Alexandre S. (@MrSheepSheep) header
Alexandre S. (@MrSheepSheep) profile picture

meh.

Joined October 2013
Photo by Alexandre S. (@MrSheepSheep)Photo by Alexandre S. (@MrSheepSheep)Photo by Alexandre S. (@MrSheepSheep)Photo by Alexandre S. (@MrSheepSheep)Photo by Alexandre S. (@MrSheepSheep)Photo by Alexandre S. (@MrSheepSheep)Photo by Alexandre S. (@MrSheepSheep)Photo by Alexandre S. (@MrSheepSheep)Photo by Alexandre S. (@MrSheepSheep)
Alexandre S. retweeted
i talked to a lot of people who played the defcon ctf finals to understand how llms affected them, both professionally and mentally. i went in hoping to learn that human intuition still mattered. instead, ctfs in their current form as everyone saying is dead, players are forced to operate slot machines because anyone who refuses to token-max loses to those who do. almost everything i learned, including how to learn, came from grinding ctfs. but the pipeline for developing that kind of skill and expertise now seems broken, juniors are rewarded for token-maxxing rather than going through the process of actually understanding things which is quiet sad and ctfs might not produce high quality security researchers any more. this also has serious implications for people who can’t afford tokens. five years ago, i wouldn’t have been able to afford access to something like gpt-5.6, and I would have been locked out of the very competitions that helped me build my career. anyway these are questions i asked if interesting for anyone: did they have fun? almost everyone was unhappy. it has largely become slot-machine operating, if they refuse to use llms, they lose to teams that do. it is not there is no fun at all, playing with friends and competing was all fun just process of solving which is main part and it isn't fun.(please let me know if you had fun) did having a skilled human in the loop still matter? i got mixed answers, but the leaderboard tells a fairly clear story, the top teams aggressively token-maxxed, by pooling gpt accounts and stuff. the #1 team allegedly spent around $50k on tokens xd. how much of the outcome came from human skill versus token-maxxing? its probably 95% token-maxxing and 5% human skill. some challenges, especially visual ones, remain difficult for llms, and human intuition to prompt mattered. but overall, the dominant strategy appears to be throwing more tokens at problems, one interesting observation, people who were better before llms were also better after the llms and they are the ones solving lot of challenges so it seems still 5% operating skill will put u in top and can't be dumb operator. will a new generation of players simply adapt to this new kind of competition? i thought maybe current players are just behaving like boomers who hate every new technology. but unlike previous technology stuff, there doesn’t seem to be much for the human to master here. token-maxxing is literally just token-maxxing. it doesn’t reward human ingenuity, it discourages it, and may eventually atrophies and makes us dumb let me know if i missed something or if you have different opinions
47
128
35
772
100,187
Last time I dealt with MSRC Found a cleartext phishing vector on login.microsoftonline.com 5 months without response, they woke up when I mentioned "public disclosure" They rewarded 1 of the many issues I reported. The others : "working as intended" xitter.gq/i/status/1918606150175…
Replying to @I_Am_Jakoby
It took 5 months. I requested an update every week. No communication, no details about what was fixed. Incorrect bounty amount in the end. Worst experience I ever had, I consider not reporting again.
1
4
676
Retex Pentest Telecom - Box 2 Backbone... Et + ! youtu.be/EknjXW1dyF4?si=WmBv…
1
108
Je preshot avant la catastrophe : je n'étais pas maître des mes actions, ni du contenu diffusé dans le reportage 🫠 Il ne représente pas la réalité de notre métier, mais bon, faut que les aînés puissent comprendre...
1
40
Next-level Redteaming
If someone catches you sneaking in 007 First Light, the main character will come up with an excuse which is actually genius instead of getting a mission failed screen or raising alarm.
1
100
Hello, small error on the date the meetup will be held on May 19. Program: 🎙️ "Your cloud identity providers are phishing platforms" - by @MrSheepSheep 🎙️ "Understanding EDRs to better bypass them" - by CursedFRA 📍 Oculto, 27 R. Quincampoix, 75004 🕖 19:00 See you there !
3
2
840
Here's the talk for the next meetup! 🎙️ "Your cloud identity providers are phishing platforms" - by @MrSheepSheep 📅 19/04 📍 Oculto, 27 R. Quincampoix, 75004 🕖 19:00 Registration on our website
1
1
1
5
686
Alexandre S. retweeted
If you're interested in YARA and Sigma rules linked to this research, check them out on our dedicated repository: github.com/synacktiv/synackt…
In recent incident responses with an Ivanti CSA compromise as the root cause, Synacktiv's CSIRT came across open-source tools used for post-exploitation. Our ninja @Cybiosity explores their functionalities and discusses detection capabilities. synacktiv.com/en/publication…
2
1
185
Don't log in to unknown Okta tenants. Double-check organization URLs before logging in. It is possible to abuse Okta to harvest cleartext credentials sent through the login form.
1
4
291
I briefly documented the technique for anyone interested. It applies to pretty much all cloud identity providers. github.com/mrsheepsheep/idp-… I'm essentially extending @_xpn_ incredible work, focusing on the phishing part :)
1
76
I managed to run #Balatro natively on the web ! Before anyone asks, NO, this will never go public for obvious reasons :) but it was fun to make !
2
3
332
Alexandre S. retweeted
CVE-2022-24961 In Portainer Agent before 2.11.1, an API server can continue running even if not associated with a Portainer instance in the past few days. cve.mitre.org/cgi-bin/cvenam…
1
2
Hey @discord, can you do something about bots permissions ? Lazy devs ask for admin rights and most server owners don't care. What about a red warning when a bot asks for Admin, and a way to change permissions on the invite window ? Huge privacy risk.
1
Important Update
5,088
13,665
12,032
97,459