Nicolas Grégoire

@agarri.fr

4480 Followers 619 Following

Web hacker 😈 Burp Suite Pro trainer đŸ‘šâ€đŸ« Maintainer of @mastering-burp.agarri.fr đŸ› ïž

Screenshot from X: "I dont post that much, but I do when I feel like its worth it - I have to say having taken the Burp suite Pro training by @Agarri_FR I was totally blown away. I have used burp for over 20 years and have learnt so much that will immediately help me, totally recommend the course!"
Last week, I had the opportunity to attend the 4-day Mastering Burp Suite Pro training by đŸ› ïž Nicolas Gregoire, and it exceeded my expectations by far. This wasn’t just another slide-driven course. Nicolas took the time to answer every question in depth and provided plenty of hands-on labs, allowing us to immediately apply what had just been explained. Even though I’ve been working with Burp for nearly five years, I still picked up a surprising number of new techniques and practical tricks, including ways to streamline otherwise time-consuming workflows such as managing CSRF tokens both with and without session handling rules. What I especially appreciated were the little side explorations (driven by our requests) into methodologies for leveraging features and extensions to remain stealthy or bypass WAFs. This is something that’s particularly relevant (and often underestimated) when exploiting external or internal web applications during advanced Red Team engagements. I’m genuinely looking forward to applying this newly gained knowledge in upcoming projects, and I can wholeheartedly recommend this training to any (web) pentester who wants to level up their Burp skills. Big thanks to Nicolas for an excellent and highly practical course!
Printed version of Paged Out #7, collected during GreHack 2025
A nice sunset
Capture (partielle) d’un article du Monde consĂ©cutif Ă  la condamnation de Florent Curtet
A mugshot of former president Sarkozy
Searching for "iphone mini" after yesterday’s keynote reveals that some users really like small iPhones like the 13 Mini
Another beautiful sunset over the Spree
Sunset on the Spree river
A printed copy of Phrack 63, released at the dutch hacker camp WTH 2005
Old PCMIA cards I used for Wifi hacking decades ago: Linksys WPC11 v3 and 3COM 3CRPAG175B
The 16 first chapters of ECMA-376 + the annex L. A total of ~ 500 pages
From the Urban Dictionary : "cheese" is a term coined by RTS gamers when a player uses non ordinary measures, often considered cheap tactics, to win the game early.
A meme I created. It shows Calvin (from Calvin & Hobbes) seated at a table with a sign saying "Chaining two instances of Burp Suite is such an underrated technique. Change my mind"
A few postcards edited by the Chaos Post Office
A collection of swag: a harpon of our village, the WHY and Phrack glasses, a Cyber Sayan coin, a badge and some stickers
Folding balloons workshop
Sunset on Day 3 of WHY 2025
Toasting marshmallows by the bonfire
Audience of the opening ceremony in the largest room, Andromeda
Light show during the night
Morning at the Dutch camp
Screenshot of the WHY2025 map. A vehicle named MobelhausGator is parked next to the village RandomOrange
La fraude Ă  l’URSAAF reprĂ©sente 53% du montant total
A DECT phone I use during Dutch hacker camps. It shows a phonebook entry for @jrn
Custom napkins with the RandomOrange et Agarri logos. The text reads "Bon appétit !"
Stock badge, including a real keyboard
Public dashboard showing a plateau of tickets sales after 3,751
Screenshot of the man page for fold
Second training session with Nicolas and we're still learning a lot. I'd like to emphasize once again the quality of the training, which is one of the best available. The time between theory and practice is very well managed and you never see the week go by. I particularly liked the pedagogical approach, and the combination of technical and business objectives to fine-tune attacks. At the end of the session, you realize that you were using barely 20% of the functionalities offered by the Burp tool.
Sunset shot from a hill next to my home
A press release from Aylo (owner of Pornhub) saying that "All it requires is that the government enforce regulations on three companies – Apple, Google and Microsoft – the three operating system manufacturers requiring age verification at the device level prior to accessing adult content"
Le fameux lapin Ă  trois yeux, du mĂȘme auteur que les cĂ©lĂšbres enfants Ă  neuf doigts
Le lapin présent sur la couverture. Il a trois yeux
An extract of the timeline: - 2024-03-19: We report the issues to Insomnia and Postman via email - 2024-03-19: The Postman team asks us to use their bug bounty platform instead - 2024-03-21: We decline Postman's request due to conflict with our disclosure policy
A screenshot of the advisory. The text: says: We get chastised for not following someone else's random definition of responsible disclosure, but where is the accountability for vendors who update a text file every time their solution gets popped?
20 December 2024: First XXE vulnerability report sent to SysAid. 22 December 2024: SysAid responds, stating they are unable to reproduce the XXE and highlights that they have their own vulnerability disclosure terms & conditions they’d like to somehow commit us to. 22 December 2024: watchTowr checks with counsel to ensure that it’s still not possible to arbitrarily bind people to random contracts without agreement - counsel confirms that the world has not changed.
A drawing with two characters Character A: You’ve changed Character B: We are supposed to
Tool reqvis displaying some web traffic https://github.com/ibudiallo/reqvis
Lac d’Esparron, France
Sunrise over the Sainte Victoire (Aix en Provence đŸ‡«đŸ‡·
Grafana dashboard showing that 2,772 tickets have already been sold
A screenshot from Johan Carlsson's Linkedin account: "Last week, I participated in Nicolas Gregoire's course "Mastering Burp Suite Pro". I must say it was probably the single best technical course I have taken. Using Burp (one of the main tools I use daily) feels like a whole new experience. I can not recommend enough jumping on one of these sessions."
A cartoon character (depicting Jeffrey Goldberg) sits in a meeting with JD Vance, Peter Hegseth and others (cf the article "The Trump Administration Accidentally Texted Me Its War Plans")
Screen capture with an excerpt from the article: "The resolver will first try to handle the parameter entities, and only afterwards will perform the DTD prohibition check! An exception will be thrown in the end, but it still allows you to exploit the Out-of-Band XXE and potentially exfiltrate data (using, for example, an HTTP channel)."
Screenshot showing LibreOffice being loaded inside a browser. The "ping" diagram is generated from network response times, and users can enter which websites to test
My stats: - joined 604 days ago - has 3650 followers and 876 followings - posted 0.93 messages per day
Le lac d’Annecy - France
This graph, showing my Twitter postings habits over time, was generated by https://tweetplot.streamlit.app/
A graph showing at what time of the day I posted to Twitter between 2011 and 2024
A Bash script looping through Gitlab repositories. For each repo, a ruler (horizontal line) is inserted before the repo's details are printed
The ouput of a Python script is beautified with the Rich library Activity is color-coded (red = inactive, green = active) and rulers (aka horizontal lines) are used to delimit sections
Jazco’s live counter showing that Bluesky reached 20 million users
A tutorial on how to write alt-text, with the famous "capybara with yellow fruits" as an example
A photo taken in the city, on the edge of a small canal. A tree broke through the concrete floor to grow. Then it was cut down with a chainsaw... But it grows back!
Screenshot showing DeckBlue with two accounts
My latest sneakers are white-on-black Vans, with HackInTheBox swag for the matching laces