RomanNum3ral
/
Cybersecurity-Projects
mirror of https://github.com/CarterPerez-dev/Cybersecurity-Projects.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
1,120 Commits 71 Branches 2 Tags 108 MiB
Commit Graph

317 Commits

Author SHA1 Message Date
surya b6af44c1f6 [docs]: reorder detection rules by severity score 
_PATTERN_RULES list had XXE_INJECTION (0.82) after XSS (0.80) and
CRLF_INJECTION (0.65) after PATH_TRAVERSAL (0.60), placing higher-
scored rules below lower-scored ones. Reordered to strict descending
order and updated the module docstring to match. No change to
scoring behavior — score_request() takes max + boost regardless
of list position.
 2026-07-06 18:02:05 +05:30
surya e8124990af [fix]: align pnpm override with lockfile version 
overrides.vite was pinned to npm:rolldown-vite@7.2.5 while
devDependencies and pnpm-lock.yaml both resolved 7.3.1. The mismatch
can produce ERR_PNPM_OUTDATED_LOCKFILE on --frozen-lockfile installs.
Updated override to 7.3.1 to match the resolved version throughout
the lockfile. No lockfile edits required.
 2026-07-06 18:01:34 +05:30
surya b34afd61b9 [refactor]: relocate backend entrypoint outside bind mount 
Moved entrypoint.sh copy target from /app/entrypoint.sh to
/entrypoint.sh in the dev Dockerfile. The dev compose bind mount
./backend:/app overlays /app entirely; placing the entrypoint above
that boundary ensures the image-baked script is never shadowed by
host directory contents. No startup failure was reproduced — this
is a preventive hardening change.
 2026-07-06 18:01:04 +05:30
surya 1709e0cf0a [fix]: preserve pre-encoded payloads in simulator requests 
urllib.parse.quote(path, safe='/?&=') was re-encoding % to %25 in
already-encoded attack paths (XXE, XSS, traversal payloads). Replaced
with a manual first-? split: path component encoded with safe='/%\'
(preserving existing percent sequences and backslash traversal vectors),
query string passed through untouched. Covers all 53 attack payloads
across 7 simulation modes. Inline comments removed from XXE_PAYLOADS
to match the style of all other payload lists.
 2026-07-06 18:00:52 +05:30
surya fd5f6a74f1 [fix]: correct encoded SYSTEM XXE regex matching 
The final branch of _XXE_INJECTION was missing % separators between
hex pairs. Pattern %(?:25)?53(?:25)?59... never matched because after
consuming %53 the next sub-pattern expected 5 or 2, not %. Fixed by
inserting % anchors between each pair so both single-encoded
(%53%59%53%54%45%4D) and double-encoded (%2553%2559...) SYSTEM strings
match correctly. All existing XXE branches are unaffected.
 2026-07-06 18:00:25 +05:30
surya b29476d1d8 [chore]: bump rolldown-vite to 7.3.1 and migrate pnpm overrides to root 2026-07-04 21:36:38 +05:30
surya ae159b3e7a [chore]: copy lockfile and workspace config before pnpm install in Dockerfiles 2026-07-04 21:36:29 +05:30
surya 7f536cb617 [fix]: correct postgres volume mount path to /var/lib/postgresql 2026-07-04 21:36:16 +05:30
surya 614fc12bf2 [feat]: add xxe simulation mode with 5 XXE payload variants 2026-07-04 21:36:12 +05:30
surya a12df57316 [feat]: register XXE_INJECTION detection rule with score 0.82 2026-07-04 21:36:08 +05:30
surya 22c9f66dcf [feat]: add XXE_INJECTION regex pattern to ATTACK_COMBINED 2026-07-04 21:36:03 +05:30
Carter Perez 21741e0906
Merge pull request #286 from CarterPerez-dev/project/ja3-ja4-tls-fingerprinting 
Project/ja3 ja4 tls fingerprinting
 2026-06-18 19:38:51 -04:00
CarterPerez-dev e87efe7e29 i count the tiles every morning. today there's one more. there's always one more. 2026-06-18 19:28:21 -04:00
Carter Perez ddbe7b2387
Merge pull request #281 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/bug-bounty-platform/backend/pyjwt-2.13.0 
chore(deps): bump pyjwt from 2.12.0 to 2.13.0 in /PROJECTS/advanced/bug-bounty-platform/backend
 2026-06-16 10:05:48 -04:00
dependabot[bot] 7bb2319b78
chore(deps): bump pyjwt in /PROJECTS/advanced/api-rate-limiter 
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.12.0 to 2.13.0.
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/jpadilla/pyjwt/compare/2.12.0...2.13.0)

---
updated-dependencies:
- dependency-name: pyjwt
  dependency-version: 2.13.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-16 12:07:25 +00:00
CarterPerez-dev c7e4f7572c feat(hsm-emulator): materialize default key-usage attributes per object class 
materializeDefaults now sets CKA_ENCRYPT/DECRYPT/SIGN/VERIFY/SIGN_RECOVER/VERIFY_RECOVER/WRAP/UNWRAP/DERIVE (plus ALWAYS_AUTHENTICATE for private keys) to CK_FALSE when absent, per CKO_PUBLIC_KEY/PRIVATE_KEY/SECRET_KEY; smoke sets the RSA wrap and recover usage flags.
 2026-06-16 03:07:03 -04:00
dependabot[bot] ba83b180bb
chore(deps): bump pyjwt 
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.12.0 to 2.13.0.
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/jpadilla/pyjwt/compare/2.12.0...2.13.0)

---
updated-dependencies:
- dependency-name: pyjwt
  dependency-version: 2.13.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-16 02:40:51 +00:00
dependabot[bot] 3af80845a1
chore(deps): bump pyarrow 
Bumps [pyarrow](https://github.com/apache/arrow) from 22.0.0 to 23.0.1.
- [Release notes](https://github.com/apache/arrow/releases)
- [Commits](https://github.com/apache/arrow/compare/apache-arrow-22.0.0...apache-arrow-23.0.1)

---
updated-dependencies:
- dependency-name: pyarrow
  dependency-version: 23.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-05 23:50:09 +00:00
Carter Perez 35efe0806d
Update README.md 2026-06-05 13:18:57 -04:00
Carter Perez 48b6d21517
Merge pull request #271 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/bug-bounty-platform/backend/starlette-1.0.1 
chore(deps): bump starlette from 0.50.0 to 1.0.1 in /PROJECTS/advanced/bug-bounty-platform/backend
 2026-06-05 04:32:50 -04:00
Carter Perez e7766c6402
Merge pull request #270 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/encrypted-p2p-chat/backend/starlette-1.0.1 
chore(deps): bump starlette from 0.50.0 to 1.0.1 in /PROJECTS/advanced/encrypted-p2p-chat/backend
 2026-06-05 04:32:30 -04:00
dependabot[bot] 48ed34a3a5
chore(deps): bump starlette in /PROJECTS/advanced/api-rate-limiter 
Bumps [starlette](https://github.com/Kludex/starlette) from 0.52.1 to 1.0.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.52.1...1.0.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-04 17:27:21 +00:00
dependabot[bot] 5071d5f77e
chore(deps): bump starlette 
Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.50.0...1.0.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-04 17:13:30 +00:00
dependabot[bot] b51361c4d4
chore(deps): bump starlette 
Bumps [starlette](https://github.com/Kludex/starlette) from 0.50.0 to 1.0.1.
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/0.50.0...1.0.1)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-04 17:09:29 +00:00
Carter Perez 387346bcb2
Merge pull request #267 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/encrypted-p2p-chat/backend/aiohttp-3.14.0 
chore(deps): bump aiohttp from 3.13.4 to 3.14.0 in /PROJECTS/advanced/encrypted-p2p-chat/backend
 2026-06-03 21:11:52 -04:00
dependabot[bot] f9c1c2c183
chore(deps): bump aiohttp 
---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-03 23:46:31 +00:00
dependabot[bot] 6d3e01c6cf
chore(deps): bump aiohttp 
---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-03 23:42:42 +00:00
Carter Perez 0b6f0479f0
Update README.md 2026-06-02 15:20:45 -04:00
Carter Perez afa663d350
Update README.md 2026-06-02 14:18:11 -04:00
Carter Perez e8fe3c18c1
Update README.md 2026-06-02 08:37:58 -04:00
Carter Perez d57b17004b
Update README.md 2026-06-02 08:32:26 -04:00
Carter Perez 26166998ed
Merge pull request #265 from CarterPerez-dev/project/hsm-emulator 
Project/hsm emulator
 2026-06-02 08:29:01 -04:00
dependabot[bot] d0aa0b0e0b
chore(deps): bump axios 
Bumps [axios](https://github.com/axios/axios) from 1.15.2 to 1.16.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.15.2...v1.16.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-02 12:19:18 +00:00
CarterPerez-dev d03b9a37ad fix(hsm-emulator): install.sh builds and validates the ReleaseSafe artifact 
build_module printed (ReleaseSafe) but ran plain 'zig build', which is Debug here (preferred_optimize_mode only ships ReleaseSafe with --release). It left a 20M Debug .so labeled as the shipped build, and 'zig build smoke' would reinstall Debug over any ReleaseSafe artifact via its install-step dependency.

Run build + test + smoke with --release=safe so the script produces and validates the real 5.9M shipped artifact end to end. Kept check-only (no dependency auto-install): missing deps still hard-fail/warn with the exact apt command.

Verified: ./install.sh exits 0 on a clean tree, final zig-out/lib/libhsm.so is 5.9M ReleaseSafe, tests + smoke pass, pkcs11-tool loads it.
 2026-06-02 08:01:48 -04:00
CarterPerez-dev 53fd886ed8 docs(hsm-emulator): M12 learn track + README flip 
learn/: add 00-OVERVIEW, 01-CONCEPTS, 02-ARCHITECTURE, 03-IMPLEMENTATION, 04-CHALLENGES, and MECHANICS (the byte-by-byte crypto deep-dive). CONFORMANCE shipped in M11. Real-breach grounding, function/file code refs (no line numbers), no AI voice.

Project README: flip M0-stale to real M0-M11 (21 mechanisms, std.Io.randomSecure, roadmap done through M12, learn/ link table).

Root README: graduate HSM to a completed project (Full Source Code 32->33, C badge -> Zig, title + footer now link to source and learn/).

Verified docs-only: zig build test and zig build smoke both exit 0, smoke mechanisms=21, objdump -T shows only C_GetFunctionList. No source changed.
 2026-06-02 07:28:08 -04:00
dependabot[bot] 86128cd1a1
chore(deps-dev): bump vitest 
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 2.1.9 to 4.1.0.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 4.1.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-02 11:15:51 +00:00
CarterPerez-dev f70ca3f32c feat(hsm-emulator): M10 crypto-surface, M11 conformance, deep-audit hardening 
M10 (crypto-surface): RUP-safe buffered AES-GCM streaming (16 MiB cap),
DigestEncrypt/SignEncrypt/DecryptDigest/DecryptVerify dual functions
(decrypt-side CBC-only), RSA C_SignRecover/C_VerifyRecover (CKM_RSA_PKCS),
digest-only Get/SetOperationState.

M11 (conformance): spec-correct C_WaitForSlotEvent (DONT_BLOCK->CKR_NO_EVENT,
blocking->FUNCTION_NOT_SUPPORTED, pReserved->ARGUMENTS_BAD) + CKF_DONT_BLOCK;
public learn/CONFORMANCE.md documenting every deliberate N/A with its OASIS
v2.40 section and exact return code.

Deep project audit (5 read-only dimension agents, 0 Critical/High):
- fix: C_Finalize-vs-fast-path use-after-free race -- replace lockless
  state.current() with state.acquire() (lock + verify-live atomically)
  across all ~57 entry points
- fix: enforce CKR_PIN_LEN_RANGE on the new PIN in InitToken/InitPIN/SetPIN
- fix: clear a stale sealed flag on Object.set replace (login-unseal wedge)
- harden: zeroize CBC plaintext stack temporaries; Debug leak-assert at
  C_Finalize turns smoke into an API-layer leak gate
- test: ABI layout-check PSS/OAEP param structs; +sealed-flag regression

Proven: 76/76 unit (Debug + ReleaseSafe), in-process smoke (with PIN-length
asserts), cross-process pkcs11-tool (init/pin/RSA keygen+sign/wrong-pin).
.so exports only C_GetFunctionList.
 2026-06-02 06:48:25 -04:00
CarterPerez-dev 0b8f8df8a3 feat(hsm-emulator): M9 key management — wrap/unwrap, derive, digest-key 
- C_WrapKey/C_UnwrapKey: CKM_AES_KEY_WRAP (RFC 3394) + CKM_RSA_PKCS_OAEP, secret keys only
- new AES-KEY-WRAP primitive in cipher.zig (RFC 3394 KAT-verified, fail-closed, zeroized temps)
- C_DeriveKey: factor shared secret-key-object builder; accept raw SEC1 or DER peer point
- C_DigestKey: secret-key class + sealed-guard (CKR_KEY_INDIGESTIBLE / CKR_USER_NOT_LOGGED_IN)
- advertise CKM_ECDH1_DERIVE + CKM_AES_KEY_WRAP; add WRAP/UNWRAP to RSA-PKCS-OAEP
- 9 OASIS-exact CKR_* wrap/unwrap/digest error codes
- 70/70 tests; proven via in-process smoke + cross-process pkcs11-tool (OpenSSL + RFC 3394 oracles)
 2026-06-01 23:03:53 -04:00
CarterPerez-dev ccb1b40a15 feat(hsm-emulator): PKCS#11 HSM emulator in Zig (M0–M7) 
Software HSM that compiles to a real Cryptoki (PKCS#11) v2.40 shared
object, loadable by pkcs11-tool / OpenSSL like a smartcard. SoftHSM2-style
three-layer split: C-ABI facade -> typed core state -> crypto + persistence.

- M0  hand-written v2.40 ABI + build-time OASIS cross-check; exports only C_GetFunctionList
- M1  sessions, login, Argon2id PIN, lockout
- M2  objects + find, CKA_PRIVATE gating, persisted token store
- M3  RNG, SHA-2 digest, HMAC, AES-CBC/CBC-PAD/GCM
- M4  ECDSA P-256/P-384 keygen + sign/verify (std.crypto)
- M5  RSA 2048-4096 via libcrypto: PKCS#1 v1.5 / PSS sign-verify, PKCS#1 / OAEP enc-dec
- M6  encrypted-at-rest store: selective AES-256-GCM envelope, master key wrapped under Argon2id(User-PIN)
- M7  hardening (session-secret zeroization, fail-closed relock, heap-leak scrub, ubsan-free ABI) + Docker

Verified three ways: 65/65 unit tests, in-process dlopen smoke, and
cross-process OpenSC pkcs11-tool (token keys survive process restart).

Also excludes vendor/pkcs11 from the trailing-whitespace / end-of-file
pre-commit hooks so the vendored OASIS headers keep their documented
SHA-256 provenance.
 2026-06-01 20:35:48 -04:00
dependabot[bot] 49b47185bd
chore(deps): bump axios 
Bumps [axios](https://github.com/axios/axios) from 1.15.2 to 1.16.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.15.2...v1.16.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-01 16:48:39 +00:00
Carter Perez 789d4ebd82
Merge pull request #260 from CarterPerez-dev/dependabot/npm_and_yarn/PROJECTS/advanced/ai-threat-detection/frontend/axios-1.16.0 
chore(deps): bump axios from 1.15.2 to 1.16.0 in /PROJECTS/advanced/ai-threat-detection/frontend
 2026-06-01 12:46:33 -04:00
dependabot[bot] 3a2fb4af85
chore(deps): bump axios in /PROJECTS/advanced/honeypot-network/frontend 
Bumps [axios](https://github.com/axios/axios) from 1.15.2 to 1.16.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.15.2...v1.16.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-29 16:32:54 +00:00
dependabot[bot] a455b78639
chore(deps): bump axios 
Bumps [axios](https://github.com/axios/axios) from 1.15.2 to 1.16.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.15.2...v1.16.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-29 16:31:21 +00:00
Carter Perez 163d126655
Merge pull request #256 from CarterPerez-dev/chore/add-linting-to-yml-and-pre-commit 
Chore/add linting to yml and pre commit
 2026-05-23 06:43:38 -04:00
CarterPerez-dev 0006ddad3d cracked 2026-05-23 05:01:01 -04:00
Carter Perez ac9ed2c0d4
Merge pull request #247 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/ai-threat-detection/backend/idna-3.15 
chore(deps): bump idna from 3.11 to 3.15 in /PROJECTS/advanced/ai-threat-detection/backend
 2026-05-22 14:18:49 -04:00
Carter Perez 2aa8efeb85
Merge pull request #248 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/api-rate-limiter/idna-3.15 
chore(deps): bump idna from 3.11 to 3.15 in /PROJECTS/advanced/api-rate-limiter
 2026-05-22 14:18:36 -04:00
Carter Perez bab3440788
Merge pull request #250 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/bug-bounty-platform/backend/idna-3.15 
chore(deps): bump idna from 3.11 to 3.15 in /PROJECTS/advanced/bug-bounty-platform/backend
 2026-05-22 14:18:22 -04:00
Carter Perez 46231c15ed
Merge pull request #252 from CarterPerez-dev/dependabot/uv/PROJECTS/advanced/encrypted-p2p-chat/backend/idna-3.15 
chore(deps): bump idna from 3.11 to 3.15 in /PROJECTS/advanced/encrypted-p2p-chat/backend
 2026-05-22 10:13:38 -04:00
dependabot[bot] 3474d7711b
chore(deps): bump mlflow 
Bumps [mlflow](https://github.com/mlflow/mlflow) from 3.9.0 to 3.11.1.
- [Release notes](https://github.com/mlflow/mlflow/releases)
- [Changelog](https://github.com/mlflow/mlflow/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mlflow/mlflow/compare/v3.9.0...v3.11.1)

---
updated-dependencies:
- dependency-name: mlflow
  dependency-version: 3.11.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-21 20:33:21 +00:00