Bridging the gap between Dev & Security // ICT Security // DevSecOps // Full-Stack Engineer // AI Engineerhttps://gianlucacaruso.me/https://gianlucacaruso.me/en/blog/blind-command-injection-with-nuclei/https://gianlucacaruso.me/en/blog/blind-command-injection-with-nuclei/How a blind command injection via eval() was exploited with a timing attack and automated end-to-end with a Nuclei template, from file detection to character-by-character extraction.Mon, 12 May 2025 00:00:00 GMThttps://gianlucacaruso.me/en/blog/llm-guardrails-defense-in-depth/https://gianlucacaruso.me/en/blog/llm-guardrails-defense-in-depth/A practical breakdown of the three layers of LLM guardrails (character, content, AI-based), the bypasses that break each one, and how managed services like Google Model Armor fit in.Sat, 04 Apr 2026 00:00:00 GMThttps://gianlucacaruso.me/en/blog/whitebox-pentesting/https://gianlucacaruso.me/en/blog/whitebox-pentesting/The four phases of whitebox pentesting: code review, local testing, proof of concept and patching, and why source access finds bugs that blackbox testing structurally can't.Wed, 19 Mar 2025 00:00:00 GMThttps://gianlucacaruso.me/en/blog/why-a-chalkboard/https://gianlucacaruso.me/en/blog/why-a-chalkboard/Why a cybersecurity blog outside the formal mold, with a chalkboard aesthetic? The concept behind this site and what it has to do with how security actually gets explained.Sun, 05 Jul 2026 00:00:00 GMThttps://gianlucacaruso.me/it/blog/blind-command-injection-con-nuclei/https://gianlucacaruso.me/it/blog/blind-command-injection-con-nuclei/Come una blind command injection via eval() è stata sfruttata con un timing attack e automatizzata end-to-end con un template Nuclei, dal rilevamento del file all'estrazione carattere per carattere.Mon, 12 May 2025 00:00:00 GMThttps://gianlucacaruso.me/it/blog/llm-guardrails-difesa-in-profondita/https://gianlucacaruso.me/it/blog/llm-guardrails-difesa-in-profondita/Una guida pratica ai tre livelli di guardrail per LLM: controlli sui caratteri, sul contenuto e basati su AI, con i bypass tipici e il ruolo di servizi gestiti come Google Model Armor.Sat, 04 Apr 2026 00:00:00 GMThttps://gianlucacaruso.me/it/blog/perche-una-lavagna/https://gianlucacaruso.me/it/blog/perche-una-lavagna/Perché un blog di cybersecurity fuori dal formale, con un'estetica da lavagna? Il concept dietro questo sito e cosa c'entra con il modo in cui la sicurezza si spiega davvero.Sun, 05 Jul 2026 00:00:00 GMThttps://gianlucacaruso.me/it/blog/whitebox-pentesting/https://gianlucacaruso.me/it/blog/whitebox-pentesting/Le quattro fasi del whitebox pentesting: code review, local testing, proof of concept e patching, e perché l'accesso al sorgente trova bug che il blackbox testing non può vedere strutturalmente.Wed, 19 Mar 2025 00:00:00 GMT