Amazon
Secure MCP
A practical guide for people shipping MCP servers in production. Code, auth, permissions and what almost nobody implements well.
Books, talks, research
Publications
Here is what I have written, spoken and published.
I put the books first, then the talks, and the research at the end.
Books
Amazon
¿Cuántas APIs tienes realmente?
Half of organizations do not know how many APIs they run. How to find and manage the ones nobody documented, with open source and low cost tools. For tech leads and architects tired of finding surprise APIs in production.
ePub
Hacking and IPv4 packet manipulation with SCAPY
How to build and manipulate an IPv4 packet by hand. For people who want to understand the protocol, not recipes.
Talks
RootedCON
MCP Enterprise Security: A Practical Architecture and Lessons to Avoid Being Pwned
Practical security architecture for MCP in enterprise environments and lessons learned to avoid being compromised. With Alfonso Muñoz
RootedCON
When MCP goes Wrong - Que MCP no rompa tu seguridad
Security in Model Context Protocol (MCP): how design and implementation errors can compromise your infrastructure. With Alfonso Muñoz
RootedCON
Censorship, privacy and the fine art of disappearing without trace
Privacy techniques, censorship, anonymity and robust cryptography. With Dr. Alfonso Muñoz
Navaja Negra
Doing fun things with databases
Unconventional ways to exploit databases: beyond deleting data or stealing information
RootedCON
AWS, with its lambdas and its little things
Real AWS Lambda examples. Good, bad and terrible practices. With César Gallego
Navaja Negra
Protect your Python... because if it's as bad as it sounds, better nobody sees it
Techniques to protect Python code: from basic methods to creating custom Python interpreters
Navaja Negra
Protecting Python Source Code
Techniques to protect Python source code when publishing it: from the simplest to compiling your own Python interpreter
PyConES
Asyncio in production: what nobody tells you
Everything I've learned using Python Asyncio in production processing millions of events per day: the good, the bad and the ugly
RSA Conference
Spreading Application Security Ownership Across the Entire Organization
How to distribute application security responsibility across the entire organization, beyond the security team
RootedCON
From the Heaven to Hell in the CI/CD
Critical vulnerabilities in CI/CD pipelines and how attackers can compromise your entire development and deployment process
RootedCON
Crawlino: The New Level of Crawling Systems
High-performance distributed crawling system for reconnaissance and analysis of web applications at scale
RootedCON
Docker Might Not Be Your Friend - Trojanizing Docker Images
How to trojanize Docker images like a pro and why your container registry might be your worst enemy
OWASP Madrid
I Meetup OWASP Madrid
Technical talk at the first OWASP Madrid chapter meetup about web application security
RootedCON
Broker & MQ Injection
Introduction of the Broker Injection concept and presentation of Enteletaor, a tool to inject, extract and modify information from Brokers like Redis, RabbitMQ or ZeroMQ
Cybercamp
Python, Hacking and Sec-tools from the Trenches
Technical workshop on developing security tools with Python: from basic scripts to professional tools
Codemotion
Your DevOp Gives Me Work: I'm a Security Auditor
How DevOps are creating new attack vectors and vulnerabilities that security auditors have to fix
Papers
Research
LAPIS: Lightweight API Specification for Intelligent Systems
New API specification format designed for LLMs. Reduces token overhead by 85.5% compared to OpenAPI YAML and 88.6% compared to OpenAPI JSON, with results validated on GitHub, Twilio and DigitalOcean APIs.
Research
Slow JSON Stream: A Low-Bandwidth Denial-of-Service Attack Against HTTP APIs with JSON Request Bodies
Low-bandwidth DoS attack against HTTP APIs that accept JSON bodies. The attacker opens an HTTP/1.1 chunked connection and drips a valid JSON prefix at one byte per second, never sending the closing token. 90% of 41 evaluated targets are vulnerable under default configuration.