{
  "site": {
    "url": "https://mmadersbacher.github.io/",
    "title": "Mario Madersbacher · Security Researcher",
    "description": "Security researcher and web penetration tester (HTB CWES) from Tyrol, Austria. Three CVEs, merged fixes in Impacket, Scapy, Volatility 3 and ffuf, accepted bug bounty reports. Everything on the page links to where you can check it.",
    "updated": "October 2026",
    "repo": "https://github.com/mmadersbacher/mmadersbacher.github.io/tree/main/site"
  },
  "person": {
    "name": "Mario Madersbacher",
    "headline": "Security researcher and web penetration tester",
    "location": "Tyrol, Austria",
    "country": "AT",
    "region": "Tyrol",
    "email": "mario.madersbacher.2008@gmail.com",
    "intro": "I find bugs in software people actually use. npm packages, the tools this field runs on, web apps in bug bounty programs. Then I report them so they get fixed. I'm still in school, Matura is in June 2027.",
    "principle": "I don't inflate severity. If there is a CVSS score on this page I demonstrated it, I didn't estimate it.",
    "handles": [
      {
        "platform": "GitHub",
        "handle": "mmadersbacher",
        "url": "https://github.com/mmadersbacher"
      },
      {
        "platform": "HackerOne",
        "handle": "telqrrr",
        "url": "https://hackerone.com/telqrrr"
      },
      {
        "platform": "YesWeHack",
        "handle": "Telqrrrrr",
        "url": "https://yeswehack.com/hunters/telqrrrrr"
      },
      {
        "platform": "Hack The Box",
        "handle": "Telqrrr",
        "url": "https://profile.hackthebox.com/profile/019f563d-c2b9-7061-ba9e-17ef2ca8a910"
      },
      {
        "platform": "CTFtime",
        "handle": "Telqrrr",
        "url": "https://ctftime.org/user/264976"
      },
      {
        "platform": "LinkedIn",
        "handle": "mario-madersbacher",
        "url": "https://www.linkedin.com/in/mario-madersbacher-310b49414"
      }
    ]
  },
  "cves": [
    {
      "id": "CVE-2026-103043",
      "product": "anchorme.js",
      "ecosystem": "npm",
      "range": "≤ 3.0.8",
      "cwe": "CWE-1333",
      "cweName": "Inefficient regular expression complexity",
      "severity": "High",
      "cvss31": "7.5",
      "cvss40": "8.7",
      "vector31": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "assigner": "VulnCheck CNA",
      "published": "2026-09-29",
      "mechanism": "ReDoS in the regex that pulls IPv6 hosts out of a URL, reachable through the default `anchorme()` call. A URL under 100 bytes makes it backtrack exponentially and the Node.js event loop just stops.",
      "status": "No fix released as of October 2026, npm latest is still 3.0.8.",
      "credit": "Credited under my real name on the CVE record.",
      "links": [
        {
          "label": "CVE record",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-103043"
        },
        {
          "label": "VulnCheck advisory",
          "url": "https://www.vulncheck.com/advisories/anchorme-through-3.0.8-regular-expression-denial-of-service"
        },
        {
          "label": "PoC gist",
          "url": "https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3"
        }
      ]
    },
    {
      "id": "CVE-2026-90776",
      "product": "Nodemailer",
      "ecosystem": "npm",
      "range": "9.1.0 to 10.0.4",
      "cwe": "CWE-407",
      "cweName": "Inefficient algorithmic complexity",
      "severity": "High",
      "cvss31": "7.5",
      "cvss40": "8.7",
      "vector31": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "assigner": "VulnCheck CNA",
      "published": "2026-09-13",
      "mechanism": "The address parser in `lib/addressparser` goes quadratic on comment-joined addresses. Through **mailparser** that is reachable from outside with a normal inbound mail, no auth, and the event loop stalls for seconds.",
      "status": "Reported through a GitHub private advisory with a PoC and a fix suggestion. The maintainer patched it in 10.0.5.",
      "credit": "Credited on the advisory and on the CVE record.",
      "links": [
        {
          "label": "GHSA-prgh-xp8r-p3m5",
          "url": "https://github.com/advisories/GHSA-prgh-xp8r-p3m5"
        },
        {
          "label": "CVE record",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-90776"
        },
        {
          "label": "Fix commit",
          "url": "https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89"
        }
      ]
    },
    {
      "id": "CVE-2026-90492",
      "product": "webgjc/web_robot",
      "ecosystem": "Python",
      "range": "2.4.0 to 2.8.0",
      "cwe": "CWE-78",
      "cweName": "OS command injection",
      "severity": "Medium",
      "cvss31": "6.3",
      "cvss40": "5.3",
      "vector31": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "assigner": "VulDB CNA",
      "published": "2026-09-13",
      "mechanism": "The `case_name` request parameter goes straight into `os.system()` in `py/web.py` (`controller_listen` and `controller_recover`), nothing is sanitised.",
      "status": "The vendor never answered, so it went out through VulDB.",
      "credit": "Credited as Telqrrr.",
      "links": [
        {
          "label": "VulDB VDB-403080",
          "url": "https://vuldb.com/?id.403080"
        },
        {
          "label": "CVE record",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-90492"
        }
      ]
    }
  ],
  "contributions": [
    {
      "repo": "epi052/feroxbuster",
      "project": "feroxbuster",
      "number": 1322,
      "state": "open",
      "date": "2026-10-03",
      "what": "If `parallel` came from a config file, every run died with an unwrap panic (#1321). Fix plus a regression test, Rust.",
      "url": "https://github.com/epi052/feroxbuster/pull/1322"
    },
    {
      "repo": "ffuf/ffuf",
      "project": "ffuf",
      "number": 952,
      "state": "merged",
      "date": "2026-09-26",
      "what": "Made the test suite pass on Windows. Three separate causes, one of them a pipe buffer deadlock in the stdout capture that only ever showed up as a hang.",
      "url": "https://github.com/ffuf/ffuf/pull/952"
    },
    {
      "repo": "secdev/scapy",
      "project": "Scapy",
      "number": 5150,
      "state": "merged",
      "date": "2026-09-03",
      "what": "The BGP NLRI dissector crashed when the prefix on the wire was shorter than the mask said.",
      "url": "https://github.com/secdev/scapy/pull/5150"
    },
    {
      "repo": "secdev/scapy",
      "project": "Scapy",
      "number": 5149,
      "state": "merged",
      "date": "2026-09-03",
      "what": "`IP6ListField` crashed on a truncated last IPv6 address. That field sits in about 17 dissectors, DHCPv6, ICMPv6 and SRv6 among them.",
      "url": "https://github.com/secdev/scapy/pull/5149"
    },
    {
      "repo": "fortra/impacket",
      "project": "Impacket",
      "number": 2263,
      "state": "merged",
      "date": "2026-09-02",
      "what": "`BootpDecoder` threw `struct.error` on BOOTP messages below the 300 octets RFC 1542 requires (#1900). Now handled the way the RFC says, with regression tests.",
      "url": "https://github.com/fortra/impacket/pull/2263"
    },
    {
      "repo": "LOLBAS-Project/LOLBAS",
      "project": "LOLBAS",
      "number": 520,
      "state": "merged",
      "date": "2026-08-26",
      "what": "Entry for Vssadmin.exe deleting shadow copies (MITRE T1490).",
      "url": "https://github.com/LOLBAS-Project/LOLBAS/pull/520"
    },
    {
      "repo": "secdev/scapy",
      "project": "Scapy",
      "number": 5096,
      "state": "merged",
      "date": "2026-08-26",
      "what": "NSH MD-Type 2 context headers didn't dissect at all, `count_from` had been given a string. Redone along RFC 8300 with real length handling.",
      "url": "https://github.com/secdev/scapy/pull/5096"
    },
    {
      "repo": "secdev/scapy",
      "project": "Scapy",
      "number": 5095,
      "state": "merged",
      "date": "2026-08-26",
      "what": "OPC DA: `STDOBJREF.IPID` and `OpcDaFack.selack` used field classes where packet classes belong, so dissecting them raised `TypeError`.",
      "url": "https://github.com/secdev/scapy/pull/5095"
    },
    {
      "repo": "secdev/scapy",
      "project": "Scapy",
      "number": 5094,
      "state": "merged",
      "date": "2026-08-26",
      "what": "Bluetooth `Set_Extended_Advertise_Enable` always returned a single advertising set, no matter what `num_sets` said.",
      "url": "https://github.com/secdev/scapy/pull/5094"
    },
    {
      "repo": "volatilityfoundation/volatility3",
      "project": "Volatility 3",
      "number": 2017,
      "state": "merged",
      "date": "2026-08-19",
      "what": "The capabilities plugin broke on Linux kernels before 6.3. Fixed the structure handling.",
      "url": "https://github.com/volatilityfoundation/volatility3/pull/2017"
    },
    {
      "repo": "volatilityfoundation/volatility3",
      "project": "Volatility 3",
      "number": 2016,
      "state": "merged",
      "date": "2026-08-19",
      "what": "An architecture typo blocked `scheduled_tasks` on 32-bit memory images.",
      "url": "https://github.com/volatilityfoundation/volatility3/pull/2016"
    },
    {
      "repo": "projectdiscovery/nuclei-templates",
      "project": "Nuclei Templates",
      "number": 16902,
      "state": "merged",
      "date": "2026-08-19",
      "what": "Template for CVE-2020-10204 (Nexus Repository Manager 3 RCE), verified against a live instance.",
      "url": "https://github.com/projectdiscovery/nuclei-templates/pull/16902"
    },
    {
      "repo": "secdev/scapy",
      "project": "Scapy",
      "number": 5090,
      "state": "merged",
      "date": "2026-08-16",
      "what": "NBNS name query responses only gave back the first address record. Now every entry gets parsed.",
      "url": "https://github.com/secdev/scapy/pull/5090"
    },
    {
      "repo": "SigmaHQ/sigma",
      "project": "Sigma",
      "number": 6238,
      "state": "open",
      "date": "2026-08-16",
      "what": "Detection rule for Kerberos pre-auth getting disabled on a user account, which is exactly what AS-REP roasting needs.",
      "url": "https://github.com/SigmaHQ/sigma/pull/6238"
    }
  ],
  "bounty": {
    "items": [
      {
        "severity": "High",
        "cvss": "7.5",
        "vector": "C:H/I:N/A:N",
        "outcome": "accepted · rewarded",
        "what": "An unauthenticated third-party proxy endpoint at a big European electronics retailer. It exposed around 9.1 M customer trade-in records, name, IMEI, contact, payout, across seven EU storefronts."
      },
      {
        "severity": "Government VDP",
        "cvss": "",
        "vector": "",
        "outcome": "Belgium",
        "what": "An internal Confluence that let anonymous users in (resolved). SQL injection in a public geo API (accepted). An open Grafana/Mimir/Loki stack with tenant enumeration (closed as informational)."
      },
      {
        "severity": "Earliest",
        "cvss": "",
        "vector": "",
        "outcome": "€300",
        "what": "My first one, an XSS chain on an Austrian price comparison site."
      }
    ]
  },
  "experience": [],
  "projects": [
    {
      "name": "Own tools",
      "meta": "Rust, Go and Python, all on GitHub",
      "what": "IoTShade for network and IoT discovery, NetReconUltra, a Go scanner with a React dashboard, NetRecon in Python, and a hash cracker. I wrote them to understand how the real tools work.",
      "url": "https://github.com/mmadersbacher?tab=repositories"
    }
  ],
  "ctf": [
    {
      "place": 3,
      "event": "BrunnerCTF 2026",
      "field": 1102,
      "kind": "Jeopardy",
      "date": "2026-08-23",
      "url": "https://ctftime.org/event/3065",
      "note": "team"
    },
    {
      "place": 2,
      "event": "MntcrlCTF 2026",
      "field": 118,
      "kind": "Jeopardy",
      "date": "2026-06-28",
      "url": "https://ctftime.org/event/3282",
      "note": "team"
    },
    {
      "place": 37,
      "event": "SAS CTF 2026 Quals",
      "field": 515,
      "kind": "Qualifier",
      "date": "2026-06-07",
      "url": "https://ctftime.org/event/3109",
      "note": "team"
    },
    {
      "place": 14,
      "event": "HTB Cyber Apocalypse 2026",
      "fieldNote": "team of 3 · several thousand teams",
      "kind": "Jeopardy",
      "date": "2026",
      "note": "HTB scoreboard, not on CTFtime"
    },
    {
      "place": 2,
      "event": "TryHackMe AI Odyssey CTF",
      "fieldNote": "worldwide",
      "kind": "Jeopardy",
      "date": "2026",
      "note": "TryHackMe scoreboard, not on CTFtime"
    }
  ],
  "certs": [
    {
      "name": "HTB Certified Web Exploitation Specialist (CWES)",
      "issuer": "Hack The Box",
      "date": "2026-10-07",
      "detail": "100 of 100 points in the exam.",
      "id": "HTBCERT-BB6F9B6B7A",
      "url": "https://profile.hackthebox.com/profile/019f563d-c2b9-7061-ba9e-17ef2ca8a910/certificate/HTBCERT-BB6F9B6B7A"
    },
    {
      "name": "Junior Penetration Tester (PT1)",
      "issuer": "TryHackMe",
      "date": "2026-06",
      "detail": "Valid to June 2029."
    },
    {
      "name": "AI Security (AI1)",
      "issuer": "TryHackMe",
      "date": "2026-06",
      "detail": "Valid to June 2029."
    }
  ],
  "education": [],
  "skills": {
    "Web & API": [
      "Burp Suite",
      "OWASP Top 10",
      "GraphQL",
      "REST",
      "ffuf",
      "sqlmap",
      "ReDoS / algorithmic DoS"
    ],
    "Network & AD": [
      "nmap",
      "Impacket",
      "Scapy",
      "Kerberos",
      "LDAP / SMB",
      "VLANs"
    ],
    "Detection & defense": [
      "Wazuh",
      "MITRE ATT&CK",
      "Sysmon",
      "CIS Benchmarks",
      "vulnerability management"
    ],
    "Code & tooling": [
      "Python",
      "Rust",
      "TypeScript",
      "Bash",
      "Docker",
      "Git",
      "Ghidra / BinDiff"
    ],
    "Reporting": [
      "CVSS v3.1 / v4",
      "CWE",
      "coordinated disclosure",
      "pentest reports"
    ],
    "Languages": [
      "German (native)",
      "English (B2)"
    ]
  },
  "copy": {
    "heroTail": "Everything on this page links to where you can ~~check it~~.",
    "researchLead": "Three CVEs with me as the credited finder. The scores are what the CNA published, not my own numbers.",
    "ossLead": "Bugs I ran into while reading the tools this field actually runs on. The fixes went upstream, not into forks of my own.",
    "ossTail": "Every line is the pull request.",
    "bountyLead": "No program names here, that's the rule. The platform profiles are the record:",
    "ctfIntro": "I play as **Telqrrr**, mostly with «Gehackt ist Geil», a small CTF community I started. If CTFtime tracks the event the rank links to the scoreboard. Two results only exist on the platform's own board and say so.",
    "contactLead": "Vetting my application, triaging one of my reports, or you've got a target worth a weekend:",
    "contactAlso": "I'm also on",
    "contactTail": "PGP on request. Anything about this site itself goes to"
  }
}