G
YouTube TikTok Games
Skip to content
View marcostolosa's full-sized avatar
🏴‍☠️
Mem3nt0 Mori.
🏴‍☠️
Mem3nt0 Mori.
83 followers · 39 following

Achievements

Achievement: StarstruckAchievement: Public SponsorAchievement: Pull Sharkx2Achievement: YOLOAchievement: QuickdrawAchievement: Arctic Code Vault Contributor

Achievements

Achievement: StarstruckAchievement: Public SponsorAchievement: Pull Sharkx2Achievement: YOLOAchievement: QuickdrawAchievement: Arctic Code Vault Contributor

Highlights

Block or report marcostolosa

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
marcostolosa/README.md
Marcos Tolosa, pentester and red teamer. Bug bounty hunter and reverse engineer in Rio de Janeiro, Brazil. CVE-2025-10230 (CVSS 10.0) in Samba. 6× U.S. Government Hall of Fame. 93.75% accuracy across 15 valid reports.

Pentester (penetration tester), red teamer and bug bounty hunter. I test web applications, APIs, mobile apps and Active Directory the way real attackers do, and I only report what I can prove.

Selected work

  • CVE-2025-10230 · Samba · CVSS 10.0. Critical OS command injection that stayed hidden for 13 years. Advisory
  • 6× U.S. Government Hall of Fame. NASA, U.S. Dept. of Commerce, Veterans Affairs, NCUA, EPA, Fish & Wildlife Service. Includes a P1 unauthenticated command injection at the NCUA. Bugcrowd profile
  • More disclosures. CVE-2026-23722 (CVSS 9.1, stored XSS → RCE) and CVE-2025-67503 (CVSS 8.2) in WeGIA · blind XXE → SSRF for the Belgian Government · buffer overflow in Samba CTDB.
  • Open-source tools. MANW-NG (Windows API docs and live execution for reverse engineers) · OCRack (PDF OCR and translation) · ARCTAX (prompt-injection research).

What I do

Web, API and mobile penetration testing · Red team operations and Active Directory attacks · Bug bounty (Bugcrowd, HackerOne, YesWeHack, Intigriti) · Vulnerability research and exploit development · Reverse engineering and malware analysis · Application security (AppSec) and code review · Cloud security (AWS, Azure, GCP)

Certifications: CRTA · CCSP · CKS · OWASP member since 2021.

Contact

Open to pentest and red team roles and freelance engagements.

marcos.tolosa@owasp.org · LinkedIn · mindsecurity.org · YouTube · Versão em português

Pinned Loading

  1. manw-ng manw-ng Public

    A command-line tool for extracting Win32 API documentation from Microsoft and exec this functions.

    Python 15 1

  2. hollow hollow Public

    C++ 1

  3. atticus-linux atticus-linux Public

    Voice assistant overlay for Omarchy (Hyprland/Wayland): hotkey or wake word, Brazilian Portuguese and English speech, neural voice.

    Shell 1

  4. arctax arctax Public

    AI bypass prompt generator with ML + Uncensored local LLM.

    Python 12 3

  5. OCRack OCRack Public

    High-performance PDF translation tool featuring PaddleOCR for maximum text extraction with optimized prompts, automatic chapter detection, smart chunking, checkpoint/resume system, and comprehensiv…

    Python 8 2

  6. mindsecurity/REload.Me mindsecurity/REload.Me Public

    REload.Me – The most easy reverse engineer classroom.

    Python 2