Junior penetration tester in Santiago: documented lab decisions, evidence and a local reporting tool.
Updated
SANTIAGO, CHILE · JUNIOR PENETRATION TESTER
I am Sebastián Latorre Muñoz. I investigate security problems, connect evidence and explain the next decision. My focus is web security, Active Directory and the boundaries of AI-assisted applications.
I am looking for a junior pentesting role. This portfolio brings together training labs and my own tools. View my verifiable certifications, including OSCP+.
I separate an observation from a hypothesis, test an explicit question and preserve the context needed to explain the result. A report should make the scope, uncertainty and proposed action clear.
The HTTP case includes my own application, its authorization fix and recorded local requests. The HTB cases are concise retrospectives linked to the underlying Spanish guides; their limits identify what original evidence is not included.
Alice and Bruno each own a report. Changing only the requested object ID lets a valid session read or modify the other person’s report in the intentionally vulnerable mode.
The fix checks server-held ownership before reading or writing. 18 recorded scenarios cover both modes, including legitimate access and a read after each write: 48 HTTP exchanges match the declared expectations.
Public synthetic data, loopback HTTP and automated execution. This is not a client engagement or a production-ready API; the case does not measure timing side channels or establish the absence of other vulnerabilities.
A deterministic model-response adapter proposes tool calls. The local exercise compares a trusting executor with server-side authorization checks. It does not evaluate a real language model.
I develop report-gen, a local editor for findings, evidence and remediation. It produces PDF, DOCX, Markdown and portable HTML, with a review step before sharing.