Tanguy Boisset

🇫🇷 Cybersecurity consultant @Klee_Group
Passionate about cybersecurity & esport

[Jean-Michel Besnard @jmbesnard_maz]

This week we released AD Miner 1.4 and had the opportunity to give a talk about it at #SSTIC
Video is available (in French however the slides are in English) here https://t.co/O1DWjadfBq

[Tanguy Boisset @Sopalinge]

Back in December, I've found two medium vulnerabilities on GestSup < 3.2.46 which can lead to admin account takeover. Update your GestSup and learn more about CVE-2023-52059 and CVE-2023-52060 here: https://t.co/M4q9tU2rsS

[Jean-Michel Besnard @jmbesnard_maz]

Happy to share a new Active Directory audit tool to the cybersecurity community :
AD Miner (aka #Bloodhound on steroids) can help you:
⏩Check more than 40 attack vectors or weaknesses
⏩Uncover most risky control paths
⏩Prioritize and track mitigations efforts
https://t.co/d5j2OWWGSo

AD Miner basically plugs into an already-populated neo4j BH database, runs a series of cypher queries and produces a report where all results are nicely presented with graphs, listing, etc.

Enjoy and feel free to send feedback or to open issues on our github.

[Tanguy Boisset @Sopalinge]

Wanted to share a small script I wrote that quickly deploys and populates an instance of the new #BloodHound version using the new API. May be useful for multiple clients scenario : https://t.co/upsJ948jbj

[Tanguy Boisset @Sopalinge]

Very proud to share that I passed the BSCP exam and am officially #burpsuitecertified 🥳
Thank you @PortSwigger for the great learning materials !

[Tanguy Boisset @Sopalinge]

And I did ! 36th place as senior at #FCSC2023 ! 🙌
I'm really happy about my progress and thankful to @ANSSI_FR for the amazing challenges ! 💙
See you next year !

[Tanguy Boisset @Sopalinge]

Last week, I participated in #FCSC2022 and ended up at the 69th place for the senior category. It was a hard but very rewarding challenge ! I'm looking forward to the next edition and will do better !💪

[Tanguy Boisset @Sopalinge]

The idea is to use Responder for the poisoning part and then relay the victim to a local smb server.
Then, it's only a test of patience and luck to harvest and crack some hashes ! 😊

[Tanguy Boisset @Sopalinge]

Is your Responder poisoning answers but not capturing any hashes ?
That has happened to me twice during #pentest and I wanted to share a small tip which helped me greatly get those juicy NTLMv2 hashes ! 😋👇

[Synacktiv @Synacktiv]

Ever wanted to exploit a PHP file inclusion without having a file upload? Follow @_remsio_'s journey to discover PHP filter chains, ensuring they work properly, and transforming them into a tool. You can now convert almost any file inclusion to RCE! https://t.co/yKMPu5guh7

[Tanguy Boisset @Sopalinge]

@Synacktiv @_remsio_ Kind of a crazy coincidence, I just published yesterday a small script on GitHub using the same exploit haha. Anyway, nice article ! 👍 https://t.co/RzKCf2jVey

[Tanguy Boisset @Sopalinge]

Just posted a script on my github to gain RCE through an LFI with PHP filters : https://t.co/KEgACAZmx4
May be useful for #CTF enjoyers and pentesters 😊
Full credit for the exploit method goes to @loknop !

[Tanguy Boisset @Sopalinge]

Just posted a script on my github to gain RCE through an LFI with PHP filters : https://t.co/KEgACAZmx4
May be useful for #CTF enjoyers and pentesters 😊
Full credit for the exploit method goes to @loknop !

[Tanguy Boisset @Sopalinge]

Moral of the story : keep your softwares updated and don't always rely on your WAF to protect you ! 🧑‍🚒

[Tanguy Boisset @Sopalinge]

Last month, I was able to exploit #Atlassian's #Confluence to gain an #RCE on the hosting machine with CVE-2021-26084, eventhough the client was protected with #Cloudflare's WAF. 🕵️🔎 ⬇️

[Tanguy Boisset @Sopalinge]

You can see that 'exec(' is split in the query but is recovered and interpreted by the Java engine. You can split other parts of payloads with the same logic if a WAF triggers.