Florian retweeted
🚨 The #Entrypoint2027 Call For Papers is now open!
Have original offensive security research to share? New techniques, tools, or attack stories ? We want to hear from you.
📅 CFP closes: Sept 20, 2026.
Our review board will be revealed soon.
👉 cfp.entrypoint.fr/entrypoint…
Florian retweeted
We've been working on something for a while.
The talks your blue team doesn't want you to see.
🔴 Red Teaming. Initial Access. AD. Cloud & Web exploitation.
📍 Paris - Le Dernier Étage
📅 March 19–20, 2027
entrypoint.fr
CFP and additional details coming soon.
Florian retweeted
🧑🎓 Boost your offensive Active Directory skills with our Entry & Advanced trainings. Hands-on labs with dozens of machines + latest research from DEFCON, x33fcon & more! Seats are limited, don’t miss out!
🔗 Entry: synacktiv.com/en/offers/trai…
🔗 Advanced: synacktiv.com/en/offers/trai…
Florian retweeted
Azure intrusion for red teamers
by Paul Barbé & Matthieu Barjole (@aevy__)
hexacon.fr/trainer/barbe_bar…
Florian retweeted
Want to master cutting-edge techniques for attacking Azure? Join us this summer at @BlackHatEvents in Vegas for a deep dive into red teaming on Azure, M365, Azure DevOps, and hybrid infrastructures. Early bird tickets available until May 23rd! blackhat.com/us-25/training/…
Florian retweeted
GitLab recently released a patch for the Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409). Our ninjas @alexisdanizan and @b1two_ analyzed the patch and wrote the exploit code! github.com/synacktiv/CVE-202…
Florian retweeted
It's @_barbhack_ time! @croco_byte is on stage to present OU exploitation in AD environments.
Florian retweeted
In our latest blogpost, @croco_byte explores the inner workings of SCCM policies and introduces SCCMSecrets.py, a tool targeting secret policies in order to exploit misconfigurations, harvest credentials, and pivot across collections by impersonating legitimate clients.
synacktiv.com/publications/s…
Florian retweeted
Here is the second part of my GitHub action exploitation series. You will find some exploitation scenarios on popular projects like Microsoft, Apache, FreeRDP, AutoGPT, Ant-Design, Cypress and others 👨💻
Want to know how we prevented some CI/CD supply chain attacks against Microsoft, FreeRDP, AutoGPT, Ant-Design, Cypress, Excalidraw and others? Read the second article in our series on exploiting GitHub Actions by @hugow_vincent.
synacktiv.com/publications/g…
Florian retweeted
For @WEareTROOPERS second day, @Scouty__ and Paul are presenting their research on Kubernetes bootstrap tokens and AKS
Florian retweeted
A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine. github.com/synacktiv/Invoke-…
Florian retweeted
Checkout my new article if you want to know how to compromise a #GitHub organization by hijacking #CICD runners 🌚
Exploiting GitHub Actions jobs by registering a rogue #CICD runner to exfiltrate secrets, @hugow_vincent developed a tool for a real engagement, successfully compromising the GitHub organization!
synacktiv.com/publications/h…
Florian retweeted
A fun research I did, check it out!
In his latest blogpost, @yaumn_ analyzes MDI's detection of PKINIT authentication, explains how to bypass it and releases Invoke-RunAsWithCert, a tool to perform Kerberos authentication via PKINIT with the Windows API from a non domain-joined machine.
synacktiv.com/publications/u…
Florian retweeted
☁️ Whether it's on premises or in the cloud, a domain is a domain.
💪 Flex your intrusion muscles with @tiyeuse and @hugow_vincent's training!
➡️ hexacon.fr/trainer/vincent_b…
📆 30/09-03/10 2024
📍Espace Vinci, Rue des Jeuneurs, Paris
Florian retweeted
A while ago during a security assessment, @0hexit identified multiple vulnerabilities on the PRTG Network Monitor application version 21.3.69.1333, allowing an attacker to perform XSS attacks. Read the technical details in the advisory: synacktiv.com/sites/default/…
Florian retweeted
We have updated nord-stream, our #CI/CD secrets extraction tool to support GitLab. Turns out it is way easier to dump all the creds on GitLab, check out the updated version of our blogpost to understand why.
synacktiv.com/publications/c…
Florian retweeted
Good news, Synacktiv 2023 trainings are open! Come and get trained by our best ninjas about pentesting Active Directory environments over 5 days, from 27 to 31/03 in our Parisian offices.
🇫🇷 More details here: synacktiv.com/offres/formati…
Register at [email protected]
Florian retweeted
Watchout! CVE-2023-22809 on Sudo was patched today to prevent a privilege escalation on sudoedit. Read the security advisory by @aevy__ and @v1csec: synacktiv.com/sites/default/…
Florian retweeted
In-depth ldap enumeration utility
github.com/franc-pentest/lde…
Florian retweeted
Through a case study inspired by a recent intrusion test, @ROLANDQuentin2 provides an overview of the different techniques allowing to smuggle PHP payloads into PNG files.
Discover how to reliably inject PHP code into images, even in tricky situations!
synacktiv.com/publications/p…
