Security Engineer by profession, Hacker by passion
I've been breaking things professionally for almost a decade as a Product/Application Security Engineer, but I've been tinkering with security for 20 years (yes, I started young 😎).
🗼 WatchTower - VSCode extension that scans your workspace for malicious configurations, invisible Unicode threats, and dangerous IDE attack vectors — fully local, fully open source.
🔑 How To Test Secrets - A visual, interactive cheat-sheet for testing whether leaked API keys and secrets are still valid — pick a service and get a ready-to-run command.
🎭 MirageVM - Javascript virtual machine for code obfuscation. It can be used to protect sensitive client side logic with custom bytecode. Supports all Javascript features through a custom low level language (Private project)
🛡️ Orgsec Guide - A comprehensive checklist and guide for organizations looking to implement a robust cybersecurity program
💥 XXExploiter - Tool to help exploit XXE vulnerabilities. Generates XML payloads and automatically starts a server to serve DTD's or do data exfiltration
🔪 VSCode Swissknife - Scriptable VSCode extension to generate or manipulate data. Stop pasting sensitive data in webpages
🔓 DamnVulnerableCryptoApp - An app with intentionally insecure crypto implementations. Perfect for testing/exploiting weak cryptography and learning crypto without diving deep into the math
#️⃣ hash-identifier-js - Port from hash-identifier to javascript
Daily drivers:
JavaScript/TypeScript • Node.js • Express • React
Python • Django • Flask
The old friends (a bit rusty, but we go way back):
Java • Spring • Ruby/Rails • C# • PHP
🎤 Occasional speaker at security conferences
📚 Currently trying to write a fictional book (stay tuned!)
✍️ Sharing knowledge on TheSecurityVault