Freelance Cybersecurity Specialists in São PauloFreelance Cybersecurity Specialists in São Paulo
ProjectsPeople
Guilherme Farinassi's avatar
Guilherme Farinassi
São Paulo, Brazil
Penetration Tester & Security Researcher | Web, Mobile & API
New to Contra
Penetration Tester & Security Researcher | Web, Mobile & API
Cover image for Bug Bounty Research - Web
Bug Bounty Research - Web Vulnerability Discovery Conducted independent bug bounty research on public VDP and paid programs (Bugcrowd/HackerOne). Discovered and reported multiple valid vulnerabilities including IDOR exposing PII, stored XSS in user-controlled fields, SSRF via internal metadata endpoint, authentication bypass via JWT manipulation, and sensitive data exposure through misconfigured S3 buckets. Findings spanned government agencies, SaaS platforms, and financial services targets. Documented all findings with full reproduction steps, CVSS scoring, and business impact analysis following responsible disclosure guidelines.
1
11
Cover image for API Security Assessment - REST
API Security Assessment - REST and GraphQL Endpoints Performed a black-box API security assessment covering REST and GraphQL endpoints for a fintech platform. Identified BOLA/IDOR vulnerabilities allowing unauthorized access to other users financial data, mass assignment flaws exposing admin-only fields, broken function-level authorization on privileged endpoints, and GraphQL introspection exposing internal schema. Also found SSRF via webhook URL parameter and JWT algorithm confusion (RS256 to HS256). Delivered OWASP API Top 10 aligned report with curl-based PoC for each finding and remediation guidance.
1
11
Cover image for Mobile Application Pentest - Android
Mobile Application Pentest - Android Banking App Conducted a full black-box mobile penetration test on an Android banking application following OWASP MASTG methodology. Identified 17 vulnerabilities including 5 critical findings: hardcoded AES encryption keys in SharedPreferences, SSL pinning bypass via Frida instrumentation, root detection bypass via LIEF binary patching, exported Activities without permission checks, and sensitive data exposed in Logcat. Delivered MASTG-aligned report with CVSS scoring and PoC code for all critical findings.
1
17
Cover image for Web Application Pentest — Insurance
Web Application Pentest — Insurance Portal Conducted a full black-box web application penetration test on an insurance client portal. Identified 11 vulnerabilities including 3 critical findings: unauthenticated access to customer PII (CPF, phone, address), broken authentication allowing account takeover, and exposed debug endpoints with Facelets stack traces. Delivered a structured report with CVSS scoring, PoC for each finding, and prioritized remediation guidance. All critical findings were reproduced and confirmed in a retest cycle. Stack targeted: Java EE, REST APIs, JWT auth, LGPD-sensitive data.
1
29
Cybersecurity Specialist(4)