Every year in my engineering school, we had to carry out a “major” project. The major 1st year project is carrying out a scientific study on a subject of our choice related to cybersecurity.

The goal of this project was to introduce us the scientifical research world by teaching us how to find interesting articles for our subject in research databases (IEE / arxiv / ACM / Springer ...), how to cross-reference scientific articles (google scholar / zotero ...) and how to write a scientific article with the LaTeX language.

For this project I decided to write a scientific article about the different methods of creating and detecting Deepfake.

The students' articles who obtained the maximum score were submitted for peer review by real researchers (to be potentially published in a scientific journal). Several students obtained the maximum mark, this was also my case, unfortunately no students were published this year.

Configurator

Creating an investigation

Processus listing

Evidence marking

Report generation

Previous Next

OffGrid is a decentralized platform based on the Volweb tool for setting up Bash Bunny keys for doing dump RAM.

The idea is to allow any technician to perform an extraction of the RAM of a corrupted machine without waiting for a forensic expert.

OffGrid also makes it possible to analyze the recovered RAM and to generate a signed forensic report admissible by justice.

Offgrid could also contain other configuration profiles such as system/network administration or hardening tasks (these profiles have not been written).

Previous Next

Locked Shields is the world's largest cybersecurity exercise. Each year, it is organized to train NATO teams, 40 different nations bringing together more than 3000 experts compete for 4 days.

For my final year engineering school project I had the chance to participate in the organization of this exercise, in collaboration with the University of Tallinn (Estonia) and the CCDCOE (The NATO Cooperative Cyber Defence Centre of Excellence).

We were part of the Green Team (development team), our role was to implemented a WebSSO solution used during the exercise scenario. This solution had to meet very specific constraints to interact with the global infrastructure (in particular being deployable with Ansible).

Team members visited the site before and during the exercise to ensure the availability of the delivered solution.

Listing of a researcher's articles

Trigger creation

Previous Next

OnlineLib is a scientific documentation management service written in Java and using the JDBC library. This project was carried out as part of my studies in University Diploma in Computer Science at IUT Charlemagne.

The goal was to manage a database via a Java application with a graphical interface.

In this application the user could store scientific documents in different formats (pdf, docx, txt...) or links. He could consult them, extract them or delete them from the database.

Each document has a list of associated researchers / research locations. It is also possible to create alerts (trigger) when a new document with a particular title or notes is added to the database.

Creation of a wishlist

Example of wishlist

Previous Next

MyWishList is a PHP application dedicated to creating, sharing and managing gift lists. This project was carried out as part of my studies in University Diploma in Computer Science at IUT Charlemagne.

The goal of the project was to create a PHP application with a simple authentication system (access tokens) as well as a rights system (each token gave precise rights to the user).

The application allows you to create gift lists, share them with authenticated or unauthenticated users and manage their rights (writing, reading, sharing, etc.)

Homepage

Empty jukebox

Previous Next

JBox is a Node.js application designed for owners of establishments (bars, restaurants, bowling, etc.) wanting to create a musical atmosphere personalized by customers. This project was the last carried out as part of my studies in University Diploma in Computer Science at IUT Charlemagne.

The owner can create a Jukebox and share a QR Code allowing anyone to join. Once the user joins the Jukebox, he can add music present in the database, it will be added to the Jukebox waiting list.

The feature allowing any audio file to be added to the database was not finalized due to lack of time and considered too dangerous upon delivery of the project. This is why the music list is restricted to the included database.

The creator of the Jukebox can skip music or ban users if necessary.

Homepage

Example of gaming page

Rest of the page

Previous Next

HeyNow is the first website I created. This project was carried out as part of my studies in University Diploma in Computer Science at IUT Charlemagne.

The goal was to code an HTML and CSS site by hand without any plugins and to make it responsive in 1 month.

You will find 10 sheets presenting video games grouped into 3 categories: PC Games, Console Games and Smartphone Games.

The objective is to present these games via gameplay images and summary bubbles, there are also models of the site made before designing it in the "About" page.

Sleep action/h4>

Fight action

Run action

Previous Next

ShrekLife is the first Javascript script I wrote. This project was carried out as part of my studies in University Diploma in Computer Science at IUT Charlemagne.

Le but était de rendre un site web interactif en 1 semaine, sur le site en question nous contrôlons un monstre (ici Shrek). Chaque bouton correspond à une action que le monstre peut faire.

The purpose was to make an interactive website in 1 week, on the site we control a monster (here Shrek). Each button corresponds to an action that the monster can do.

For example the action "work" makes you gain money but lose life, while the action "eat" makes you lose money but earn life. The site is programmed to generate random actions as well, your goal is to survive as long as possible.

First floor

Last floor

Game Over page

Shrek page

Previous Next

Zeldiablo is the first Java project with a graphical interface that I created. This project was carried out as part of my studies in University Diploma in Computer Science at IUT Charlemagne.

The objective was to create a Java game with the graphics engine given to us. Here we opted for a maze with monsters and boxes with different actions.

We originally wanted to use sprites from the Zelda and Diablo games (hence the name) but ended up using those from the Megaman game.

The maze is made up of several (predefined) floors, the player controls Megaman and must avoid monsters. The presence of boxes giving a speed bonus or penalty as well as teleporters / traps make the game more complex.

To win the game you must reach the trophy box located on the top floor, however we have also added an invisible box which allows the player to win, this brings up the victory screen with Shrek!

Before

After

Previous Next

SSI Actus is a weekly news magazine covering topics related to cybersecurity in the hospital environment. The magazine is distributed on the GHBS intranet.

The magazine was created by Dana Hussein Hassan, another GHBS trainee.

I suggested to take over the editing of the journal and modernize it. The project was validated by the GHBS communication department and extended to other health establishments, such as the EPSM Charcot psychiatric hospital.

Results examples

Previous Next

IDSniffer is a Python script allowing you to list all files containing plaintext identifiers from a root folder.

I wrote this Python script shortly after being recruited as an apprentice cybersecurity engineer at GHBS. Indeed, I noticed the presence of numerous files containing clear identifiers in the shared folders of the company.

The script lists files containing character strings referring to identifiers (example: "password = " / "creds are" / "login:" ...)
The script is able to read files with the following extensions:
["csv", "docx", "doc", "gif", "jpg", "json", "html", "msg ", "odt", "pdf", "png", "pptx", "txt", "xlsx", "xls"]

Human verification is however necessary because the script returns many false positives, no process to ignore these false positives has yet been implemented.

My Final Study Project (FSP), consisted in carrying out internal and external technical audits of GHBS and then correcting the vulnerabilities found as part of the CaRE program.

For internal audits, I relied on the tools: Oradad and PingCastle as well as my own knowledge.

For external audits, I carried out a comparative study of several tools for the Agence du Numérique en Santé (ANS):

• AlgoLightHouse published by AlgoSecure
• BearEye published by BearOps
• Patrowl
• Uncovery (selected)

This final project confirmed my decision to continue my career in the field of technical auditing.

Before

After

Previous Next

I completed a 3 month internship at the Apprentice Training Center of the University of Lorraine during my University Diploma in Computer Science at IUT Charlemagne.

My mission was to carry out the migration of the CodeIgniter framework to the Symfony framework for the CFA web management application.

During this internship I learned to use the PHP framework Symfony and CodeIgniter as well as the javascript libraries Twig / React / jQuery.

Homepage

CTF Page

Example of post

Previous Next

Blog where I post content related to cybersecurity, especially the CTF writeups in which I participated.

Character creation

Rendering

Previous Next

Small video game made on the UE4 engine, the player played Shrek in an open world, his goal was to investigate a mysterious force which was disturbing the balance of the kingdom.

The project allowed me to learn more about the UE4 and Unity engine, as well as the Blender CAD software. Unfortunately the project will never come to fruition due to lack of time.

Sending mails

Mails creation

Mails verification

Previous Next

Ryoshi is a Python program allowing you to send personalized Phishing emails via a graphical interface, while bypassing the SPF / DKIM / DMARC protocols.

The objective of the project was to deepen my knowledge of email security, in fact I carried out this project at the same time as the implementation of a DMARC policy in my company.

Ryoshi allows you to check if an email exists (thanks to Holehe), it also allows you to create/personalize your own phishing email and of course to send it with a fake email address.

Ryoshi means "fisherman" in Japanese, it is greatly inspired by the espoofer tool presented at the conference BlackHat USA 2020.