Penetration testing labs, IAM architecture, exploit research, threat monitoring, and adversarial security assessments.
Designed and implemented a centralized IAM architecture using Keycloak, OAuth2 Proxy, NGINX, Redis, and Flask to enforce authentication, authorization, MFA, SSO, and secure session management through OIDC. Configured NGINX as a policy enforcement gateway with rate limiting and identity-aware access control, integrated Redis-backed server-side session storage, and developed a privilege access review automation script to identify and revoke inactive privileged accounts within Keycloak realms.
Deployed and configured an Active Directory environment then executed a full-scope red team engagement progressing from OSINT reconnaissance and password spraying through Kerberoasting, ACL abuse, and DCSync to achieve complete domain compromise across seven attack phases.
Architected and deployed a fully local, cost-free LLM-powered Retrieval-Augmented Generation system using LangChain, Ollama, and Phi-3 Mini, simulating a public-facing AI application with tiered document access. Conducted structured adversarial testing across ten attack scenarios spanning prompt injection, data exfiltration, and jailbreak techniques. Engineered and verified a three-layer Python-based defense system comprising input validation, regex prompt filtering, and context isolation.
Conducted a comprehensive offensive security assessment of a deliberately vulnerable REST API application, methodically identifying and exploiting vulnerabilities across all ten OWASP API Security Top 10 categories including Broken Object Level Authorization, Broken Authentication, SQL and NoSQL Injection, Server Side Request Forgery, and Remote Code Execution chains. Utilized Burp Suite, jwt_tool, sqlmap, and FFUF. Produced a full security assessment report mapping every vulnerability to its corresponding OWASP category.
Engineered a self-hosted enterprise authentication system using Keycloak, OpenLDAP, and WebAuthn, replacing password-based login with hardware-bound FIDO2 credentials via Windows Hello. Implemented adaptive authentication with IP-based network trust policies, OAuth2 token introspection for real-time session validation, and refresh token rotation for concurrent session theft detection. Validated the infrastructure against credential phishing and session hijacking attack scenarios.
Architected a production-grade IAM infrastructure using Keycloak and FreeIPA, implementing federated Single Sign-On across OAuth2/OIDC and SAML 2.0 protocols with MFA enforcement. Engineered secure authentication pipelines with session management policies, token lifecycle controls, and backchannel logout propagation. Validated the security posture through simulated adversarial attack scenarios including brute force, token replay, and session hijacking, with centralized threat visibility via an ELK Stack pipeline.
Conducted a comprehensive security assessment of the Damn Vulnerable GraphQL Application (DVGA), performing endpoint reconnaissance, schema enumeration, and exploitation of multiple GraphQL vulnerabilities including SQL Injection, Stored XSS, SSRF, command injection, denial of service attacks, path traversal, arbitrary file write, and authentication weaknesses. Used Burp Suite, sqlmap, ffuf, GraphQL Voyager, graphwOOf, and a custom-built GraphQL reconnaissance tool.
Conducted a full-spectrum web application and host exploitation assessment against a vulnerable WordPress environment, progressing from reconnaissance and credential compromise to privilege escalation, remote code execution, lateral movement, and root-level system compromise through misconfigured cron jobs and insecure file permissions. Used Nmap, WPScan, Burp Suite, LinPEAS, and PsPy.
Exploited CVE-2024-22722, a Server-Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1, by identifying insecure Smarty template rendering, achieving arbitrary command execution, and deploying a reverse shell to gain remote access to the target system. Demonstrated practical exploitation of insecure templating engines, payload crafting, and post-exploitation access techniques in a controlled environment.
Conducted a comprehensive SQL Injection assessment against OWASP Juice Shop, successfully bypassing authentication controls, impersonating privileged users, and exploiting vulnerable search functionality to enumerate the underlying SQLite database structure. Demonstrated manual SQLi exploitation including UNION-based enumeration, authentication bypass, and schema extraction using Burp Suite and custom payload manipulation.
Conducted a web application security assessment to exploit Reflective and Stored Cross-Site Scripting (XSS) vulnerabilities across multiple security levels. Analyzed insecure PHP filtering mechanisms, bypassed input sanitization using crafted payloads, and demonstrated attack scenarios including iframe injection and session cookie theft.
Designed and implemented a centralized threat detection and monitoring architecture for a fintech infrastructure spanning on-premise Ubuntu servers and AWS cloud workloads. Integrated Wazuh agents, Suricata network intrusion detection, AWS CloudTrail log ingestion, and File Integrity Monitoring to detect brute-force attacks, SQL injection attempts, reconnaissance activity, malicious network traffic, and unauthorized file modifications in real time.
Built an automated malware triage and remediation pipeline by integrating Wazuh File Integrity Monitoring with VirusTotal threat intelligence services. Configured automated hash lookups, malicious file detection, and Active Response actions to identify and remove suspicious files from monitored endpoints while generating centralized alerts for incident visibility and response coordination.
Engineered a Windows-based malware detection and automated response workflow using Wazuh, Sysmon, custom detection rules, CDB hash lists, and Active Response modules to identify and remove simulated XWorm RAT activity. Developed custom telemetry correlation logic for obfuscated PowerShell execution, persistence mechanisms, malicious file creation, and network beaconing, enabling real-time detection and automated remediation of malware artifacts.