Skip to content
View sys0xFF's full-sized avatar
28 followers · 18 following

Achievements

Achievement: Pull Sharkx3Achievement: Pair Extraordinairex3Achievement: Public SponsorAchievement: YOLOAchievement: Quickdraw

Achievements

Achievement: Pull Sharkx3Achievement: Pair Extraordinairex3Achievement: Public SponsorAchievement: YOLOAchievement: Quickdraw

Highlights

  • Pro

Block or report sys0xFF

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
sys0xFF/README.md

banner

Anthony Sforzin

Software engineer and offensive security researcher. Full-stack development and vulnerability research with coordinated disclosure, from application code to the kernel.

São Paulo, Brazil · Software Engineering @ FIAP

Work

  • Full-stack and backend development: Java, TypeScript, Python, C++.
  • Vulnerability research, reverse engineering, and pentesting.

Highlights

  • CVE-2025-61155 — co-credited researcher (with Gabriel Maciel Ramos and Gabriel Gomes). Access control flaw in a signed kernel driver on Windows (GameDriverX64.sys): an unprivileged IOCTL reaches ZwTerminateProcess in kernel context, allowing arbitrary processes to be terminated, including protected security services (BYOVD / EDR-killer class). CWE-400 · CVSS 5.5.
  • pagewright — skill for Claude Code that generates landing pages from a one-line brief. Python.
  • Caustic — personal security research project: 90-day disclosure policy, PGP contact, public advisories.

Certifications

  • CRTA — Certified Red Team Analyst (CyberWarFare Labs)
  • NPP — Novo Pentest Profissional (Desec Security)

Stack

Java · TypeScript · Python · C++

Contact

Popular repositories Loading

  1. pagewright pagewright Public

    Design-grade SaaS landing pages, generated, not templated. A Claude Code skill.

    Python

  2. anglis anglis Public

    Anglis - brand repositioning, landing page and platform demo. Consulting for FIAP NEXT.

    JavaScript

  3. sys0xFF sys0xFF Public

    GitHub profile

  4. tc-pr-scope-poc tc-pr-scope-poc Public

    Forked from n4sh7/tc-pr-scope-poc

    Authorized Mozilla bug-bounty PoC (F-6 Taskcluster PR trust boundary)

  5. CVE-2025-61155 CVE-2025-61155 Public

    CVE-2025-61155 — arbitrary process termination in GameDriverX64.sys (Tower of Fantasy anti-cheat). Original IDA Pro teardown, PoC, YARA, IOCs, mitigation.

    YARA

  6. tc-poc tc-poc Public

    Taskcluster PR-trust PoC (HackerOne #3820002) - benign

    1