Andres Riancho

Andres Riancho is an Argentine application-security researcher and open-source software developer based in Buenos Aires. He is best known as the creator of w3af (Web Application Attack and Audit Framework), an open-source, Python-based web application security scanner and exploitation tool that he started in March 2007. w3af combines a core engine with a plug-in architecture—covering discovery, audit, grep, attack, output, mangle, evasion, and brute-force plug-in types—and is distributed under the GPLv2 license. The project is documented at w3af.org and its source is hosted on GitHub, where it has accumulated thousands of stars and over 16,000 commits across its history.

In July 2010, w3af gained sponsorship from Rapid7, which helped accelerate its development. Riancho subsequently joined Rapid7 as Director of Web Security, where he managed a software development team working to improve the web application scanning capabilities of Rapid7's NeXpose product—a shift from purely open-source community work into a commercial security-vendor role.

Earlier in his career, Riancho worked at Impsat, where he was part of a Security Operations Center deploying intrusion detection systems, and later at Cybsec, an information security consultancy in Buenos Aires that was subsequently acquired by Deloitte; he has described this period as where he learned formal security-assessment methodology. In 2009 he founded his own consulting firm, Bonsai, through which he provided application security services before eventually closing it to work as an independent freelance consultant, serving clients including major Latin American companies such as MercadoLibre and Despegar as well as U.S.-based startups and consulting firms.

Beyond w3af, Riancho has published several other open-source security tools, including nimbostratus, aimed at fingerprinting and exploiting Amazon Web Services cloud infrastructure, and enumerate-iam, a tool for enumerating AWS IAM permissions associated with a set of credentials. He has also released proof-of-concept tooling touching on race-condition exploitation, MongoDB ObjectID prediction, and WebSocket fuzzing.

Riancho has been an accepted speaker at more than 30 international information-security conferences spanning Latin America, Europe, Asia, and the United States. Documented talks include "Web Application Security Payloads" at OWASP AppSec USA (2011), "Pivoting in Amazon Clouds" at Black Hat USA (2014), and "Esoteric Web Application Vulnerabilities" at CODE BLUE (2016). As of the mid-2020s, w3af's original site had experienced periods of downtime, and community development attention has partly shifted to a fork called w4af, aimed at porting the codebase to Python 3, while Riancho continues to work as an independent application-security consultant in Buenos Aires.

Timeline

• 2007Starts development of w3af (Web Application Attack and Audit Framework), an open-source web application security scanner.
• 2009Founds Bonsai, an application-security consulting firm.
• 2010-07w3af receives sponsorship and development partnership from Rapid7.
• 2011Speaks at OWASP AppSec USA on 'Web Application Security Payloads'.
• 2014Speaks at Black Hat USA on 'Pivoting in Amazon Clouds', reflecting his AWS/cloud security research (e.g., the nimbostratus toolset).
• 2016Speaks at CODE BLUE on 'Esoteric Web Application Vulnerabilities'.