miguel llamazares

Well, I don’t usually post about personal stuff, but hey, hoomanity (and me) deserves something different every now and then.

I recently passed the OSEP exam on the first attempt, achieving both independent requirements to pass: >=100 points and the slippery secret.txt flag. 💅 I wanted to solidify my internal pentesting skillz, since web hacking is more my comfort zone (check my…

After years of virtualbox and vmware, I finally moved to qemu.

This is the story of how abfe and I turned a closed-as-informational report into a critical finding with max bounty, by using column name validation as a boolean oracle and AWS API Gateway to dodge Cloudflare’s rate limiting. 🫰 Let’s get to it. sniff, sni…

Recently, Robbe Van Roey posted something on linkedin that resonated with pretty much everyone in the bug bounty space: HackerOne receives around 200 reports per hour now.

I recently escalated a preauth SQL injection on an ASP app sitting on top of MSSQL to full RCE and exfiltrated the output via DNS.

A friend of mine once told me: If you ever spot an IIS blue screen, don’t stop there; there must be something.

Most people use llms the same way regardless of what they’re doing: hunting for an IDOR in a SaaS app, triaging a buffer overflow in a C codebase, or brainstorming names for a cat that will never answer to any of them. 😸 Then, they get slop back and either

[!

I guess we can call this JARP, Just Another React2Shell Post, because everyone has already milked this vuln that exploded like it was auditioning for Log4j’s sequel.