Philippe Leothaud @pleothaud
Joined September 2010-
Tweets284
-
Followers47
-
Following332
-
Likes106
@S1r1u5_ HMAC Algorithm Attack • HMAC is symmetric: same shared key used to sign & verify • RSA is asymmetric: public & private keys • Attacker: 1. Puts HS256 instead of RS256 2. Signs with public RS256 key • API code blindly uses public RSA key with HMAC alg to verify signature
Matthias Leothaud poursuit son ascension dans le peloton junior non sans lorgner sur les professionnels ➡️ l.midilibre.fr/iCWB
@BetterCallMedhi At last blue teams will be as good as red teams 😉 And we might end up with software built with security in mind from design to prod
@BetterCallMedhi No choice but to implement a rock solid agentic DevSecOps workflow now, and continuous AI based pentesting... With a little bit of luck AI based blue team efforts will prevent AI based red team ones
@ZackKorman @pilvar222 Very nice! We have simular stuff at @42crunch and currently working on integrating the distributed testing of increments in the IDE and the central governance layer verified in the CI/CD when building/moving to prod What can be probabilistic and what must remain deterministic ?
GraphQL Introspection Bypass via Field Suggestions Even with introspection disabled, GraphQL APIs leak schema information through error messages. When introspection returns errors, exploit the suggestion feature: > Send queries with intentional typos > GraphQL suggests similar field names in error responses > Tools like Clairvoyance can automate schema reconstruction > Build a complete schema map from suggestions alone Source👇 assetnote.io/resources/rese…
Join our experts Anthony Lonergan and Heshaam Attar for an exclusive webinar unpacking the findings of the State of API Security 2026 Report 42crunch.com/api-security-r…
Join our webinar featuring highlights from two years of investigative research on breaches mentioned in the APIsecurity.io newsletter, and a demonstration of how a continuous API security approach is the only strategy in an AI-driven world. 42crunch.com/why-scaling-ap…
@gugus_bontaquin Un s en trop dans subrepticement
There are no logs when Actor tokens are issued or used. They cannot be revoked within their 24 hours validity. They completely bypass any restrictions configured in Conditional Access.
following Entra ID data could be accessed without any traces: User information including all their personal details stored in Entra ID. Group and role information. Device information and BitLocker keys synced to Entra ID
FAPI 2.0 sets a strong foundation for API access control, but it doesn’t cover many common, high-risk vulnerabilities, like Broken Object Level Authorization (BOLA) or API logic flaws. 42Crunch extends FAPI security further. 42crunch.com/why-fapi-2-0-i…
In Issue 278 we dive into reports of vulnerabilities impacting Intel, McDonald’s, and TeaForHer, the latest news from the Optus 2022 API breach and an insightful article offering practical tips for designing APIs for efficient AI agent consumption. apisecurity.io/issue-278-owas…
Two key API endpoints with no authorization lead to access bypass flaw in AI-powered platform Base44 wiz.io/blog/critical-…
In Issue 276 we have articles on input validation best practices, take a look at claims about API discovery that risk distracting from real security issues, and review API security incidents reported at McDonald’s and Cisco. apisecurity.io/issue-276-api-… #apisecurity #newsletter
API Drift describes inconsistencies between an API’s actual behavior and its intended design and is a security concern with real consequences - the recent attack on CoinMarketCap. Explores the challenges and how to prevent unintended consequences: 42crunch.com/when-api-drift…
Registrieren Sie sich für unser bevorstehendes Webinar über das Auffinden und Beheben der OWASP-API-Sicherheitsschwachstellen BOLA, BA und BOPLA. 42crunch.com/owasp-bola-ba-… #BOLA #BOPLA #OWASP #APIsecurity
Jean Wilhelmina @JeanWilhel70313
6 Followers 143 Following Unstoppable in grace, unbreakable in spirit.
Sosineyt @SosineytMj96X
69 Followers 2K Following
미진부부 @eva_kelley70222
17 Followers 1K Following
Xavier Léothaud @Djambaar
24 Followers 234 Following
Université de l'Epar... @Epargne_UDE
107K Followers 9K Following Apprenez à investir à l'Université de l'Épargne Rejoignez 9000+ investisseurs Chaine YouTube https://t.co/EVUs97Z3hv
Kitetoa @_Kitetoa_
8K Followers 4K Following Dino du net égaré dans le journalisme. L'inverse marche aussi - Redchef de @_reflets_ Je suis moins ici. Retrouvez-moi sur Bluesky : @kitetoa.reflets.info
Sylvie Bigotte @sylvie_bigotte
58 Followers 692 Following
🎊Emotion🏖 @MasmoudiHanane
398 Followers 3K Following It is never too late to be who you might have been.
Dima Postnikov 🆔 @dima_postnikov
315 Followers 764 Following #Identity #OpenBanking #Architecture My personal views only
Hugh Carroll @techmuses
892 Followers 1K Following B2B tech marketer. CMO @42Crunch. Former CMO with Asavie (now Akamai) and Vordel (now Axway). #surf #triathlon #seaswimming #axethrowing
API Strategy Guy @apistrategyguy
665 Followers 691 Following Serious API strategy (from a not-so-serious guy...) #APIs #WhatsYourStrategy?
🅹🅴🅽🅽🅸�... @Jennifer_93623
18 Followers 2K Following A beautiful and lonely girl wants to meet an interesting men!Add me and I´ll send you a message with my most favorite photo 💖💋💖
Philippe Bogaerts @xxradar
929 Followers 2K Following #BruCON co-founder, #OWASP, #pentesting, #research, #kubernetes, #K8S, #docker, #containers, #devsecops, #music, #food, #bbq, #lowandslow ... and #mojito !!
FusionAuth @FusionAuth
2K Followers 1K Following The only Customer Identity and Access Management (CIAM) with hybrid, single-tenant deployment you can dev and test anywhere*
Ailton @ailtonTT
299 Followers 2K Following Dev, p̵r̵ó̵ ̵c̵a̵f̵é̵, security researcher depois da meia noite; PhD student; Juninho na vida
Ben Hutton @relequestual
2K Followers 3K Following Follower of Jesus, Dad and Husband, Open-Sourcer, Gamer, Board Games, Drummer, Music Lover, Cats - {@jsonschema} - @[email protected]
Kimball Bighorse @kbighorse
583 Followers 3K Following I formulate infinity, stored deep inside me. blocked by @idahofreedom.
Jeff Lombardo @IdentityMonk
1K Followers 595 Following Dubito ergo cogito. Not a GURU, just a monk trying to comprehend, discuss & promote best practices, evolutions and trends of Digital Identity, Privacy and Trust
Rainer Hermanns @rhai... @rhaix
448 Followers 2K Following He/Him, cloud native nerd, software craftsperson, Struts2 PMC and OpenSource enthusiast, husband, proud father, cyclist, scuba diver and snowboarder
Rick Krueger @richard_krueger
137 Followers 143 Following Regional Sales Manager, Wallarm, dominant leader in API security and API threat protection.
Sebastien Gioria @SPoint
2K Followers 2K Following #OWASP France Leader/Expert Judiciaire #Application #Security/Life tweets. DevSecOPS Officer @LectraOfficial. Every tweet is personal, not company
DARREAU DIDIER @ddarreau1
64 Followers 168 Following
Ronan Tallec @TallecRonan
60 Followers 222 Following
Chris Wiechmann @cwiechmann2007
46 Followers 180 Following
Frequentz @Frequentz
10K Followers 578 Following Technology driven company and leader in providing comprehensive serialized data warehousing, traceability, and information solutions. #FrequentzNewz
David Brossard @davidjbrossard
1K Followers 2K Following CTO @axiomatics AuthZ Former Sr. Director Identity PM @salesforce Editor XACML - founding member @idpro_org Geek #authorization #identity #privacy 🇸🇪🇫🇷🇨🇦
Magdalena @Magda_Kucza
306 Followers 926 Following Senior Media Relations Strategist @ANSYS kind of geek:-) passionate communicator and strong believer that Comms bring a real business value for organizations.
Sebastien Vugier @svugier
218 Followers 99 Following Senior Director, Digital Banking Engagement Platform, Sopra Banking Software
Axway @Axway
5K Followers 2K Following Axway helps companies move forward faster and build brilliant experiences using our Amplify API Management Platform and proven MFT and B2B/EDI solutions.
Philipp Schöne @PhSchoene
294 Followers 363 Following API | Cloud | IOT - Working for Mulesoft. BBQ fan in his private life
Hanissa KHODRI @HanissaKhodri
59 Followers 113 Following
AppSecForum @appsec_forum
421 Followers 193 Following Application Security Forum - Western Switzerland #ASFWS
Sylvain RICHET @sylvainrichet
27 Followers 142 Following croit toujours que le monde est exactement tel qu'on le fait.
${mguillem37} @mguillem37
78 Followers 249 Following Informaticien passionné 🤓 Python, Big-Data, Spark, Spring, Angular, NodeJS, API Gateway, SAML, OAUTH/OIDC,...Toujours un truc à apprendre 🤗
Mark O'Neill @TheMarkONeill
4K Followers 982 Following Forward-deployed analyst. APIs, AI, Farming, Cycling. Opinions here are my own; RTs/favs ≠ endorsements.
Sylvain MARET - "Un H... @smaret
935 Followers 1K Following Un Homme sur la Terre / Cyber Security Veteran / Scuba Diving Teacher https://t.co/4VfEDo3Hsf / @dontkillthecow @un.homme.sur.la.terre (insta) - Travel - Explo
Julian Assange @ImJulianAssange
104K Followers 21K Following
ClaudeDevs @ClaudeDevs
626K Followers 3 Following Official updates for developers building with @ClaudeAI
DirectVelo @directvelo
34K Followers 2K Following Un projet global pour le cyclisme : site web, livres, films, événements... L'actualité des Féminines, des Juniors, des Amateurs et des Pros.
Timothy Gowers @wtgow... @wtgowers
58K Followers 189 Following Mathematician. Professeur titulaire de la chaire Combinatoire au Collège de France. Also fellow of Trinity College Cambridge.
Claude @claudeai
1.7M Followers 2 Following Claude is an AI assistant built by @anthropicai to be safe, accurate, and secure. Talk to Claude on https://t.co/ZhTwG8dz3D or download the app.
rootsecdev @rootsecdev
27K Followers 1K Following Senior Security Consultant @TrustedSec | Military grade meme poster, researcher, cloud penetration tester, voider of warranties. My thoughts are my own.
The Hacker News @TheHackersNews
1.9M Followers 2K Following The #1 trusted source for cybersecurity news, insights, and analysis — built for defenders and trusted by decision-makers.
bugcrowd @Bugcrowd
200K Followers 6K Following The leading provider of crowdsourced cybersecurity solutions purpose-built to secure the digitally connected world...Unleash Ingenuity™
HackerSploit @HackerSploit
107K Followers 2K Following Leading Provider of Free Cybersecurity Training: https://t.co/x91kxo5yck Writeups: https://t.co/5xOk0uqsWc | Academy: https://t.co/GHqvlqpmd9
Hacking Articles @hackinarticles
301K Followers 480 Following House of Pentesters Join us: https://t.co/Y6XOlSP7YA
Mehdi Medjaoui @medjawii
4K Followers 4K Following Code is law and law is code. Building APIs to make GDPR Programmable on @aliasCodeisLaw Founder @ApidaysGlobal & @OAuth_io (acquired), co-author @thecambook
Mike Amundsen @mamund... @mamund
13K Followers 9K Following https://t.co/9HNGpKXNC6 Working to improve the quality and usability of information on the Web with APIs, Microservices, and Digital Transformation
Justin Gardner @Rhynorater
38K Followers 2K Following Christian | Full-time Bug Bounty Hunter | Host of @ctbbpodcast | Advisor @CaidoIO | 4x LHE MVH | 🗣️ English, 日本語 | ♥️ @mariahchan_ ♥️
Intigriti @intigriti
211K Followers 668 Following Bug bounty & VDP platform trusted by the world’s largest organisations! 🌍
Emmanuel Paraskakis @manp
2K Followers 4K Following API Product Consultant @level_250, @MavenHQ instructor
Newton Cheng @newton_cheng
2K Followers 259 Following Frontier Red Team at @AnthropicAI | Physics PhD from @UCBerkeley
Insecure Agents Podca... @insecureagents
962 Followers 111 Following AI engineers and security practitioners listen to us to learn how to give their agents the security they need to reach full autonomy and capability.
Matthew @embee_research
14K Followers 2K Following Security Researcher, Creating and Sharing Educational Content.
shubs @infosec_au
59K Followers 2K Following Co-founder, security researcher. Building an attack surface management platform, @assetnote
Zack Korman @ZackKorman
14K Followers 2K Following Cofounder @ Embroidery. Building AI cybersecurity stuff.
Velina Tchakarova @vtchakarova
217K Followers 8K Following Geopolitical Strategist| Chief Strategic Foreseer | I coined #Dragonbear |#geopolitics |#GlobalSystem | #realpolitik | #foresight | #trends | #risks | #RWRI
ᴅᴀɴɪᴇʟ ᴍɪ... @DanielMiessler
159K Followers 2K Following I help people/companies articulate and pursue their Ideal State. | https://t.co/muV0Un0Hi8, https://t.co/c9CkgMpaQw, https://t.co/z0T3GvB2Kn | Ex: Apple, Robinhood, HP
André Baptista @0xacb
19K Followers 842 Following Hacker grinding for L1gh7 and Fr33dφm, straight outta the cosmic realm. Co-founder @ethiack
Yassine Aboukir 🐐 @Yassineaboukir
33K Followers 415 Following HackerOne Top 40, Elite, Pentest Lead, Ambassador, x2 MVH Title, $1 million bounties and ex- Hacker Advisory Board • Digital Nomad/Hybrid Athlete/Surfer
publiclyDisclosed @disclosedh1
68K Followers 2 Following This is an unofficial HackerOne public disclosure watcher who keeps you up to date about the recently disclosed bugs. By @NOBBD
PentesterLab @PentesterLab
206K Followers 0 Following Don’t just learn tools and payloads. Learn why vulnerabilities exist. Hands-on web hacking, security code review, and real-world CVE labs.
Cyber_OSINT @Cyber_O51NT
23K Followers 316 Following #OSINT treasure hunter, investigator, #CyberThreatIntel analyst. Opinions are my own. Follow me on Telegram https://t.co/i6VBbeUXgd for cyber news.
spaceraccoon | Eugene... @spaceraccoonsec
26K Followers 314 Following Author of "From Day Zero to Zero Day" - No Starch Press. Every day is 0day! Personal profile - all opinions expressed are my own.
Nicolas Grégoire @Agarri_FR
28K Followers 628 Following Web hacker and Burp Suite Pro trainer Refer to https://t.co/D5tRH7U2hg for trainings Follow @MasteringBurp for free tips and tricks
Dhruv | AI Tools & De... @DhruvOnSteroids
34 Followers 77 Following Software Dev | Web3 • DSA • MERN • LLM • Cloud | git pull harder | SIH & SSIP Hackathon Winner | Dev by day. Builder by night | Sharing AI tools + GitHub repo
Het Mehta @hetmehtaa
42K Followers 2K Following Security Engineer | Content Creator | I talk about Cybersecurity, Tech, Privacy, AI & Startups | Building @Sentynio @100xSecurity
zodttd @zodttd
15K Followers 3K Following ZodTTD - App Publisher - AI - Made last year's chart-topping #1 app in App Store, Gamma game emulator. Brought ads to iPhone before it wasn't cool. Florida man.
watchTowr @watchtowrcyber
12K Followers 12 Following watchTowr enables organizations to get ahead of in-the-wild exploitation with Preemptive Exposure Management technology.
Philippe Lagadec @decalage2
5K Followers 1K Following Author of oletools, olefile, ViperMonkey, ExeFilter, Balbuzard. #DFIR, #malware analysis, maldocs, file formats, #Python. @[email protected]
Willi Ballenthin @williballenthin
7K Followers 1K Following
MagicSword @magicswordio
1K Followers 31 Following It Ends with Us! ⚔️Watch 📺 https://t.co/zofSxbytt8 Follow 🥷 https://t.co/kGRIGi9InO Read 📓 https://t.co/BowPLUlKqy
Piotr Bazydło @chudyPB
5K Followers 319 Following Principal Vulnerability Researcher at watchTowr | Previously: Zero Day Initiative | @[email protected]
Kirill Firsov @k_firsov
6K Followers 414 Following Co-founder and CTO of @FearsOff | Protecting the World’s Top Crypto Exchanges & Financial Institutions | Cybersecurity Enthusiast
张惠倩 @momika233
19K Followers 237 Following Anda boleh melakukan segala-galanya dari syurga ke bumi, wanita kecil!! If you have any questions, please contact me https://t.co/MkzsavUU9V
Jonny Johnson @JonnyJohnson_
9K Followers 449 Following Windows Internals & Telemetry Research @ThePayloadPod Blog: https://t.co/MnE9BCsSnA Github: https://t.co/v7hSLq6Edz
sixtyvividtails @sixtyvividtails
4K Followers 400 Following Currently working as an independent GUID merchant. Fully licensed. I acquire, produce, and sell high-quality GUIDs.
Florian Roth ⚡️ @cyb3rops
222K Followers 3K Following Head of Research @nextronsystems #DFIR #YARA #Sigma | detection engineer | creator of @thor_scanner, Aurora, Sigma, LOKI, YARA-Forge | always busy ⌚️🐇 | vi/vim
Melvin langvik @Flangvik
12K Followers 528 Following Red Team @TrustedSec , terrible creator of InfoSec content 📹Opinions are my own and not the views of my employer.
Stephen Sims @Steph3nSims
26K Followers 867 Following Perpetual Student | SANS Fellow | Musician | Braggart Hater | Gray Hat Hacking | VR | 🏂 | deadcode | https://t.co/4neOSsnCQ8
eversinc33 🤍🔪�... @eversinc33
7K Followers 1K Following reversing/deobfuscation/drivers @ https://t.co/64HAro8Scw
You might like
