|
IOActive Senior Security Consultant |
Maldev Academy Security Researcher & Developer |
Internal Work · CVEs · Publications & Talks · Maldev Academy · Tools
I'm Carlos Gómez Quintana, aka 0xh3l1x, Senior Security Consultant and Red Team Leader within IOActive's Global Threat Group (GTG). I'm also a Security Researcher and Developer at Maldev Academy. I write about what I can share at cgomezsec.com.
|
I lead technical development and build the tools we use on engagements. I also help define the team's structure and technical workflows. |
Active Directory and Microsoft Entra ID attack paths, privilege escalation, and lateral movement. OAuth device-code and consent flows, token manipulation, conditional access, and cross-tenant scenarios. |
|
CDP-driven AiTM, BotGuard behavior, Chrome Sync, and session handling. FIDO2/WebAuthn research focuses on downgrade paths in real implementations. |
Cloudflare Workers and Azure Functions / Front Door for engagement infrastructure. Request and response rewriting, client profiling, anti-bot checks, and sandbox detection. |
|
Implants in C/C++ and C#/.NET, BOFs, custom UDRLs, payload staging, DLL sideloading, and signed binary abuse. Tested against production EDR products. |
LLM-assisted code review, runtime checks, and patch validation. For |
I use LLMs to review code, then test suspected bugs against real builds. My IOActive article follows that process through two Angular findings and their fixes, from threat modeling to checking the patched versions.
| CVE | Product | Vulnerability | Contribution |
|---|---|---|---|
| CVE-2026-68945 | Angular | Different request parameters could produce the same HttpTransferCache key, causing the wrong cached response to be reused. |
Research and patch development. |
| CVE-2026-69151 | Angular | A translation file could inject JavaScript through event-handler attributes marked for i18n. | Research and patch development. |
| CVE-2026-105803 | Git LFS | A malicious repository's .lfsconfig could make Git LFS run an arbitrary program as a custom transfer adapter. |
Additional responsible reporter, acknowledged in the release notes. |
|
LLM-Assisted Vulnerability Research: Finding Real Bugs with Code-Reasoning Models A workflow for turning code-review candidates into confirmed bugs, with runtime tests and patch comparisons. |
Authentication Downgrade Attacks: Deep Dive into MFA Bypass How weaker fallback methods let authentication flows be downgraded, even when FIDO2/WebAuthn is available. |
|
Cloud Edge Phishing: Breaking the Future of Auth Out of the Box · Bangkok · 2025 Cloudflare Workers and Azure infrastructure for AiTM operations. |
Upgrading Rollback-Agnostic Replay Attacks Hack In The Box · Amsterdam · 2023 |
I'm researching browser-based AiTM phishing through CDP, including BotGuard behavior and Chrome Sync. My FIDO2/WebAuthn work looks at downgrade paths and session handling in real implementations.
I write modules and build companion tooling for Maldev Academy on phishing, authentication attacks, and cloud identity exploitation. Protocol internals, working implementations, OPSEC. Topics include MFA downgrade paths where weaker fallback methods remain available.
|
|
GitHub OAuth device code phishing. Minimal setup. |
Device code phishing for GitLab cloud and self-managed instances. |
Shodan MCP server. Query Shodan from AI assistants. |
These private tools come with the Maldev Academy modules and are available to members.
|
Real-time Phishing Framework
Credential relay with live feedback. Real Chrome per target via nodriver/CDP; Google, GitHub, and Bitwarden support. |
Cloudflare Workers AiTM Proxy
Serverless reverse proxy for request/response rewriting and credential/session capture. |
|
Azure AiTM Proxy
AiTM proxy on Azure Functions and Azure Front Door. |
Evilginx M365 Phishlet
MFA downgrade paths where weaker authentication methods remain enabled. |
|
Google MFA Bypass Framework
BotGuard analysis, browser-driven authentication via nodriver/CDP, and Chrome Sync research. |
Passkey Phisher
Synced passkeys and hardware-key authentication flows, CDP virtual authenticators, downgrade paths, and session capture. |
|
ConsentFix Tool
OAuth consent abuse with the ConsentFix lure flow, packaged for engagements. |
Client Fingerprinting Worker
Client profiling on Cloudflare Workers: anti-bot checks, sandbox detection, browser fingerprinting, and geo filtering. |
0xh3l1x