About me
¡Hi, I’m Mateo! 👋👋
Welcome to this section in my blog. But before, an introduction in brief…
🌐 Since child I always had a passion for computing and technology. After finish my high school degree, I started to study coding and Web Development.
📅 On October, 2022 was when I started entering the world of Cybersecurity and Ethical Hacking 🕵️.
📚 I started by studying everything that encompasses Web Application Pentesting, practicing vulnerable machine resolution at Hack The Box, taking online courses and reading Cybersecurity articles and Writeups.
👔 Eventually, with time and practice I decided that Web Application Pentesting is the area where I want to specialize.
💻 Currently on 2024 I spend my time as Bug Bounty Hunter on HackerOne, Intigriti and Bugcrowd.
❖ HackerOne Profile: https://hackerone.com/hackermater
❖ Bugcrowd Profile: https://bugcrowd.com/hackermater
❖ Intigriti Profile: https://app.intigriti.com/profile/xvim_hacker
Here is a list of my favorites tools for Bug Bounty Hunting, which I highly recommend:
- Reconnaissance:
- Explotation:
- Manual: Burp Suite
- Out-of-Band (OOB): Interactsh
- Automation: Nuclei
- XSS:
- XSS Cheatsheet (Burp Extension)
- Gxss
- Dalfox
- Fuzzing: FFUF
- Directories:
- SQL Injection:
- SSTI: SSTImap
- WAF Bypass: Hackvertor (Burp Extension)
- 401/403 Bypass: Bypass Url Parser
- APIs:
- JWT (JSON Web Tokens):
- JWT Editor (Burp Extension)
- jwt_tool.py
Firefox Extensions
- Wappalyzer (https://addons.mozilla.org/en-US/firefox/addon/wappalyzer/)
- Cookie-Editor (https://addons.mozilla.org/en-US/firefox/addon/cookie-editor/)
- FoxyProxy Standard (https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/)
- User-Agent Switcher and Manager (https://addons.mozilla.org/en-US/firefox/addon/user-agent-string-switcher/)
- ModHeader (https://addons.mozilla.org/en-US/firefox/addon/modheader-firefox/)
- Wayback Machine (https://addons.mozilla.org/en-US/firefox/addon/wayback-machine_new/)
- Firefox Multi-Account Containers (https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/)
🏆 Courses and Certifications
API Penetration Testing
APIsec University course which covered the most complete and advanced content and techniques to perform Pentesting in APIs, which includes: Reverse Engineering in API to then create a custom Swagger file, as well as API reconnaissance and the advanced use of Postman. In this course I also learned relevant attacks techniques such as BOLA (Broken Object Level Authorization) and BFLA (Broken Function Level Authorization), as well as JWT tokens attacks, Injections and SSRF in APIs, and the OWASP API Security Top 10.
CompTIA PenTest+ (PT0-002) Cert Prep: 4 Reporting and Communication
LinkedIn Learning course which prepared me for the CompTIA PenTest+, specifically focusing on reporting and communication. This course covered the essential skills required for carrying out reporting and communication during the Pen-testing process. It included the most important aspects such as: keeping all data encrypted and safe, effectively communicating with the appropriate authority when action is needed for a critical situation, and also emphasizing the importance of writing a report depending on the audience (whether executive, technical, managers, etc…). Additionally this course covered how to write professionally and in detail, taking care of the client’s sensitive information, to finally present and explain the findings during the Pen-test and suggesting mitigations and the best practices.
Mobile Application Penetration Testing
TCM Security course on Mobile Pentesting. In this course I learned how to perform penetration testing on mobile applications by performing both static and dynamic analysis. With tools such as jadx-gui, Apktool, Objection, Frida, Burp Suite and Android Studio, this course covered in a complete way the phases of mobile pentesting.
Ingeniería Social para IT
LinkedIn Learning course which covered in a complete and exhaustive way the essential aspects, both theoretical and with real examples, the art of how the Social Engineers carry out their work in Cybersecurity and Red Teaming, with the objective of persuading a subject and obtaining confidential information, or that this one carries out an action desired by the Social Engineer.
“Hacking WEP/WPA/WPA2 Wi-Fi Networks Using Kali Linux 2.0”
EC-Council course where I learned how to perform attacks on wireless networks: WEP, WPA and WPA2. Through the use of the Aircrack-ng suite, Airgeddon, Wifite, Reaver, Crunch, Hashcat, John The Ripper and other tools I managed to understand the methodology of brute force attacks (Rainbow Tables) or through Social Engineering (Evil-Twin Attack). In addition to Pin WPS attacks with tools such as Reaver.
“Advanced Open Source Intelligence and Privacy”
EC-Council course in which I learned OSINT techniques, the use of tools such as Recon-ng, Sherlock, Spiderfoot, theHarvester, Sublist3r and dnstwist. I was also trained to conduct target investigations both through Google using Google Dorks, and on the Dark Web through the Tor network. In addition to that I learned how to use advanced search engines to gather information from a domain name or a simple IP address, as could be the example of “Censys.io” or the services of “Shodan.io”.
“Practical Ethical Hacking - The Complete Course”
Course taught by the current CEO of TCM Security, Heath Adams, which covered a complete introduction from the basics of Ethical Hacking, as well as Information Gathering using OSINT (Open Source Intelligence), to Active Directory Pentesting, Web Pentesting and also Wireless Network Pentesting. In the course I also learned how to perform a Buffer Overflow and how to take notes during, before and after an audit and then generate a professional report for the client.
“Practical API Hacking”
Course of TCM Security, taught by Professor Alex Olsen, in which I deepened my knowledge in Web Pentesting by hacking APIs. Through the manipulation of the APIs used by Web Applications, I learned techniques such as Fuzzing and techniques of changes in the various methods of Requests (such as GET, POST, HEAD, OPTIONS, PUT, PATCH, DELETE, etc …) by which as Pentester, in a web audit, it is possible to breach and access privileged functions (Broken Function Level Authorization) or sensitive information (Sensitive Data Exposure). I also learned how to perform token attacks, such as JWTs attacks (JSON Web Tokens).
“Practical Web Application Security and Testing”
Course of TCM Security, taught by Professor Michael Taggart, lasted 9 hours in total. In the course I learned in depth how to audit web applications, including the use of OWASP ZAP and report writing. I also learned how web applications work on both the client and server side and how they communicate through the HTTP protocol.
“Ethical Hacking Essentials”
Course of EC-Council “Ethical Hacking Essentials”. In this course I covered the main and essential topics of Ethical Hacking and how hackers (ethical and unethical) manage to penetrate systems, using different techniques and methods such as social engineering or attacks on wireless networks; also attacks on cloud services and the creation and use of malware such as botnets, spyware, trojans, rootkits, or worms. I also learned which are the countermeasures to mitigate these attacks in order to protect the company and the services it provides.
“Pentesting Web. Prácticas de un Ethical Hacker Profesional.”
Course of Udemy about Web Application Pentesting: “Pentesting Web. Practices of a Professional Ethical Hacker.” dictated by Professor Alvaro Chirou. In it I learned the Top 10 Vulnerabilities of Web Applications, or also called OWASP Top 10 and how to use several pentesting tools and techniques in a professional way.
“Introducción a la Seguridad Cibernética”
In 2021 I took a course from the company Cisco, on Cybersecurity: “Introduction to Cyber Security”. In it I learned the essential theoretical concepts about Cybersecurity today, its importance and the impact that companies, governments, organizations and individuals receive because of cyberattacks that increase more and more every year.
📚💻 Currently I like to program mainly in Bash Scripting and Python which helps me when analyzing code for vulnerabilities and creating some simple scripts when pentesting.
However I have in mind to continue learning programming, specifically the Golang language to then create scripts that automate the task of Web Pentesting and contribute to the community of Hackers and Pentesters on Github.
🌐 Links:
❖ LinkedIn: https://www.linkedin.com/in/mateo-gabriel-fumis
❖ Offensive Cybersecurity (by hackermater): https://hackermater.gitbook.io
❖ Hack The Box Profile: https://app.hackthebox.com/profile/1223814
❖ Github Profile: https://github.com/mateofumis
❖ HackerOne Profile: https://hackerone.com/hackermater
❖ Bugcrowd Profile: https://bugcrowd.com/hackermater
❖ Intigriti Profile: https://app.intigriti.com/profile/xvim_hacker