Building 70 Projects ranging from beginner to advanced so anyone can — learn from, build upon, use as a reference, or even copy directly. Gamified Cybersecurity learning 👇

Go to file

CarterPerez-dev 47907a3eb4 chore(canary-phase8): mysql fake TCP server complete — generator set CLOSED Phase 8 ships the SEVENTH AND FINAL generator. All 7 token types (webbug, slowredirect, docx, pdf, kubeconfig, envfile, mysql) are now registered; the canary token-type set is closed. Phases 9-18 are service/handler/wire-up/notification/manage-page/admin/geoip/frontend work — no more generators. mysql is the only non-HTTP generator: the trigger fires when an attacker tries to authenticate against our fake MySQL server using the canary-issued connection string. We accept the TCP connection, write a real-looking HandshakeV10 packet (5.7.40-canary banner + mysql_native_password auth plugin + valid capability mask), read the client's HandshakeResponse41, extract the username (which is "canary_"+token.ID per spec §9.7 line 1341), look up the token by stripping the prefix, record an event with the kubectl-equivalent forensic fields (mysql_username + mysql_client_capabilities formatted as 0x%08x + mysql_client_charset), and respond with the canonical ERR_Packet 1045 "Access denied" message before closing. To the attacker the response is byte-indistinguishable from a real MySQL server rejecting bad credentials. Implementation commits in this phase: - `712202ab` feat(canary): mysql wire protocol (handshake + auth + ERR packets) - `4d4d4951` feat(canary): mysql server + connection handler - `fe80c94a` feat(canary): mysql generator + register in registry Deliverables: - protocol.go: byte-exact HandshakeV10 builder per spec §9.7 lines 1366-1379 (3-byte LE length + seq id, protocol version 0x0a, "5.7.40-canary\x00", random conn id, 8+12 split auth-plugin-data, capability flags 0xf7ff/0x81ff, charset 0x21, status 0x0002, auth-plugin-data length 0x15, mysql_native_password); ClientAuth parser for HandshakeResponse41; BuildAccessDeniedErr ERR_Packet with code 1045 + SQL state 28000; crypto/rand-backed NewRandomAuthData (20 bytes) + NewRandomConnectionID (uint32); error sentinels (ErrShortPacket, ErrPacketTooLarge, ErrInvalidPayload, ErrUsernameMissing, ErrHTTPTriggerNotSupported) - handler.go: HandleConnection per spec §9.7 lines 1410-1442 — 10-second deadline, handshake-first, defense-in-depth silent drops for non-canary username / unknown token / lookup error / nil recorder; TokenLookup + EventRecorder interfaces decouple from Phase 9/10 services - server.go: ctx-aware net.ListenConfig listener, per-connection goroutines drained via WaitGroup on shutdown, net.ErrClosed silenced during graceful close - generator.go: New() + NewWithAddress(host, port); Generate writes mysql:// connection string and persists mysql_username into t.Metadata via setMySQLUsername (map[string]json.RawMessage merge — sanctioned deviation from spec §9.7 line 1343's map[string]any indexing because real Token.Metadata is json.RawMessage); Trigger returns ErrHTTPTriggerNotSupported (TCP-only, no HTTP route) - Registry expanded 6 → 7; TestBuild_AllSevenGeneratorsRegistered closes the cardinality-test sequence (no more "pending types" list — the set is complete) ~115 test cases added across 4 test files: - protocol_test.go (~24): byte-exact packet header re-decode, LE conn-id round-trip, 5-username Build/Read round-trip, error paths (short, missing terminator, empty reader, oversize), randomness distinctness for both crypto/rand helpers - handler_test.go (~10): real socket pairs (net.Listen + Dial), handshake-first assertion, non-canary username silent drop, full known-token flow with ERR packet + event Extra capture, unknown token silent, lookup error silent, nil EventRecorder tolerated, bad auth packet silent - server_test.go (~5): nil handler rejection, real-dial dispatch, 10 concurrent connections, ctx cancellation graceful shutdown, invalid address rejection - generator_test.go (~11): Type, KindConnectionString, default + custom address, canary_ prefix invariant, metadata persistence on empty token, existing-fields preservation (non-string field round-trips), malformed-metadata recovery, stale-username overwrite, baseURL irrelevance, Trigger sentinel error path (happy + nil token) Audit outcome (2 agents in parallel per standing pattern): - superpowers:code-reviewer: PASS-WITH-NITS (0 BLOCKER, 0 SHOULD-FIX, 8 NITs all explicitly marked "not worth fixing" / "leave as-is" / "theoretical, never happens") - general-purpose spec-adherence vs §9.7 + sanctioned deviations: PASS (0 BLOCKER, 0 SHOULD-FIX, 0 NITs — confirmed both sanctioned deviations matched the slowredirect/envfile metadata pattern and the TCP-only Trigger shape) No audit-fix commit this phase. Matching Phase 5 / Phase 7 pattern (Phase 6 was the only phase to require an audit-fix commit before rollup). DEFERRED TO PHASE 9 (sanctioned per handoff anti-relitigation): - Task 8.5: wire `go mysql.Run(ctx, addr, handler)` into cmd/canary/main.go via cfg.MySQL.Enabled + cfg.MySQL.Addr. Requires config.Config.MySQL field which lands in Phase 9 alongside config.Config.Canary.BaseURL. Wiring it in Phase 8 would require partial config additions Phase 9 then re-touches. - Task 8.6: manual `mysql -h ... -u canary_<id> -ptest internal_db` smoke test. Operator-deferred per standing rule. Pre-rollup acceptance gate clean at HEAD fe80c94a: - go build ./... + go vet ./... clean - go test -race -timeout=60s ./... all packages pass - go test -tags=integration -race -timeout=300s ./internal/token/... ./internal/event/... pass - golangci-lint run ./... → 0 issues. - grep -rn "//nolint" --include=".go" returns nothing - BACKLOG.md open section still _(none)_ - go.mod surface unchanged (no new deps for the entire phase) # GENERATOR SET CLOSED webbug (Phase 2) — /c/{id} GIF, simplest case slowredirect (Phase 3) — HTML page + fingerprint endpoint docx (Phase 4) — zip-patched OOXML INCLUDEPICTURE pdf (Phase 5) — byte-replace fixed-width URI action kubeconfig (Phase 6) — YAML + fake K8s /k/{id}/ handler envfile (Phase 7) — shuffled bait + INTERNAL_METRICS_ENDPOINT mysql (Phase 8) — TCP wire protocol + ERR_Packet 1045 Forward state for Phase 9 (token service + handlers + Turnstile + fingerprint mw): wires the registry into cmd/canary/main.go, brings config.Config.Canary{BaseURL} + config.Config.MySQL{Enabled,Addr, PublicHost,PublicPort}, defines token.Service.Create (id+manage_id generation, registry dispatch, repository persistence) and token.Handler (POST /api/tokens, GET /tokens/types, route mounting for /c/{id} + /c/{id}/fingerprint + /k/{id}/*), promotes the realIP helper from webbug into middleware, adds turnstile verification + fingerprint rate-limit middleware. Closes Phase 8's deferred task 8.5 by spawning `go mysql.Run(...)` from main.go.		2026-05-13 14:59:56 -04:00
.github	fix: pin pnpm to v10 in CI and add .npmrc to all frontend projects	2026-05-08 05:46:38 -04:00
PROJECTS	feat(canary): mysql generator + register in registry	2026-05-13 14:55:37 -04:00
RESOURCES	Update README.md	2026-04-29 03:14:28 -04:00
ROADMAPS	docs(roadmaps): replace mentorship CTAs with CertGames	2026-04-29 03:20:45 -04:00
SYNOPSES	Update Base64.Encoder.Decoder.md	2026-04-29 03:19:37 -04:00
TEMPLATES	Update Makefile.example	2026-04-29 03:18:41 -04:00
.gitguardian.yml	feat: Complete Go secrets scanner - Portia	2026-02-22 20:02:38 -05:00
.gitignore	add learn folder to IM MONITORING THE SITUATION DASHBOARD project	2026-05-08 04:43:29 -04:00
.gitmodules	Fix submodule path: rename templates to TEMPLATES	2026-01-30 02:24:37 -05:00
.pre-commit-config.yaml	fix(monitor): pick conflict-free host ports (8432/5432/4432/6432/3432); JWT keygen-on-boot, healthcheck path, baseline migration; ignore frontend/.pnpm-store; pre-commit excludes	2026-05-01 20:13:00 -04:00
LICENSE	move docs to .github/	2026-02-11 07:52:29 -05:00
README.md	docs(readme): add docs link for ai-threat-detection	2026-05-13 14:05:16 -04:00

README.md

Cybersecurity Projects 🐉

67 Cybersecurity Projects, Certification Roadmaps & Resources

Made possible by CertGames

View Complete Projects:

_{Currently building: Steganography Multi-Tool}

Projects

67 hands-on cybersecurity projects with full source code, from beginner to advanced level.

Certification Roadmaps

10 structured career paths with certification guides for SOC Analyst, Pentester, Security Engineer, and more.

Learning Resources

Tools, courses, certifications, communities, and frameworks for cybersecurity professionals.

Projects

Beginner Projects

Project	Info	What You'll Learn
Simple Port Scanner Async TCP port scanner in C++ @deniskhud		TCP socket programming • Async I/O patterns • Service detection Source Code \| Docs
Keylogger Capture keyboard events with timestamps		Event handling • File I/O • Ethical considerations Source Code \| Docs
Caesar Cipher CLI encryption/decryption tool		Classical cryptography • Brute force attacks • CLI design Source Code \| Docs
DNS Lookup CLI Tool Query DNS records with WHOIS		DNS protocols • WHOIS queries • Reverse DNS lookup Source Code \| Docs
Simple Vulnerability Scanner Check software against CVE databases		CVE databases • Dependency scanning • Vulnerability assessment Source Code \| Docs
Metadata Scrubber Tool Remove EXIF and privacy metadata @Heritage-XioN		EXIF data • Privacy protection • Batch processing Source Code \| Docs
Network Traffic Analyzer Capture and analyze packets		Packet capture • Protocol analysis • Traffic visualization Source (C++) \| Docs (C++) \| Source (Python) \| Docs (Python)
Hash Cracker Dictionary and brute-force cracking		Hash algorithms • Dictionary attacks • Password security Source Code \| Docs
Steganography Multi-Tool Hide data in images, audio, QR, PDFs, text		Multi-format steganography • Zero-width Unicode • Audio LSB • QR exploitation Learn More
Ghost on the Wire L2 attack & defense: MAC spoofing + ARP detection		ARP protocol • MAC spoofing • MITM detection • L2 trust mapping Learn More
Canary Token Generator Self-hosted honeytokens that alert on access		Deception defense • Honeytokens • Webhook alerting • Intrusion detection Learn More
Security News Scraper Aggregate cybersecurity news		Web scraping • CVE parsing • Database storage Learn More
Phishing Domain Generator & Quishing Scanner Typosquat generation + QR phishing detection		Homoglyph attacks • Typosquatting • QR code analysis • Domain intelligence Learn More
SSH Brute Force Detector Monitor and block SSH attacks		Log parsing • Attack detection • Firewall automation Learn More
Simple C2 Beacon Command and Control beacon/server		C2 architecture • MITRE ATT&CK • WebSocket protocol • XOR encoding Source Code \| Docs
Base64 Encoder/Decoder Multi-format encoding tool		Base64/32 encoding • URL encoding • Auto-detection Source Code \| Docs
Linux CIS Hardening Auditor CIS benchmark compliance checker		CIS benchmarks • System hardening • Compliance scoring • Shell scripting Source Code \| Docs
Systemd Persistence Scanner Hunt Linux persistence mechanisms		Persistence techniques • Systemd internals • Cron analysis • Threat hunting Source Code \| Docs
Linux eBPF Security Tracer Real-time syscall tracing with eBPF		eBPF programs • Syscall tracing • BCC framework • Security observability Source Code \| Docs
Trojan Application Builder Educational malware lifecycle demo		Trojan anatomy • Data exfiltration • File encryption • Attack lifecycle Learn More
DNS Sinkhole Pi-hole-style malware domain blocker		DNS protocol • Blocklist management • Query logging • Network defense Learn More
Firewall Rule Engine Parse and validate iptables/nftables rules		Firewall internals • Rule parsing • iptables/nftables • V language Source Code \| Docs
LLM Prompt Injection Firewall Detect and block prompt injection attacks		AI security • Prompt injection • Input sanitization • LLM defense Learn More

Intermediate Projects

Project	Info	What You'll Learn
Payload Obfuscation Engine Multi-layer payload obfuscation toolkit		Obfuscation techniques • Polymorphism • AV evasion • Signature detection Learn More
SIEM Dashboard Log aggregation with correlation		SIEM concepts • Log correlation • Full-stack development Source Code \| Docs
Token Abuse Playground 15+ token vulnerabilities to exploit and fix		JWT exploitation • OAuth attacks • Session security • Token forensics Learn More
Supply Chain Attack Simulator Fake PyPI package dependency confusion demo		Supply chain attacks • Dependency confusion • Package security • PyPI internals Learn More
DDoS Mitigation Tool Detect traffic spikes		DDoS detection • Rate limiting • Anomaly detection Learn More
Secrets Scanner Scan codebases and git history for leaked secrets		Secret detection • Shannon entropy • HIBP k-anonymity • SARIF output Source Code \| Docs
API Security Scanner Enterprise API vulnerability scanner		OWASP API Top 10 • ML fuzzing • GraphQL/SOAP testing Source Code \| Docs
Wireless Deauth Detector Monitor WiFi deauth attacks		Wireless security • Packet sniffing • Attack detection Learn More
Credential Enumeration Post-exploitation credential collection		Credential extraction • Browser forensics • Red team tooling • Nim language Source Code \| Docs
Binary Analysis Tool Disassemble and analyze executables		Binary analysis • String extraction • Malware detection Source Code \| Docs
Chaos Engineering Security Tool Inject security failures to test resilience		Chaos engineering • Security resilience • Credential spraying • Auth testing Learn More
Credential Rotation Enforcer Track and enforce credential rotation policies		Credential hygiene • Secret rotation • Compliance dashboards • API integration Source Code \| Docs
Race Condition Exploiter TOCTOU race condition attack & defense lab		TOCTOU attacks • Double-spend bugs • Concurrent exploitation • Race visualization Learn More
Self-Hosted Shodan Clone Internet-connected device search engine		Service fingerprinting • Network scanning • OSINT • Search engine design Learn More
JA3/JA4 TLS Fingerprinting Tool Fingerprint TLS clients by handshake		TLS handshake analysis • JA3/JA4 hashing • Bot detection • Malware C2 identification Learn More
Mobile App Security Analyzer Decompile and analyze mobile apps		APK/IPA analysis • Reverse engineering • OWASP Mobile Learn More
DLP Scanner Data Loss Prevention for files, DBs, and traffic		PII detection • GDPR/HIPAA compliance • Pattern matching • Data classification Source Code \| Docs
Lua/Nginx Edge Backend Full CRUD backend via Lua in Nginx		Edge computing • OpenResty • Lua scripting • WAF • JWT at the edge Learn More
Privesc Playground 20+ privilege escalation paths to exploit		SUID exploitation • Sudo abuse • Cron hijacking • GTFOBins • Capability abuse Learn More
SBOM Generator & Vulnerability Matcher Software Bill of Materials with CVE matching		SPDX/CycloneDX formats • Dependency analysis • CVE databases • EO 14028 compliance Source Code \| Docs
Subdomain Takeover Scanner Detect dangling DNS records		DNS enumeration • CNAME analysis • Cloud resource claiming • Bug bounty Learn More
GraphQL Security Tester Automated GraphQL vulnerability testing		Introspection attacks • Query depth DoS • Authorization bypass • Batching abuse Learn More
Docker Security Audit CIS Docker Benchmark scanner		CIS benchmarks • Container security • Multiple output formats Source Code \| Docs

Advanced Projects

Project	Info	What You'll Learn
API Rate Limiter Distributed rate limiting middleware		Token bucket algorithm • Distributed systems • Redis backend Source Code \| Docs
Encrypted Chat Application Real-time E2EE messaging		Signal Protocol • Double Ratchet • WebAuthn • WebSockets Source Code \| Docs
Exploit Development Framework Modular exploitation framework		Exploit development • Payload generation • Plugin architecture Learn More
AI Threat Detection ML-powered nginx threat detection		ML ensemble (AE + RF + IF) • ONNX inference • Real-time detection Source Code \| Docs
Bug Bounty Platform Full vulnerability disclosure platform		Full-stack development • CVSS scoring • Workflow automation Source Code \| Docs
Cloud Security Compliance Dashboard Multi-cloud compliance with CIS, SOC2, HIPAA		CIS benchmarks • SOC2/HIPAA compliance • Cost-security optimization • Drift detection Learn More
Malware Analysis Platform Automated sandbox analysis		Malware analysis • Sandboxing • YARA rules • IOC extraction Learn More
Quantum Resistant Encryption Post-quantum cryptography		Post-quantum algorithms • Hybrid encryption • Kyber/Dilithium Learn More
Zero Day Vulnerability Scanner Coverage-guided fuzzing		Fuzzing • Vulnerability research • Crash triage Learn More
Distributed Password Cracker GPU-accelerated cracking		Distributed systems • GPU computing • Hash cracking Learn More
Kernel Rootkit Detection Detect kernel-level rootkits		Kernel internals • Memory forensics • Rootkit detection Learn More
Blockchain Smart Contract Auditor Solidity vulnerability analysis		Smart contracts • Static analysis • Solidity security Learn More
Adversarial ML Attacker Generate adversarial examples		Adversarial ML • FGSM/DeepFool • Model robustness Learn More
Advanced Persistent Threat Simulator Multi-stage APT simulation		APT techniques • C2 infrastructure • Lateral movement Learn More
Hardware Security Module Emulator Software HSM with PKCS#11		HSM concepts • PKCS#11 interface • Cryptographic operations Learn More
Network Covert Channel Data exfiltration techniques		Covert channels • Data exfiltration • Steganography Learn More
Automated Penetration Testing Full pentest automation		Pentest automation • Recon to exploitation • Report generation Learn More
Haskell Reverse Proxy Functional reverse proxy with security middleware		Functional programming • Reverse proxy design • Security middleware • Haskell Source Code
"Monitor the Situation" Dashboard Real-time cyber threat situational awareness		Threat intel feeds • EPSS/KEV/CVE velocity • BGP hijacks • WebSocket fan-out • 3D globe SOC view Source Code \| Docs
Honeypot Network Multi-service honeypot deployment & analysis		Honeypot deployment • Attacker behavior analysis • IOC extraction • MITRE mapping Source Code \| Docs
Supply Chain Security Analyzer Dependency vulnerability analysis		Supply chain security • Dependency analysis • Malicious packages Learn More