Product
Projects
Disclosed and patched vulnerabilities
Research
Research · GHSA-vwf4-m7j8-wcjf · private code
Inyección SQL sin autenticar en Metabase
Metabase published a maximum-severity advisory without explaining the vector, giving only a log signature to search for. Two well-known companies had already confirmed attacks through the same flaw. I built a lab with three containers, two vulnerable versions and one patched, and reconstructed the mechanism by sending identical requests to both. The vulnerable one ran a query the patched one did not, with a value I had not supplied anywhere.
Research · CVE-2026-31431
CopyFail
A logic flaw in the Linux kernel's cryptographic subsystem lets an unprivileged local user write four controlled bytes into the page cache of any readable file on the system. That is enough to alter the behaviour of a privileged binary such as su, in memory and without touching the file on disk. It escapes containers, because they share the page cache with the host. I studied it over a long weekend, reproduced it on Debian 13, Ubuntu 24.04, Kali and Docker, and wrote variants in several languages. One of them, in C, compiles with gcc and runs on any distribution with no dependencies.
7.8CVSS · CISA KEV catalogue
Open source
Tools
Tool · open source
Talos
Hardening audit for Linux and Windows servers in a single dependency-free binary. Read-only, it never changes anything, and finishes a full server in under ten seconds. It carries 147 checks written as data files, each with its severity, weight, the Spanish ENS controls it covers and how to remediate it. It came out of a larger platform and I released it separately because it stood on its own.
<10 sper server · 147 checks
Tool · private code
Controles de seguridad para integración continua
Five security controls packaged as reusable GitHub Actions workflows: secret leakage, static analysis, dependency analysis, container image scanning and dynamic testing. The idea is that any repository imports them with one line instead of copying configuration that goes stale.
Infrastructure as code and practice environments
Labs
Laboratorio de ciberseguridad como código
Five machines across four isolated segments, with a Windows domain and a monitoring hub, defined entirely as code and brought up with a single command. I built it for my Master's final project, and I use it to practise lateral movement and detection without touching anything that is not mine.
BashProxmoxWindows ServerWazuhActiveprivate code
Infraestructura como código en Hetzner
Server, firewall and team modules for standing up infrastructure on Hetzner repeatably, with automated boot and idempotent provisioning. This is what I use to avoid building servers by hand and to be able to destroy and recreate them without worrying.
Terraformcloud-initHetznerActiveprivate code
Apagado automático ante corte de luz
Monitoring for an uninterruptible power supply, with alerts and an orderly hypervisor shutdown when the battery drops below a threshold. I built it after losing a machine to a power cut, which is the classic way to learn that an unclean shutdown is an availability problem too.
BashNUTProxmoxActiveprivate code
Keycloak con importación declarativa
Keycloak with PostgreSQL and a realm imported declaratively at startup, so a test identity provider is reproducible without configuring it by hand every time.
DockerKeycloakPostgreSQLArchived
Pila LEMP para prácticas
A Linux, Nginx, database and PHP stack on current versions, ready to bring up in seconds. I built it to stop wasting time setting up the environment every time I wanted to practise, and published it because it was just as useful to others.
DockerNginxPHPMySQLArchived
Laboratorio de pentesting asistido por IA
A language model running locally takes a natural-language request, crosses an SSH tunnel to a Kali container, runs the reconnaissance, filters the noise and returns the results in tables. Fully local: nothing leaves the machine. Three documented deliverables with own measurements, and the NetSentinel workshop on agentic workflows as formal backing.
OllamaKaliDockerSSHActiveprivate code
With 1mpulso
Websites
Website · private code
1mpulso
My own studio, building websites for freelancers and small businesses on a subscription basis. Static sites with security headers and a restrictive content policy, no third-party trackers, and deployments that roll back in one click. The client never has to learn any of it.
Website · private code
Multiservicios Izhar
The studio's first client, a home renovation company in Madrid. A static site built to generate calls: instant loading, a work gallery optimised during the build itself, and careful technical SEO. Delivered and under maintenance.
Coursework archive15
Exercise repositories from my studies.