Marios Gyftos — Senior Cloud & Offensive Security Consultant

_{Scan to connect on LinkedIn}

I'm Marios Gyftos (aka nintendo) — a senior security consultant and team lead focused on attack & penetration testing, cloud threat emulation, and identity abuse across Azure, AWS, and GCP. I publish PoCs, speak at community events, and build practical tools.

Disclaimer: Views are my own; content is for educational purposes only.

• May the Least Privilege Be With You: Exposing the Dark Side of Azure Service Principal Permissions (DefCon 2025) — Dangerous Graph permissions & non‑privileged Entra ID roles; intro to Azure AppHunter.
  ▶ Session: https://sessionize.com/s/marios-gyftos/may-the-least-privilege-be-with-you-exposing-the-d/143304
• Cloud Convergence: Interconnected Cloud, DevOps & AD in Pentesting (BSides Athens 2024)
  ▶ Session: https://sessionize.com/s/marios-gyftos/cloud-convergence-exploring-the-interconnected-wor/101053
• The Dark Side of DevOps (BSides Chicago 2023) — Secrets → CI/CD → Cloud compromise; cloud/AD interconnectivity.
  ▶ Session: https://sessionize.com/s/marios-gyftos/the-dark-side-of-devops/75154

• Oracle Health Sciences Applications: CVE‑2019‑2431 (XSS), CVE‑2019‑2430 (IDOR), CVE‑2019‑2432 (PrivEsc)
• Microsoft Dynamics 365: CVE‑2018‑8607 (XSS)
• Contributor: Nuages C2

Cloud Village CTF: DEF CON 2025 (2nd); RSA 2025 (1st); DEF CON 2024 (3rd), RSA 2024 (2nd); DEF CON 2023 (2nd)
ECSC Greece Team (2017) · Panoptis National Military Cyber‑Defense Exercise — 1st place

I focus on cloud identity abuse (Azure/AWS/GCP), service principal risk, and operator‑friendly tooling.

Tip: Pin your top repos so they appear here on the profile.

_{Last updated:}