JF / 2026
Available
CASE FILE 2026-JF-01 Valencia area · ES — GMT+1

Jonas Fernandez

Jonas Fernandez

Cybersecurity Associate & Vulnerability Researcher. I break software on purpose, then build the detections and defenses that stop the next person from doing the same.

Credentials

Cert
OSCP+
Cert
CRTO
Cert
eJPTv2
Training
Maldev · Malware in C

Navigate

Journal → CV ↓ Contact →
200+ Machines
compromised
70+ Pentest
reports
04 Vulnerabilities
disclosed
07 Certifications
& training
Journal

Latest research

All research →
01
2026.10.28 Technique · Privilege Escalation

Wildcard Injection — From Tar Checkpoint Actions to 7z Listfiles

Wildcard injection is a class of privilege escalation that abuses the way shells expand glob patterns before executing a command. When a root-owned script uses * in a shell command, the filenames in the current directory become arguments to that command — including filenames crafted to look like options. This article covers three variants: tar checkpoint actions, 7z listfile injection, and the symlink-plus-listfile combination that bypasses both -- and -snl.

Intermediate · 16 min read
→ 02
2026.10.26 Technique · Privilege Escalation

Git Symlinks and ClamAV XXE — Two Local Privilege Escalations

Two local privilege escalation vulnerabilities that were patched in early 2023 but remain present in unpatched systems: CVE-2023-23946, a symlink path traversal in git apply, and CVE-2023-20052, an XML External Entity in ClamAV's DMG parser. This article explains the mechanics of each, why they work in restrictive environments, and how the exploits are constructed.

Advanced · 18 min read
→ 03
2026.10.26 Technique · Credential Access

Intercepting Credentials — DNS Manipulation, Password Resets and SSH Honeypots

Three techniques for intercepting credentials in environments that assume their infrastructure is trustworthy: abusing BIND's dynamic update capability to redirect a mail subdomain, capturing password reset tokens through SMTP interception, and harvesting SSH credentials via chat bot provisioning features pointed at fake SSH servers. Each technique exploits a gap between what the infrastructure is supposed to do and what it can be made to do.

Intermediate · 15 min read
→
Builds

Recent projects

All projects →
RESEARCH 2026

Blind SQLi to Root — Laravel Admin, Monit Credentials and 7z Wildcard Injection

A penetration test of a Linux host running a Laravel-based blog and a Laravel Admin panel. The chain starts with an unauthenticated blind SQL injection in the password reset form, extracts the admin bcrypt hash, cracks it with a common password list, abuses CVE-2023-24249 in laravel-admin to upload a web shell, extracts a Monit credential from a local configuration file to pivot to a second user, and finally abuses a 7z wildcard injection in a root-owned backup script to read the root SSH private key.

LaravelLaravel AdminNginxPHPMonit7-ZipUbuntuMySQL
Details →
RESEARCH 2026

DNS Spoofing to Root — LFI, Credential Interception and Two Chained CVEs

A complete penetration test of a Linux host running Nginx, BIND and Mattermost. The chain starts with a path traversal on a download endpoint, extracts a BIND rndc-key from the filesystem, uses the DNS server's allow-update directive to hijack a mail subdomain, intercepts a Mattermost password reset token via SMTP, harvests SSH credentials through a chat bot, pivots with CVE-2023-23946 to a second user, and finally abuses CVE-2023-20052 in ClamAV to read the root SSH key.

NginxBINDMattermostGitClamAVUbuntuDNSSSHSMTP
Details →
PUBLIC 2026

Building a C2 Lab — Sliver, Nginx Redirector and Network Segmentation

A self-contained red team lab built on VMware Workstation: three isolated networks, a dedicated router VM running iptables, an Nginx TLS-passthrough redirector, a Sliver C2 server, and a Windows Server target. Includes beacon generation, delivery, execution, and a realistic Windows Defender exclusion scenario.

VMware WorkstationSliverNginxiptablesUbuntu ServerWindows ServerKali Linux
Details →
RESEARCH 2026

Credential Chain Compromise — From Git History Leak to Vault Root

A professional assessment of a Linux environment running Gogs, a Flask API, and HashiCorp Vault. The chain starts with credentials buried in Git history, escalates through an eval() injection in the API, pivots across containers with Ligolo-ng, extracts plaintext database credentials, recovers an SSH private key from a private repository, and ends with root access via a Vault root token and the SSH OTP engine.

GogsFlaskHashiCorp VaultMySQLDockerLigolo-ngPythonSSH
Details →
Say hi

Open to opportunities
worth pursuing.

Get in touch → See profile →