Christophe Tafani-Dereeper

Latest posts from my blog where I write about things I like, use, dislike and misuse.

• June 29, 2022 MitM at the Edge: Abusing Cloudflare Workers
• Jan 28, 2022 Introducing Stratus Red Team, an Adversary Emulation Tool for the Cloud
• Jan 11, 2022 Implementing a Vulnerable AWS DevOps Environment as a CloudGoat Scenario
• Dec 22, 2021 Cloud Security Breaches and Vulnerabilities: 2021 in Review
• June 9, 2021 Phishing for AWS credentials via AWS SSO device code authentication

Latest posts I wrote with current or past employers.

• Dec 21, 2022 A retrospective on public cloud breaches of 2022
• Nov 23, 2022 Investigating a backdoored PyPi package targeting FastAPI applications
• Nov 15, 2022 Finding malicious PyPI packages through static code analysis: Meet GuardDog
• Nov 1, 2022 The OpenSSL punycode vulnerability (CVE-2022-3602), detailed write-up
• Oct 5, 2022 State of AWS Security in 2022: a look into 600+ real-world AWS environments

Stratus Red Team

Granular, Actionable Adversary Emulation for the Cloud

CloudFlair

Find origins of websites behind by CloudFlare using Internet-wide scan data from Censys

Adaz

Automate the provisioning of Active Directory labs in Azure

log4shell-vulnerable-app

Vulnerable Spring Boot application for easy reproduction of the Log4shell vulnerability

Threatest

Go framework for end to end testing threat detection rules

censys-subdomain-finder

Subdomain enumeration using the certificate transparency logs from Censys

hunting-mindmaps

Mindmaps for threat hunting using memory captures and Windows event logs

• Purple Teaming & Adversary Emulation in the Cloud (DEFCON Cloud Village 2022)
• Purple Teaming the Cloud with Stratus Red Team @ Cloud-Native SecurityCon 2022
• Fantastic AWS Hacks and Where to Find Them @ SANS New2Cyber 2022 (video, slides)
• Scanning Infrastructure-as-Code for security flaws (video, slides) (OWASP DevSlop)
• Can't Take My Lab off You — Automating the Provisioning of Active Directory Labs in Azure   (vOPCDE #7)
• Adaz presentation (Forensic Lunch October 23rd, 2020)
• Switzerland has bunkers, we have Vault  (BlackAlps 2018)
• How hackers exploit weak SSH credentials to build DDoS botnets  (Blackalps 2017, Grehack 2017)

• Scanning Infrastructure-as-Code For Security Issues (Day Two Cloud episode 125)
• Infrastructure-as-Code Security (French only, NoLimitSecu podcast)
• Service Meshes and their Security Implications (French only, NoLimitSecu podcast)

Technical and non-technical books I particularly enjoyed reading and learning from.

Security:

• Hacking, the Art of Exploitation
• Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
• Violent Python
• The Phoenix Project
• The Goal: A Process of Ongoing Improvement
• Team Topologies
• Building Microservices: Designing Fine-Grained Systems

DevOps / Engineeering:

• The Phoenix Project
• The Goal: A Process of Ongoing Improvement
• Team Topologies
• Building Microservices: Designing Fine-Grained Systems

Quotes I find inspiring. Taken from a book, a movie, a reddit post, a blog post, or an overheard conversation.

• «  Not every problem is a nail, and not every solution a hammer  »
• «  Under-promise, over-deliver  »