Florian Picca

91 posts

Florian Picca banner
Florian Picca

Florian Picca

@ENOENT_

Cryptography lover. Member of @AperiKube

France Katılım Mart 2018
64 Takip Edilen727 Takipçiler
Florian Picca
Florian Picca@ENOENT_·
@maki_mitz @pry0cc the RS -> HS algorithm switching would just allow you to forge a new token (if vulnerable), but not to get the private key
English
0
0
1
0
Maki
Maki@maki_mitz·
@pry0cc If you can get 2 differents tokens signed with the same private key, you can recover the public key : github.com/FlorianPicca/J… Then try the RS -> HS tricks or try to get the private from the public cc @ENOENT_
English
1
2
4
0
Synacktiv
Synacktiv@Synacktiv·
Trick or treats! Track the leak! Hack for treats! The first three travelers to get out of this spooky Halloween challenge will get themselves a special surprise. Hurry up, your time will run out on the 1st of November. halloween.synacktiv.com
GIF
English
2
12
30
0
Florian Picca retweetledi
CryptoHack
CryptoHack@CryptoHack__·
Sharing a partially redacted PEM online is the same as sharing the PEM. In this blog post, we show that with partial exposure of a PEM, private data can be extracted to recover the full private key. blog.cryptohack.org/twitter-secrets
SaxX ¯\_(ツ)_/¯@_SaxX_

This morning, I began another #pentest for a client. After some google-fu dorking combine with the major search engines, I found the id_rsa key that gave me access to the server and a bunch of others 😬😬 another mistake under their radar...

English
12
372
832
0
Florian Picca
Florian Picca@ENOENT_·
@_SaxX_ Recovery the full private key based on the infos you just leaked looks a lot like a CTF challenge and might be doable (cc @CryptoHack__ )
English
2
4
52
0
SaxX ¯\_(ツ)_/¯
SaxX ¯\_(ツ)_/¯@_SaxX_·
This morning, I began another #pentest for a client. After some google-fu dorking combine with the major search engines, I found the id_rsa key that gave me access to the server and a bunch of others 😬😬 another mistake under their radar...
SaxX ¯\_(ツ)_/¯ tweet media
English
14
18
170
0
Florian Picca
Florian Picca@ENOENT_·
I've written a tool to recover the RSA/ECDSA public key used to sign JWT tokens, because most of the time you don't have access to it. github.com/FlorianPicca/J…
English
2
10
57
0
Florian Picca retweetledi
Laluka@OffenSkill
Laluka@OffenSkill@TheLaluka·
New article ! How share a shell with your friends to troubleshoot stuff when EVERYTHING ELSE FAILS, a tail of tmux, socat, ssh tunnels, tmate, gotty, ngrok and more ! \o/ thinkloveshare.com/en/hacking/a_h…
Laluka@OffenSkill tweet media
English
1
5
19
0
Florian Picca retweetledi
Haax
Haax@Haax9_·
Almost one year ago, I started to put together things I know, things I read and things I learn, on a same place. Some days ago, I decided to refactor and reorganize the whole content. And today, I release it ! Here is a global #Infosec cheatsheet : cheatsheet.haax.fr [1/2]
English
2
40
101
0
Florian Picca
Florian Picca@ENOENT_·
@CryptoHack__ Lo-Hi Card Game. It felt more like exploiting a vulnerable application than just exploiting the underlying issue
English
0
0
1
0
CryptoHack
CryptoHack@CryptoHack__·
Which is your favourite challenge on the site? What you hoping to learn next?
English
1
0
1
0
Florian Picca retweetledi
CryptoHack
CryptoHack@CryptoHack__·
Users can now upload challenge solutions to CryptoHack. Solutions are unlocked after you submit the flag and you will gain access to all user's solutions. We hope this helps the community learn together. Excited to read your write-ups! cryptohack.org
English
0
5
14
0
Florian Picca retweetledi
StormXploit
StormXploit@StormXploit·
Hello guys! Today, I'd like to promote a new crypto platform which is very fun! This platform is cryptohack.org by @CryptoHack__ . There are many categories like block ciphers, elliptic curves so you can learn a lot! I have to admit that is kinda addictive. Enjoy 😁
English
0
22
38
0