Daniel Alfocea

MCP Enterprise Security: A Practical Architecture and Lessons to Avoid Being Pwned

Fri, 06 Mar 2026 00:00:00 +0000

When MCP goes Wrong - Que MCP no rompa tu seguridad

Thu, 05 Mar 2026 00:00:00 +0000

LAPIS: Lightweight API Specification for Intelligent Systems

Fri, 20 Feb 2026 00:00:00 +0000

OpenAPI was designed for code generators and documentation tools. When an LLM processes it, it spends tokens on information the model doesn’t need.

LAPIS is an API specification format designed specifically for how language models consume documentation. Tested on GitHub, Twilio and DigitalOcean APIs, the average reduction is 85.5% fewer tokens compared to OpenAPI YAML and 88.6% compared to JSON.

Beyond compactness, LAPIS includes centralized error handling, webhook triggers, rate limiting descriptions and operation flows, things OpenAPI scatters or doesn’t address directly.

Censorship, privacy and the fine art of disappearing without trace

Fri, 07 Mar 2025 00:00:00 +0000

Doing fun things with databases

Fri, 04 Oct 2024 00:00:00 +0000

Databases as sophisticated attack infrastructure.

What it’s about

Let’s forget basic SQL injection, data deletion or information theft. We already know that.

This talk is about how attackers can use databases as part of sophisticated attack infrastructure:

Databases as C2 (Command & Control)
Advanced persistence via DB
Lateral movement using DB infrastructure
Covert exfiltration
Parallels with malware evolution

Why it’s relevant

Databases are at the heart of every modern system. But they’re rarely thought of as advanced attack vectors.

Dockerscan

Mon, 01 Jan 2024 00:00:00 +0000

Dockerscan is probably the most comprehensive Docker security scanner available.

When the container boom started, I realized there was a big problem: people didn’t know how to secure their containers. And the tools available were… well, let’s say they left much to be desired.

So I rolled up my sleeves and created Dockerscan.

What does it do?

Scans Docker images for vulnerabilities
Analyzes container configuration
Detects hardcoded secrets
Identifies security issues in real-time
And much more

Impact

With +1,400 stars on GitHub, Dockerscan has become a reference tool for securing containers.

Slow JSON Stream: A Low-Bandwidth Denial-of-Service Attack Against HTTP APIs with JSON Request Bodies

Wed, 24 Jun 2026 00:00:00 +0000

Slow JSON Stream is a low-bandwidth denial-of-service attack against HTTP APIs that accept application/json bodies.

How it works

The attacker opens an HTTP/1.1 connection with chunked Transfer-Encoding and drips a valid JSON prefix (e.g. {"items":[{...,}) at one byte per second, never sending the closing token. Slowloris does the same with HTTP headers and servers already cut it with client_header_timeout. This variant reaches the framework body reader and JSON parser, where most frameworks have no body timeout set by default.

AWS, with its lambdas and its little things

Fri, 08 Mar 2024 00:00:00 +0000

Aiotasks

Tue, 02 Jan 2024 00:00:00 +0000

Aiotasks is a distributed task manager for Python Asyncio. Think Celery, but for asynchronous code.

I love Asyncio. I think it’s one of the best things that ever happened to Python. But when I tried to use Celery with asynchronous code, it was hell.

So I created Aiotasks.

Why Aiotasks?

Truly asynchronous: Designed from scratch for Asyncio
Simple: You don’t need a PhD in Python to use it
Distributed: Scales horizontally without issues
Lightweight: Doesn’t have the thousand dependencies Celery has

Use cases

I’ve used it in production for:

Protect your Python... because if it's as bad as it sounds, better nobody sees it

Fri, 06 Oct 2023 00:00:00 +0000

Entertaining, instructive, and a genuine brainfuck about Python code protection.

What it’s about

Scenarios where you need to protect your Python code: intellectual property, distributing applications, improving performance, securing sensitive algorithms.

This talk covers:

Basic obfuscation methods
Code packaging and encryption
Advanced techniques: creating custom Python interpreters
Effectiveness analysis of each method
Real use cases and limitations

Why it’s relevant

Python is open source by design. But sometimes you need to protect proprietary algorithms, commercial products, or sensitive internal tools.

Protecting Python Source Code

Fri, 06 Oct 2023 00:00:00 +0000

Techniques to protect Python source code, from the obvious to the most advanced.

What it’s about

When you publish Python code, you normally publish it as plain text. But sometimes you need to protect your source code.

This talk covers:

Basic techniques: obfuscation, bytecode
Intermediate techniques: packaging, encryption
Advanced techniques: compiling your own modified Python interpreter
Pros and cons of each approach
Real use cases

Why it’s relevant

There are situations where protecting source code is necessary: commercial products, proprietary algorithms, internal tools.

Plecost

Mon, 17 Mar 2014 00:00:00 +0000

Plecost finds vulnerabilities in WordPress installations: core, plugins and themes. Every finding is matched against a local CVE database that updates daily.

It lives in its own GitHub organization, but it’s mine. I started it in 2014 and rewrote it from scratch for version 4.

Why it exists

Anyone auditing WordPress in production hits the same wall: API rate caps, vulnerability data that depends on an external service, no way to use it as a library, and slow scans because nothing runs concurrently.

NoSQL Injection Wordlists

Wed, 03 Jan 2024 00:00:00 +0000

NoSQL Injection Wordlists is the most complete collection of payloads for testing NoSQL Injections you’ll find.

When I started pentesting applications using MongoDB, Cassandra, and other NoSQL databases, I realized there were no good wordlists.

The ones available were poor. Very poor.

What’s included?

Hundreds of payloads for:

MongoDB
Cassandra
CouchDB
Redis
And many more

Real impact

+370 stars and used by pentesters worldwide.

I’ve seen bug bounty reports that used these wordlists to find critical vulnerabilities.

Asyncio in production: what nobody tells you

Sat, 08 Oct 2022 00:00:00 +0000

Everything I’ve learned using Python Asyncio in production. The good, the bad, and the ugly.

Summary

Asyncio is great. Until it isn’t.

In this talk I cover:

Common mistakes when using Asyncio
Performance issues nobody tells you about
Debugging asynchronous code
Patterns that work in production

Based on real experience

It’s not theory. It’s what I’ve learned building systems that process millions of events per day.

Impact

After the talk, many people wrote to me saying I’d saved them months of headaches.

FestIn

Thu, 04 Jan 2024 00:00:00 +0000

FestIn is an open S3 bucket scanner. It helps you find exposed data before the bad guys do.

Amazon S3 is great. But people misconfigure it. Badly.

I’ve seen everything: complete databases, confidential documents, unencrypted backups… all out in the open.

What does FestIn do?

Scans S3 buckets for insecure configurations
Detects publicly exposed data
Identifies incorrect permissions
Generates detailed reports

Real story

Once, using FestIn, I found a bucket with medical information of millions of people. I contacted the company. They had a hard time believing it.

Spreading Application Security Ownership Across the Entire Organization

Tue, 07 Jun 2022 00:00:00 +0000

RSA Conference 2022 - One of the world’s most important cybersecurity conferences.

What it’s about

Application security cannot be the sole responsibility of the security team. It needs to be distributed throughout the entire organization.

This session covers:

Strategies to distribute security ownership
How to empower development teams
Creating security culture across the organization
Success metrics and measurement
Real implementation cases

Why it’s relevant

The most successful organizations in security are those where everyone feels responsible, not just the security team.

Aiohttp-Swagger

Fri, 05 Jan 2024 00:00:00 +0000

Aiohttp-Swagger generates automatic API documentation for aiohttp servers.

Documenting APIs is a pain. I know it. You know it. We all know it.

But it’s necessary. And it has to be up to date. Otherwise, it’s worse than not having it.

Why did I create it?

I love aiohttp. It’s fast, simple, and powerful. But it didn’t have a decent way to generate Swagger documentation.

So I created it.

Features

Automatic: Generates documentation from your code
Swagger UI: Visual interface to test the API
OpenAPI: De facto standard for REST APIs
Easy: Two lines of code and you’re done

Adoption

+180 stars and used in APIs processing millions of requests per day.

From the Heaven to Hell in the CI/CD

Fri, 06 Mar 2020 00:00:00 +0000

Critical CI/CD vulnerabilities nobody tells you about.

What it’s about

CI/CD pipelines are the new target. Compromise the CI/CD and you compromise the entire company.

This talk covers:

Top 10 CI/CD vulnerabilities
Attacks on Jenkins, GitLab CI, GitHub Actions, CircleCI
Supply chain attacks through CI/CD
Secrets and credentials compromise
Defense in depth for pipelines

Why it’s relevant

CI/CD is the gateway to production. A compromised pipeline means malicious code in production without anyone noticing.

Enteletaor

Sat, 06 Jan 2024 00:00:00 +0000

Enteletaor is a specialized pentesting tool for Message Queues and Brokers.

RabbitMQ, Redis, Apache Kafka… these are critical components in modern architectures. And nobody tests them properly.

The problem

Most pentesters focus on web applications. But message brokers are equally critical. And equally misconfigured.

What does Enteletaor do?

Detects insecure configurations in brokers
Injects malicious messages
Identifies authentication issues
Tests incorrect permissions

Real cases

I’ve found critical vulnerabilities in systems processing financial transactions.

Crawlino: The New Level of Crawling Systems

Fri, 02 Mar 2018 00:00:00 +0000

Presentation of Crawlino, a next-generation distributed crawling system.

What it’s about

Crawlino is a distributed crawling system designed for reconnaissance and analysis of web applications at scale.

This talk covers:

Limitations of traditional crawlers
Distributed and scalable architecture
Intelligent crawling with learning
Use cases in pentesting and reconnaissance
Performance: millions of URLs per day

Why it’s relevant

Traditional crawlers don’t scale. When you need to analyze thousands of domains or millions of URLs, you need a different approach.

Dockerfile Security

Sun, 07 Jan 2024 00:00:00 +0000

Dockerfile Security is a static analyzer that finds security issues in your Dockerfiles before building images.

Prevention is better than cure. Especially in security.

Why is it important?

Dockerfiles are code. And like all code, they can have vulnerabilities:

Hardcoded secrets
Users with excessive privileges
Unnecessary exposed ports
Outdated software

Features

Static analysis: No need to build the image
Fast: Seconds, not minutes
Integrable: CI/CD friendly
Detailed: Explains what’s wrong and how to fix it

Impact

+95 stars and used in CI/CD pipelines of companies that take security seriously.

Docker Might Not Be Your Friend - Trojanizing Docker Images

Wed, 01 Mar 2017 00:00:00 +0000

Docker can be your worst enemy if you don’t know what you’re doing.

What it’s about

With Roberto Muñoz we presented advanced techniques to trojanize Docker images and compromise systems through containers.

This talk covers:

Docker image trojanization
Backdoors in containers
Attacks on Docker registries (Docker Hub, private)
Supply chain attacks through images
Persistence and lateral movement via Docker

Why it’s relevant

Everyone uses Docker. Everyone trusts third-party images. Nobody verifies what they actually contain.

Vulnerable Node

Mon, 08 Jan 2024 00:00:00 +0000

Vulnerable Node is a small web shop written in NodeJS with real vulnerabilities in the code. Not simulated: real.

Why it exists

When you build a code analyzer, you need something to test it against. The vulnerable apps that existed, such as OWASP NodeGoat, are fine for learning but not for measuring a tool: their flaws are simulated, and a serious analyzer does not find them because they are not really there.

I Meetup OWASP Madrid

Wed, 01 Jun 2016 00:00:00 +0000

First meetup of the OWASP Madrid chapter.

What it’s about

Technical talk about web application security at the first official meetup of the OWASP Madrid chapter.

Examples and code from the talk are available on GitHub: cr0hn/i-owasp-madrid

OWASP Madrid

OWASP (Open Web Application Security Project) is the world’s leading organization in web application security.

The Madrid chapter is one of the most active in Spain, with regular meetups on application security, APIs and secure development.

Aiohttp-Cache

Tue, 09 Jan 2024 00:00:00 +0000

Aiohttp-Cache is a cache system for aiohttp servers that makes your APIs fly.

Speed matters. A lot.

The problem

APIs often do the same thing over and over. Database queries, external service calls… all of that is slow.

The solution? Cache. But doing it right is complicated.

What does Aiohttp-Cache do?

Automatic HTTP response caching
Support for multiple backends (Redis, Memcached, memory)
Smart invalidation
Configurable TTLs
Zero config by default

Use cases

I’ve used it in APIs that went from 100ms latency to 5ms.

Broker & MQ Injection

Tue, 01 Mar 2016 00:00:00 +0000

First public presentation of the Broker Injection concept.

What it’s about

I presented for the first time the concept of Broker Injection and released Enteletaor, a security tool to inject, extract and modify information from Brokers and Message Queues.

This talk covers:

Vulnerabilities in messaging systems (Redis, RabbitMQ, ZeroMQ)
Injection techniques in brokers
Sensitive data exfiltration
Practical demonstration with Enteletaor

Why it’s relevant

Brokers and messaging systems are at the heart of modern distributed systems. But nobody was talking about their security.

OpenVAS to Report

Wed, 10 Jan 2024 00:00:00 +0000

OpenVAS to Report is a set of tools to convert OpenVAS XML reports into professional executive reports.

OpenVAS is great for finding vulnerabilities. But its reports are awful.

The real problem

When you do a pentest, you need two types of reports:

Technical: For system administrators
Executive: For bosses who make decisions

OpenVAS only gives you XML. And it’s horrible to read.

What does this tool do?

Converts OpenVAS XML into:

Python, Hacking and Sec-tools from the Trenches

Tue, 01 Dec 2015 00:00:00 +0000

Hands-on Python workshop for hacking and security.

What it’s about

Not a talk. A hands-on workshop on how to build security tools with Python.

This workshop covers:

Network hacking with Scapy
Web hacking with Python
Security tools development
From script to professional tool
Best practices and patterns

Why it’s relevant

Python is the language of choice in security. But there’s a big difference between a 50-line script and a professional tool.

ja-shortener

Sun, 01 Jan 2023 00:00:00 +0000

I built ja-shortener because I refused to depend on Bitly for something as trivial as shortening a URL.

It’s a self-hosted shortener. No third parties, no tracking, no API quotas showing up at the end of the month. It works and it doesn’t get in the way.

+43 stars on GitHub.

Your DevOp Gives Me Work: I'm a Security Auditor

Sun, 01 Nov 2015 00:00:00 +0000

The love-hate relationship between DevOps and Security.

What it’s about

Provocative title for a necessary talk: how the DevOps revolution is introducing new security problems.

This talk covers:

Common security mistakes in DevOps culture
Insecure containers
Secrets in environment variables
Pipelines without security controls
How to do DevSecOps right

Why it’s relevant

In 2015, DevOps was booming. Everyone wanted to deploy fast. Nobody thought about security.

This talk was a wake-up call: speed without security is a disaster waiting to happen.

RSM - Redis Security Map

Sat, 01 Jan 2022 00:00:00 +0000

RSM (Redis Security Map) is a security tool for Redis.

The common problem: Redis deployed with default configuration, open port, no authentication, waiting for someone to find it with a basic scan. RSM detects those configurations and blocks access attempts before they get anywhere.

+31 stars on GitHub.

EasyLogs

Sat, 01 Jan 2022 00:00:00 +0000

EasyLogs is a dashboard for watching logs in real time without setting up anything big.

I wrote it because every time I wanted to look at the logs of a small service I ended up standing up Kibana, Graylog or something like it, and losing the afternoon configuring it to read four lines. I wanted something that starts with a docker run and does what you need 90% of the time: see what is happening right now.

wordpress-docker-sec

Fri, 01 Jan 2021 00:00:00 +0000

WordPress gets configured one way and attacked another. This repository deploys on Docker the tools I use to audit and harden installations: nmap, wpscan, plecost.

Nothing new, but having it ready and automated saves time every time.

+13 stars on GitHub.

LAPIS

Fri, 20 Feb 2026 00:00:00 +0000

LAPIS (Lightweight API Specification for Intelligent Systems) is an API specification format designed for LLMs, not for code generators.

OpenAPI works fine for documentation tools. When an LLM processes it, it spends tokens on information the model doesn’t need. LAPIS cuts that overhead: 85.5% fewer tokens than OpenAPI YAML, 88.6% fewer than JSON, measured on real APIs from GitHub, Twilio and DigitalOcean.

It also includes centralized error handling, webhook triggers, rate limiting descriptions and operation flows. Converts automatically from OpenAPI 3.x. Published as an open specification under CC BY 4.0.

nginx-wordpress-docker-sec

Fri, 01 Jan 2021 00:00:00 +0000

The wordpress-docker-sec version focused on Nginx. Same audit tools, but with the hardening applied at the web server level instead of the application.

Both repos together cover most of the typical attack surface of a WordPress in production.

+12 stars on GitHub.

realtime-redis-backup

Sat, 01 Jan 2022 00:00:00 +0000

realtime-redis-backup continuously backs up Redis to S3 using asyncio, without blocking anything.

I built it because I wanted backups without having to stop Redis or set up replicas for that purpose. Configurable frequency, compression and retention.

+11 stars on GitHub.