I'll show you an analysis of 3 cloud hacking tools that were taken from the underground. These tools are being used these days by hackers and being sold/downloadable on the Darknet and other hackers forums. You will be amazed how simple to use these tools are and how easy it is to operate them. These tools are the first phase of hacking cloud accounts and emails. We will focus on brute force and password spraying tools, show you the tools, what they are doing and a deep analysis of the tools including decryption of their encrypted communication. To wrap it up we will talk about the current landscape changes of cloud attacks.

Le protocole RDP (Remote Desktop Protocol) est un vecteur d'attaque critique utilisé par des acteurs malveillants, notamment par les groupes de rançongiciel. Pour étudier les attaques RDP, nous avons créé PyRDP, un outil d'interception RDP open source doté de capacités inégalées qui nous a permis de collecter plus de 100 heures de séquences vidéo d'attaquants en action.

Pour décrire les comportements des attaquants, nous avons caractérisé les différents archétypes d'attaquants en fonction de leurs caractéristiques à travers une analogie de Donjon et Dragon : 1) les bardes effectuant des recherches obtuses; 2) les rodeurs explorent furtivement les ordinateurs et effectuent de la reconnaissances ; 3) les voleurs tentent de monétiser l'accès RDP ; 4) les barbares utilisent une large gamme d'outils pour attaquer davantage d'ordinateurs ; et 5) les magiciens utilisent leur accès RDP comme portail magique pour dissimuler leurs origines.

Cette présentation démontre l’impressionnante capacité d'interception RDP pour les bénéfices de la recherche et les équipes de défense.

Applications use secret servers to store the credentials required for their day-to-day operations. Their usage increases as businesses improve application security and follow best practices. When permissions given to an application are too broad, the secret server becomes a central point of failure that can represent a new kind of weak link for an organization. It may be used as a stepping stone to further compromise the network.

As an attacker, when you compromise an application that can access a secret server and leak its credentials, the next logical step is to remotely access the secrets contained in the secret server. However, it can be tedious to thoroughly abuse secret servers within the duration of a security assessment. Even more so when credentials obtained in the secret server can connect to the secret server themselves, and recursivity comes into play. Recursive extraction of credentials is useful to get the full potential out of your obtained accesses. A tool to tackle the issue will be released and detailed.

La cybersécurité, ce n'est pas important ; jusqu'à ce que ça le devienne. Nous allons voir le cas d'une PME qui a décider d'agir AVANT que quelque chose arrive en implantant les contrôles CyberSécuritaire Canada !

Jedi contre les hackers est un conférence sur le Darkweb et les groupes de hackers. Elle permet d'apprendre à rechercher des informations exfiltré facilement sur les sites de 50 groupes de hackers actif. Elle démontre la facilité et comment agir avec un client ou une personne qui se retrouve avec des informations exfiltrés. Elle a été donné à travers le monde : Las Vegas, République dominicaine, Calgary, Toronto, New York bientôt Paris et Dubai. Elle est en français ou anglais.

Résumé:

Nous avons tous des parcours différents, cela fait que nous n'avons pas le même niveau de connaissances de Git. Certains ont fait un parcours réseau, administratif, sécurité offensive/défensive ou encore en programmation. Cela explique la différence de niveau et c'est normal. La chose que j'ai découverte avec le temps c'est qu'il y a peu de gens qui sont confortables à utiliser Git, malgré que plusieurs de ces personnes l'utilisent pour fréquemment.

Le but de cette présentation est de vous familiariser avec certains aspects de Git, du développement de type DevOps avec les pipelines (CI/CD) en plus de vous donnez des avenues de solution pour vous permettre de vous améliorer.

Threat hunting is both an art and a science. In this session, we’ll cover the basics of threat hunting, what a well-architected program looks like, lessons learned, share ideas and concepts, and conduct a live hunt.

A proactive security team is an effective security team.
Learn how we can reduce adversary dwell time and increase operational tempo with threat hunting over endpoint telemetry.

Passkeys are the future of authentication. Moving beyond passwords to Passkeys and WebAuthN provides a significant security upgrade for end users. But what are penetration testers that have relied on weak passwords to do? In this talk I will explore the attack surface of Passkeys and identify the viable paths to help pentesters identify vulnerabilities and achieve account takeovers. A new BurpSuite plugin will also be dropped to automate the tricky parsing of Passkey objects and identify vulnerabilities in Passkey implementations.

///EN
This is your chance to get behind the driver’s seat of the industry’s leading network security solutions. This workshop is customized to enhance your understanding of how our products work and how they can improve your organization’s security posture. We’ll take you step-by-step through each of our solutions, with an expert instructor to guide you.

///FR
Voici l'opportunité de prendre le volant du pare-feu chef de file de l'industrie de la sécurité des réseaux. Cette session vous permettra d'augmenter votre compréhension de nos pare-feux, comment les opérer, en tirer la valeur pour ultimement, augmenter la posture de sécurité de votre organisation. Nous vous guiderons étape par étape à travers la solution avec un instructeur expert pour vous soutenir.

As mobile devices have become increasingly prevalent, the security of Android applications has become a critical concern.
Pentesting is an essential process for identifying and mitigating potential vulnerabilities in these applications, but Android app hacking is a specialized area that is less well-documented than other pentesting techniques.
In this session, the focus will be on how to pentest Android apps and their APIs.

The presentation will address key questions such as what Android pentesting is, how to set up an Android App pentest lab, and how to pentest an Android App and its APIs from start to finish.

Participants will leave the session with tips and resources for learning, practicing, and setting up a complete set of tools for Android application pentesting, including detailed examples on a purposefully vulnerable application.
The goal is to equip attendees with the knowledge and skills necessary to conduct thorough and effective pentests of Android applications.

Les entreprises par leur transformation numérique se doivent de prendre conscience tout comme tout le monde, que nous sommes très dépendants des TI maintenant et nous nous devons au quotidien toujours avoir un plan "B".

Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots //
Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots //
Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots //
Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots // Remplissage 150 mots //

Step into the exciting world of the Cortex Xpanse Capture the Flag challenge! This game invites participants to journey through the Expander UI, tackling a series of intricate challenges. For each challenge conquered, players will be rewarded with a "flag" and earn valuable points. The ultimate glory goes to the team or individual who unravels the most mysteries and accumulates the highest score. By participating, you not only get a hands-on experience with Cortex Xpanse but also indulge in a fun, immersive competition. This event is tailored to both seasoned pros and enthusiastic newcomers. Are you up for the challenge? Dive in, learn, compete, and emerge victorious!

This game, with a duration of one hour, calls on participants to explore the Expander interface. Make sure to bring your laptop to take part in this challenge.

=========

Entrez dans l'univers palpitant du défi Capture the Flag de Cortex Xpanse! Ce jeu invite les participants à s'aventurer dans l'interface Expander, en affrontant une série de défis élaborés. Chaque défi surmonté récompensera les joueurs avec un "drapeau" et leur permettra de gagner des points précieux. La gloire suprême est décernée à l'équipe ou à l'individu qui dévoile le plus de mystères et obtient le score le plus élevé. En participant, vous bénéficiez non seulement d'une expérience pratique avec Cortex Xpanse, mais vous vous immergez aussi dans une compétition amusante et immersive. Cet événement est adapté aussi bien aux professionnels chevronnés qu'aux novices enthousiastes. Êtes-vous prêt à relever le défi? Plongez, apprenez, concourez et triomphez!"

Ce jeu, d'une durée d'une heure, sollicite les participants à explorer l'interface d'Expander. Assurez-vous d'apporter votre ordinateur portable pour participer à ce défi.

In the field of digital forensics, the analysis of volatile memory, commonly known as RAM, has emerged as a powerful technique for uncovering critical digital evidence. As cybercriminals become increasingly sophisticated in their methods, traditional disk-based forensic approaches may miss crucial information stored solely in the volatile memory. This talk aims to shed light on the significance of RAM forensic analysis and its role in modern investigations.
During the presentation, we will explore the intricacies of RAM forensic analysis, from its foundations to advanced techniques used to extract valuable artifacts. Attendees will gain insights into the wealth of information stored in RAM, such as running processes, network connections, open files, and cryptographic keys, and how it can be leveraged to reconstruct events and attribute actions to specific actors.
The talk will cover a range of topics, including the acquisition and preservation of RAM, memory imaging, analysis methodologies, and the utilization of specialized tools for efficient examination. Real-world case studies will be presented to showcase the practical application of RAM forensic analysis in various scenarios, such as malware investigations, data breaches, and incident response.
Furthermore, the presentation will delve into the challenges and limitations associated with RAM forensic analysis,

By attending this talk, forensic professionals, incident responders, and cybersecurity experts will gain a deeper understanding of the immense value of RAM forensic analysis in modern investigations. They will acquire practical knowledge, techniques, and tools that can enhance their capabilities in uncovering digital footprints, attributing actions, and ultimately, advancing the field of digital forensics.

Static Application Security Testing (SAST) enables organizations to detect vulnerabilities in code early; however, interviews with application security analysts indicate that SAST reports are often dense and include little to no visual aids.

Over the Winter and Spring of 2023, my research partner and I invented the Abstract Syntax Tree Reader and Analyzer (ASTRA) which responds to this need of a value-adding and intuitive visual aid for more rapid and thorough consumption of SAST insights. ASTRA is a collection of Python scripts that transforms certain parts of SAST documentation a Universal Graph Format which can be imported into many graphical visualization tools.

The key insight from our research is that vulnerability stack traces, which are spread sparsely in the report and often overlooked by security analysts, can be collected and graphed to provide new vulnerability information. Once graphed, principles of graph theory can be applied to make calculations. These include calculating the substructure entropy to discover surprising occurrences and calculating the modularity for the number of vulnerability communities in code repositories. Further, calculating the eigenvector centrality allows us to see the extent to which each individual vulnerability contributes to the overall vulnerability graph of the application.

As a result, the files contributing most to the vulnerability profile of the application will be identified. Sections of the applications that are most vulnerable will also be able to be identified. Our transformed ASTRA data has been successfully uploaded into standard 2D and 3D graphing engines, as well as Virtual Reality (VR) simulations so analysts are able to explore SAST results more intuitively, bringing more humanity and rigorous calculation into cyber analysis.

Many information security professionals recommend VPN services to end-users, especially to protect against the dreaded man-in-the-middle attack on your local coffee shop's open Wi-Fi network. The commercial VPN vendors advertise heavily, making bold statements such as "we encrypt your network data so no one can see what you’re doing", "surf the web without a trace!", "avoid government eavesdropping", and assure you that "your web traffic can't be tracked anymore". These claims are all "snake oil", and attendees will watch them be debunked. The actual benefits and limitations of VPNs will be reviewed, and a discussion of the myriad ways that are used to surveil your online activities that go far beyond browser cookies . Some tactics to minimize and mitigate this online tracking will be discussed, as well as what it takes to be truly untraceable online.

As Cloud computing evolves, adversaries can take advantage of new attack surfaces and services. The threat actors are deploying sophisticated campaign strategies to abuse millions of dollars in cloud computing in compromised tenants and subscriptions while avoiding detection. Microsoft's research reveals that targeted organizations faced more than $300,000 in compute fees from cryptojacking attacks.

In this talk, we will explore the attackers’ behaviours that we observed in numerous incidents across many organizations. We will dissect the inner workings of cloud attacks such as cryptojacking and resource abuse. As we move from the Initial Access stage to the Impact stage, we will explore key TTPs (Tactics, Techniques, and Procedures). Additionally, we will explore several ways that threat actors can abuse and hijacking subscriptions that are forensically disruptive. By analyzing footprints and logs, we will provide insights that blue teamers can use to detect and counterattack these at early stage of attacks

Dans un contexte de pénurie de talents en cybersécurité et de menaces de plus en plus complexes, l'automatisation est un concept très important dans n'importe quel centre d'opérations de cyberdéfense (SOC). Un SOAR est un outil d'automatisation pour les SOCs. Dans ce talk, nous allons démystifier ce qu'est un SOAR, ce que ça permet de faire et de ne pas faire, proposer une feuille de route pour maximiser la valeur qu'un SOC peut tirer de cet outil et partager des astuces pour bien choisir et utiliser un SOAR. Le contenu est tiré de notre expérience des trois dernières années à développer des automatisations pour notre grand SOC.

Épiées, suivies, tourmentées : 70% des victimes de violence conjugales rapportent de la violence technologique. Alors que l'environnement techno autour des victimes se complexifient, comment peut-on travailler à augmenter la littératie numérique auprès des populations vulnérables et mettre en place des outils de soutien.

Concours de tatouage, vol de bus, détournement de panneau publicitaire, "black friday" et soldes, Etc. Le blackmarket a évolué, en 30 ans, pour proposer un marketing de la malveillance agressif.

///EN
This is your chance to get behind the driver’s seat of the industry’s leading network security solutions. This workshop is customized to enhance your understanding of how our products work and how they can improve your organization’s security posture. We’ll take you step-by-step through each of our solutions, with an expert instructor to guide you. Learn how to protect your network and detect known, unknown and zero-day threats 180X faster than any other platform or point solution – all within a single, integrated best-of-breed security platform.

///FR
Voici l'opportunité de prendre le volant du pare-feu chef de file de l'industrie de la sécurité des réseaux. Cette session vous permettra d'augmenter votre compréhension de nos pare-feux, comment les opérer, en tirer la valeur pour ultimement, augmenter la posture de sécurité de votre organisation. Nous vous guiderons étape par étape à travers la solution avec un instructeur expert pour vous soutenir.

Conditional Access in Microsoft Azure Active Directory, when tied with Mobile Application Management and Mobile Device Management in Microsoft Intune are the core pillars for building zero trust based access controls in Microsoft 365 and Azure published services. We will cover MDM and MAM policies, how Intune device compliance is applied to Conditional Access by Intune, when deploying authentication and most importantly a tested model for layered access, specifically as it relates to M365 in a variety of trust states.

Découvrez l'impressionannte mobilisation technologique ukrainienne: combat dans le cyberespace et sur les réseaux sociaux, drones modifiés, IT Army et OSINT.

In this talk the author proposes a novel method for intercepting phone calls over PSTN, including mobile networks.
We'll briefly each discuss the necessary components of the attack, including Caller ID spoofing, SS7, call diverts, and social engineering, and then join the all together to form the novel attack method.

"Rubber DuckHunt", un outil innovant pour détecter et contrer les attaques de keystroke injection, une menace souvent négligée depuis sa popularisation par le Rubber Ducky; je souhaite présenter et partager cet outil en exclusivité lors de la conférence.

Joignez-vous à nous pour cette tradition annuel du Podcast en direct lors de la 2e soirée du Hackfest!
Opinions, actualités, poutine et assurément quelques dérapages seront au rendez-vous pour discuter de tout ce qui entour la sécurité de l'information!

In the rapidly evolving landscape of gaming, understanding the realm of game hacking is essential, especially in multiplayer games. While some people engage in game hacking for fun or as a hobby, others use it to cheat and gain an advantage in online multiplayer games, which can ruin the experience for other players. As we delve together into this captivating subject, I will explore the fundamentals of game hacking, including its definition, real-world examples, common methods employed by hackers, and the measures implemented to counter such exploits.

Discover the intriguing world of cheats, bots, and exploits that have impacted the gaming industry. I will showcase notable instances where game hacking has disrupted fair play and affected player experiences. By examining these examples, I aim to raise awareness about the potential consequences and implications of game hacking. Furthermore, we will delve into the various techniques employed by hackers, such as memory editing, code injection, and packet manipulation. Understanding these methods is vital to recognize vulnerabilities and formulating effective countermeasures.

The discussion will also encompass the proactive steps taken by game developers to combat cheating, including encryption, client-server validation, behavior monitoring, and regular updates. By understanding these anti-cheat measures, we can gain insights into the ongoing battle between game developers and hackers. Lastly, we will explore the future of game hacking within the broader information security landscape, considering emerging technologies, evolving security measures, and the potential impact on the gaming industry.

Outillez votre cyberdéfense en apprenant à naviguer dans la matrice des tactiques et techniques utilisées par les cybercriminels et leurs écosystèmes !

Cette présentation est conçue tant pour les gestionnaires que les professionnels de la cybersécurité et de la gouvernance de la sécurité de l'information souhaitant développer leurs connaissances du domaine des opérations de cybersécurité en commençant par les plus jeunes à qui je parlerai du programme MITRE ATT&CK Defender™ (MAD) ATT&CK®.

Au fil des ans, le MITRE ATT&CK® s'est immiscé dans les opérations de cybersécurité au point de devenir un standard de facto. Mais de quoi s'agit-il ?

Apprenez comment opérationnaliser ce qui n’est ni un produit ni une technologie dans les pratiques de cyberenseignement (CTI), chasse aux cybermenaces (TH) et simulations de cyberattaques (AE) ou encore comment renforcer la valeur du centre de gestion des opérations de cybersécurité (SOC).

Enfin, que vous disposiez de l'expertise ou que vous fassiez appel à un fournisseur de services gérés, découvrez comment intégrer l'approche MITRE ATT&CK® dans votre stratégie globale de sécurité de l'information en évaluant votre posture de cyberdéfense afin d'aligner vos contrôles avec les mécanismes de détection et de réponse requis.

Security monitoring in any environment is made or broken by the signal quality in the event logs. With mass migration to the cloud, defenders are putting all of their logging capability "eggs" in one provider's "basket". This works when the logging facilities are well designed and work robustly, but what do you do when issues arise?

In this talk, we will examine logging facilities in Azure (concentrating on events generated by Azure AD and Microsoft 365) and discuss multiple problems that we have observed in monitoring them.

These include:
- Blind spots hiding critical security events
- Poorly documented events, attributes and magic values
- Missing important information about user actions
- Bugs in log records
- Unannounced changes that break detection queries
- Log pollution opportunities, potentially leading to RCE
- and more

We will examine impact of these issues on defense and monitoring, opportunities for red-teamers, and the ways the cloud provider can address the problems going forward.

LastPass is a popular password manager used from individuals through corporate levels. However, in 2022 it suffered two breaches, and only recently was the extent of the damage made known. An unknown attacker was able to take the literal keys to the kingdom, compromising everything stored in the LastPass vaults. This talk will bring to light why the LastPass events matter to everyone, even those who think they are safe using other password managers or no password managers. There are lessons here about sophisticated staged attacks that bypass defenses in place, and the increasing onus on businesses to manage IAM and BYOD

This talk offers a concise introduction to web scraping techniques using Python, focusing on automated data extraction from websites. Web scraping enables the systematic collection of web data for various purposes, including content aggregation, research, job hunting, social media analysis, and monitoring legal and compliance issues. It is also a valuable tool for preserving government data, as evidenced during Donald Trump's presidency when various government website data, such as climate change information and LGBTQ+ resources, were altered or removed. This comprehensive overview equips attendees with a versatile toolkit for extracting valuable web data.

Let's get hands on and dive into the marvelous world of "artificial intelligence" and "prompt engineering"!

This session will cover two CTF challenges based on Stable Diffusion which is a model capable of generating photo-realistic images given any text input. This will show in a practical fashion some real impact of something otherwise artificial.

The challenges are going to be solved step by step alongside a dive into diffusion models and technical details on machine learning.

We will provide a dedicated online environment that requires low computing power on your end to do prompt hacking and try out Stable Diffusion.

Prerequisites:
This workshop supports three levels of technical readiness:
1) To participate in prompt hacking, bring any laptop or cellphone with a Web browser
2) For a more low-level challenge, bring a laptop with Python installed
3) To optionally play with Stable Diffusion tools locally, a laptop with dedicated 3D graphic card is required

L'aide aux participants en Français sera aussi disponible.

Ever wondered if Skynet could run a fake news empire and win a Pulitzer? This is CounterCloud, a two month online experiment that is part 'Terminator,' part 'Black Mirror,' and takes us deep into the wild frontier of totally autonomous AI-generated disinformation.

During the pandemic I took up Bluetooth (BT) sniffing as a way to get out of the house.

Bluedriving left me with questions that are different from those you'd ask based on traditional WiFi wardriving. Is there a geographic correlation between poverty, obesity, and BT sleep apnea medical devices? What are the implications of BT on police body cameras? Are fitness trackers still making it easy to track humans instead? Can someone steal heavy-construction equipment thanks to BT keyless ignition? Can hackers be tracked by their "portable multi-tool[s]"? Do hotels using BT door locks "open the door" to easier assassinations?

In this talk I will share some of the most interesting observations from the past few years, and share surprising answers to the above questions, and more.

We'll be taking a look into the history and technical evolution of wiper malware, starting from Shamoon all the way to the modern-day wipers found in the Russia-Ukraine conflict.

How the placement of your security program may be impacting your organization.

Lorraine: Marty, this may seem a little forward, but I was wondering if you would ask me to the Enchantment Under the Sea Dance on Saturday?

This talk revisits the theme of personal privacy in the digital world, this time centring around the "I've got nothing to hide" argument. A beam of intensive light is shed on the motivation behind caring about one's privacy. We go in depth into what we can do to stay private and should we even try to do it at all. We talk about where we as an global society were able to fix privacy and where we have failed. New topics previously not covered are discussed, such as AI/LLMs.

Le phénomène de la "fatigue des alertes" ("alert/ticket fatigue" en anglais) est bien réel et affecte probablement la majorité des organisations possédant un SOC. Les différentes solutions de sécurité génèrent de plus en plus d'alertes et afin d'éviter au maximum l'épuisement de nos équipes qui peuvent traiter des faux positifs à répétition, il faut repenser à notre stratégie vis-à-vis celles-ci. Une piste intéressante est la mise en place des alertes basées sur le risque, sommairement, les deux principaux avantages seraient de réduire le nombre de faux positifs et d'également détecter des événements qui individuellement n'auraient potentiellement pas levé d'alertes.

A buzzword for years, Artificial intelligence (AI) has evolved into a powerful, accessible tool and, like any tool, it can be used for evil. How can AI technology be harnessed by adversaries (or you) as part of sophisticated information security attacks? What sort of attacks are we seeing in the wild and how can we prepare for the new offensive techniques?

On trouve sur Facebook des annonces ou des vedettes québécoises semblent faire la promotion de pilules pour perdre du poids sans efforts ou encore « avoir des érections comme dans 18 ans »! Malheureusement, des gens tombent dans le panneau et ça peut leur coûter cher.

L’émission d’enquête J.E. nous a demandé de l’aide pour dénicher les responsables de ces arnaques. À l’aide du Cycle du renseignement nous allons explorer les bases de l’OSINT. Nous verrons ce que c’est et ce que ce n’est pas, ainsi que les précautions à prendre durant ce type d’enquête.

Un stratagème comme celui-ci nécessite plusieurs acteurs. Nous montrerons les étapes qui ont mené à la cartographie du réseau, à l’identification de certaines personnes impliquées et comment la photo d'un chien nous a mis sur la piste de son adresse.

This presentation delves into the realm of cloud computing's security challenges and the Red Team perspective. It sheds light on intrusion testing, shared security models, and vulnerabilities unique to cloud systems. The discussion covers cloud intrusion testing's importance, methodologies, and distinctiveness compared to traditional approaches. Identity and Access Management's crucial role will be highlighted and explain through the 3 main CSP AWS/Azure/GCP, their main differences and security implication. The talk will outlines reasons for conducting Red Team engagements focusing on critical resource access. Applied assessment methodologies are proposed, including BlackBox, AssumBreach, and White Box approaches. Attack scenarios, based on the Mitre Att&ck Cloud Matrix framework, are explored, encompassing various stages. The presentation also delves into using the cloud offensively (Redirectors, storage and delivery), cloud-based phishing and Oauth abuse. The aim is to facilitate knowledge exchange, encourage research, and enhance cloud security by leveraging Red Team insights.

Web 3.0 smart contracts, like the ones found on Ethereum, bring promises of speed, decentralization, and security. Although DeFi's model may seem complex, these projects still can be vulnerable to relatively simple attacks like domain takeovers. In this beginner-friendly talk, we discuss how I discovered dangling DNS on several decentralized crypto exchanges and my experiences trying to responsibly disclose vulnerabilities to them.

Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc. Hackfest 2023 - La revue du CTF et des activitées, remises des prix, black coins, etc.