Application security / offensive research
Security research, secure development, and evidence engineering.
Public vulnerability records and bounded research notes. Identifiers appear where they help retrieve the source.
A denied class smuggled as a generic argument of an allow-listed container is instantiated with attacker-controlled properties, defeating the PTV allow-list and opening an unauthenticated RCE path.
Opening a malicious project instantiates attacker-specified classes. Reported responsibly to the National Security Agency.
The issue is exploitable live on the wire or through a crafted PCAP, creating a denial-of-service hazard for packet-analysis and incident-response workflows.
A path-sanitization call was removed in the decoding step, enabling arbitrary file write behavior through a crafted APK.
A chain of unauthenticated remote code execution, denial-of-service, and authentication-bypass issues was reported responsibly through a MITRE partner.
Social media analysis, photo geolocation, and image comparison were submitted to organisers in support of law-enforcement leads.
Reverse-chronological professional records with public detail bounded by client confidentiality.
Tarlogic, remote, Spain
Client work under NDA; public details omitted.
Deloitte, Madrid
ICAI, Madrid
Deloitte, Madrid
Competition results and public recognition, kept compact for comparison.
| Year | Result | Event | Context |
|---|---|---|---|
| 2024 | 1st | HackTheBox, Deloitte Worldwide CTF | 27 of 29 challenges solved across ten categories. |
| 2023 | MVP | Trace Labs, Search Party Global | Most Valuable OSINT, missing-persons investigation. |
| 2023 | 3rd | CTFTime, National, ES | team BASE64CTF. |
| 2022 | 3rd | CTFTime, National, ES | team BASE64CTF. |
| 2022 | 12th | NCL, Guardia Civil | national final, team BASE64CTF. |
| 2021 | 6th | NCL, Guardia Civil | national final, team BASE64CTF. |
Certifications, education, and affiliations.
Open to research collaborations and technically rigorous security work.