Imanol C.

Imanol's areas of expertise are source code review and application penetration testing. He also has extensive experience with software engineering and developing secure code practices within his developer roles. EXPERIENCE Conducted a hybrid application assessment for a leading machine learning platform and detected cross-site scripting on the web application’s display that allowed JavaScript code to execute in the administration dashboard. This issue could be used by an attacker to escalate privileges and perform actions in the context of admin users. Designed a vulnerable box for practice for a web application that could read and scan license plates with an OCR scanner and look up data related to the vehicle. The box provided practice exploits for common vulnerabilities, such as SQL injection, password spraying and cracking, and Linux privileged escalation. Conducted source code review of over thirty WordPress sites of a national marketing company that had been compromised by an attacker. Discovered that the bespoke web application integration was vulnerable and served as an entry point to pivot into the sites. Detected common security issues, such as insufficient authorization controls and SQL injection , allowed attackers to redirect users to malicious sites leading to reputation damage and financial impact for the company. Worked with the company to remove backdoors and remediate vulnerabilities. During a software engineering project for a national recruitment platform for educational staff, discovered insecure secure code and high-risk vulnerabilities related to information disclosure in breach of the European data privacy laws, as well as design flaws in the job posting processes that allowed an attacker to become an admin user and compromise another organization. Remediated the vulnerabilities and implemented a culture of secure coding practices within the company.