brainmaxxing or the art of failing better
Well, I don’t usually post about personal stuff, but hey, hoomanity (and me) deserves something different every now and then.
miguel llamazares
cybersecurity, tech, and personal annoyance log
Latest posts
my experience passing the osep cert
I recently passed the OSEP exam on the first attempt, achieving both independent requirements to pass: >=100 points and the slippery secret.txt flag. 💅
bypassing waf rate limiting to prove blind sqli
This is the story of how abfe and I turned a closed-as-informational report into a critical finding with max bounty, by using column name validation as a boolean oracle and AWS API Gateway to dodge Cloudflare’s rate limiting. 🫰
kali on qemu on debian: a speedrun setup
After years of virtualbox and vmware, I finally moved to qemu. I run debian as my daily driver, and qemu/kvm is native to the kernel, so you can forget about the third-party kernel modules that break on every update, the “please reinstall guest additions” rituals. 🤮
fine-tuning incentives to fight bug bounty ai slop
Recently, Robbe Van Roey posted something on linkedin that resonated with pretty much everyone in the bug bounty space: HackerOne receives around 200 reports per hour now. Two hundred. Per hour.
escalating a preauth sqli to rce
I recently escalated a preauth SQL injection on an ASP app sitting on top of MSSQL to full RCE and exfiltrated the output via DNS. All in a single messy GET request:
humiliating iis servers for fun and jail time
A friend of mine once told me: If you ever spot an IIS blue screen, don’t stop there; there must be something.
how to not be an llm kiddie
Most people use llms the same way regardless of what they’re doing: hunting for an IDOR in a SaaS app, triaging a buffer overflow in a C codebase, or brainstorming names for a cat that will never answer to any of them. 😸
neural nets in cobol & other creative ways to k*ll yourself
[!NOTE] disclaimer This is a tribute to the Cruelty Squad video game. Just to showcase how COBOL can still be used in bizarre ways to maximize shareholder value. ✨
react2shell or prototype pollution going brrr
I guess we can call this JARP, Just Another React2Shell Post, because everyone has already milked this vuln that exploded like it was auditioning for Log4j’s sequel. But here we are.