About Me

With 20+ years of experience in information security, I specialize in penetration testing, red teaming, AI security, and threat modeling. As a recognized CVE contributor and OWASP collaborator, I am dedicated to advancing secure development practices and elevating organizational security standards.

Experience

• GitHub - Staff Security Researcher, Security Lab (2026-Present)
• Amazon Web Services (AWS) - Penetration Testing Engineer, AWS GenAI Security (2025-2026)
• Amazon Web Services (AWS) - Application Security Engineer (2022-2025)
• Ingram Micro - Principal Penetration Tester (2020-2022)
• Optiv Security Inc. - Senior Security Consultant (2018-2020)
• HALOCK Security Labs - Senior Consultant (2010-2018)
• Gtron Solutions - CTO / Partner (2008-2010)
• Kraft Foods - System Project Leader (1999-2008)

Random Blog Posts

• Loading blog posts...

Notable Vulnerabilities

• CVE-2021-41527: Flexera - Multi Factor Authentication (MFA) Bypass
• CVE-2021-41528: Flexera - Vulnerable Authorization Schema
• CVE-2014-4980: Parameter Tampering in Nessus Web UI - Information Disclosure
• CVE-2013-1402: DigiLIBE Management Console - Vulnerable Authentication Schema
• CVE-2012-6493: Nexpose Security Console CSRF Vulnerability
• CVE-2012-6494: Nexpose Security Console - Session Hijacking
• CVE-2012-6342: Atlassian Confluence - CSRF Vulnerabilities
• CVE-2011-5251: vBulletin - Unvalidated Redirects

Certifications

• Certified Information Systems Security Professional (CISSP)

  A globally recognized certification for information security professionals that demonstrates expertise across multiple security domains, including governance, risk management, and the CIA triad (Confidentiality, Integrity, Availability).

• Offensive Security Web Expert (OSWE)

  A hands-on certification focused on advanced web application penetration testing, requiring the ability to identify and exploit vulnerabilities in custom web applications.

• GIAC Web Application Penetration Tester (GWAPT)

  Specializes in assessing web application vulnerabilities and security, covering topics like SQL injection, cross-site scripting (XSS), and authentication flaws.

• GIAC Python Coder (GPYC)

  Demonstrates expertise in using Python for cybersecurity tasks, including automation, exploit development, and security tool creation.

• Certified Ethical Hacker (CEH)

  Validates skills in identifying, exploiting, and mitigating vulnerabilities in systems, focusing on ethical hacking techniques and methodologies.

• Microsoft Certified Professional (MCP)

  Recognizes proficiency in Microsoft technologies and solutions, showcasing expertise in implementing and managing Microsoft-based systems.

• CompTIA A+

  A foundational certification for IT professionals, covering hardware, software, troubleshooting, and basic networking concepts.

OWASP Contributions

• Execution After Redirect (EAR):

  A vulnerability where attackers exploit improper handling of redirects, allowing unauthorized actions after a redirect.

• Information Exposure Through Query Strings in URL:

  Sensitive data passed in URLs can be exposed via logs, browser history, or referrer headers, leading to potential data leaks.

• Form Action Hijacking:

  An attack where the action URL of a form is manipulated, redirecting submitted data to an attacker-controlled endpoint.

What's With the Handle "amroot"

The tl;dr Version

• It's not a tree joke.
• It's not a gardening blog.
• It's not a patriotic slogan.

It's just root, the old-school system kind.

The Long Version

If you're wondering what's up with amroot, you're in good company. People often assume it's a Guardians of the Galaxy thing. Sorry to disappoint, but it isn't. No tree-based lifeforms were involved.

The name comes from my early hacking days, when a large point of an engagement was simple: get root (full root/admin access). Once you escalated privileges, you'd say it aloud or type it in chat like some small victory cry (and if you're cooler than me you might have even used l33t sp34k):

> i'm root

or

> i've got root

Over time that turned into a handle, then a license plate, then a domain. Marvel showed up years later with a talking tree and suddenly everyone thought I was making a pun.

It wasn't. But I get why people think it.

• amroot = "I am root," from rooting boxes in the early days
• Long before Groot existed
• Occasionally mistaken for "American Roots," which is unintentionally patriotic
• Still the simplest summary of what I've spent most of my career doing: breaking things to making them safer

Contact

• GitHub: https://github.com/amroot/
• LinkedIn: https://www.linkedin.com/in/robertgilbert808