Max Maass

@hacksilon

Building and breaking software before other people do :)

Hamburg, GermanyJoined August 2022

About

Security Expert at iteratec. I break your software before other people do, and then help you secure it afterwards :).

Available for

Nothing here yet.

Max Maass's blogs

Max' Musings on Securityblog.maass.xyz6 posts

Articles Comments

Recently published

MMMax Maassblog.maass.xyzApr 27 · 15 min read

What's your Threat Model?

If you spend any time in vaguely AI-critical circles, chances are you saw the article by "That Privacy Guy" on how Anthropic installs Spyware on your PC if you install Claude desktop. I think this art

0

MMMax Maassblog.maass.xyzMar 6, 2025 · 15 min read

Please Stop Calling GenAI "Useless"

A common shorthand I am seeing in criticisms of Generative AI technologies is that GenAI / LLMs are “useless”. This shows up again and again, especially in hot takes on Mastodon, and sometimes from people whose professional work I deeply respect. Whi...

0

MMMax Maassblog.maass.xyzFeb 26, 2025 · 17 min read

Encryption Isn't Enough: Compromising a Payment Processor using Math

During a security engagement with my employer, iteratec, I found and reported a security issue that allowed me to completely compromise the internal customer service frontend of a payment processor, which would have let us steal customer information ...

0

MMMax Maassblog.maass.xyzDec 9, 2022 · 8 min read

Spring Actuator Security, Part 3: Finding Exposed Actuators using Dynamic Testing with ffuf

This is part three of a series on the security implication of Spring Actuators. I recommend having read at least the first part to understand the context. In the previous article, we discussed how you can leverage static code analysis using semgrep ...

0

MMMax Maassblog.maass.xyzSep 14, 2022 · 13 min read

Spring Actuator Security, Part 2: Finding Actuators using Static Code Analysis with semgrep

In the first part of this series, we have discussed the risks inherent in exposing the Actuator functionality of the Spring framework. If you haven't read that part yet, I recommend that you do so before reading this article. In this article, we wi...

0

Max Maass

About

Available for

Max Maass's blogs

Recently published

What's your Threat Model?

Please Stop Calling GenAI "Useless"

Encryption Isn't Enough: Compromising a Payment Processor using Math

Spring Actuator Security, Part 3: Finding Exposed Actuators using Dynamic Testing with ffuf

Spring Actuator Security, Part 2: Finding Actuators using Static Code Analysis with semgrep

Search Hashnode

Max Maass

About

Available for

Max Maass's blogs

Recently published

What's your Threat Model?

Please Stop Calling GenAI "Useless"

Encryption Isn't Enough: Compromising a Payment Processor using Math

Spring Actuator Security, Part 3: Finding Exposed Actuators using Dynamic Testing with ffuf

Spring Actuator Security, Part 2: Finding Actuators using Static Code Analysis with semgrep