Ana Ruiz Ferrán

@nyx · Elite Hacker · Spain

Vulnerability research · browser internals

SpanishEnglish

Annex — how this was earned

44 entries. Nothing scores without one.

16,280 total

Credentials2,100

4 entries

Reports12,400

20 entries

Write-ups1,180

8 entries

Quizzes and labs600

12 entriescapped at 600

44 ledger entries back these totals. The full derivation is visible to the holder and to Rooted review.

Derived from what each verified ledger entry actually covers. You have nothing in active directory, tooling & code.

Web & appsec13,410
Evidence
Confirmed medium in the webhook receiver
Confirmed medium in the password reset flow
Confirmed medium in the tenant switcher
Confirmed critical in the webhook receiver
Getting SSRF out of a PDF renderer
Confirmed critical in the account settings endpoint
Confirmed high in the file upload handler
Chaining an IDOR into a full account takeover
Confirmed high in the OAuth callback
Confirmed low in the account settings endpoint
Cache poisoning through an unkeyed header
Confirmed low in the webhook receiver
Breaking a JWT implementation that rolled its own
Confirmed high in the invoice export
Confirmed medium in the GraphQL introspection surface
Second-order SQL injection in a reporting job
A subtle race in a payment confirmation
Confirmed high in the tenant switcher
Confirmed high in the webhook receiver
Confirmed low in the file upload handler
Confirmed critical in the OAuth callback
Confirmed low in the password reset flow
Offensive ops600
Evidence
Daily questions
Foundations600
Evidence
Daily questions
Vuln research170
Evidence
Cache poisoning through an unkeyed header
Second-order SQL injection in a reporting job
A subtle race in a payment confirmation
Active Directoryno proof yet
Tooling & codeno proof yet

5,720 pts short

Everything below is priced. Pick the cheapest one and the gap closes.

Connect Hack The Box
Rank, owns and global standing pulled from your profile.
+300
points
5% of the gap
Claim a CVE
Any published advisory with your name on the credit line.
+260
points
5% of the gap
Connect TryHackMe
Points and completed rooms.
+180
points
3% of the gap
Connect GitHub
Public tooling, exploits and the code you shipped.
+160
points
3% of the gap
Review another hacker's work
Accepted peer review adds small points and proves you can judge other hackers' reasoning.
+15
points
0% of the gap
Land another confirmed report
20 confirmed reports already. Reports have no ceiling; confirmed impact keeps moving the rank.
+360
points
6% of the gap

Not one figure above was typed in by nyx.

Rank requirements beyond points