Projects
Things I've built and worked on.
Policy-aware command-and-control framework for authorized red team operations. Go server/agent core with an operator dashboard, RBAC, audit logs, encrypted payloads, and built-in safety controls.
SSH honeypot that clusters bots by HASSH and username playbook instead of IP. Cowrie + journal ingest, intent classification, live globe dashboard, stealth persona with bait files, and STIX 2.1 IOC export.
Layer-2 LAN workbench for authorized lab use. Discovers every device on the wire (ARP, mDNS, SSDP, OUI) and applies per-target drop, throttle, or silent pcap policies via nftables, tc/IFB, and AF_PACKET ARP poisoning. TUI + JSON-RPC CLI.
Local-first Chrome MV3 TOTP authenticator with inline autofill, an encrypted local vault, QR / otpauth import, and per-domain account matching for 2FA-heavy workflows.
Spotify controller & listening analytics for Chromium. Now Playing with album art, waveform viz, analytics dashboard, friend activity, and Vibe Sync — all computed locally with BYO Client ID.
Live globe visualising 30 days of SSH brute-force attempts against my exposed Oracle Cloud VM — 1,595 attempts, 64 unique IPs, 20+ countries, all bounced off pubkey-only auth.
VulnInsights
Vulnerability tracking dashboard for security assessments and penetration testing workflows, with status tracking, severity scoring, and finding-level notes.
Cinemax
Full-stack movie booking and theatre management platform with a customer-facing frontend and an admin panel for shows, seats, and bookings.
QuickMeds
Medicine lookup and pharmacy management app for fast inventory search, stock tracking, and over-the-counter prescription handling.
Table No 21
Restaurant point-of-sale system for streamlined order entry, billing, and live table tracking across dine-in and takeaway flows.
Small tools
Focused security utilities and experiments.
Refined PHP post-exploitation shell for authorized red team engagements, with separate Linux and Windows variants tuned to OS-native recon, priv-esc, and log-clearing. Ships with a Python build-time obfuscator and self-decrypting loader for AV evasion.
Chromium MV3 extension that drops 1-3 animated Gen 5 Pokemon onto every page, with a per-hostname productivity nag that triggers a fullscreen 'get back to work' overlay. Shadow-DOM isolated, GPU-only animation, offline after first sprite cache.