White-hat hacker. Penetration testing and vulnerability research, with detours into reverse engineering and CTF pwn.

Who I am

I'm y4poo — currently working full-time in offensive security. My day-to-day moves between hands-on engagements and quietly tearing apart software to understand how it actually behaves under stress.

I've intentionally kept my focus broad — web, network, Active Directory, binary, with side trips into mobile, cloud, and the occasional embedded oddity. The questions I find most honest are still the same: can it be broken, how, and what changes when it is?

This blog is where I jot down the parts I want to remember — methodology, decisions, and the lessons that don't fit on a slide.

What I focus on

AreaFocus
Offensive webXSS · SQLi · IDOR · SSRF · auth bypass · API abuse · business-logic flaws
Network & ADInternal pentest · Kerberos abuse · ACL chains · lateral movement · Windows post-ex
RE & Exploit devBinary analysis · vulnerability triage · PoC writing · CTF pwn
Side interestsMobile (iOS / Android) · cloud configuration review · embedded & IoT

Tech stack

LayerTools & Languages
ScriptingPython · Bash
SystemsC · C++ · Rust · Go
Web testingBurp Suite · OWASP ZAP · sqlmap · nuclei
RE / ExploitGhidra · IDA · radare2 · pwntools · GDB-pwndbg

Selected work

A handful of public-facing talks and trainings. Longer write-ups live in Posts.

YearTypeTitle / Audience
—Talk[Title to fill in] — [Venue, year]
—Talk[Title] — [Venue, year]
—Course[Course name] — [Audience, year]

How I work

  • Why over how. The how is one search away. The why tends to be what's missing six months later.
  • Lead with the wrong path. What I tried that didn't work is usually more useful than the polished answer.
  • One takeaway per artifact. If I can't summarize a finding in a sentence, it's not done.
  • Sanitize and ship. Public posts strip every client identifier. The lesson outlives the engagement.

Disclosure

For anything resembling a security finding affecting a third party — please reach out by email first, not via a public channel. I default to a coordinated 90-day disclosure window from initial contact, and will negotiate from there in good faith.

Reach me