Custom tooling, security research, and open-source projects. Work in progress — more to come.
An academic study on how a proxy DLL can impersonate a legitimate library while loading and executing an encrypted payload — without touching hooked Win32 APIs, without leaving RWX memory, and without writing a single byte to ntdll.
A multi-layered evasion framework combining Hell’s Hall indirect syscalls, PEB-based API hashing, IAT camouflage, custom CRT removal, ntdll unhooking via KnownDlls, sandbox detection, self-deletion, and Fiber-based shellcode execution — built to understand and demonstrate how modern offensive tooling evades EDR/AV at every layer.
A shellcode injector that bypasses userland hooks by resolving and calling NT syscalls directly — no Win32 API strings, no GetProcAddress, no GetModuleHandle. Custom PEB walk, export table parsing, and compile-time Djb2 hashing.
A Burp Suite extension that searches NVD, CVEDetails, and Snyk for known vulnerabilities given a technology and version — with PoC availability checks from nomi-sec/PoC-in-GitHub.
A Burp Suite extension that strips sensitive data from HTTP traffic so you can safely share requests and responses with AI assistants and LLMs — no credentials, no IPs, no names, no risk.
Combining PPID Spoofing, Module Stomping, RC4 encryption, and native NT API enumeration into a single injection framework — built from scratch to understand how modern evasion techniques work under the hood.
Six chambers, six encryption/obfuscation methods. A CTF-style tool for practicing Ghidra analysis and decryption routine writing — from XOR to AES-256 CBC to UUID obfuscation.
Manual PE backdooring from scratch: code cave injection, new section addition, XOR evasion, and Adaptix C2 beacon delivery inside a legitimate PuTTY binary.
Deep dive into the Windows PE file format and runtime process inspection via PEB walking — parsing headers, import/export tables, and the loader module list.
Overview GHOUL is an educational Command & Control (C2) framework built on top of the Discord REST API. The project covers the full stack: a Windows agent written in C, and an operator bot written in Python using discord.py. The goal was to build something that goes beyond a toy example — implementing real techniques used by modern implants, with every design decision documented and explained. The result is a working C2 with encrypted beaconing, multiple AV/EDR evasion layers, and a per-agent interactive shell system, all over a transport that blends into normal network traffic. ...
Full hardware-level engagement on an IP PTZ camera: SPI flash dump, filesystem extraction, and manual static analysis revealing 8 vulnerabilities — including two critical RCE.
Overview NetAuditor is a Python-based automation tool designed to speed up the evidence collection phase of network security assessments. It chains together multiple well-known tools — nmap, ssh-audit, testssl.sh — into a single pipeline that runs unattended, extracts only the relevant findings, and generates ready-to-use screenshots for reports. The goal is simple: reduce the manual overhead of running each tool separately, grepping for vulnerable ciphers, copy-pasting output into reports. Run it against a target list, come back to a structured folder with everything already filtered and rendered. ...