I’m Qu.by (a.k.a Umby) a fantastic bachelor degreed nerd with so much interests:
- 🤓 Nerd since 11 years old
- 📓 Manga/Anime lover (oh no now you know my password!)
- 😍 Love for any programming language
- 🤯 Math and Cryptography lover
- 🧑💻 Amateur reversering engineer
- 🥋 Near to be Yellow Belt on fantastic pwn.college judo (pwn executables martial arts)
- ⚛️ Quantum Computing Enthusiast but not so skilled
- 🤖 AI Enthusiast but not so skilled
- 🕹️ CTF Player (pwn&cryptografy skills)
What else do you need?
My story
I started to programming since 11 years old in Visual Basic 6, having an happing computer destroyer childhood. Happy experience in programming in different language (VB.NET, C++, PHP, Javascript) in childhood, at 16 years old I started to disassembly x86 executables and reading books about assembly and pwning some games (my hacker side).
During my bachelor degree I improved my hacking and programming skills, and started to love not so classical language such as Python 🐍
I get 1st place in CyberChallenge in individual competition within university context (32th place in national context on over 500 partecipants) and 12th/31 place in team competition national context in 2021.
Skill List
Programming Languages:
| Language | Level | Comments |
|---|---|---|
| ©️ C | Medium | Standard Library usage and dynamic allocation skills |
| ➕ C++ | Low | Object-oriented low skills |
| 👴 Fortran | Very Low | Basic fortran statements |
| ♨️ Java | Medium | Object-oriented programing, Standard Library usage and Android App development |
| 📜 Javascript | Medium | Small web-app developer in NodeJS environment |
| 🐍 Python | Medium | Big love for fast scripting |
| 🐦 Swift | Low | iOS App development in Apple Course |
| 🇻 Visual Basic 6 | Low | First programming language to consume RAM memory |
| 🇧 Visual Basic NET | Medium | Improving visual basic skills in event driven programming |
Architecture Knownlegment:
| Architecture | Level | Comments |
|---|---|---|
| 👴 68k | Medium | Universitary course knowledgment |
| 💾 x8086 | High | Reversering and pwn skills for x86 executable |
| 💿 x64 | Medium | Reversering and pwn skills for x64 executable |
| 💿 ARM | Very Low | Starting training |
Database Management System Managament:
| DBMS | Level | Comments |
|---|---|---|
| 🐬 MySQL | Medium | Relation database used in web-app static app |
| 🦭 MariaDB | Medium | Relation database used in web-app static app |
| 🐘 PostgreSQL | Low | Starting training |
| 🔥 Firebase | Medium | No-Relational database used in Android app or web app (NodeJS) |
| 🥬 MongoDB | Very Low | Starting training |
Hacking Techniques
| Context | Techniques | Level | Comments |
|---|---|---|---|
| 🌐 Web | NoSQL Injection | Low | Introduction to NoSQL Injection techniques |
| 🌐 Web | SQL Injection | High | Most of all SQL injection techniques |
| 🌐 Web | LFI | Medium | Upload and usage of malicious files |
| 🌐 Web | RCE | High | Usage of web vulnerability to gain privilaged system access |
| 🌐 Web | SSRF | Medium | Server-side request forgery to induce the server-side application to make arbitrary HTTP requests (including some request muggling vulnerabilities) |
| 🌐 Web | XSS | High | Advanced XSS techniques (including techniques bypass CSP nonces) |
| ⏪ Reversering | Static Debugging | Medium | Static Debugger analysis and various static analysis techniques |
| ⏪ Reversering | Dynamic Debugging | Medium | Dynamic Debugger anaylis using different breakpoint analysis and knowledgment different techniques |
| ⏪ Reversering | Symbolic Debugging | Low | Starting training using ANGR framework in order to analysis executable using symbolic analysis |
| ⏪ Reversering | Unpacking Techniques | Medium | Knownlegment of packing/virtualization/junk code technqiues and usage automatical scripts |
| ⏪ Reversering | NET Reflection | Low | Usage of common decompiler and static analyzer |
| 🪄 Stegography | All | Very Low | I hate guessing 🤬 |
| 🤜 Pwn | Patching Techniques | Medium | Patching (including crc32 verification fix and IAT rebuild) or injection techniques |
| 🤜 Pwn | Buffer Overflow | High | Detect and exploiting buffer overflow vulnerabilities (including Return2LibC techniques) |
| 🤜 Pwn | Format String | Medium | Detect and exploiting format string vulnerabilities for memory leak |
| 🤜 Pwn | ROP Chaining | High | Define complex ROP chaining with very limited sizes (10 bytes record ❗️) |
| 🤯 Cryptography | Classical | Medium | Some times it looks so guessing |
| 🤯 Cryptography | Private-Key | Medium | Knowledgment of most common private key algorithm (DES/AES) and exploitation of common vulnerabilties such as Bit Flipping and Oracle Padding in CBC Block modes |
| 🤯 Cryptography | Public-Key RSA | Very High | Knowledgment and exploitation of most vulnerabilties (Coppersmith and LLL’s algorithm knownledgment) see here |
| 🤯 Cryptography | Public-Key ECC | Low | Starting Training |
| 🤯 Cryptography | Hash | Low | Need training on exploitation techniques |
| 🕵️ Osint | Google Dorks | Medium | Standard Google Dork techniques |
My Works
Below there are reported some of most relevant projects:
| Title | Description | Role |
|---|---|---|
| Nabbo Project (Escape Room) | University event inteneded to high school’s students in order to recruit and test hacking skill within social environment | Co-Responsable and developer |
| Security in IoT Pairing & Authentication protocols, a Threat Model and a Case Study Analysis | Scientific Paper presented in ITASEC21 | Co-writer |