Larouanne Tristan

Win/Linux, vim/vsc, IRC, git, Java/NodeJs

[Larouanne Tristan @Tr4LSecurity]

Update pushed on maven repo for https://t.co/NUAtLI8PJo
Now exporting chrome/edge password (Linux/Windows) and some customization like exporting via a post request.

[Larouanne Tristan @Tr4LSecurity]

@adnanthekhan @theo I think you this post is Legendary. How many hours before the Github breach ?

[Larouanne Tristan @Tr4LSecurity]

@adnanthekhan @theonejvo It's always a Peter. But probably not my first Peter target. They are way better Peter in the wild.

[Larouanne Tristan @Tr4LSecurity]

@adnanthekhan That make me wonder. Did we have audit log when a private key for an app is created ?

[Larouanne Tristan @Tr4LSecurity]

@jahirsheikh8 The more we add, the easiest we can have ten. So what about (no bias):
- CSP
- CORS
- Sanitazition
- TLS (in case mTLS is off-scope), and terminaison end point.

[DEFCON GROUP Paris @dcgparis]

The next DEFCON Paris takes place on April 27!

🎙️ "The curse of agentic memories - usecase - Github copilot" - by Tr4L
🎙️ "RETEX @_hackiin : !(How to run down a CTF)" - by LOLOLEKIK

📅 27/04
📍 Oculto, 27 R. Quincampoix, 75004
🕖 19:00

Framadate in comment

[Larouanne Tristan @Tr4LSecurity]

@adnanthekhan @cyb3rjerry It's good. I'm just sad that this still not include one of the biggest design problem.

Steps should not have abilities to see/change other steps behaviour, outside of what you allow.

Things like runner memory dump, or settings unallowed env var is just crazy by design.

[Larouanne Tristan @Tr4LSecurity]

@adnanthekhan Agree. And we seen some very dangerous stuff with AI on Github.

[Larouanne Tristan @Tr4LSecurity]

@Rhynorater @fatinsourav1 ... which allow some tracking of user activities.

[Larouanne Tristan @Tr4LSecurity]

@Rhynorater @fatinsourav1 The sequential css import wasnt fixed in chrome several year ago ?

Previous ligature work was using the loading of custom image for slider, new one seems way more robust.

Another thing interesting with the animation CSS, the refresh only happens when the element is visible...

[DEFCON GROUP Paris @dcgparis]

The next DEFCON Paris takes place on February 18!

🎙️ "Arsenal multi-périmètre d'attaques sur IA" - Aetius
🎙️ "How to run down a CTF" - LOLOLEKIK

Rumps are welcome!

📅 18/02
📍 Oculto, 27 R. Quincampoix, 75004
🕖 19:00

Framadate in our website

[DEFCON GROUP Paris @dcgparis]

Hi all,

We are looking for speakers for mid-February for our next meetup in Paris! 🍻

French or English, format and topic are up to you, recorded or private!

If you have any questions, topics, or requests, please contact us at cfp[@]defconparis[.]org

[Larouanne Tristan @Tr4LSecurity]

@adnanthekhan @_0xffd Github app. No one look at them, or know what they do.

[Larouanne Tristan @Tr4LSecurity]

@I_Am_Jakoby Did you submit an issue with powershell gallery to azure bounty program ?
It's the same thing as reporting issue on excel to github program because they are both Microsoft tools... Try to check/find the appropriate program (if it exist)

[Larouanne Tristan @Tr4LSecurity]

@RedTeamTactics Back in time, same code, same compiler. Some différent option.
https://t.co/n1X11Kk58D

One flagged a lot, the other one? Nope

[Larouanne Tristan @Tr4LSecurity]

@newsoft J'ai entendu parler de sujets de talk bien sympa.

[Larouanne Tristan @Tr4LSecurity]

@DefconParis Est-ce qu'il y a une cave?

[Larouanne Tristan @Tr4LSecurity]

@AtaxyaNetwork Trop jolie les stickers snes, true reverse gamer inside

[Larouanne Tristan @Tr4LSecurity]

@GenIArt_Fr @DFintelligence En vrai, si tous est fait par des robots, pourquoi aurait-on encore besoin "d'Argent"?

Tout est gratuit, vu que personne travaille. C'est bien plus simple.

[Larouanne Tristan @Tr4LSecurity]

@sapirxfed So after asking sysops to delete the file '*' with their shell, I can now ask devops to create a github federation.

(However, I'm not sur they are a correct answer for the latest)

[Larouanne Tristan @Tr4LSecurity]

@sapirxfed Nooooooooooo :'(