Founder & CEO @ Cinta Infinita ;-) Fan de la Encarta 98 y de la Menta Granizada.
Joined May 2010
- Tweets 11,021
- Following 5,016
- Followers 2,856
- Likes 21,105
529 Photos and videos
Pinned Tweet
4 Apr 2018
Six months ago we discovered an Authentication Bypass Vulnerabiity in the @auth0 platform. After working with them, today, we can disclose the full details. Read our blog post here: medium.com/@cintainfinita/kn…
3
93
156
👾Moebius retweeted
Jun 8
Bug Bounty Village @ @ekoparty 2026 is now looking for sponsors!
With the support of our sponsors, we're able to keep growing the Village year after year, bringing talks, challenges, networking opportunities, swag, prizes, and unforgettable experiences to the bug bounty community.
If your company wants to connect with hundreds of security researchers, bug bounty hunters, and offensive security professionals from across LATAM and beyond, we'd love to talk.
📩 bugbountyvillage@ekoparty.org
#BugBounty #CyberSecurity #InfoSec #Ekoparty #BugBountyVillage #HackerCommunity
2
7
181
Jun 8
Come on! We need to unlock the transparent case!!!! Go go go !!!! Show your love to @herrmann1001 and team!
Jun 8
⏰ LAST DAYS: Proxmark5 at its lowest price EVER.
We're inches from unlocking the transparent case for EVERY backer.
This is the most powerful RFID research tool yet future-proof and ready for the next decade.
Who’s jumping in before it ends?
1
1
6
865
👾Moebius retweeted
May 27
Nos fuimos unos días a vivir la primer edición de @ekoparty Miami junto a @BugBountyArg y documenté todo en un VLOG. Espero que les guste :)
youtu.be/ZRFrmwk_0MU
7
18
2,721
👾Moebius retweeted
May 30
Just successfully exploited my first web race condition using the techniques described by @albino_wax in Smashing the State Machine. With a bit of AI, I identified a race in an authorization check where shared state between concurrent requests could be overwritten by a higher-privileged user. By triggering the race condition during authorization validation, I was able to bypass access controls and retrieve data belonging to users from other organizations.
A great reminder that sometimes the bug isn't in the authorization logic itself, but in when that logic executes. Thanks @albinowax for the excellent research and methodology.
1 Jun 2023
I'm thrilled to announce "Smashing the State Machine: the True Potential of Web Race Conditions" will premiere at @BlackHatEvents' #BHUSA this August! Looking forward to sharing some exploits that blew my mind!
blackhat.com/us-23/briefings…
2
8
121
13,789
👾Moebius retweeted
May 24
I know it is really hard to understand how much better and improved the proxmark3 has become over the years.
Here is a graphic list of the following card technologies that is currently supported in #proxmark.
11
57
3,395
👾Moebius retweeted
May 11
11
36
114
7,057
👾Moebius retweeted
Apr 21
Meet the Burp Ambassadors: @soyelmago 🇦🇷
Alan Levy is a Buenos Aires-based security consultant, content creator, and founder of @BugBountyArg.
He’s also behind LATAM’s first online bug bounty conference: BountyMagicCon.
#BurpAmbassador #BurpSuite
2
7
61
4,734
👾Moebius retweeted
Apr 21
Everything in the Proxmark3 Iceman firmware.
Every iCLASS, SEOS, Mifare, UL-AES, FeliCa update.
Every late night debugging session.
None of it is sponsored. All of it is open source.
If it has saved you time or taught you something, consider buying me a coffee.
Patreon this week: promo code 82409 for a discount.
patreon.com/iceman1001
#Proxmark3 #RFID #OpenSource #InfoSec
2
25
114
5,968
Apr 12
Hacker
Apr 12
The math on this collection should mass-humble every streaming service on the planet.
One guy. A Sony cassette recorder. 10,000 concerts over 40 years. 30,000 individual sets from 3,000 artists. R.E.M., The Cure, Nirvana, Björk, Depeche Mode, Sonic Youth, Phish, Tracy Chapman, Boogie Down Productions.
His first recording of Nirvana was July 8, 1989 at a tiny club called Dreamerz. Kurt Cobain was 20 years old. The band introduced themselves by saying they were from Seattle. This was two full years before Nevermind existed. That tape is now cleaned up and streaming for free.
The digitization operation alone is wild. One volunteer drives to Jacobs' house monthly, picks up 10-20 boxes of 50-100 tapes each, runs them through 10 simultaneous cassette decks he repaired himself. 5,500 tapes digitized since late 2024. Dozens more volunteers across the US and Europe do mastering, metadata, and setlist verification. Sometimes they contact the actual artists to confirm what songs were played.
The collection went from 171 recordings in January 2025 to over 2,300 by April 2026. At this rate it'll take years to upload everything.
Spotify has 100 million tracks. Apple Music has 100 million. Neither has a recording of Nirvana's first Chicago show. A guy with a tape recorder in his pocket does.
1
74
👾Moebius retweeted
Apr 2
When I started seriously getting into RFID security, the information landscape was a mess.
Forum threads from 2009 with broken links. Research papers behind paywalls. Knowledge sitting in private Slack channels and IRC rooms that you needed to already know someone to access. The people who knew things weren't being gatekeepers intentionally, the tooling just hadn't created a natural gathering point yet.
Then there was the Proxmark forum, the center of it all for a decade.
Not https, and overrun with spam. Haters flooded it with spam.
That's part of why the Discord server exists.
It's now the largest RFID hacking community online with members from 40 countries, spanning everyone from published researchers presenting at DEF CON and Black Hat to people who received their first Proxmark3 last week and aren't sure which end to point at the card.
The mix is deliberate. Beginners ask the questions that experts stopped asking years ago. Those questions are often the most interesting ones. "Why does this card respond to `lf search` but not `hf search`?" leads to a surprisingly fun conversation about frequency, modulation, and why the protocol landscape is the way it is.
If you're into RFID, NFC, access control security, or hardware hacking in general, the door is open.
discord.gg/iceman
#RFID #NFC #CyberSecurity #InfoSec #HardwareSecurity #Community #Proxmark3
youtube.com/@iceman1001
github.com/RfidResearchGroup…
7
32
1,458
👾Moebius retweeted
Apr 1
"iClass is secure"
Sure. Until the firmware was extracted and master keys leaked.
Then: "use iClass SE"
Until the crypto was reversed, tear-off attacks published, and SAM support.
Then: "use SEOS"
Until the SAM got hacked and SAM support landed in Flipper
Every proprietary RFID system follows the same arc.
Obscurity. Breach. Patch. Repeat.
Open standards with real crypto exist.
Nobody wants to replace the hardware.
#iClass #HID #SEOS #RFID #Proxmark3 #PhysicalSecurity
github.com/RfidResearchGroup…
x.com/herrmann1001
3
13
67
5,546
Mar 31
Hacking del bueno
Mar 30
You can now run a full Linux operating system inside a 6mb PDF.
Someone embedded a RISC-V emulator inside a standard document. You don't need a virtual machine, just a PDF reader.
→ Runs interactively inside the file.
→ Powered by a tiny RISC-V emulator.
→ The entire OS fits in just 6MB.
1
107
Mar 9
Está mal que conozca todos esos pececitos? Gracias Win98 por todo lo brindado.
1
66
👾Moebius retweeted
Feb 24
Emily Noble
Notation of Harmonic Scale to No.8 Cello G, 1908
8
120
698
18,163
Feb 20
👾🥰❤️👾
Feb 20
Cinematic platformers.
Key characteristics are realistic animations, interactions with the environment, harsh consequences and heavy focus on story and atmosphere.
Pioneered by Jordan Mechner with Prince of Persia (Amiga version shown in the video).
Another World and Flashback are also the Amiga versions, Blackthorn is the SNES one, OnEscapee is on Amiga and Oddworld is shown on the PlayStation. Background music is the Flashback main theme (Amiga version).
1
36
👾Moebius retweeted
Feb 17
Graphic designers back in day were incredible. Can you name all four games?
29
9
306
18,444
Merry Christmas! 🎄✨ All music at lukhash.bandcamp.com is now FREE to download 🎁 It’s also DMCA-safe if you want to use it on your Twitch streams 👾🎶 Hope you have a great time! 🎄❤️
17
68
359
17,212
You can now play Grand Theft Auto: Vice City right in your browser!
Try it here: dos.zone/grand-theft-auto-vi…
240
2,032
22,715
2,037,082
19 Dec 2025
IMPECABLE.
We paid $1 million to hackers to harden our firewall defenses.
Today we're telling the story of how we strengthened our WAF, disclosing a runtime mitigation layer for the first time, and how we partnered with
@Hacker0x01 to defend against React2Shell.
vercel.com/blog/our-million-…
1
570
17 Dec 2025
Mi sitio de cabecera
16 Dec 2025
Anyone who didn't know this website in the 90s was not on the Internet.
Astalavista. box. sk website in 1999
#InternetHistory
ALT Astalavista. box. sk website in 1999
68