities during an 18-hour event at the LeHack conference last week.

The live hacking event in Paris began at 10am on day two of LeHack (7 July) and concluded at 4am the following morning after some intensive triaging. The rewards grid went up to €5,000.

The scopes comprised a representative sample of L’Oréal’s most business-critical assets, including:

E-commerce websites for various brands and markets, built on different core technologies

Technologies highly specific to L’Oréal that process sensitive customer data

Impressed by the initial findings, L’Oréal’s security team extended the scope early in the evening to maximise the talent and unique opportunity available – a decision vindicated by the submission of some invaluable findings as the event drew to a close. Most notably, credentials were available for one added scope – an uncommon move for a live hacking event – which allowed hunters to dig deep into a new application and make some intriguing discoveries.

More than 50 YesWeHack-registered hunters kicked off the event and around 100 took part overall, with 31 making it onto the leaderboard.

 by a huge margin in his first-ever live hacking event (although he 

 until the second half of the event). He notched 142 points via nine bug reports.

In second place, ‘Borgi’ accrued 49 points from six vulnerabilities, while third on the podium was ‘cosades’, who scored 45 points from three reports.

However, the leaderboard is only one part of the story of live Bug Bounties, which are as much about (if not more so) collaboration and community.

“It was really nice to meet [fellow hunters] again and to discuss with some managers of programs I'm used to hunting on,” said ‘Aituglo’, one of the participants, in a 

Aituglo said his own pre-event automation work and the support of his peers paid dividends for L’Oréal. A custom plugin helped him “get a hit for an XSS” within five minutes of starting his hunt, then “with the help of some friends, I got a nice PoC to steal the password of the user”.

Despite the generous bounties on offer, Aituglo said that making “a lot of money” was not the overriding incentive. It’s “more to discuss and see your friends, hunt together and so on”.

“Thank you for this wonderful event. It was a pleasant surprise and an honour to top the leaderboard. This motivates me to continue learning and improving.

“It was my first in-person event in cybersecurity, and it was really exciting. The other participants were all friendly and warm. The event was well structured, with responsive support. A very positive and enriching experience.”

The event was also “an enriching experience for another hunter, @dropn0w, who 

 on X: “We learned many valuable lessons and measured our skills against the best hackers in France.”

Guillaume Kermarrec, threat and vulnerability manager at L'Oréal’s CyberDefence Center, and in charge of L'Oréal’s Bug Bounty Programs, said:

“The key benefits were meeting the security researchers, meeting the triage team, and working together to find and fix some complex vulnerabilities. We focused on our most critical websites, both global websites and from different regions, B2B and B2C, and some uncovered assets like APIs and mobile applications. Thanks to this live event we could test some new scopes with very specific configurations that couldn’t be added to our continuous program. We have found some interesting vulnerabilities at the live hacking event.”

Fabio Bührer, global application security manager at L'Oréal’s CyberDefence Center:

“The scopes have been tested in the past and now there’s a lot of good people here going through the scopes to see if there’s anything that needs to be taken care of. It’s good to meet the people who work on the program virtually and and see that they actually exist – they’re not just an avatar or AI! YesWeHack did a great job of organising this.”

From YesWeHack, a sincere and heartfelt thanks to all participants for helping to secure the digital assets of L'Oréal, the personal data of L'Oréal customers, and the global internet as a whole.

The L'Oréal event follows a recent Live Bug Bounty held for a similarly glamorous and legendary French brand: Louis Vuitton, which was more than satisfied with the outcome of 

YesWeHack’s second ‘Hack Me I'm Famous’ event

. This in turn came hot on the heels of a 

 in the scopes of Groupe Caisse des Dépôts (CDC), a French public financial institution, at InCyber Forum (FIC) Europe. The targets for LeHack 2023, meanwhile, were provided by the

 French Red Cross and retail distribution giant Les Mousquetaires Group

 and also yielded an impressive bug haul.

YesWeHack also welcomed a steady stream of ethical hackers, security researchers and other security professionals at our LeHack booth, in Cité des sciences et de l'industrie.

 CTF training platforms, we gave away countless t-shirts and other swag. Other sought-after merch was exclusively available to anyone who managed to take on our claw machine (pictured) and triumph.

Finally, many thanks to our tech ambassador, BitK, for the CTF he created exclusively for LeHack attendees (the ‘Pandemic CTF’).

L'Oréal lauds live Bug Bounty success at LeHack 2024

 has recounted how an attack on his own home network led him to uncover how an attacker could have breached 

The US telco that supplied the modems, Cox Communications, said it found no history of abuse of the relevant attack vector, patched the issue rapidly and promised a comprehensive security review, according to Curry.

“This series of vulnerabilities demonstrated a way in which a fully external attacker with no prerequisites could've executed commands and modified the settings of millions of modems, accessed any business customer's PII, and gained essentially the same permissions of an ISP support team,” wrote Curry in his latest 

Curry’s latest tour de force was the lead story in our latest 

, a monthly LinkedIn roundup of notable security research, new hunting opportunities, and hacking advice and inspiration.

The next story saw the Federation of American Scientists (FAD) urge Congress to establish 

 and create a safe harbour for research on generative AI platforms.

“While Congress encourages companies to provide bug bounties and protections for security research, this is not yet the case for AI safety research,” 

. AI companies were criticised for “implicitly threatening to ban independent researchers that demonstrate safety flaws in their systems,” and failing to “adequately test their models after they are deployed as part of an evolving product or service”.

Meanwhile, a patch was issued for a remote code execution vulnerability in PHP CGI that affects XAMPP for Windows by default, allowing unauthenticated attackers to execute arbitrary code on remote XAMPP servers through specific character sequences, reveals a 

“This vulnerability is incredibly simple, but that’s also what makes it interesting,” 

said renowned DEVCORE researcher Orange Tsai on his blog

. “Who would have thought that a patch, which has been reviewed and proven secure for the past 12 years, could be bypassed due to a minor Windows feature? I believe this feature could lead to more potential vulnerabilities.” Watchtowr Labs 

 the vulnerability and its implications further.

 secure communications suite has resurfaced, zombie-like, to 

expose an estimated 700,000 Linux-based systems

 to the risk of “full system compromise”. Downstream vendors are have been rushing out patches for the aptly dubbed 'RegreSSHion' RCE (CVE-2024-6387), which is a signal handler race condition in OpenSSH’s server (sshd). The OpenSSH team seemingly reintroduced a long-ago patched flaw (CVE-2006-5051) by mistake in a 2020 software update.

While the high severity (CVSS 8.1) issue’s impact is potentially enormous, exploitation could potentially take “approximately 10,000 attempts on average to succeed," 

, co-founder and CTO at Contrast Security, reassuringly. The issue was 

. In a recent development, it has emerged that a circulating proof-of-concept (PoC) purporting to be an exploit for CVE-2024-6387 is in reality a “trap” for security researchers, 

Nearly 30 popular apps (and potentially more as yet untested apps) and an iOS feature were vulnerable to an attack in which any installed 

 from the Apple App Store could perform a user account takeover, according to 

: “This vulnerability exploits the nuances of the OAuth protocol and iOS’s handling of Custom URL Schemes and Safari browser sessions to steal OAuth Authentication Codes from vulnerable OAuth implementations, thereby allowing an attacker to gain access to a victim’s account.” He also notes: “Unless Apple changes the behavior of ASWebAuthenticationSession, the onus is on developers to mitigate this".

A vulnerability in the Lua implementation of 

) construction and management simulation game, potentially allowed a malicious server to obtain arbitrary execution on clients, according to a researcher. Now patched, the bug is dissected in a post 

 as “one of the best exploit development write ups I've read” by one infosec redditor, which concludes with a gamified challenge to practice the techniques explored.

, Soroush Dalili, who assisted with PortSwigger’s 

, explores a scenario where the “aggregate” function in MongoDB is exposed and vulnerable to NoSQL injection attacks, increasing the impact by allowing adding or updated data, or reading data from, other collections.

A developer recently made popular open source project 'ip' read-only after “someone filed a dubious CVE about my 

” and being inundated with messages about the bug. 

 that this reflects an uptick in open source developers “receiving debatable or, in some cases, outright bogus CVE reports filed for their projects without confirmation”.

 allegedly targeted hundreds of thousands of its own customers with malware in a bid to stop them using torrenting sites, in a story first reported by a local media outlets.

 from Shubham Shah of AssetNote which will contextually insert “junk data” into your HTTP request inside the repeater tab. You can select from a preset amount of junk data you want inserted, or you can insert an arbitrary amount of junk data by selecting the "Custom" option.

, there are some Bug Bounty disclosures with unusual twists involving 

crypto exchange, as well as a new Bug Bounty Program for large language models (LLMs), and an interesting report on the growing role of 

 in capture-the-flag competitions and Bug Bounty Programs.

We’ve handcrafted some of our own hacker-focused content, as per usual, so behold: our latest bug hunter interview below (Swedish bug hunter Eldar Zeynalli, aka ‘

‘The Art of Bypassing WAFs’ from NahamCon 2024 (watch below)

, delivered by our very own in-house hunter, 

, which awards YesWeHack swag to the three best write-ups, is 

Submit your solution by 2 August to participate.

Congratulations to the winners of last month’s ‘

’ challenge: ‘Memset’, ‘Weac’ and ‘Kix29’. Kudos also to ‘lr04d’ for the first valid critical report within a mobile scope on a public program – leaving just one achievement (prize: exclusive swag pack) on our 

: discovering a valid critical bug on YesWeHack’s public program.

For Bug Bounty hunting proper, we’ve a pair of new public programs to flag, both operated by

 one of India’s leading crypto exchanges

 and offering $2,000 for critical vulnerabilities: for the

 crypto exchange platform and CoinDCX’s orchestration layer of Web3, 

 of our latest Live Bug Bounty marathon, this time with L’Oreal, which took place at LeHack in Paris over the weekend.

Read this monthly roundup of content aimed at ethical hackers even sooner by subscribing to 

Are you a CISO, other security professional or security-conscious dev? Check out our CISO-focused sister newsletter, 

 – bringing you news, insights and inspiration around offensive security topics like Bug Bounty, vulnerability disclosure and management, pentest management and attack surface protection.

Sam Curry modem masterclass, PHP threat to Windows Servers, Calls for AI safety Bug Bounties – ethical hacker news roundup

YesWeHack has migrated its platform architecture to a private cloud service that is fully compliant with SecNumCloud, a super-stringent security qualification overseen by France’s cybersecurity agency.

This effectively means YesWeHack now enjoys protections for sensitive data, and against downtime, at elevated levels intended for government agencies and critical infrastructure.

Moreover, our customers’ data will continue to be stored only within the EU thanks to SecNumCloud’s rigorous rules around data sovereignty.

The SecNumCloud-qualified service is now provided by Infrastructure-as-a-Service (IaaS) specialist OVHcloud, which was named the European leader in the hosted private cloud market in 2020 by market research firm Forrester.

The SecNumCloud initiative was launched in 2013 by ANSSI, the French cybersecurity agency, to protect the data being outsourced to third parties in increasing volumes by government entities and critical national infrastructure.

have been instructed to choose only SecNumCloud (or other European equivalent)-qualified providers

 when seeking commercial cloud storage for highly sensitive data.

As such, the qualification has extremely demanding criteria that offers high levels of assurance to any customer, whatever their sector or risk profile.

SecNumCloud could soon be succeeded by an equivalent EU-wide scheme, the proposed EUCS (European Cybersecurity Certification Scheme for Cloud Services). However, since the EUCS has been partly modelled on the French scheme, SecNumCloud-qualified providers will have a huge head start on non-qualified providers in gaining EUCS qualification.

 (PDF) comprises 360 security requirements, covering areas such as information security and risk management, encryption mechanisms, incident response and business continuity.

A multi-stage qualification process begins with a rigorous audit of security policies and controls. The cloud provider must then implement any recommendations made after the audit. Qualification is attained following a final audit and ANSSI validation.

This exhaustive process must be repeated every three years to renew qualification, with annual audits in between validating ongoing compliance. 

Only six providers have achieved qualification so far

SecNumCloud prescribes that providers must be headquartered, and store and process data, within the EU. It also precludes majority foreign-owned providers from being SecNumCloud-qualified.

YesWeHack’s own strict compliance with the EU’s strict security and data privacy laws offers strong assurance to EU- and non-EU customers alike. YesWeHack also recently gained 

CREST accreditation for pentesting services

The YesWeHack Blog

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

White-box penetration testing with Xdebug: Debugging for PHP vulnerabilities

L'Oréal lauds live Bug Bounty success at LeHack 2024

Hack Me I’m Famous #2: Louis Vuitton sets trend with first live hacking event in luxury fashion sector

Sam Curry modem masterclass, PHP threat to Windows Servers, Calls for AI safety Bug Bounties – ethical hacker news roundup

Critical infrastructure-level protections for YesWeHack cloud after switch to SecNumCloud-qualified service

Apple declines to pay Kaspersky vuln reward, Bug Bounty ‘extortion’ dispute, Microsoft Recall backlash – OffSec roundup for CISOs

Sam Curry modem masterclass, PHP threat to Windows Servers, Calls for AI safety Bug Bounties – ethical hacker news roundup

Dojo challenge #33 winners!

Countdown to NIS 2 compliance: Key insights and implications for your SecOps strategy

YesWeHack lève 26 millions d'euros pour accélérer sa croissance et son expansion internationale

Dojo challenge #33 winners!

Don't wait for threats to strike

Produits

Chercheurs

Ressources

A propos

Suivez-nous