Rooted
Join
Verified credential - MasteryCurrent

BM::nyx

Ana Ruiz Ferrán

@nyx · Elite Hacker · Spain

Vulnerability research · browser internals

SpanishEnglish
MASTERY7RANK
RANK
7 · Elite Hacker
Verified points
16,280
Issued
2026-08-08
Valid until
2027-08-08
Standing
2 of 132

Annex — how this was earned

44 entries. Nothing scores without one.

16,280 total
Credentials2,100

4 entries

Reports12,400

20 entries

Write-ups1,180

8 entries

Quizzes and labs800

12 entries

44 ledger entries back these totals. The full derivation is visible to the holder and to Rooted review.

Where your proof lands

Derived from what each verified ledger entry actually covers. You have nothing in networks & protocols, active directory, cryptography, forensics & dfir, recon & osint, cloud & containers.

  • Web & AppSec14,610
    Evidence
    Daily questions
    Confirmed medium in the webhook receiver
    Confirmed medium in the password reset flow
    Confirmed medium in the tenant switcher
    Confirmed critical in the webhook receiver
    Getting SSRF out of a PDF renderer
    Confirmed critical in the account settings endpoint
    Confirmed high in the file upload handler
    Chaining an IDOR into a full account takeover
    Confirmed high in the OAuth callback
    Confirmed low in the account settings endpoint
    Cache poisoning through an unkeyed header
    Confirmed low in the webhook receiver
    Breaking a JWT implementation that rolled its own
    Confirmed high in the invoice export
    Confirmed medium in the GraphQL introspection surface
    Second-order SQL injection in a reporting job
    A subtle race in a payment confirmation
    Confirmed high in the tenant switcher
    Confirmed high in the webhook receiver
    Confirmed low in the file upload handler
    Confirmed critical in the OAuth callback
    Confirmed low in the password reset flow
  • Code & tooling170
    Evidence
    Cache poisoning through an unkeyed header
    Second-order SQL injection in a reporting job
    A subtle race in a payment confirmation
  • Networks & protocolsno proof yet
  • Active Directoryno proof yet
  • Cryptographyno proof yet
  • Forensics & DFIRno proof yet
  • Recon & OSINTno proof yet
  • Cloud & containersno proof yet

The road to Ghost

5,720 pts short

Everything below is priced. Pick the cheapest one and the gap closes.

  1. Connect Hack The Box

    Rank, owns and global standing pulled from your profile.

    +300
    points
    5% of the gap
  2. Claim a CVE

    Any published advisory with your name on the credit line.

    +260
    points
    5% of the gap
  3. Connect TryHackMe

    Points and completed rooms.

    +180
    points
    3% of the gap
  4. Connect GitHub

    Public tooling, exploits and the code you shipped.

    +160
    points
    3% of the gap
  5. Clear another lab

    12 lab entries scored. 1,200 points left before the lab ceiling.

    +60
    points
    1% of the gap
  6. Review another hacker's work

    Accepted peer review adds small points and proves you can judge other hackers' reasoning.

    +15
    points
    0% of the gap

Not one figure above was typed in by nyx.

Read how points are earned
Get your credential
Rank requirements beyond points
  • Rank 4+ - One verified credential or one confirmed report
  • Rank 7+ - One confirmed report or one credited CVE
  • Rank 9+ - A credited CVE at CVSS 9.0+, or three critical confirmed reports