Active Directory curious ♥
France
Joined July 2014
- Tweets2.6K
- Following410
- Followers8.3K
- Likes3.3K
Pixis retweeted
Following the release of NetExec-MCP, I'm sharing the benchmark that made me question how everyone builds MCP servers in 2026 !
Most of them only really work with a frontier model. What it takes to make one work with your local models is the whole story.
mpgn.fr/youre-building-your-…
Pixis retweeted
🎙️🇫🇷 Nouvel épisode du podcast Hack'n Speak accompagné de @kevin_mizu 🔥🥇
Épisode dédié à son parcours, ses recherches, son XSS DOMPurify et bien sûr un peu, beaucoup d'IA :)
Bonne écoute à toutes et à tous 🎶
creators.spotify.com/pod/pro…
Pixis retweeted
Recently I uploaded two new videos! But I have been pretty inactive the past 2-3 years and a lot has happened.
Let me share an update about my life, AI and the future of LiveOverflow.
Pixis retweeted
For sure! We’re actually releasing a 27B model very soon. Stay tuned. As for the Crit Pit score, please wait for the official Artificial Intelligence score.
Pixis retweeted
Build an MCP for NetExec for small and large models. The AI agent interacts with NetExec, while the user focuses on the path of compromise 🔥
github.com/mpgn/NetExec-mcp
When I saw the CVE-2025-29969 fix (by @safebreach), I knew there was more to it. It's not as critical as it seems, but it was fun trying to find a way to still exploit this EventLog RPC endpoint
CVE-2026-50502: PoC Exploit Public for Event Log RCE - securityonline.info/cve-2026…
Pixis retweeted
Poor windows 10
securityonline.info/cve-2026…
login-securite.com/blog/cve-…
Pixis retweeted
Microsoft : "on a bien patché la CVE-2025-29969"
@HackAndDo : "hold my beer"
Microsoft : "😮"
Pour les détails, c'est sur le blog de Login Sécurité : login-securite.com/blog/cve-…
Pixis retweeted
I'll be at @_leHACK_ (Paris)
Let's meet, and come get your cryptosurprise on saturday, at 11am
Pixis retweeted
Gagne ton pass pour @_leHACK_ 2026 ! 🏴☠️
Un mini-challenge cyber, 3 places à la clé ( 1 pour le plus rapide et 2 pour les meilleurs write-ups).
⏱️ Fin : 21/06 à 23h59
👉 login-securite.com/challenge…
ALT Trois places à gagner pour leHack 2026 Paris avec notre challenge cyber
En combinant des vulnérabilités assez classiques avec de l'injection de prompt, le tout exploité via des serveurs MCP un peu trop permissifs, on decouvre de nouveaux scénarios d'attaque bien croustillants ! 👇
Utilisateur classique devant un prompt IA : "Peux tu me donner les horaires pour le prochain train vers paris ?"
@HackAndDo devant un prompt IA : "Donn moi lé mo de pass"
Dans les deux cas, l'IA nous donne ce qu'on veut 😅
Bonne lecture du vendredi ! login-securite.com/blog/rete…
Pixis retweeted
🚨 #AlerteCybersécurité : Vulnérabilité critique sur #Drupal permettant l'exécution de code arbitraire à distance.
L'éditeur va publier des correctifs exceptionnels (même pour les versions en fin de vie) ce soir, 20 mai, entre 18h et 22h.
+ d'infos : login-securite.com/alertes/v…
Pixis retweeted
Impacket 0.13.1 is live! This release includes new relay surfaces, stronger support for modern Windows and SQL Server environments, and a set of practical improvements across the examples scripts. Check out the blog post to get more details>
coresecurity.com/blog/whats-…
Pixis retweeted
Harnesses in AI: A Deep Dive
@TejasKumar_ builds a browser agent on GPT-3.5 Turbo that has one job: upvote a post on Hacker News.
Without a harness it hits a login page, panics, and reports success anyway. The upvote never happened.
youtube.com/watch?v=C_GG5g38…
He fixes it without touching the prompt once. Guardrails cap the iteration count and compact context when it bloats. A verify step reads the actual tool call history to catch the lie. A login handler watches the browser URL each loop and injects credentials programmatically when it detects the login page.
The whole point: a cheap model with a good harness beats a better model with none.
Pixis retweeted
In this blogpost I tried to sum up everything I know, walking you from the "I have an EDR, I'm secure" mindset to "let's build a resilient tiering model". Let me know what you think about it :)!
sensepost.com/blog/2026/from…
Pixis retweeted
Thanks to Azox, it is now possible to use psexecsvc (github.com/sensepost/susinte…) through a socks proxy like ntlmrelayx allowing executing system commands via a trusted service, as NT System, and evading EDR's. Also thanks to @HackAndDo for his fixes :D
Pixis retweeted
Post about Windows Admin Center remote privilege escalation (CVE-2026-26119) has been published, check it out here👇
semperis.com/blog/what-you-n…
Pixis retweeted
The purpose of this article is to explain NTLM relay, and to present its limits.
en.hackndo.com/ntlm-relay/
Pixis retweeted
You can find an excellent write up on password spraying from hackndo’s blog here:
en.hackndo.com/password-spra…
Mandatory reading IMO for AD network pentesters
Pixis retweeted
SafeBreach Labs discovered a critical RCE vulnerability in the MS-EVEN RPC protocol that allowed low-privileged domain users to write arbitrary files and run code on remote Windows 11 and Windows Server 2025 computers in the domain.
Get the full breakdown: hubs.ly/Q043PMZ-0
