Pig-Tail · Offensive Security Engineer · Vulnerability Researcher · Red Teamer

Offensive security engineer and vulnerability researcher. I audit widely-used open-source and commercial software for credible, exploitation-defensible bugs and drive them through coordinated disclosure — attack-surface mapping → taint tracking → a working PoC → a defensible CVSS write-up. Comfortable across web/API stacks, C/C++ memory safety, Go/Rust/PHP/Python, and red-team tooling.

• 🔭 Classes I hunt: RCE & command/arg injection · auth/authz bypass, IDOR & tenant escape · SSRF · path traversal / zip-slip · unsafe deserialization · memory corruption · race/TOCTOU.
• 🧪 How I verify: local instance + benign PoC (sentinel / timing oracle), then an adversarial re-read to kill false positives. No theoretical reports.
• 🛡️ Background: 10+ years in offensive security — red team & ethical hacking (hacking since the early 2010s); red-team infrastructure & malware-dev tradecraft, and CVE research since 2017 (see certifications).

_{CVE records are public at cve.org; some GitHub advisories are resolved privately (no public advisory page).}

• wolfSSL — X.509 DNS name-constraint bypass (CWE-295) · A leaf carrying a registeredID (or iPAddress) SAN sets altNames != NULL, which suppresses the CN-as-DNS name-constraint check in ConfirmNameConstraints() while the CN is still used to authenticate the peer — a DNS-name-constrained sub-CA can impersonate arbitrary hosts. Incomplete fix / regression of CVE-2026-6731. Reported with a working PoC; reproduced and fixed by wolfSSL in PR #10837. (CVE pending.)
• wolfSSL — PKCS7 / DTLS 1.3 hardening · Two PKCS7 non-streaming bounds over-reads (EnvelopedData IV, AuthEnvelopedData authTag) + an unbounded DTLS 1.3 WriteDup ACK-list growth (memory-exhaustion DoS). Fixed & merged in PR #10833.
• Microsoft Windows — StorSvc RPC EoP · The Storage Service registers its ALPC/RPC interface (44d1520b-…) with a NULL security callback and NULL security descriptor, so any unprivileged local user can invoke all 36 procedures. SvcTriggerStorageCleanup drives StorSvc (SYSTEM) into CreateProcessW("cleanmgr.exe", …) without impersonating the caller → SYSTEM process creation from a standard user (missing authorization, CWE-285). Reported to MSRC — Case 111782 (VULN-180255). (Related tooling: alpc-toolkit.)
• OpenStreetMap · Reported and fixed several issues in the OSM website, publicly credited by the project: TOTP-cookie handling, CSP rules, and a private-message rate-limit bypass — PR #7045 · #7046 · #7047 · announcement.

138+ further findings reported across 67+ projects are either resolved privately (no public advisory page) or under active coordinated disclosure / vendor embargo — including memory-safety bugs in widely-used engines, unauth secret-disclosure and RCE chains, and supply-chain issues. Details are withheld until each vendor publishes; they surface here automatically on disclosure.

_{→ full indexed set (58 certificates) in Pig-Tail/Cert.}

_{Coordinated disclosure / collaboration → jorge@jmilla.es · @jgonzalezmilla}