Pentester (penetration tester), red teamer and bug bounty hunter. I test web applications, APIs, mobile apps and Active Directory the way real attackers do, and I only report what I can prove.
- CVE-2025-10230 · Samba · CVSS 10.0. Critical OS command injection that stayed hidden for 13 years. Advisory
- 6× U.S. Government Hall of Fame. NASA, U.S. Dept. of Commerce, Veterans Affairs, NCUA, EPA, Fish & Wildlife Service. Includes a P1 unauthenticated command injection at the NCUA. Bugcrowd profile
- More disclosures. CVE-2026-23722 (CVSS 9.1, stored XSS → RCE) and CVE-2025-67503 (CVSS 8.2) in WeGIA · blind XXE → SSRF for the Belgian Government · buffer overflow in Samba CTDB.
- Open-source tools. MANW-NG (Windows API docs and live execution for reverse engineers) · OCRack (PDF OCR and translation) · ARCTAX (prompt-injection research).
Web, API and mobile penetration testing · Red team operations and Active Directory attacks · Bug bounty (Bugcrowd, HackerOne, YesWeHack, Intigriti) · Vulnerability research and exploit development · Reverse engineering and malware analysis · Application security (AppSec) and code review · Cloud security (AWS, Azure, GCP)
Certifications: CRTA · CCSP · CKS · OWASP member since 2021.
Open to pentest and red team roles and freelance engagements.
[email protected] · LinkedIn · mindsecurity.org · YouTube · Versão em português