@alexb616

Alejandro Baño

@alexb616Murcia, Spain - Angers, FranceJoined June 2026

Offensive Security Engineer

About

Offensive security engineer with experience in external penetration testing, web applications, APIs, and Active Directory infrastructure. My research led me to discover new attack techniques and several assigned CVEs. I also have experience from the defensive side (Blue and Purple team operations), incident response, and adversary TTP simulation across SIEM and EDR platforms to improve detection coverage. I hold the OSEP, OSCP, BSCP, OSWP and CCFA certifications.

Available for

Nothing here yet.

Alejandro Baño's blogs

CAINblog.cain.tech1 post

Articles Comments

Recently published

ABAlejandro Bañoblog.cain.techAug 7 · 13 min read

One Click, No File: Upload XSS Without the Upload

TL;DR Reflected XSS on a file upload endpoint is routinely written off as unexploitable. The reasoning is always the same: the victim would have to craft a malicious file and upload it themselves, so

Alejandro Baño

About

Available for

Alejandro Baño's blogs

Recently published

One Click, No File: Upload XSS Without the Upload

Search Hashnode

Alejandro Baño

About

Available for

Alejandro Baño's blogs

Recently published

One Click, No File: Upload XSS Without the Upload