Raphaël Lacroix (@Chepycou) header
Raphaël Lacroix (@Chepycou) profile picture

Raphaël Lacroix

@Chepycou

🇫🇷 French ✏️ Penetration tester, CTF Player 🎹 Plays piano, drums and composes

 Toulouse
blog.ar-lacroix.fr/
Joined September 2025
  • Tweets114
  • Following344
  • Followers15
Raphaël Lacroix retweeted
Theo - t3.gg (@theo) profile picture
Theo - t3.gg
@theoOct 28
The Mac in this test cost $12,000. The PC cost $700.
Image from Theo - t3.gg (@theo)
Theo - t3.gg (@theo) profile pictureTheo - t3.gg
@theoOct 28
Every time I spin up a thread on my Mac I am amazed at how much slower it is than my linux machines. I'm so thankful I moved all my code work to Linux.
176
77
55
3,097
363,464
Raphaël Lacroix retweeted
Gareth Heyes \u2028 (@garethheyes) profile picture
Gareth Heyes \u2028@garethheyesOct 27
XSS from a response header 🤯 Firefox will load an XSLT stylesheet from a data: URL in a Link header. Combined with a harmless XML body and you get JS running in the page origin. Plus Safari importing GIFs as SVG and more sanitizer bypasses
Image from Gareth Heyes \u2028 (@garethheyes)
2
27
1
110
6,437
🇫🇷 French below 👇 I am happy to share that I have successfully passed Hack The Box's Certified Offensive AI Expert with 100/100 points at the exam! It was challenging yet very fun to learn about the various ways AI can be attacked and leveraged as a penetration tester.
1
18
more replies
I look forward to breaking more AI-related systems with the new knowledge alongside the great team at Fenrisk. Thanks again to PandaSt0rm and the whole COAE team for their work!
1
4
PS : This thread is 100% AI-free 🙃 PPS : Yes, I used "holistic" in my day to day life before AI became a thing 🤓
1
Raphaël Lacroix retweeted
vx-underground (@vxunderground) profile picture
vx-underground
@vxundergroundOct 24
Just found a zero day If you right click on an executable on Windows, select run as administrator, it will run as administrator I'm calling it Program2Shell
195
515
47
11,210
218,966
Raphaël Lacroix retweeted
aas (@aas_s3curity) profile picture
aas@aas_s3curityOct 21
I wrote up a way to defeat enforced SMB signing for relay. It abuses a documented SMB re-authentication behavior. I'm surely missing nuance and prior art. Corrections welcome. Writeup: blackfield.ch/blog/defeating… PoC: github.com/aas-n/reauthx
Defeating enforced SMB signing: a note

Defeating enforced SMB signing: a note

A documented SMB2/3 re-authentication behavior that keeps a reflected authentication working against a signing-required target.

blackfield.ch
2
70
2
184
16,007
Raphaël Lacroix retweeted
Abdul Mhanni (@abdo_mhanni) profile picture
Abdul Mhanni
@abdo_mhanniOct 22
Crazy cool blog I saw on linkedin about an SMB signing bypass technique TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included. blackfield.ch/blog/defeating…
Defeating enforced SMB signing: a note

Defeating enforced SMB signing: a note

A documented SMB2/3 re-authentication behavior that keeps a reflected authentication working against a signing-required target.

blackfield.ch
4
56
1
157
8,735
Raphaël Lacroix retweeted
Luke Stephens (hakluke) (@hakluke) profile picture
Luke Stephens (hakluke)
@haklukeOct 21
Image from Luke Stephens (hakluke) (@hakluke)
9
47
3
457
18,717
Raphaël Lacroix retweeted
ANSSI (@ANSSI_FR) profile picture
ANSSI
@ANSSI_FROct 21
⚠️ Une mise à jour de PHP a été publiée. Elle corrige deux vulnérabilités critiques dont l’exploitation rapide est à craindre. Plus d'informations sur les vulnérabilités, les versions affectées et les recommandations à appliquer sur : ➡️ cert.cyber.gouv.fr/alerte/CE…
Alerte de sécurité

ALT Alerte de sécurité

CERT-FR (@CERT_FR) profile pictureCERT-FR
@CERT_FROct 21
⚠️ Alerte CERT-FR ⚠️ PHP a publié une communication concernant deux vulnérabilités critiques. L'éditeur annonce la disponibilité des correctifs de sécurité pour le 21 octobre 2026 à 16h00 heure de Paris (14h00 UTC). cert.cyber.gouv.fr/alerte/CE…
17
363
36
773
90,047
Raphaël Lacroix retweeted
Alex Neff (@al3x_n3ff) profile picture
Alex Neff@al3x_n3ffOct 16
Make NetExec fast again🚀 A great idea by @mpgn_x64 and a few minutes of development time, and I was able to make the general loading time of NXC much, much faster. This cuts down on execution by up to 42% for non-impacket protocols, e.g., NFS⏱️
Improve loading time of NFS by 42%

ALT Improve loading time of NFS by 42%

Improve loading time of SSH by 28%

ALT Improve loading time of SSH by 28%

Improve loading time of RDP by 25%

ALT Improve loading time of RDP by 25%

2
18
138
5,643
Raphaël Lacroix retweeted
OWASP® Foundation (@owasp) profile picture
OWASP® Foundation
@owaspOct 15
Do checkout MCP Security Testing Guide
Vandana Verma (@InfosecVandana) profile pictureVandana Verma
@InfosecVandanaOct 15
What would you test first in an MCP-powered app? Help review the OWASP MCP Security Testing Guide. Pick one section. Flag a gap. Suggest a fix. Practical tests, clearer examples, missing attack scenarios—all welcome. github.com/OWASP/MCP-Securit… @owasp
Image from Vandana Verma (@InfosecVandana)
1
5
25
3,533
Raphaël Lacroix retweeted
The Hacker News (@TheHackersNews) profile picture
The Hacker News
@TheHackersNewsOct 13
‼️ A CVSS 10.0 flaw in GitLab could have let unauthenticated users execute code on the server under certain conditions. GitLab has patched the CI/CD vulnerability (CVE-2026-97229) affecting CE and EE. Fixed versions: 19.2.8, 19.3.5, and 19.4.2. Read: thehackernews.com/2026/10/gi…
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

GitLab fixed CVE-2026-97229 (CVSS 10.0), a CI/CD flaw that could allow unauthenticated code execution under certain conditions.

thehackernews.com
9
57
2
228
52,643
Raphaël Lacroix retweeted
Fenrisk (@FenriskSec) profile picture
Fenrisk@FenriskSecOct 5
History repeating itself on Open Build Service (OBS). One year after our first advisory, we took another look and found a very similar vulnerability pattern on the exact same component. A great case study on recurring flaws and root-cause remediation: 👉 fenrisk.com/research/open-bu…
Open Build Service, one year later: command execution through Mercurial argument injection

Open Build Service, one year later: command execution through Mercurial argument injection

In March 2025 we published an analysis of a remote code execution vulnerability in Open Build Service (OBS), tracked as CVE-2024-22033. A little over a year later we went back to the same attack...

fenrisk.com
2
5
90
Raphaël Lacroix retweeted
GrapheneOS (@GrapheneOS) profile picture
GrapheneOS
@GrapheneOSSep 27
Our massive overhaul of the AOSP Messaging app has reached the Stable channel in our App Store after 3 releases. It's well on the way to becoming our own high quality GrapheneOS Messaging app instead. There are still parts of the interface to overhaul including widgets and important features to add. Full support for RCS with all of the additional features it brings including proper group chats, media, opt-in read receipts and much more is going to be the largest project. We'll also be adding RCS end-to-end encryption via Messaging Layer Security (MLS) compatible with Google Messages and iOS. RCS support will be provided via an optional dependency on sandboxed Google Play for activation. In the longer term, we plan to make a fully standalone implementation requiring the carrier to support it. We probably won't make an alternate implementation of using Google's own system for this. Finishing the user interface overhaul, resolving many minor issues and adding important features including search are going to be the priority before getting to RCS. In the meantime, Google Messages is already fully supported on GrapheneOS including RCS with E2EE via MLS: grapheneos.org/usage#rcs
GrapheneOS usage guide

GrapheneOS usage guide

Usage instructions for GrapheneOS, a security and privacy focused mobile OS with Android app compatibility.

grapheneos.org
62
103
11
1,272
63,991
Raphaël Lacroix retweeted
mpgn (@mpgn_x64) profile picture
mpgn@mpgn_x64Sep 4
J'organise un CTF Active Directory en ligne 🏰 12 heures 2 domaines 1 seul but : Domain Admin 👑 AD LAB LANFEUST hardéné, niveau confirmé. Mais venez tenter le siège quel que soit votre niveau ⚔️ 📅 18/09 · 11h-23h · 20 teams de 4-5, sur invitation 🔗 ctfad.mpgn.fr/
AD LAB Lanfeust — CTF Active Directory

AD LAB Lanfeust — CTF Active Directory

18 septembre 2026 · 11h–23h CEST · Remote via VPN. 20 teams, 2 domains, 12 hours to become Domain Admin.

ctfad.mpgn.fr
31
73
5
424
32,855
Raphaël Lacroix retweeted
BiereSecuTLS (@BiereSecu) profile picture
BiereSecuTLS@BiereSecuAug 28
Rappel 📣 Bientôt la rentrée pour Bière&Sécu Toulouse ! RDV le mercredi 9 septembre ! beta.framadate.org/polls/49b…
2
1
220
Gotta say I love @GrapheneOS 's new speech Services. Can't wait for it to be available in French so I can start recognizing the road names 😅 discuss.grapheneos.org/d/357…
2
30
7,077
Load more