Win/Linux, vim/vsc, IRC, git, Java/NodeJs
Joined August 2018
- Tweets417
- Following205
- Followers105
- Likes1.3K
Pinned Tweet
Update pushed on maven repo for github.com/tr4l/maven-passwo…
Now exporting chrome/edge password (Linux/Windows) and some customization like exporting via a post request.
Larouanne Tristan retweeted
The next DEFCON Paris takes place on April 27!
🎙️ "The curse of agentic memories - usecase - Github copilot" - by Tr4L
🎙️ "RETEX @_hackiin : !(How to run down a CTF)" - by LOLOLEKIK
📅 27/04
📍 Oculto, 27 R. Quincampoix, 75004
🕖 19:00
Framadate in comment
Larouanne Tristan retweeted
The next DEFCON Paris takes place on February 18!
🎙️ "Arsenal multi-périmètre d'attaques sur IA" - Aetius
🎙️ "How to run down a CTF" - LOLOLEKIK
Rumps are welcome!
📅 18/02
📍 Oculto, 27 R. Quincampoix, 75004
🕖 19:00
Framadate in our website
Larouanne Tristan retweeted
Hi all,
We are looking for speakers for mid-February for our next meetup in Paris! 🍻
French or English, format and topic are up to you, recorded or private!
If you have any questions, topics, or requests, please contact us at cfp[@]defconparis[.]org
I'm the only one bothered that I can't view my github secret, as an admin of my repos (partial or full).
But any non-admin with enough permission can dump them with a workflow ? (Which is what I do, hoping to clean my logs fast enough).
What's the point?
Vous avez raté le #defcon paris où on vous explique comment une injection de secret dans un log github action vous permet de manipuler la business logic ?
Dommage, il vous reste des slides pas clair : tr4l.github.io/defcon/
Larouanne Tristan retweeted
🇬🇧 See you tonight!
🇫🇷 À ce soir !
📅 defconparis.org
📍 Le Carlie, 177 rue Saint Martin, Paris
🕖 19:00
🎟️ framadate.org/9jJvAOKnvkIwjK…
Larouanne Tristan retweeted
I performed some analysis that might shed light on how the recent @kong supply chain attack (github.com/Kong/kubernetes-i…) happened. Thanks @Devyn for tweeting it earlier!!
🧵:
Back in November, we can see that the maintainers updated workflows: github.com/Kong/kubernetes-i…
Viendez, on est bien.
defconparis.org/index.php/20…
🇬🇧 Happy New Year! Next DEFCON Paris on JAN-13
🇫🇷 Bonne Année ! Prochain meetup DEFCON Paris le 13/01
📅 defconparis.org/
📍 Le Carlie, 177 rue Saint Martin, Paris
🕖 19:00
🎟️ framadate.org/9jJvAOKnvkIwjK…
Fun #github action challenge for the end of the year.
Can you run the sensible with an issue ?
One is easier than the "fixed" version.
Of course, no real CICD jobs has been hurt during that "discovery"
Hey, @github released a post about immutable github action!
ghsioux.github.io/2024/12/10…
Time to play :)
Ok, I have not finish my test, but that secret is not safe.
With some extra benefits.
Pretty sure @github or @Microsoft will not pay bounty anyway, so ... Stay tuned.
2/ environnement secret can also be nice.
7/ check your pipeline/artefact for those secrets:
Docker layer (even erased without multistep)
.npmrc or other package manager
Logs (even with GH Mask, secret can but outputed by one of the tools in modifier form. Splitted, etc...
Secrets Management is crucial in #DevOps
Here are some best practices:
1) Use tools like Vault or AWS Secrets Manager.
2) Store GitHub Actions secrets in repository/organization secrets.
3) Never store secrets in code or config files.
4) Rotate secrets regularly.
5) Encrypt secrets at rest and in transit.
6) Audit access to secrets.
Managing secrets is crucial part of the DevOps job. Keep them in secure place and make sure access is limited.
Quick GH-Action CTF: github.com/tr4l/peter-manage…
Tools like github.com/AdnaneKhan/Gato-X or github.com/synacktiv/octosca… can detect the suspicious "Pwn Requests".
However, with "Require approval for all outside collaborators" and some custom check, I should be safe.
Can you spot the issue ?
@adnanthekhan , @hugow_vincent
If you exploit this one (the intended way...), this may open a new dimensions for your research/tools.
Larouanne Tristan retweeted
🔴 Annonce lots pour le Mindbreak
Grâce à @hackthebox_eu , les 5 premières équipes de la compétition repartiront avec :
🥇 4 annual prolabs vouchers
🥈 4 annual VIP+ vouchers
🥉 4 annual VIP vouchers
🏅 4x6 months VIP vouchers
🏅 4x1 month VIP+ vouchers
Larouanne Tristan retweeted
Rejoignez le meetup #OWASP France pour échanger sur les dernières tendances #appsec!
C'est lundi 12 juin 2023 à 19h chez @TotalEnergies Digital Factory.
Inscrivez-vous maintenant!
meetup.com/owasp-france/even… #Meetup