Cybersecurity Projects 🐉
67 Cybersecurity Projects, Certification Roadmaps & Resources
Made possible by CertGames
View Complete Projects:
Currently building: project #24
---
## Quick Navigation
### [Projects](#projects)
67 hands-on cybersecurity projects with full source code, from beginner to advanced level.
### [Certification Roadmaps](./ROADMAPS/README.md)
10 structured career paths with certification guides for SOC Analyst, Pentester, Security Engineer, and more.
### [Learning Resources](./RESOURCES/README.md)
Tools, courses, certifications, communities, and frameworks for cybersecurity professionals.
---
# Projects
## Beginner Projects
| Project | Info | What You'll Learn |
|---------|------|-------------------|
| **[Simple Port Scanner](./PROJECTS/beginner/simple-port-scanner)**
Async TCP port scanner in C++ [@deniskhud](https://github.com/deniskhud) |    | TCP socket programming • Async I/O patterns • Service detection
[Source Code](./PROJECTS/beginner/simple-port-scanner) \| [Docs](./PROJECTS/beginner/simple-port-scanner/learn) |
| **[Keylogger](./PROJECTS/beginner/keylogger)**
Capture keyboard events with timestamps |    | Event handling • File I/O • Ethical considerations
[Source Code](./PROJECTS/beginner/keylogger) \| [Docs](./PROJECTS/beginner/keylogger/learn) |
| **[Caesar Cipher](./PROJECTS/beginner/caesar-cipher)**
CLI encryption/decryption tool |    | Classical cryptography • Brute force attacks • CLI design
[Source Code](./PROJECTS/beginner/caesar-cipher) \| [Docs](./PROJECTS/beginner/caesar-cipher/learn) |
| **[DNS Lookup CLI Tool](./PROJECTS/beginner/dns-lookup)**
Query DNS records with WHOIS |    | DNS protocols • WHOIS queries • Reverse DNS lookup
[Source Code](./PROJECTS/beginner/dns-lookup) \| [Docs](./PROJECTS/beginner/dns-lookup/learn) |
| **[Simple Vulnerability Scanner](./PROJECTS/beginner/simple-vulnerability-scanner)**
Check software against CVE databases |    | CVE databases • Dependency scanning • Vulnerability assessment
[Source Code](./PROJECTS/beginner/simple-vulnerability-scanner) \| [Docs](./PROJECTS/beginner/simple-vulnerability-scanner/learn) |
| **[Metadata Scrubber Tool](./PROJECTS/beginner/metadata-scrubber-tool)**
Remove EXIF and privacy metadata [@Heritage-XioN](https://github.com/Heritage-XioN) |    | EXIF data • Privacy protection • Batch processing
[Source Code](./PROJECTS/beginner/metadata-scrubber-tool) \| [Docs](./PROJECTS/beginner/metadata-scrubber-tool/learn) |
| **[Network Traffic Analyzer](./PROJECTS/beginner/network-traffic-analyzer)**
Capture and analyze packets |     | Packet capture • Protocol analysis • Traffic visualization
[Source (C++)](./PROJECTS/beginner/network-traffic-analyzer/cpp) \| [Docs (C++)](./PROJECTS/beginner/network-traffic-analyzer/cpp/learn) \| [Source (Python)](./PROJECTS/beginner/network-traffic-analyzer/python) \| [Docs (Python)](./PROJECTS/beginner/network-traffic-analyzer/python/learn) |
| **[Hash Cracker](./PROJECTS/beginner/hash-cracker)**
Dictionary and brute-force cracking |    | Hash algorithms • Dictionary attacks • Password security
[Source Code](./PROJECTS/beginner/hash-cracker) \| [Docs](./PROJECTS/beginner/hash-cracker/learn) |
| **[Steganography Multi-Tool](./SYNOPSES/beginner/Steganography.Multi.Tool.md)**
Hide data in images, audio, QR, PDFs, text |    | Multi-format steganography • Zero-width Unicode • Audio LSB • QR exploitation
[Learn More](./SYNOPSES/beginner/Steganography.Multi.Tool.md) |
| **[Ghost on the Wire](./SYNOPSES/beginner/Ghost.On.The.Wire.md)**
L2 attack & defense: MAC spoofing + ARP detection |    | ARP protocol • MAC spoofing • MITM detection • L2 trust mapping
[Learn More](./SYNOPSES/beginner/Ghost.On.The.Wire.md) |
| **[Canary Token Generator](./SYNOPSES/beginner/Canary.Token.Generator.md)**
Self-hosted honeytokens that alert on access |    | Deception defense • Honeytokens • Webhook alerting • Intrusion detection
[Learn More](./SYNOPSES/beginner/Canary.Token.Generator.md) |
| **[Security News Scraper](./SYNOPSES/beginner/Security.News.Scraper.md)**
Aggregate cybersecurity news |    | Web scraping • CVE parsing • Database storage
[Learn More](./SYNOPSES/beginner/Security.News.Scraper.md) |
| **[Phishing Domain Generator & Quishing Scanner](./SYNOPSES/beginner/Phishing.Domain.Generator.And.Quishing.Scanner.md)**
Typosquat generation + QR phishing detection |    | Homoglyph attacks • Typosquatting • QR code analysis • Domain intelligence
[Learn More](./SYNOPSES/beginner/Phishing.Domain.Generator.And.Quishing.Scanner.md) |
| **[SSH Brute Force Detector](./SYNOPSES/beginner/SSH.Brute.Force.Detector.md)**
Monitor and block SSH attacks |    | Log parsing • Attack detection • Firewall automation
[Learn More](./SYNOPSES/beginner/SSH.Brute.Force.Detector.md) |
| **[Simple C2 Beacon](./PROJECTS/beginner/c2-beacon)**
Command and Control beacon/server |      | C2 architecture • MITRE ATT&CK • WebSocket protocol • XOR encoding
[Source Code](./PROJECTS/beginner/c2-beacon) \| [Docs](./PROJECTS/beginner/c2-beacon/learn) |
| **[Base64 Encoder/Decoder](./SYNOPSES/beginner/Base64.Encoder.Decoder.md)**
Multi-format encoding tool |    | Base64/32 encoding • URL encoding • Auto-detection
[Source Code](./PROJECTS/beginner/base64-tool) \| [Docs](./PROJECTS/beginner/base64-tool/learn) |
| **[Linux CIS Hardening Auditor](./SYNOPSES/beginner/Linux.CIS.Hardening.Auditor.md)**
CIS benchmark compliance checker |    | CIS benchmarks • System hardening • Compliance scoring • Shell scripting
[Learn More](./SYNOPSES/beginner/Linux.CIS.Hardening.Auditor.md) |
| **[Systemd Persistence Scanner](./SYNOPSES/beginner/Systemd.Persistence.Scanner.md)**
Hunt Linux persistence mechanisms |    | Persistence techniques • Systemd internals • Cron analysis • Threat hunting
[Learn More](./SYNOPSES/beginner/Systemd.Persistence.Scanner.md) |
| **[Linux eBPF Security Tracer](./PROJECTS/beginner/linux-ebpf-security-tracer)**
Real-time syscall tracing with eBPF |     | eBPF programs • Syscall tracing • BCC framework • Security observability
[Source Code](./PROJECTS/beginner/linux-ebpf-security-tracer) \| [Docs](./PROJECTS/beginner/linux-ebpf-security-tracer/learn) |
| **[Trojan Application Builder](./SYNOPSES/beginner/Trojan.Application.Builder.md)**
Educational malware lifecycle demo |    | Trojan anatomy • Data exfiltration • File encryption • Attack lifecycle
[Learn More](./SYNOPSES/beginner/Trojan.Application.Builder.md) |
| **[DNS Sinkhole](./SYNOPSES/beginner/DNS.Sinkhole.md)**
Pi-hole-style malware domain blocker |    | DNS protocol • Blocklist management • Query logging • Network defense
[Learn More](./SYNOPSES/beginner/DNS.Sinkhole.md) |
| **[Firewall Rule Engine](./PROJECTS/beginner/firewall-rule-engine)**
Parse and validate iptables/nftables rules |    | Firewall internals • Rule parsing • iptables/nftables • V language
[Source Code](./PROJECTS/beginner/firewall-rule-engine) \| [Docs](./PROJECTS/beginner/firewall-rule-engine/learn) |
| **[LLM Prompt Injection Firewall](./SYNOPSES/beginner/LLM.Prompt.Injection.Firewall.md)**
Detect and block prompt injection attacks |    | AI security • Prompt injection • Input sanitization • LLM defense
[Learn More](./SYNOPSES/beginner/LLM.Prompt.Injection.Firewall.md) |
## Intermediate Projects
| Project | Info | What You'll Learn |
|---------|------|-------------------|
| **[Payload Obfuscation Engine](./SYNOPSES/intermediate/Payload.Obfuscation.Engine.md)**
Multi-layer payload obfuscation toolkit |    | Obfuscation techniques • Polymorphism • AV evasion • Signature detection
[Learn More](./SYNOPSES/intermediate/Payload.Obfuscation.Engine.md) |
| **[SIEM Dashboard](./SYNOPSES/intermediate/SIEM.Dashboard.md)**
Log aggregation with correlation |     | SIEM concepts • Log correlation • Full-stack development
[Source Code](./PROJECTS/intermediate/siem-dashboard) \| [Docs](./PROJECTS/intermediate/siem-dashboard/learn) |
| **[Token Abuse Playground](./SYNOPSES/intermediate/Token.Abuse.Playground.md)**
15+ token vulnerabilities to exploit and fix |     | JWT exploitation • OAuth attacks • Session security • Token forensics
[Learn More](./SYNOPSES/intermediate/Token.Abuse.Playground.md) |
| **[Supply Chain Attack Simulator](./SYNOPSES/intermediate/Supply.Chain.Attack.Simulator.md)**
Fake PyPI package dependency confusion demo |    | Supply chain attacks • Dependency confusion • Package security • PyPI internals
[Learn More](./SYNOPSES/intermediate/Supply.Chain.Attack.Simulator.md) |
| **[DDoS Mitigation Tool](./SYNOPSES/intermediate/DDoS.Mitigation.Tool.md)**
Detect traffic spikes |    | DDoS detection • Rate limiting • Anomaly detection
[Learn More](./SYNOPSES/intermediate/DDoS.Mitigation.Tool.md) |
| **[Secrets Scanner](./PROJECTS/intermediate/secrets-scanner)**
Scan codebases and git history for leaked secrets |    | Secret detection • Shannon entropy • HIBP k-anonymity • SARIF output
[Source Code](./PROJECTS/intermediate/secrets-scanner) \| [Docs](./PROJECTS/intermediate/secrets-scanner/learn) |
| **[API Security Scanner](./PROJECTS/intermediate/api-security-scanner)**
Enterprise API vulnerability scanner |      | OWASP API Top 10 • ML fuzzing • GraphQL/SOAP testing
[Source Code](./PROJECTS/intermediate/api-security-scanner) \| [Docs](./PROJECTS/intermediate/api-security-scanner/learn) |
| **[Wireless Deauth Detector](./SYNOPSES/intermediate/Wireless.Deauth.Detector.md)**
Monitor WiFi deauth attacks |    | Wireless security • Packet sniffing • Attack detection
[Learn More](./SYNOPSES/intermediate/Wireless.Deauth.Detector.md) |
| **[Credential Enumeration](./PROJECTS/intermediate/credential-enumeration)**
Post-exploitation credential collection |    | Credential extraction • Browser forensics • Red team tooling • Nim language
[Source Code](./PROJECTS/intermediate/credential-enumeration) \| [Docs](./PROJECTS/intermediate/credential-enumeration/learn) |
| **[Binary Analysis Tool](./PROJECTS/intermediate/binary-analysis-tool)**
Disassemble and analyze executables |    | Binary analysis • String extraction • Malware detection
[Source Code](./PROJECTS/intermediate/binary-analysis-tool) \| [Docs](./PROJECTS/intermediate/binary-analysis-tool/learn) |
| **[Chaos Engineering Security Tool](./SYNOPSES/intermediate/Chaos.Engineering.Security.Tool.md)**
Inject security failures to test resilience |    | Chaos engineering • Security resilience • Credential spraying • Auth testing
[Learn More](./SYNOPSES/intermediate/Chaos.Engineering.Security.Tool.md) |
| **[Credential Rotation Enforcer](./SYNOPSES/intermediate/Credential.Rotation.Enforcer.md)**
Track and enforce credential rotation policies |    | Credential hygiene • Secret rotation • Compliance dashboards • API integration
[Learn More](./SYNOPSES/intermediate/Credential.Rotation.Enforcer.md) |
| **[Race Condition Exploiter](./SYNOPSES/intermediate/Race.Condition.Exploiter.md)**
TOCTOU race condition attack & defense lab |     | TOCTOU attacks • Double-spend bugs • Concurrent exploitation • Race visualization
[Learn More](./SYNOPSES/intermediate/Race.Condition.Exploiter.md) |
| **[Self-Hosted Shodan Clone](./SYNOPSES/intermediate/Self.Hosted.Shodan.Clone.md)**
Internet-connected device search engine |     | Service fingerprinting • Network scanning • OSINT • Search engine design
[Learn More](./SYNOPSES/intermediate/Self.Hosted.Shodan.Clone.md) |
| **[JA3/JA4 TLS Fingerprinting Tool](./SYNOPSES/intermediate/JA3.JA4.TLS.Fingerprinting.Tool.md)**
Fingerprint TLS clients by handshake |    | TLS handshake analysis • JA3/JA4 hashing • Bot detection • Malware C2 identification
[Learn More](./SYNOPSES/intermediate/JA3.JA4.TLS.Fingerprinting.Tool.md) |
| **[Mobile App Security Analyzer](./SYNOPSES/intermediate/Mobile.App.Security.Analyzer.md)**
Decompile and analyze mobile apps |    | APK/IPA analysis • Reverse engineering • OWASP Mobile
[Learn More](./SYNOPSES/intermediate/Mobile.App.Security.Analyzer.md) |
| **[DLP Scanner](./PROJECTS/intermediate/dlp-scanner)**
Data Loss Prevention for files, DBs, and traffic |    | PII detection • GDPR/HIPAA compliance • Pattern matching • Data classification
[Source Code](./PROJECTS/intermediate/dlp-scanner) \| [Docs](./PROJECTS/intermediate/dlp-scanner/learn) |
| **[Lua/Nginx Edge Backend](./SYNOPSES/intermediate/Lua.Nginx.Edge.Backend.md)**
Full CRUD backend via Lua in Nginx |     | Edge computing • OpenResty • Lua scripting • WAF • JWT at the edge
[Learn More](./SYNOPSES/intermediate/Lua.Nginx.Edge.Backend.md) |
| **[Privesc Playground](./SYNOPSES/intermediate/Privesc.Playground.md)**
20+ privilege escalation paths to exploit |    | SUID exploitation • Sudo abuse • Cron hijacking • GTFOBins • Capability abuse
[Learn More](./SYNOPSES/intermediate/Privesc.Playground.md) |
| **[SBOM Generator & Vulnerability Matcher](./SYNOPSES/intermediate/SBOM.Generator.md)**
Software Bill of Materials with CVE matching |    | SPDX/CycloneDX formats • Dependency analysis • CVE databases • EO 14028 compliance
[Learn More](./SYNOPSES/intermediate/SBOM.Generator.md) |
| **[Subdomain Takeover Scanner](./SYNOPSES/intermediate/Subdomain.Takeover.Scanner.md)**
Detect dangling DNS records |    | DNS enumeration • CNAME analysis • Cloud resource claiming • Bug bounty
[Learn More](./SYNOPSES/intermediate/Subdomain.Takeover.Scanner.md) |
| **[GraphQL Security Tester](./SYNOPSES/intermediate/GraphQL.Security.Tester.md)**
Automated GraphQL vulnerability testing |    | Introspection attacks • Query depth DoS • Authorization bypass • Batching abuse
[Learn More](./SYNOPSES/intermediate/GraphQL.Security.Tester.md) |
| **[Docker Security Audit](./PROJECTS/intermediate/docker-security-audit)**
CIS Docker Benchmark scanner |     | CIS benchmarks • Container security • Multiple output formats
[Source Code](./PROJECTS/intermediate/docker-security-audit) \| [Docs](./PROJECTS/intermediate/docker-security-audit/learn) |
## Advanced Projects
| Project | Info | What You'll Learn |
|---------|------|-------------------|
| **[API Rate Limiter](./PROJECTS/advanced/api-rate-limiter)**
Distributed rate limiting middleware |     | Token bucket algorithm • Distributed systems • Redis backend
[Source Code](./PROJECTS/advanced/api-rate-limiter) \| [Docs](./PROJECTS/advanced/api-rate-limiter/learn) |
| **[Encrypted Chat Application](./PROJECTS/advanced/encrypted-p2p-chat)**
Real-time E2EE messaging |      | Signal Protocol • Double Ratchet • WebAuthn • WebSockets
[Source Code](./PROJECTS/advanced/encrypted-p2p-chat) \| [Docs](./PROJECTS/advanced/encrypted-p2p-chat/learn) |
| **[Exploit Development Framework](./SYNOPSES/advanced/Exploit.Development.Framework.md)**
Modular exploitation framework |    | Exploit development • Payload generation • Plugin architecture
[Learn More](./SYNOPSES/advanced/Exploit.Development.Framework.md) |
| **[AI Threat Detection](./PROJECTS/advanced/ai-threat-detection)**
ML-powered nginx threat detection |      | ML ensemble (AE + RF + IF) • ONNX inference • Real-time detection
[Source Code](./PROJECTS/advanced/ai-threat-detection) |
| **[Bug Bounty Platform](./PROJECTS/advanced/bug-bounty-platform)**
Full vulnerability disclosure platform |      | Full-stack development • CVSS scoring • Workflow automation
[Source Code](./PROJECTS/advanced/bug-bounty-platform) \| [Docs](./PROJECTS/advanced/bug-bounty-platform/learn) |
| **[Cloud Security Compliance Dashboard](./SYNOPSES/advanced/Cloud.Security.Compliance.Dashboard.md)**
Multi-cloud compliance with CIS, SOC2, HIPAA |      | CIS benchmarks • SOC2/HIPAA compliance • Cost-security optimization • Drift detection
[Learn More](./SYNOPSES/advanced/Cloud.Security.Compliance.Dashboard.md) |
| **[Malware Analysis Platform](./SYNOPSES/advanced/Malware.Analysis.Platform.md)**
Automated sandbox analysis |     | Malware analysis • Sandboxing • YARA rules • IOC extraction
[Learn More](./SYNOPSES/advanced/Malware.Analysis.Platform.md) |
| **[Quantum Resistant Encryption](./SYNOPSES/advanced/Quantum.Resistant.Encryption.md)**
Post-quantum cryptography |    | Post-quantum algorithms • Hybrid encryption • Kyber/Dilithium
[Learn More](./SYNOPSES/advanced/Quantum.Resistant.Encryption.md) |
| **[Zero Day Vulnerability Scanner](./SYNOPSES/advanced/Zero.Day.Vulnerability.Scanner.md)**
Coverage-guided fuzzing |     | Fuzzing • Vulnerability research • Crash triage
[Learn More](./SYNOPSES/advanced/Zero.Day.Vulnerability.Scanner.md) |
| **[Distributed Password Cracker](./SYNOPSES/advanced/Distributed.Password.Cracker.md)**
GPU-accelerated cracking |     | Distributed systems • GPU computing • Hash cracking
[Learn More](./SYNOPSES/advanced/Distributed.Password.Cracker.md) |
| **[Kernel Rootkit Detection](./SYNOPSES/advanced/Kernel.Rootkit.Detection.md)**
Detect kernel-level rootkits |    | Kernel internals • Memory forensics • Rootkit detection
[Learn More](./SYNOPSES/advanced/Kernel.Rootkit.Detection.md) |
| **[Blockchain Smart Contract Auditor](./SYNOPSES/advanced/Blockchain.Smart.Contract.Auditor.md)**
Solidity vulnerability analysis |     | Smart contracts • Static analysis • Solidity security
[Learn More](./SYNOPSES/advanced/Blockchain.Smart.Contract.Auditor.md) |
| **[Adversarial ML Attacker](./SYNOPSES/advanced/Adversarial.ML.Attacker.md)**
Generate adversarial examples |     | Adversarial ML • FGSM/DeepFool • Model robustness
[Learn More](./SYNOPSES/advanced/Adversarial.ML.Attacker.md) |
| **[Advanced Persistent Threat Simulator](./SYNOPSES/advanced/Advanced.Persistent.Threat.Simulator.md)**
Multi-stage APT simulation |    | APT techniques • C2 infrastructure • Lateral movement
[Learn More](./SYNOPSES/advanced/Advanced.Persistent.Threat.Simulator.md) |
| **[Hardware Security Module Emulator](./SYNOPSES/advanced/Hardware.Security.Module.Emulator.md)**
Software HSM with PKCS#11 |    | HSM concepts • PKCS#11 interface • Cryptographic operations
[Learn More](./SYNOPSES/advanced/Hardware.Security.Module.Emulator.md) |
| **[Network Covert Channel](./SYNOPSES/advanced/Network.Covert.Channel.md)**
Data exfiltration techniques |    | Covert channels • Data exfiltration • Steganography
[Learn More](./SYNOPSES/advanced/Network.Covert.Channel.md) |
| **[Automated Penetration Testing](./SYNOPSES/advanced/Automated.Penetration.Testing.md)**
Full pentest automation |    | Pentest automation • Recon to exploitation • Report generation
[Learn More](./SYNOPSES/advanced/Automated.Penetration.Testing.md) |
| **[Haskell Reverse Proxy](./PROJECTS/advanced/haskell-reverse-proxy)**
Functional reverse proxy with security middleware |    | Functional programming • Reverse proxy design • Security middleware • Haskell
[Source Code](./PROJECTS/advanced/haskell-reverse-proxy) |
| **["Monitor the Situation" Dashboard](./SYNOPSES/advanced/Monitor.The.Situation.Dashboard.md)**
Real-time cyber threat situational awareness |     | Threat intelligence • CVE tracking • MITRE ATT&CK • OSINT • Real-time dashboards
[Learn More](./SYNOPSES/advanced/Monitor.The.Situation.Dashboard.md) |
| **[Honeypot Network](./SYNOPSES/advanced/Honeypot.Network.md)**
Multi-service honeypot deployment & analysis |    | Honeypot deployment • Attacker behavior analysis • IOC extraction • MITRE mapping
[Learn More](./SYNOPSES/advanced/Honeypot.Network.md) |
| **[Supply Chain Security Analyzer](./SYNOPSES/advanced/Supply.Chain.Security.Analyzer.md)**
Dependency vulnerability analysis |    | Supply chain security • Dependency analysis • Malicious packages
[Learn More](./SYNOPSES/advanced/Supply.Chain.Security.Analyzer.md) |
---
## Learn More
**[Certification Roadmaps](./ROADMAPS/README.md)** - Career paths for SOC Analyst, Pentester, Security Engineer, GRC Analyst, and 6 more tracks
**[Learning Resources](./RESOURCES/README.md)** - Tools, courses, certifications, YouTube channels, Reddit communities, and security frameworks
## License
AGPL 3.0
