# miguel llamazares > cybersecurity, tech, and personal annoyance log Personal site of Miguel Llamazares. Posts are notes on application security, bug bounty, offensive certifications, and machine learning. The Markdown links below are the same essays as the HTML pages. ## Posts - [passing the osai cert in just 1h 22min](https://mll.sh/passing-osai.md): I recently passed the OSAI exam on the first attempt, scoring 100/100 points. I reached the passing score (75 points) in just 1h 22min, with 80 points, and… - [hacking chatbots with winnie the pooh](https://mll.sh/hacking-chatbots-with-winnie-the-pooh.md): I was poking around llm ctfs while prepping for the OSAI and landed on lakera's agent breaker. - [teaching ml to hate marvel movies](https://mll.sh/teaching-ml-to-hate-marvel-movies.md): It turns out that I've rated 1,325 films and series on filmaffinity. That's years of free labels just sitting there, so why not use them? - [cooking a custom x86 stager in nasm](https://mll.sh/cooking-a-custom-x86-stager-in-nasm.md): Follow me in this deep dive into building a position-independent stager for x86 win. We'll build the entire shellcode from asm, using only stack strings… - [brainmaxxing or the art of failing better](https://mll.sh/brainmaxxing-or-the-art-of-failing-better.md): Well, I don't usually post about personal stuff, but hey, hoomanity (and me) deserves something different every now and then. - [my experience passing the osep cert](https://mll.sh/passing-osep.md): I recently passed the OSEP exam on the first attempt, achieving both independent requirements to pass: >=100 points and the slippery secret.txt flag. 💅 - [kali on qemu on debian: a speedrun setup](https://mll.sh/kali-on-qemu-on-debian-speedrun-setup.md): After years of virtualbox and vmware, I finally moved to qemu. I run debian as my daily driver, and qemu/kvm is native to the kernel, so you can forget about… - [bypassing waf rate limiting to prove blind sqli](https://mll.sh/bypassing-waf-rate-limiting-to-prove-blind-sqli.md): This is the story of how abfe and I turned a closed-as-informational report into a critical finding with max bounty, by using column name validation as a… - [fine-tuning incentives to fight bug bounty ai slop](https://mll.sh/fine-tuning-incentives-to-fight-bb-ai-slop.md): Recently, Robbe Van Roey posted something on linkedin that resonated with pretty much everyone in the bug bounty space: HackerOne receives around 200 reports… - [escalating a preauth sqli to rce](https://mll.sh/escalating-preauth-sqli-to-rce.md): I recently escalated a preauth SQL injection on an ASP app sitting on top of MSSQL to full RCE and exfiltrated the output via DNS. All in a single messy GET… - [humiliating iis servers for fun and jail time](https://mll.sh/humiliating-iis-servers-for-fun-and-jail-time.md): A friend of mine once told me: Yep, he was right. That IIS splash page is not a dead end. Behind that blue window sits one of the most consistently… - [how to not be an llm kiddie](https://mll.sh/how-to-not-be-a-llm-kiddie.md): Most people use llms the same way regardless of what they're doing: hunting for an IDOR in a SaaS app, triaging a buffer overflow in a C codebase, or… - [neural nets in cobol & other creative ways to k*ll yourself](https://mll.sh/neural-networks-cobol.md): Yesterday I opened my inbox expecting the usual sprint cosplay and jira fan fiction. Instead, I got a message from a guy that predates agile, devops, and most… - [react2shell or prototype pollution going brrr](https://mll.sh/react2shell-or-prototype-pollution-going-brrr.md): I guess we can call this JARP, Just Another React2Shell Post, because everyone has already milked this vuln that exploded like it was auditioning for Log4j's… - [my experience passing the oswe cert](https://mll.sh/passing-oswe.md): After some months, I finally decided to share my experience with the AWAE course and how I passed the OSWE cert on the first try. - [hello world](https://mll.sh/hello-world.md): Hey there. Welcome. My name's Miguel and this is my little island on the Internet. 🏝️ You'll notice there're already some posts here. I stole them from my own… - [using node graphs for subdomain relationship mapping](https://mll.sh/using-node-graphs-for-subdomain-relationship-mapping.md): I built vibecoded a simple app that lets you visualize subdomain relationships using a dynamic, drag-and-drop node network chart (everything runs locally via… - [exfiltrating a db via blind sqli using python](https://mll.sh/exfiltrating-a-db-via-blind-sqli-using-python.md): Yesterday, during my bug-hunting journey, I discovered a cool blind SQL injection. To determine if the condition was fulfilled, I had to monitor the request… - [nuxt misconfig exposed +6,700 user records](https://mll.sh/nuxt-misconfig-exposed-6700-user-records.md): Today I found sensitive info disclosure of +6,700 users! In this case, the Nuxt context object stored PII of all registered users (name, surname, email… - [making owasp asvs actually usable](https://mll.sh/making-owasp-asvs-actually-usable.md): I've always liked OWASP Application Security Verification Standard (ASVS). It's a solid blueprint of security controls. But try to take it straight off the… - [don't blindly trust public exploits](https://mll.sh/dont-blindly-trust-public-exploits.md): Found this shady function in a GitHub PoC for a CVE: It looks like, in exchange for a shortcut to exploit it, you help the author build a database of vulnerable… - [triggering xss in hidden inputs](https://mll.sh/hidden-input-xss.md): Did you know you can still exploit XSS in a hidden input? (I didn't either). I found an injection point within a hidden input type. This is difficult to exploit… - [recon harder or how I found a hidden blind sqli](https://mll.sh/recon-harder-found-blind-sqli.md): Found an interesting open port with naabu, inspected JS files, and discovered an interesting API endpoint. ## Pages - [About](https://mll.sh/about.md): Who Miguel is, the work, and the certifications. - [Contact](https://mll.sh/contact.md): How to reach him. - [Topics](https://mll.sh/tags/): Posts grouped by tag. - [Archive](https://mll.sh/archive/): Every post, newest first. ## Optional - [Full text of every post](https://mll.sh/llms-full.txt) - [Atom feed](https://mll.sh/feed.xml) - [XML sitemap](https://mll.sh/sitemap.xml)