Hands-on labs, tools and research across detection engineering, offensive security, cloud and embedded systems.

🛡️ SOC Lab & Detection Engineering

Splunk · Sysmon · MITRE ATT&CK · Personal homelab

I built an end-to-end detection lab. Sysmon runs on a Windows 11 VM and sends its logs to Splunk Enterprise through a universal forwarder. I then wrote SPL searches to investigate simulated attacker activity: process creation, PowerShell execution, external file retrieval, data staging and network connections.

• I mapped the observed behaviour to seven ATT&CK techniques across Discovery, Execution, Collection and Command & Control, including T1059.001 (PowerShell), T1105 (Ingress Tool Transfer) and T1560.001 (Archive Collected Data)

🔓 Active Directory Credential Auditing

Hashcat · NTDS.dit · Windows Server · Postgraduate coursework

I extracted the NTDS.dit database and the SYSTEM registry hive from a domain controller, then cracked the password hashes with Hashcat using custom wordlists. The goal was to measure how strong the domain’s passwords really were and make the case for stronger password policy.

🔍 OSINT Reconnaissance

SpiderFoot (self-hosted, Docker) · CEH v12 methodology · Postgraduate coursework

I ran structured reconnaissance against assessment targets to map the exposed attack surface and the information that could be collected about them.

☁️ Cloud Security & Threat Modelling

AWS IAM · S3/EBS · CloudTrail · AWS Config · NIST RMF

• Did a graded threat-modelling exercise on mitigating cloud-native ransomware against AWS S3 and EBS
• Wrote a threat model for a personal Android app, covering data exposure, token theft and subscription fraud
• Completed hands-on labs in least-privilege IAM policy design, bucket permissions, secure networking and auditing

📄 Incident Analysis: Change Healthcare Ransomware (2024)

I wrote a structured analysis of the attack on Change Healthcare/UnitedHealth. It covers the exploited weakness, the technical and human factors, containment and remediation, and a future mitigation strategy, with reference to OWASP authentication and MFA guidance.

🔐 Hardened PHP Web Application

bcrypt · CSRF tokens · prepared statements · Personal project

I designed and built a PHP web app from scratch with security in mind. It uses bcrypt password hashing, cryptographically secure CSRF tokens, timing-safe comparisons, SQL injection prevention and hardened session management.

🔑 CryptoWeb: Crypto Calculators

React · TypeScript · Vite · Tailwind · Personal project

CryptoWeb is a cryptography learning app I’m building, with step-by-step explanations, guided problems and progress tracking. Its calculators are live on this site: Caesar, monoalphabetic and row-transposition ciphers, Base64 and hex encoding, XOR, and RSA key generation, encryption and decryption. Every result shows its working.

🧮 CRC-8 Calculator

Embedded · integrity checking

A web-based CRC-8 calculator for experimenting with the cyclic redundancy checks used in protocols, firmware and embedded systems. It comes with a write-up on how CRC-8 works.

🚩 CTF & Lab Write-ups

Coming soon. Write-ups from TryHackMe and other platforms will be posted here and tagged by platform and topic.

---

Want to collaborate or suggest a topic? Get in touch.