Hands-on security engineering \u2014 from SIEM deployments and vulnerability research to custom CTF machines and open-source tooling.<\/p>\n\n\n\n
Aug 2024 \u2013 Present<\/em><\/p>\n\n\n\n Designed and implemented a Security Information and Event Management (SIEM) platform and Security Operations Center (SOC) using Microsoft Azure and Microsoft Sentinel \u2014 focusing on real-time threat detection, log analytics, incident management, and incident response workflows.<\/p>\n\n\n\n Independent security research across production web applications and APIs. Notable findings include GraphQL vulnerabilities enabling unauthorized admin account creation and remote device control, IDOR flaws exposing GPS and account metadata, 18+ XSS vulnerabilities caused by outdated JavaScript modules, and multiple information disclosure and authentication weaknesses \u2014 all responsibly reported with detailed remediation guidance.<\/p>\n\n\n\n Final capstone project for Woz U: a full walkthrough of a Capture the Flag vulnerable machine themed around The Office<\/em>. Demonstrates a complete penetration testing methodology using Nmap, netdiscover, FFuF, Burp Suite, Wireshark, MySQL, netcat, Exiftool, Gobuster, Hydra, John the Ripper, and more \u2014 from reconnaissance through privilege escalation to root.<\/p>\n\n\n\n A custom vulnerable machine sandbox for penetration testing practice, with multiple solution paths for each flag. Incorporates audio\/visual steganography, Morse code, PGP encryption, and image metadata exfiltration \u2014 requiring packet analysis, brute-force entry, FTP infiltration, geolocation, wordlist creation, PHP exploitation, SQL injection, and shell establishment to reach root.<\/p>\n\n\n\n A Python cybersecurity acronym quiz to help learners studying for infosec certifications (Security+, A+, CySA+) build quick recall. Fully functional, with planned leaderboard, certification-specific quiz sets, and randomization.<\/p>\n<\/div>\n\n\n\n A wordlist generator built for the “Doomsday Device” CTF scenario. Outputs targeted wordlists for use with brute-force tools like Hydra, Nmap, and Burp Suite.<\/p>\n<\/div>\n\n\n\n A Python network ping\/discovery script similar to netdiscover and arp-scan, with added functionality for host enumeration.<\/p>\n<\/div>\n<\/div>\n\n\n\n Want the technical details? Read the write-ups on my blog<\/a> or reach out<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Hands-on security engineering \u2014 from SIEM deployments and vulnerability research to custom CTF machines and open-source tooling. Microsoft Sentinel SIEM & SOC Lab Aug 2024 \u2013 Present Designed and implemented a Security Information and Event Management (SIEM) platform and Security Operations Center (SOC) using Microsoft Azure and Microsoft Sentinel \u2014 focusing on real-time threat detection, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-31","page","type-page","status-publish","hentry"],"yoast_head":"\nVulnerability Research & Bug Bounty<\/h2>\n\n\n\n
The Office: Doomsday Device \u2014 CTF Walkthrough<\/h2>\n\n\n\n
CTF Vulnerable Machine<\/h2>\n\n\n\n
Open-Source Tools<\/h2>\n\n\n\n
Acronomicon<\/h3>\n\n\n\n
creedGEN<\/h3>\n\n\n\n
cyberPUNKED<\/h3>\n\n\n\n
\n\n\n\n