Bastien Faure retweeted
AD Pentest mindmap upgrade :
Full version: github.com/Orange-Cyberdefen…
xmind version (slow, the map is big) :
xmind.net/m/5dypm8/
Fell free to tell me what is missing !
Bastien Faure retweeted
I created a tool that removes boring/duplicate URLs from a URL list.
"uro" understands our pain, check the demo below :)
github.com/s0md3v/uro
Bastien Faure retweeted
After 6 years working at an awesome and talented security company in Paris where I learned a lot and had a ton of fun❤️, and in part thanks to @snyff inspiring tweets. I finally decided to move forward and start a new journey on my own . Wish me luck and stay tuned !
Bastien Faure retweeted
It has been a difficult year for many of us, especially for students. We're teaming up with @PentesterLab to offer 30 student accounts on this fantastic platform.
Stay at home, learn webapp security and redeem a free account at [email protected] from a valid school/Uni e-mail.
Bastien Faure retweeted
Meet JWT heartbreaker! A Burp extension that finds thousands of weak JWT secrets lab.wallarm.com/meet-jwt-hea…
Bastien Faure retweeted
We just added an awesome new topic on HTTP Host header attacks.
portswigger.net/web-security…
Bastien Faure retweeted
I have published Arbitrary code execution on Facebook for Android's write up, Enjoy reading!
medium.com/@dPhoeniixx/arbit…
Bastien Faure retweeted
💥Easy RCE Ports
Java RMI: 1090,1098,1099,4444,11099,47001,47002,10999
WebLogic: 7000-7004,8000-8003,9000-9003,9503,7070,7071
JDWP: 45000,45001
JMX: 8686,9012,50500
GlassFish: 4848
jBoss: 11111,4444,4445
Cisco Smart Install: 4786
HP Data Protector: 5555,5556
#ptswarmTechniques
Bastien Faure retweeted
This is indeed the vulnerability I reported to @vBulletin. Pre-auth SQLi, leads to privilege escalation and RCE as admin (CVE-2020-12720).
Bastien Faure retweeted
wpa_sycophant - A tool to relay phase 2 authentication attempts to access WPA Enterprise without cracking the password #infosec
github.com/sensepost/wpa_syc…
Bastien Faure retweeted
The offensive security community means a lot to me. Following @Antonlovesdnb's great thread that injected some much needed infosec positivity, I wanted to highlight a few (offensive-ish) posts/talks that my team and myself enjoyed over the last year or so.
Bastien Faure retweeted
One command to rule them all!
Just finished to update @metasploit web_delivery to automatically bypass AMSI/SBL with latest definitions.
Testing and feedbacks are welcome!
github.com/rapid7/metasploit…
github.com/rapid7/rex-powers…
Test it with:
msfconsole -r web.rc
Bastien Faure retweeted
Je serais là-bas pour parler obfuscation. Passez dire bonjour!
C'est ce soir 🔥🔥🔥
Il est encore temps de vous inscrire et de réserver votre soirée pour venir rencontrer nos deux speakers du jour. 👌
#meetup #rouen #ReactNative #tech #obfuscation
Bastien Faure retweeted
Finally met @frohoff in person! Ysoserial & Ysoserial.NET mainteiners reunited :)
Bastien Faure retweeted
Bug bounty tip : If you find XSS in the domain without any CSRF protection, and CSP is enabled, try using the ping attribute, a new <a> tag’s attribute in HTML5 which makes a POST request. Ex XSS Payload : <a href=yogosha.com ping=/changepass?password=new_pwd/>
Bastien Faure retweeted
Hack all the networks! Our team member @flgy will do a live pentest demo at @infosecurity London, bypassing 802.1x and other network security measures!
infosecurityeurope.com/en/Se…
cc @Forescout