@noraj_rawsec

🇫🇷 Penetration test engineer. 🐧 #BlackArch Linux maintainer. 🔣 (Unicode) security researcher.

 France
pwn.by/noraj
Joined September 2018
  • Tweets1.4K
  • Following389
  • Followers2.8K
316Media
In 2023, @Synacktiv researchers identified an authentication bypass in #Danfoss SM800 and SC255/SC355 controllers. The same vulnerability, reported again in 2025, could be linked to the recent supermarket refrigeration attack. 🔎 Authentication Bypass - Danfoss SM800 & SC255/SC355: synacktiv.com/sites/default/… 🔎 Multiple Vulnerabilities - Danfoss SM800A: synacktiv.com/sites/default/…
23
2
76
5,388
10 years of #opensource contributions 🎂🥳🎉
1
10
540
For those interested in my work, read this interview (2022): pentestreports.com/articles/…

PentestReports.com - Largest Collection of Public Penetration Testing Reports

Access real-world pentest reports, templates, and tools to strengthen your security posture. Learn from industry experts.

pentestreports.com
2
113
I have release a new version of miniss with a listenning socket filter and a pid option to list sockets inside a the network namespace of a given process. github.com/noraj/miniss/rele…

Release 0.0.3 · noraj/miniss

Code: Add a -l --listen option to show only listening sockets. Code: Add a -p --pid PID option to show the sockets in the namespace of a given process ID by parsing /proc/PID/net Code: Miniss::Sock...

github.com
1
2
431
I released a new version of tls-map that fixes sslyze and testssl extraction. github.com/noraj/tls-map/rel…

Release v3.3.0 · noraj/tls-map

Updates Fixed sslyze extraction for version 6.1+ #200 Now sslyze4 (4.x - 5.x) and sslyze6 (6.x+) are separated Fixed testssl.sh extraction for version 3.2+ (including 3.1dev) #199 Chores Brea...

github.com
163
And GrapheneOS only runs on Google phones 🤡 grapheneos.org/faq#supported…

GrapheneOS Frequently Asked Questions

Answers to frequently asked questions about GrapheneOS.

grapheneos.org
𝐿𝑖𝑛𝑢𝑥 𝑢𝑠𝑒𝑟
@linuxuser1996Aug 10
Google is slowly turning Android into a walled garden. Starting September, certified Android devices will block apps from unverified developers. Sideloading gets harder. Independent stores get squeezed. “Open platform” was always temporary. GrapheneOS stays free. No Google gatekeeper. No forced developer registration. No artificial limits on what you can install. Just a hardened system that still respects the user. While Android gets more locked down every year, GrapheneOS keeps the actual freedom part. Privacy and control > corporate permission.
1
5
474
C'est beaucoup 1 mois pour corriger une critique non ? Ces dommage que les plateformes de BB n'aient pas des délais différenciés selon la nature de la vuln : - pré-auth ? - avec correctif ? - avec PoC / exploit public ? - exploitée dans la nature (LEV NIST) ? - etc.
Noobosaurus R3x 🦖@NoobosaurusR3xJul 18
3
440
Checkmate #Writeup #TryHackMe Basic password hash cracking and password wordlist generation. blog.raw.pm/en/TryHackMe-Che…

Checkmate - Write-up - TryHackMe

Information Room# Name: Checkmate Profile: tryhackme.com Difficulty: Easy Description: Exploit weak password practices across Marco’s internal systems to achieve full compromise. Write-up Overview#

blog.raw.pm
1
4
449
I wanted to try #Lesso text-only (markdown) course / learning platform, so I created a short Shodan hacking course. lesso.app/course/shodan-for-… By the way nice new platform, quickly evolving.
3
401
Pentester seems cooked with AI PtaaS, what do you think? areyoucooked.dev/
2
335
Il n'y a pas que Chat Control, Google aussi est à l'offensive : keepandroidopen.org/

Keep Android Open

Your phone is about to stop being yours. In 2027, Google will block every Android app whose developer hasn't registered with them.

keepandroidopen.org
2
3
359
After MySQL, it's now SQL Server's turn. @noraj_rawsec takes a deep dive into Unicode-related security issues. 📚 Read the full article: synacktiv.com/en/publication…

The SQL Server Unicode problem: why your data might not be what you

The SQL Server Unicode problem: why your data might not be what you

synacktiv.com
17
43
4,968
I made a Ruby wrapper library for the EUVD API. github.com/noraj/euvd

GitHub - noraj/euvd: A Ruby wrapper library for the EUVD API.

A Ruby wrapper library for the EUVD API. Contribute to noraj/euvd development by creating an account on GitHub.

github.com
324
For Unicode hacking enjoyers: I have released unisec v0.0.9 TL;DR: many new search functions github.com/noraj/unisec/rele…

Release 0.0.9 · noraj/unisec

Features Added reverse normalization Lib: Unisec::Normalization.reverse_normalize CLI: unisec normalize reverse Added reverse hexdump (search which characters will give this resulting encoded v...

github.com
1
4
324
Pour ceux qui tiennent à leur vie privée : cetoc.org/

NULL_ROUTE · Krypto Privacy Directory

Privacy-first crypto directory. No-KYC services, anonymous swaps, privacy tools and wallets.

cetoc.org
MoneyRadar Crypto
@MRadarCryptoJun 19
Bruxelles vient de dater l'exécution de vos libertés individuelles : juillet 2027. La nouvelle réglementation AML n'est pas une simple mise à jour, c'est un protocole de surveillance absolue. Le couperet tombe pour tout le monde : -Interdiction stricte des paiements en espèces au-dessus de 10 000 €. -Bannissement total et définitif de tous les comptes crypto anonymes. -Obligation légale pour les plateformes de délister les Privacy Coins (Monero, Zcash). L'Europe est en train de transformer le continent en une prison financière à ciel ouvert où chaque centime devra être validé par un bureaucrate.
1
1
340
We've been working on something for a while. The talks your blue team doesn't want you to see. 🔴 Red Teaming. Initial Access. AD. Cloud & Web exploitation. 📍 Paris - Le Dernier Étage 📅 March 19–20, 2027 entrypoint.fr CFP and additional details coming soon.
1
54
2
101
20,777
This medium room was involving a bit of wordlist attacks so it was the occasion to test the new interface of legba (Multiprotocol credentials bruteforcer). Thanks @evilsocket for the tool, I was annoyed of hydra. blog.raw.pm/en/TryHackMe-Sup…

Support - Write-up - TryHackMe

Information Room# Name: Support Profile: tryhackme.com Difficulty: Medium Description: Pentest the Support Ops platform to exploit vulnerabilities and achieve RCE. Write-up Overview# Install tools

blog.raw.pm
2
4
520
The http-success syntax documentation was not easy to find, but once I did it's more powerful that static/binary fail/pass string.
144
Simple and privacy-friendly Web Analytics. No tracking. Open-source. counter.dev/
105
3 new #TryHackMe Write-ups: - W1seGuy blog.raw.pm/en/TryHackMe-W1s… - Overpass blog.raw.pm/en/TryHackMe-Ove… - Capture! blog.raw.pm/en/TryHackMe-Cap…
1
283
Load more