“I am just a child who has never grown up. I still keep asking these ‘how’ and ‘why’ questions. Occasionally, I find an answer.”
― Stephen Hawking
I am a Senior Penetration Tester and Offensive Security Researcher specializing in Web Hacking, API Security, and Android Exploitation. Alongside my core work, I have a strong interest in low-level programming, reverse engineering, and systems internals, which I actively explore through my personal projects.
I hold a Degree in Cyber Defense, and I am currently pursuing an M.Sc. in Computer Science at the Federal University of Technology – Paraná (UTFPR), researching offensive security and side-channel threats.
-
[SBSeg 2026] Fast Frame Rate Estimation in Electromagnetic Side-Channel Attacks on Public Systems
[EN - arXiv] · [PT-BR - SBC SOL] -
[SBSeg 2026] Do Electromagnetic Side-Channel Attacks Threaten Electronic Polling Stations? Scenarios and Recommendations
[EN - arXiv] · [PT-BR - SBC SOL] -
[IEEE ICASSP 2026] Pre-Characterization of Electromagnetic Side-Channel Leakage Using Publicly Available Information: A Case Study on E-Voting Interfaces
[IEEE Program] · [Article]
| Project | Description | Tech |
|---|---|---|
| androguard-js | JavaScript library for static & dynamic Android analysis: APK/DEX/ODEX/AXML/ARSC parsing, 224-opcode Dalvik disassembler, pseudo-Java decompiler, SQLite session state, and Frida integration. | JavaScript Node.js Frida |
| ios-pentest-setup | One-click iOS pentesting environment setup for Linux, Windows, and palera1n-jailbroken iPhones over USB. | Shell PowerShell |
| CrawAu | Automated web reconnaissance and information gathering tool for penetration testing engagements. | Python |
Latest Blog Posts (https://squ4n.ch)
- Pre-Characterization of Electromagnetic Side-Channel Leakage: A Case Study on E-Voting Interfaces
- Git Dis-amend: The Danger of "Rewriting" History
- Entendendo o DLL Hijacking (Understanding DLL Hijacking)
- Customizando o bash para pentest (Customizing Bash for Pentest)
- Offensive Security & Pentesting:
eWPTX·eMAPT·DCPT·SCWAP·SCMPA·Pentest+·eJPT
| CVE ID | Target / Product | Vulnerability Type |
|---|---|---|
| CVE-2026-47673 | Hono Web Framework (< 4.12.21) |
Improper Authorization / JWT & JWK Scheme Validation Bypass (CWE-285) |
| CVE-2024-29638 | Reserved | Identification and Authentication Failure (CWE-287) |
| CVE-2024-29637 | Reserved | Reflected Cross-Site Scripting (CWE-79) |
| CVE-2024-2480 | MHA Sistemas arMHAzena (v9.6.0.0) |
Error-Based SQL Injection in Executa Page (CWE-89) |
| CVE-2024-2479 | MHA Sistemas arMHAzena (v9.6.0.0) |
Cross-Site Scripting in Cadastro Page (CWE-79) |
| CVE-2023-0125 | Control iD Gerencia Web (v1.30) |
Cross-Site Scripting in Web Interface (CWE-79) |
