CTF player | Bug Hunter | Ex infosec student at @EsnaBretagne
Joined September 2021
- Tweets98
- Following336
- Followers506
- Likes1K
Perce retweeted
I really hope that bug bounty platforms (cc @Bugcrowd @HackerOne @intigriti @yeswehack) will apply their 0day usual policies and will reject the farming of php2shell that is coming very soon.
Don't add to the triage fatigue, please
#BugBounty
Perce retweeted
I made a fun little game: ZeroDay Tycoon 🐛
Start as a broke bug bounty hunter, survive triage and your worst enemy (Duplicate), and build a cybersec empire.
100% free, plays in your browser.
👉 zeroday-tycoon.com
💬 discord : discord.gg/nYHtxf5FZX
Perce retweeted
We're building Depi Red Team.
Zero to a validated exploit in 3m 56s. Depi does the recon and validation, the red teamer builds the exploit locally on top.
We also used Bug Bounty as a sandbox for our research and got XX,XXX$ bounties with it ;D
Our team went from hours or days to minutes on the hardest exploits.
I need help from Red Teamers and get some feedback. DM me what's missing or let's jump into a call ;D
Perce retweeted
Recently, I've been looking at DOMPurify again, trying to find ways to bypass 3.x.x after browsers started encoding attrs during serialization.
I ended up with a nice ≤3.2.6 Safari default-configuration bypass using only SMIL tags/attrs :D
Details 👇
mizu.re/post/dompurify-bypas…
ALT https://yeswehack.github.io/Dom-Explorer/shared?id=9c1f671a-fc8f-4284-9217-eba4df143db3
Perce retweeted
It's official: Vulnotes is live 🎉
The platform for your entire pentest engagement
✍️ Visual report editor
🔁 Built-in review workflow
📤 Export to docx, pdf, csv..
🤖 AI: screenshots → findings, translate, rewrite
🔌 API + MCP
👉 vulnotes.com
Big thanks to @yeswehack for the LHE, solid event and great people all around. And thanks to @PUMA for having us. Already hyped for the next one 🙌
Final score: bugs found, hackers crowned 👑
🥇 @Vozec1 and @_Worty
🥈 swdb
🥉 @PerceSecu
🩸 First Blood: @TheLaluka and p4st1s
💥 Biggest Impact: @Vozec1 and @_Worty
Check out the final leaderboard of our #LiveHackingEvent with @PUMA: event.yeswehack.com/events/l…
Perce retweeted
I'm happy to release the first version of my DOMLogger++ plugin for @CaidoIO! 🔎
It improves the browser extension in several ways:
• Persistent, per-project storage
• Temporary session recording
• AI support
• Stack trace reconstitution
• ...
👉 github.com/kevin-mizu/domlog…
Perce retweeted
Our new website is live 🎉
Check out vulnotes.com and let us know what you think:
vulnotes.com
Perce retweeted
My work on the novel SSRF technique that landed a critical payout at a Live Hacking Event: slcyber.io/assetnote-securit…
Perce retweeted
Big update: Subdomain enumeration now uses separate quotas for each plan!
This means MORE data for the same price. Plus, our free tier still lets you discover hundreds of subdomains monthly - no payment required.
Check out the documentation docs.profundis.io/api/subdom…
#bugbounty
Perce retweeted
Guillaume Chouquet, fondateur et directeur de l'ESNA, viré de sa propre école par l'@Formation_bzh !!!
Je suis consterné et en colère.
C'est affligeant de prendre une telle décision quand on sait tout ce que le bonhomme a fait pour l'école et les alternants !
Perce retweeted
This is still v1, there's lots to improve and many gadgets to add.
If you'd like to contribute or have any feedback, please don't hesitate to reach out 😁
4/4
Perce retweeted
Each library page includes:
* Affected versions
* A short description
* Root cause of the gadget
* Related links
* Credit to the discoverer
* And even a preview button to play with the gadget live!
3/4
Perce retweeted
The wiki lets you filter gadgets by browser, tags, attributes, CSP, and timing, making it as easy as possible to find interesting vectors (at least I hope so!) 🔎
2/4
Perce retweeted
I'm happy to release a script gadgets wiki inspired by the work of @slekies, @kkotowicz, and @sirdarckcat in their Black Hat USA 2017 talk! 🔥
The goal is to provide quick access to gadgets that help bypass HTML sanitizers and CSPs 👇
gmsgadget.com/
1/4
Perce retweeted
Today was my last day as a pentester at Bsecure, and it feels a bit surreal. After a three-year journey of hunting on the side, I’m finally ready to go all-in as a full-time bug bounty hunter.
To celebrate this milestone, I've written an article sharing the full story. It’s a transparent look at the path that got me here: the wins, the lessons, the real financial numbers, and my honest advice for anyone considering this adventure.
You can read all about my journey from pentester to full-time hunter here: gelu.chat/posts/from-pentest…
Perce retweeted
There we go, after 3 years of work, endless nights of dev and a truckload of coffee. We are finally releasing the biggest project we've done in our entire life.
I hope you will like it !
Profundis.io is live!
Quickly uncover DNS records, subdomains, hosts, and their historical data directly via your browser.
No noise, just the data you need for asset discovery and security research.
Explore now: profundis.io
Perce retweeted
DOMLogger++ v1.0.8 is now out and available! 🎉
This update includes several UX improvements, such as syntax highlighting and new shortcuts. Major changes have been made to custom types and several annoying bugs have been fixed 🚀
👉 github.com/kevin-mizu/domlog…
Perce retweeted
I'm very happy to finally share the second part of my DOMPurify security research 🔥
This article mostly focuses on DOMPurify misconfigurations, especially hooks, that downgrade the sanitizer's protection (even in the latest version)!
Link 👇
mizu.re/post/exploring-the-d…
1/2