Michael Bargury

Security research, hacking, AppSec, primarily focused on low-code/no-code apps.

less than 1 minute read

Assorted links for All You Need Is Guest @ RSAC 2024:

  1. Power Platform DLP Bypass via Copy & Paste
  2. OWASP No-Code / Low-Code Top 10
  3. powerpwn
  4. Microsoft docs on EntraID multitenant sharing options

Other talks (slides and source code)

  1. All You Need is Guest @ BlackHat USA 2023
  2. Sure, Let Business Users Build Their Own. What Could Go Wrong? @ BlackHAt USA 2023
  3. Low Code High Risk: Enterprise Domination via Low Code Abuse @ DEFCON30
  4. No-Code Malware: Windows 11 At Your Service @ DEFCON30

Updated:

You May Also Enjoy

Safe Web Browsing for Copilots

1 minute read

Allowing a copilot to search the web at will is extremely dangerous. Here are two somewhat-understood vulnerabilities and how to mitigate them. Note: this is...

All You Need Is Guest

6 minute read

This is a long overdue blog version of a talk I gave at BlackHat USA 2023 titled All You Need Is Guest. Slides and video recording are available as well.