Penetration Testing & Vulnerability Assessment
Reconnaissance, active scanning, service enumeration, and exploit execution using Nmap, Metasploit, and Gobuster across Linux and Windows lab targets.
Web Application Security & Exploitation
Identifying and exploiting OWASP Top 10 vulnerabilities, including SQL injection with SQLMap, brute-forcing auth endpoints with Hydra, XSS, CSRF, and broken access controls.
Burp Suite & Interception Proxies
Intercepting and tampering with HTTP/S traffic, repeater manual payload testing, intruder fuzzing, session token analysis, and API endpoint verification.
Splunk & Elastic Stack (SIEM)
Investigating simulated security incidents using SPL and KQL, building threat hunting queries, creating visualizations, and detecting anomalous VPN authentications and IOCs.
Wireshark & Traffic Analysis
Deep packet inspection to detect Nmap port scans, ARP cache poisoning, DNS and ICMP tunneling, credential leakage, and unauthorized network protocols.
Active Directory & Windows Server
Enterprise domain administration in VMware, Group Policy Objects (GPOs), password policies, user access management, and auditing Windows Security Event Logs.
TCP/IP, Firewalls & Microsoft 365
Network routing, ports and protocols analysis, packet header structure, stateful firewall rules, network segmentation, and Microsoft 365 security administration.
MITRE ATT&CK & Threat Mapping
Mapping observed adversary tactics, techniques, and procedures (TTPs) across initial access, execution, persistence, privilege escalation, and lateral movement.
OWASP Top 10 & Application Defense
Defense-in-depth security hardening, strict Content Security Policies (CSP), anti-clickjacking headers, HSTS, input sanitization, and output encoding.
OWASP Top 10 for LLMs & MITRE ATLAS
Assessing emerging AI risks including prompt injection, jailbreaking, model evasion, training data poisoning, and designing defensive AI guardrails.
Python Automation & Security Tools
Custom automation scripting for log parsing, network socket communication, vulnerability verification, API interactions, and proof-of-concept exploit scripts.
Bash & PowerShell Scripting
Command-line automation, triage scripting, Linux/Windows systems administration, process monitoring, and environment configuration.
JavaScript, TypeScript & React
Building full-stack dashboards, secure client-side input sanitization, API consumption, and defense against client-side DOM XSS vectors.
C, C++ & SQL
Systems programming, memory safety analysis, relational database schema design, SQL query crafting, and parameterized defense against injection attacks.
