Julien PERRIN

Achievements

• Investment in the implementation of the company's PASSI certification
• Response to different bids and participating in costs evaluations

Cyber Monitor OSINT Passively scans the internet for credentials, domains, subdomains, vulnerabilities and typosquatting

OSINT VIP Exposure assessment of a company's key executives across public sources

Achievements

CAPE — Certified Active Directory Pentester Expert

RPG

Kaiju

Xen

Hades

POO

Zephyr

Dante

Academy Progress

Achievements

• Pentest management, pentest reviews and pentest of a complete system
• Creation of automated configuration audit scripts for penetration testing on Windows and Linux systems of a set of machines on a Vsphere virtualized infrastructure. Automated deployment, data recovery and removal of penetration test files on the entire virtualized system
• Advanced network configuration based on architecture and addressing schemes
• Writing of the vulnerability closure report of the previous penetration tests on the Galileo system
• Vulnerability analysis and impact evaluation on the system
• Study of the cybersecurity impacts of the divergence of requirements between "As-built" and "As-designed" industrial systems. Decision making on the adoption or not of the deviation according to the criticality of the impact of the vulnerability created, in correlation with the global criticality of the system where the deviation is located

Achievements

• Team management and piloting of penetration tests on internal and external missions — technical and editorial quality review, expertise support on vulnerability exploitation
• Capitalization in the form of a database on vulnerabilities and recommendations based on OWASP flaws and methodologies
• Web penetration testing templates and creation of the internal wiki of the Cyber business unit
• Set up a web attack scenario and developed a methodology for its detection via the Splunk tool

CyberUS Flask platform to monitor and improve team skills, based on root-me challenges

OSINT Leaks CTI tool harvesting client emails and leaked passwords, then scoring the criticality of each leak

Root-us Automated bash script to check and exploit Linux misconfigurations for privilege escalation

Splunk detection Web attack scenario and its detection methodology built on Splunk

Main achievements

• Mobile applications audit & pentests
• Web application audit & pentests
• Internal talk to increase the team's skills on XXE (SOAP) vulnerabilities

Category Progress

Main achievements

• Mobile applications audit & pentests
• Web application audit & pentests
• Development of a vulnerable iOS application for internal training and recruitment
• PoC using HackRF

• Bruteforce of iOS application PINs, to demonstrate the impact of a missing timeout or lockout after X attempts — 3 min for 4 characters, 5 hours for 6 characters
• Automated recovery of application permissions
• Script checking the compiler protections in place (PIE, ARC, SSP, etc.)
• Script recovering the classes of an application

• Authentication by login and encryption
• Administration panel
• API integration (Cryptlex, Algolia, Stripe)
• Payment system

• Authentication by login and encryption
• Platform grouping the different training courses
• Download and launch of training courses

• Android Studio — authentication by login and encryption, password administration panel, swipe control events, simplicity and design
• Server — one way encryption (bcrypt) and database architecture

• Visual Studio — MVC (Model View Controller) architecture
• Currency and transaction management
• Filters by week, month and year