Pentester Spotlight: Antonio Catalan Fuentes

The Cobalt Pentester Spotlight highlights the fascinating journey of our Core members. Through an interview style, we share their experiences, background, and insights into the world of an accomplished pentester.

1. What's your handle? Do you use more than one? Where did it come from/ What's the origin story?

My handle is f4d3/fade, and it comes from the nickname "fadeout," which I originally chose because it was inspired by a song I love from Radiohead and Cevladé (a Chilean rapper). Over time, however, fadeout felt a bit too long and awkward to use in a normal conversation, so I shortened it to just fade, which I find much more comfortable and I really like.

2. What got you into cybersecurity? How did you get into pentesting specifically?

I’ve been passionate about computers since I was very young. It all started with video games (entry point for many of us). I wanted to play online with friends, which led me to set up VPNs without even realizing what they were at the time. This early curiosity gave me a strong foundation in how computers and networks work. Later, I pursued an ICT engineering degree in college, where I met people deeply involved in the hacking scene through CTFs, Hack The Box, and similar challenges—many of whom are now my Cntr0llz friends. I quickly became hooked, diving into ethical hacking and earning my OSCP and CEH certifications. This passion eventually led me to a career in cybersecurity, working in a consultancy firm, helping secure well-known companies across LATAM. Now, I’m managing a well-known public bug bounty program.

3. What exploit or clever attack are you most proud of and why? 

There have been many vulnerabilities that made me think, "How is this even possible?" But if I had to choose, I’d probably go with an out-of-band XML External Entity (XXE) exploit that allowed me to retrieve internal files. Another standout moment was achieving Domain Admin in record time during a red team exercise—both were incredibly rewarding challenges that reinforced my passion for offensive security.

4. What is your go-to brag when talking about your pentesting skills?

I’d say my biggest strength is outside-the-box thinking. Some of my best findings have come from diving deep into an application's logic and breaking it down in ways developers never anticipated. This approach has led me to discover some pretty unique and impactful vulnerabilities that others might overlook.

5. Share a time something went wrong in the course of a pentest. What happened and what did you do?

One of the challenges in pentesting is managing the risk of unintended impact, especially when there are no development or staging environments to test in. I’ve encountered situations where I unintentionally caused a DoS on production servers or triggered unexpected changes in customer data. Certain functions consumed excessive system resources in one case, causing the server to hang temporarily. As soon as I noticed I immediately notified the client to inform them of the issue and ensure they were aware of any potential recurrence. Clear communication and swift action are key to minimizing disruptions and maintaining trust.

6. What are your favorite tools or TTPs when conducting pentests? Why do you find them effective?

I’m the kind of hacker who believes that almost anything can be done with just a proxy, a web browser, and a terminal. I like to keep my toolkit minimal, focusing on mastering core techniques rather than relying on a long list of tools. For exploitation, I often use SQLMap for web applications and Frida for mobile assessments—both are incredibly powerful for automating tedious tasks and gaining deeper control over targets.

7. What are your favorite asset types (web applications, APIs, network, etc.) for pentests and why?

It depends! I enjoy pentesting web, API, and mobile applications because their attack surfaces are directly exposed to end users, making them high-impact targets. However, I also love the challenge of corporate environments—working with Active Directory, multiple servers, and internal assets adds another layer of complexity that keeps things exciting.

8. What certifications do you have? Why did you go for those ones specifically?

I have an ICT engineering degree and OSCP, CEH, and OSWE certifications. I chose these because I enjoy code review, so pursuing OSWE was a natural fit. My next goal is to challenge myself with an exploitation-focused certification to expand my skill set further.

9. What advice do you wish someone had given you when you first started pentesting?

Great question! The advice I wish I had received is: “Don’t be intimidated by targets, customers, or applications that have already been tested by other pentesters.” Everyone has a unique perspective, and I’ve found vulnerabilities in bug bounty programs that have been public for a long time. Just because an application has been tested multiple times doesn’t mean it is secure. There’s always something new to discover. Early on, it can feel intimidating to go after well-audited targets, but confidence and persistence often lead to surprising results.

10. How do you approach explaining findings to customers during a pentest? Is there a way you discuss your findings with customers? How do you ensure they have a quality experience?

This is an area where I believe continuous improvement is key. My approach is to deeply understand the product so that I can explain vulnerabilities from multiple perspectives—technical, financial, or user-based. Depending on the customer's needs. It's essential to consider the customer’s expertise level and tailor the explanation accordingly. If necessary, I take a moment to rethink the vulnerability and present it in a way that resonates most effectively with that specific customer, ensuring they understand the risk in the context of their business.

11. What is your favorite part of working with a pentesting team? What about working on your own?

My favorite part of working with a pentesting team is the variety of perspectives on the same logic, vulnerability, or application. Every hacker has a unique way of approaching an attack vector, and seeing different methodologies in action is both humbling and inspiring. It pushes me to grow as a professional and continuously improve my skills.

I also enjoy working alone at times—it’s a great way to challenge myself and prove that I can tackle complex problems independently. However, based on my experience, I prefer working in a team. The collaboration and shared knowledge make the process much more rewarding.

12. Why do you like pentesting with Cobalt?

I really appreciate the organization, the Cobalt team, the talented pentesters, and the clients I get to interact with. Having everything set up and ready to go allows me to focus entirely on testing, which is a huge advantage. Additionally, the flexibility to manage my own time is invaluable. Being able to work efficiently without unnecessary constraints makes the experience even better. 

13. Would you recommend someone to join the Cobalt Core? Why or why not?

Absolutely! I’d highly recommend Cobalt to any pentester looking to join a strong community of skilled hackers or challenge themselves with high-quality applications. The platform provides great opportunities to grow, collaborate, and work on engaging real-world projects.

14. What do customers or the media often misunderstand about pentesters? 

This is a tricky question, but my number one opinion is the misconception that “everything can be automated.” Many people misunderstand the value of manual penetration testing, believing that automated scanners can fully replace it. In reality, scanners are just a starting point. They can identify common vulnerabilities, but they lack the critical thinking, creativity, and adaptability that human testers bring. Relying solely on automation often results in a much lower security posture than organizations realize.

15. How do you see pentesting changing in 2025 and over the next few years?

With the rise of AI, I expect a lot of attention and development in that space. Many companies are aggressively pushing LLM initiatives, sometimes without a clear purpose, which inevitably expands the attack surface. From a cybersecurity perspective, this will introduce new and interesting vulnerabilities to explore in the near future. As pentesters, we will have to adapt and understand these new exploits and vectors.

16. Whats your p(Doom)?

I’d say it’s high, but not necessarily in the sense of a world-ending event. My genuine concern lies in how many companies currently view cybersecurity. For a lot of organizations, pentesting is still treated as a one-man job, which leaves many vulnerabilities undiscovered, whether by white hat or black hat hackers. Based on incidents like the CrowdStrike 2024 BSOD, I believe we’ll continue to see similar incidents in the near future. It’s exciting, though, especially for sci-fi fans like me. 

Learn More from our Cobalt Core

Unlock the secrets of successful pentesting. Read more the Cobalt Pentester Spotlights on our blog homepage.