Alvaro Balada – Medium

Alvaro Balada

Pinned

Grafana CVE-2025–4123: Full Read SSRF & Account Takeover

May 22

Grafana CVE-2025–4123: Full Read SSRF & Account Takeover

May 22

Pinned

Admin Account Takeover in Moodle!

Feb 23

Admin Account Takeover in Moodle!

Feb 23

A Beautiful Bug: Interesting URL scheme bypass + Race Condition.

May 30, 2024

A Beautiful Bug: Interesting URL scheme bypass + Race Condition.

May 30, 2024

SSRF on a Headless Browser Becomes Critical!

Feb 5, 2024

SSRF on a Headless Browser Becomes Critical!

Feb 5, 2024

The power of Client-Side Path Traversal: How I found and escalated 2 bugs through “../”

Hi, some time ago I found a very well known application that I used quite a lot when I was in high school, it is a private program in…

Jan 1, 2024

The power of Client-Side Path Traversal: How I found and escalated 2 bugs through “../”

Jan 1, 2024

My first Bugs: Persistence and mentality (Not a Writeup).

I’m Alvaro, I’m 19 years old and I’m going to explain my experience in Bug Bounty. I would recommend you to check my first post My Bug…

Dec 9, 2023

My first Bugs: Persistence and mentality (Not a Writeup).

Dec 9, 2023

Burpsuite vs Caido: Why You Should give Caido a try

In my Offensive Security journey, I have always used BurpsuiteCommunity as my main and unique proxy tool, I tried tools like OWASP ZAP, but…

Sep 29, 2023

Burpsuite vs Caido: Why You Should give Caido a try

Sep 29, 2023

My Bug Bounty failures

I was very frustrated due to my constant failures in Bug Bounty, I had high expectations when I started and I thought that I would have a…

Sep 27, 2023

My Bug Bounty failures

Sep 27, 2023

Alvaro Balada

Alvaro Balada

Trying to make a living in security research. https://nightbloodz.github.io https://www.linkedin.com/in/alvarobalada https://x.com/nightbloodz_

Following

Help

Status

About

Careers

Press

Blog

Privacy

Rules

Terms

Text to speech