Guilherme Farinassi
Penetration Tester & Security Researcher | Web, Mobile & API
New to Contra
Guilherme is ready for their next project!
Bug Bounty Research - Web Vulnerability Discovery
Conducted independent bug bounty research on public VDP and paid programs (Bugcrowd/HackerOne). Discovered and reported multiple valid vulnerabilities including IDOR exposing PII, stored XSS in user-controlled fields, SSRF via...
API Security Assessment - REST and GraphQL Endpoints
Performed a black-box API security assessment covering REST and GraphQL endpoints for a fintech platform. Identified BOLA/IDOR vulnerabilities allowing unauthorized access to other users financial data, mass assignment flaws...
Mobile Application Pentest - Android Banking App
Conducted a full black-box mobile penetration test on an Android banking application following OWASP MASTG methodology. Identified 17 vulnerabilities including 5 critical findings: hardcoded AES encryption keys in...
Web Application Pentest — Insurance Portal
Conducted a full black-box web application penetration test on an insurance client portal. Identified 11 vulnerabilities including 3 critical findings: unauthenticated access to customer PII (CPF, phone, address), broken authentication...
