---
title: "Alejandro Baño (@alexb616) | Hashnode"
description: "Offensive Security Engineer. Read the latest articles by Alejandro Baño on Hashnode."
url: "https://hashnode.com/@alexb616"
---

@alexb616

# Alejandro Baño

@alexb616 · Murcia, Spain - Prague, Czech Republic · Joined June 2026

Offensive Security Engineer

[Website](https://blog.cain.tech/)

### [Business Logic Flaws: When the bug is the behavior](https://blog.cain.tech/business-logic-flaws-when-the-bug-is-the-behavior?utm_source=hashnode&utm_medium=feed)

From donation feature to infinite points glitch

14 min read · [blog.cain.tech](https://blog.cain.tech/business-logic-flaws-when-the-bug-is-the-behavior?utm_source=hashnode&utm_medium=feed)

[Sep 21](https://hashnode.com/posts/business-logic-flaws-when-the-bug-is-the-behavior/6ab110c51a972732a9db878e)

### [One Click, No File: Upload XSS Without the Upload](https://blog.cain.tech/one-click-no-file-upload-xss-without-the-upload?utm_source=hashnode&utm_medium=feed)

How multipart/form-data turns "the victim has to pick a file" into a single link

13 min read · [blog.cain.tech](https://blog.cain.tech/one-click-no-file-upload-xss-without-the-upload?utm_source=hashnode&utm_medium=feed)

[Aug 7](https://hashnode.com/posts/one-click-no-file-upload-xss-without-the-upload/6a75a5b1bea5e9f028fd66e3)