Étienne Ducharme

Offensive security enthusiast | Pentester @ Desjardins

[Étienne Ducharme @b13bs_]

Didn't see much noise around this, but is IP rotation through AWS API Gateway now being detected and blocked?
I never had an issue with Fireprox before, but I'm definitely hitting some walls now.
This might be why Flareprox and OmniProx were released in the past few months.

[Étienne Ducharme @b13bs_]

The @NorthSec_io CTF always has its fair share of physical challenges!
Here's how we completed the NFC challenge of the vending machine: https://t.co/dzd1q6uoSL

[Étienne Ducharme @b13bs_]

How's your M365 password spraying game in 2024 ?
On my side, it's harder than ever.

For instance, after 6 rounds each 6 hours apart, starting to lock out accounts more and more each round, to the point where impact is noticeable.

Rounds performed using the great #TeamFiltration

[Étienne Ducharme @b13bs_]

Getting back into bug bounty.
Is the HackerOne CTF for private invites still a thing ? I haven't receive anything for days, which seems different from a few years ago

#bugbounty #hackerone

[Étienne Ducharme @b13bs_]

@ShitSecure Great article, thanks!
I'm currently hosting different versions of my phishing page with different entropy levels and obfuscators, including a custom one as you recommend.
Good results so far, but TrustWave appears to be the most thorough regarding the entropy. @OffenseTeacher

[Étienne Ducharme @b13bs_]

I fail to see how subdomain takeover could still work for https://t.co/QJ9M5AQNbY. Validation through asuid prevents the Custom Domain from being configured, hence it should block the attack. Does it not ?

[Étienne Ducharme @b13bs_]

Almost done with RTO course and I learned a lot, it is very complete and up-to-date.
However, one *key* material is not covered... Which MX switches is @_RastaMouse using ! We hear them in the background during the demo videos, I'm loving the sound.

[Étienne Ducharme @b13bs_]

@Jhaddix @Agarri_FR @NorthSec_io Awesome. I'll be able to thank you in person for EO newsletter. Cheers!

[Étienne Ducharme @b13bs_]

@ldionmarcil Great, seems to suit my needs from my quick tests. Thanks!

[Étienne Ducharme @b13bs_]

Hard to break good old habits, I'm still using the deprecated tool Aquatone for subdomain web flyover.

Any suggestions for a replacement ? I especially liked Aquatone's grouping feature for similar-looking pages.

[Étienne Ducharme @b13bs_]

Almost forgot to #brag for our podium (3rd place) at the CTF, with my colleagues from @OKIOKdata! The CTF was truly challenging and rewarding

[Étienne Ducharme @b13bs_]

Before post-event depression settles in, I'd like to thank @NorthSec_io organization and volunteers! Had an awesome couple of days

[Étienne Ducharme @b13bs_]

@NahamSec Still planning on doing it ? This content got me to sub to your Twitch channel

[Étienne Ducharme @b13bs_]

I hadn't written a writeup in a while, here is mine for the NorthSec 2022 internal network track. Props to @davidlebr1 for creating a great challenge!

https://t.co/c0wpLGiqJV

[Étienne Ducharme @b13bs_]

@OffenseTeacher @Bandrel Why not try it!

[Étienne Ducharme @b13bs_]

@mpgn_x64 I just got what you meant. Your uncracked NT hashes are the wordlist for hashcat -m 27100 on your captured NetNTLMv2 hashes.
Althought performance is not optimal, it would still be a good idea to run it without a rulefile and with uncracked NT hashes.
Nice find!

[Étienne Ducharme @b13bs_]

@mpgn_x64 I meant, I am not able to crack 5600 hashes with 27100 even thought it looks like the exact same format.

How would you find hashes that could be cracked with 27100 ?

[Étienne Ducharme @b13bs_]

@0xConda @snaplabsio Awesome, thanks!