DNS Resolution Monitoring
CAA-record analysis for TLS-interception detection, plus a passive-DNS hunt for the SolarWinds/SUNBURST C2 domain.
digPassive DNS
Skills
Cloud & Container
AWS IAM
VPC
S3 / EC2
Docker
Threat Hunting & DFIR
Wazuh
Wireshark
Autopsy
FTK Imager
VirusTotal
Shodan
AppSec & Network
SQLi / XSS / CSRF
Scapy
iptables
AI/ML for Security
scikit-learn
PyTorch
XGBoost
pandas
Languages
Python
PowerShell
Bash
Projects
Wardrobe — private closet catalog
Upload a photo or paste a product link, auto-detect the dominant color, tag the type, and search "blue top" later. Built and deployed solo, end to end — including provisioning the VM and cutting its TLS certificate.
Node.js / Express
SQLite
nginx + Let's Encrypt
Multi-user, SSRF-guarded
Labs
Hands-on labs from an M.Tech Cybersecurity program, grouped by domain.
Threat Hunting & Detection
DNS Threat Analysis
tshark-driven pcap analysis that surfaced a live phishing domain impersonating a major Chilean bank, confirmed against real query traffic.
tsharkWireshark
Wazuh Threat Hunting
Hunted brute-force logons, a port scan, and malware alerts by querying Wazuh's indexer API directly with curl.
WazuhOpenSearch
Threat Intel: VirusTotal & Shodan
Traced a malicious hash to the SystemBC backdoor trojan, then pivoted to Shodan to profile its C2 infrastructure.
VirusTotalShodan
Cloud Security
AWS Environment & IAM Setup
Stood up a Kali attack VM and AWS account with scoped IAM access keys.
AWS IAMKali Linux
VPC & Network Architecture
Built a segmented AWS network: public/private subnets across two AZs, a NAT gateway, and a default-deny NACL.
VPCNACLs
AWS Misconfigurations (flaws.cloud)
Worked the well-known flaws.cloud series: public S3 buckets, leaked git credentials, EC2 metadata SSRF, and an over-permissioned IAM policy.
AWS CLIS3IAM
Docker Container Security
Built and published Docker images, then demonstrated the supply-chain risk by containerizing a keylogger and capturing live keystrokes from it.
DockerDocker Hub
AI/ML for Cybersecurity
Colab & ML Fundamentals
Compared SVM, Decision Tree, KNN, and Naive Bayes on IoT device classification, plus a manual PyTorch linear regression.
scikit-learnPyTorch
Phishing Website Detection
Decision Tree vs. Random Forest on 11,430 URLs, tuned via grid search. Random Forest reached 96% accuracy, 0.99 ROC-AUC.
scikit-learn
Online Payment Fraud Detection
Four models on 2.5M+ transactions at a 0.13% fraud rate. Random Forest hit 100% precision, 99.4% recall.
scikit-learnXGBoost
Static Android Malware Analysis
Five models classifying apps by permissions — the simplest one (Logistic Regression) won, missing only 2 of 42 malware apps.
scikit-learnKeras
K-Means Malware Clustering
Unsupervised clustering of 9,932 unlabeled PE files, validated with silhouette scores and a feature-redundancy stress test.
scikit-learn
Digital Forensics
Disk Acquisition (FTK Imager)
Acquired and hash-verified a forensic image of an 8GB drive, weighing logical vs. physical imaging and format trade-offs.
FTK Imagerdd
Case Investigation (Autopsy)
Full forensic workup of a suspect disk image: registry analysis, deleted files, malware indicators, browser history.
Autopsy
Deleted-Data Recovery & Carving
Recovered deleted evidence across four seized drives — including manually carving a PDF from raw hex signatures.
PhotorecHex editor
Colonial Pipeline Case Study
Incident-response critique of the 2021 ransomware attack — what failed, and the controls that would've prevented it.
Incident Response
Applied Cryptography
MD5 Collision Attacks
Generated real MD5 collisions — including two executables that share a hash but run different code.
Hash collisions
SHA-256 Length-Extension Attack
Forged a valid MAC against a naive keyed hash construction, then verified HMAC closes the hole.
HMAC
Web Application Security
SQL Injection
Bypassed login and hijacked another user's account via UPDATE-statement injection, then fixed it with prepared statements.
MySQLPHP
Cross-Site Scripting (XSS)
Recreated the 2005 Samy MySpace worm — cookie theft, forged requests, and a self-propagating XSS worm.
ElggJavaScript
Cross-Site Request Forgery (CSRF)
Forged GET and POST requests to hijack a profile, then verified secret-token and SameSite-cookie defenses actually stop it.
Elgg
Network Security
Packet Sniffing & Spoofing
Wrote sniffers, spoofers, and a traceroute from scratch with Scapy.
Scapy
Firewall Internals (iptables/Netfilter)
Built a firewall as a kernel module, then reproduced it with iptables — stateless, stateful, and rate-limited rules.
iptablesLKM
ARP Cache Poisoning & MITM
Poisoned ARP caches three ways, then intercepted and altered live Telnet traffic.
Scapytcpdump
DNS-over-HTTPS & TLS Analysis
Decrypted DoH sessions with TLS session keys to compare plaintext vs. encrypted DNS visibility.
Wireshark
HTTP/1.1 vs. HTTP/2 vs. HTTP/3
Reconstructed HTTP/1.1 conversations, then decrypted TLS 1.3 to compare HTTP/2 and HTTP/3 multiplexing.
TLS 1.3
About
I'm pursuing an M.Tech in Cybersecurity Engineering, building on a background in cybersecurity risk, compliance, and cloud security. My focus is the intersection of cloud infrastructure security, threat detection, and applying machine learning to security problems.
Certifications: Certified Ethical Hacker (CEH), AWS Certified Cloud Practitioner.