I'm Tiago Galvão, an Electrical and Computer Engineer with an MSc in Cybersecurity. I test web applications, APIs and infrastructure, combining manual analysis with practical offensive security techniques.
I am building my career in offensive security through continuous hands-on practice. I enjoy analysing how applications are designed, identifying insecure assumptions and validating vulnerabilities through controlled exploitation.
Authentication, access control, business logic, injection, file handling and session management testing.
Testing REST APIs for IDOR, broken authorisation, mass assignment, injection and sensitive data exposure.
Asset discovery, endpoint enumeration, parameter discovery, virtual-host testing and attack-surface mapping.
Network enumeration, exposed-service analysis, vulnerability validation and privilege-escalation fundamentals.
Chaining password brute force, cookie manipulation, IDOR, local file inclusion and command injection to obtain administrative access and remote command execution.
TryHackMeExploiting information disclosure and path traversal before identifying SQL injection and extracting administrator credentials from the backend database.
TryHackMeHosting a remote PHP payload and abusing a vulnerable file parameter to achieve command execution on the target server.
Tools I currently use during reconnaissance, vulnerability analysis, exploitation and technical documentation.