Skip to content
View jacoboavariento's full-sized avatar
🔒
🔒
3 followers · 18 following

Achievements

Achievement: Pull Shark

Achievements

Achievement: Pull Shark

Block or report jacoboavariento

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don't include any personal information such as legal names or email addresses. Markdown supported. This note will be visible to only you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
jacoboavariento/README.md

I'm a certified ethical hacker / security engineer with 20+ years in cybersecurity, now deep in DeFi/smart contract auditing 🚀

Web2 contributions 🏅

  • Dropped the first public PoC exploits for CVE-2006-3747 (Apache mod_rewrite LDAP off-by-one buffer overflow) back in 2006 — Advanced off-by-one buffer overflow vuln that got wild attention on GitHub/exploit-db scenes 🛡️💥
  • Cooked up a remote code execution bug in Roundcube Webmail (versions 0.2-3 Beta) via html2text.php — that's CVE-2008-5619, published on Exploit-DB/Milw0rm in 2008. Straight mail client pwnage 📧🔥
  • Credited in other finds like XSS/weak creds in stuff: Samsung DVR weak authentication, net2ftp 0day XSS, ...
  • Awarded CVE-2017-12544 for HPE System Management Homepage DOM-based XSS
  • Authored some Metasploit modules (like SAP Management Console) or implemented TrustedSec PTF in a docker container or multiple contributions to nikto 🛠️

Web3 contributions 🏅

Certifications, badges, ... 📚

  • Certified Ethical Hacker, 2017
  • OSCP, 2018
  • Certified Blockchain Security Professional, 2021
  • Certified Smart Contract Auditor, 2024
  • Boring Security 101, 2025
  • Boring Security Solana Security, 2025

Contact:

Pinned Loading

  1. bitcoin-opcodes bitcoin-opcodes Public

    Bitcoin Script opcodes

  2. burp-js-urlsucker burp-js-urlsucker Public

    Burpsuite Extender plugin that passively finds hidden URLs and endpoints in any downloaded Javascript files. Great for native Javascript applications such as Next.js, Node.js or Dapps frontends.

    Java 1

  3. evm-cli-hacking evm-cli-hacking Public

    Several CLI commands to interact with smart contracts on different blockchains from the command line using Foundry tools and seth.

  4. evm-opcodes evm-opcodes Public

    Forked from wolflo/evm-opcodes

    A quick reference for EVM opcodes

  5. forge-poc-templates forge-poc-templates Public

    Forked from immunefi-team/forge-poc-templates

    Solidity

  6. SmartContractMonitor SmartContractMonitor Public

    Forked from argotorg/sourcify

    Monitors transactions on EVM-compatible blockchains to detect newly deployed contracts and automatically dumps their bytecode to facilitate decompilation. (Fork of the Sourcify monitor)

    TypeScript