Building 70 Projects ranging from beginner to advanced so anyone can — learn from, build upon, use as a reference, or even copy directly. Gamified Cybersecurity learning 👇

Go to file

CarterPerez-dev 8207b2747b chore(canary-phase2): generator interface + webbug complete Phase 2 of the 18-phase plan. Lands the plugin scaffolding (Generator interface, shared transparent-pixel package, generator registry) and the first concrete generator (webbug). Phase 2 is intentionally the smallest phase — subsequent phases add slowredirect, docx, pdf, kubeconfig, envfile, and mysql generators against the same Generator interface. Implementation commits (oldest → newest): `6cc724c1` feat(canary): Generator interface for token-type plugins `0b6e586e` feat(canary): shared 43-byte transparent GIF for image triggers `9c0ad749` feat(canary): webbug generator (Generate + Trigger) `bb95f745` feat(canary): generator registry (token.Type → Generator) `c39b56b9` fix(canary): clear pre-audit lint debt + migrate golangci config to v2 `1a240952` fix(canary-phase2): address audit findings before rollup Deliverables vs. plan: - Generator interface (spec §6.2): Type/Generate/Trigger contract with ArtifactKind url\|file\|text\|connection_string, Artifact discriminated by Kind, TriggerResponse value type so generators stay pure. - Pixel package: 43-byte canonical GIF89a literal exposed via pixel.Clone() (immutable source, independent slice per call) + pixel.Len() helper + ContentType const. - Webbug generator (spec §9.1 + §8.5): Generate returns KindURL artifact with baseURL/c/{id} (trailing slash trimmed). Trigger returns 200 + image/gif + 43-byte pixel + no-store cache headers. realIP precedence: CF-Connecting-IP > X-Forwarded-For (rightmost non-empty) > X-Real-IP > net.SplitHostPort(RemoteAddr). Handles IPv4/IPv6 (including bracketed form). Empty XFF entries (trailing comma, all-empty list) fall through to the next source. Nil token returns nil event + non-nil GIF response — the contract is explicit in the return shape, so the future Phase 9 handler cannot accidentally insert an event row with empty TokenID (which would fail the events → tokens FK anyway). - Generator registry: lives in backend/internal/token/generators/registry/ (sub-package, NOT the generators package itself) to break the generators → webbug → generators import cycle the implementation plan inadvertently created. registry.Config + registry.Registry + registry.Build. Phase 2 registers webbug only; cardinality test asserts exactly 1 and enumerates the 6 future types as absent. - Cross-cutting cleanup (`c39b56b9`): pre-audit gate found Phase 0/1 golangci-lint debt the prior phase audits didn't catch. Per fix-in-phase rule, cleared all 14 (5 errcheck, 6 golines, 1 funlen via run() → run+initTelemetry+mountRouter+gracefulShutdown split, 1 govet shadow, plus the 1 Phase-2-introduced funlen-on-test that the broken .golangci.yml v1-syntax exclude-rules failed to suppress under golangci-lint v2). Also migrated .golangci.yml to v2 schema (linters.exclusions.{paths,rules}) and added gosec G706 to excludes (false-positive log-injection on slog structured-logging call sites). Phase 2 audit — TWO agents in parallel per standing pattern: superpowers:code-reviewer → PASS (9 findings, all cleared in-phase by commit `1a240952`) general-purpose (spec-adherence)→ PASS (every spec contract item verified; 3 known deltas accepted: Type() refined to token.Type, registry moved to subpackage to break cycle, optionalHeader bridges plan-vs-schema pointer types) Findings cleared in-phase (from code-reviewer): MEDIUM — realIP fallback returned "IP:port"; now net.SplitHostPort MEDIUM — XFF rightmost empty entry skipped fallback; now walks right- to-left and falls through cleanly MEDIUM — pixel.TransparentGIF was exported mutable []byte; now unexported + pixel.Clone() per call LOW — nil token returned non-nil event with empty TokenID; now returns nil event (explicit contract) LOW — no IPv6 coverage in IP precedence tests; added 3 IPv6 cases + XFF IPv6 + port-less RemoteAddr NIT — gracefulShutdown swallowed shutdown errors; now errors.Join Accepted as-is (NIT, Phase 3+ concern): NIT — Artifact discriminated-union may want sealed-interface refactor once non-URL kinds land NIT — Registry exposed bare map (acceptable: read-only post-Build, Go memory model permits concurrent map reads with no writes) NIT — registry.Build accepts but ignores its Config (signature reserved for future stateful generators like mysql) Forward-looking notes for Phase 3 (NOT deferred items, just heads-up): - Phase 3's main.go wire-up cannot copy spec §6.3's `generators.BuildRegistry(cfg.Canary)` verbatim; the call is now registry.Build(registry.Config{...}) and the cfg.Canary field will need to be declared on config.Config. Deferred items: NONE. BACKLOG.md open section remains empty. Quality gates (final, post-fix): go build ./... OK go vet ./... OK go test -race ./... PASS (4 packages, 20 unit tests) go test -tags=integration -race PASS (token + event integration, ~12s testcontainers) golangci-lint run ./... 0 issues Audited: PASS.		2026-05-12 02:57:29 -04:00
.github	fix: pin pnpm to v10 in CI and add .npmrc to all frontend projects	2026-05-08 05:46:38 -04:00
PROJECTS	fix(canary-phase2): address audit findings before rollup	2026-05-12 02:56:29 -04:00
RESOURCES	Update README.md	2026-04-29 03:14:28 -04:00
ROADMAPS	docs(roadmaps): replace mentorship CTAs with CertGames	2026-04-29 03:20:45 -04:00
SYNOPSES	Update Base64.Encoder.Decoder.md	2026-04-29 03:19:37 -04:00
TEMPLATES	Update Makefile.example	2026-04-29 03:18:41 -04:00
.gitguardian.yml	feat: Complete Go secrets scanner - Portia	2026-02-22 20:02:38 -05:00
.gitignore	add learn folder to IM MONITORING THE SITUATION DASHBOARD project	2026-05-08 04:43:29 -04:00
.gitmodules	Fix submodule path: rename templates to TEMPLATES	2026-01-30 02:24:37 -05:00
.pre-commit-config.yaml	fix(monitor): pick conflict-free host ports (8432/5432/4432/6432/3432); JWT keygen-on-boot, healthcheck path, baseline migration; ignore frontend/.pnpm-store; pre-commit excludes	2026-05-01 20:13:00 -04:00
LICENSE	move docs to .github/	2026-02-11 07:52:29 -05:00
README.md	add learn folder to IM MONITORING THE SITUATION DASHBOARD project	2026-05-08 04:43:29 -04:00

README.md

Cybersecurity Projects 🐉

67 Cybersecurity Projects, Certification Roadmaps & Resources

Made possible by CertGames

View Complete Projects:

_{Currently building: Steganography Multi-Tool}

Projects

67 hands-on cybersecurity projects with full source code, from beginner to advanced level.

Certification Roadmaps

10 structured career paths with certification guides for SOC Analyst, Pentester, Security Engineer, and more.

Learning Resources

Tools, courses, certifications, communities, and frameworks for cybersecurity professionals.

Projects

Beginner Projects

Project	Info	What You'll Learn
Simple Port Scanner Async TCP port scanner in C++ @deniskhud		TCP socket programming • Async I/O patterns • Service detection Source Code \| Docs
Keylogger Capture keyboard events with timestamps		Event handling • File I/O • Ethical considerations Source Code \| Docs
Caesar Cipher CLI encryption/decryption tool		Classical cryptography • Brute force attacks • CLI design Source Code \| Docs
DNS Lookup CLI Tool Query DNS records with WHOIS		DNS protocols • WHOIS queries • Reverse DNS lookup Source Code \| Docs
Simple Vulnerability Scanner Check software against CVE databases		CVE databases • Dependency scanning • Vulnerability assessment Source Code \| Docs
Metadata Scrubber Tool Remove EXIF and privacy metadata @Heritage-XioN		EXIF data • Privacy protection • Batch processing Source Code \| Docs
Network Traffic Analyzer Capture and analyze packets		Packet capture • Protocol analysis • Traffic visualization Source (C++) \| Docs (C++) \| Source (Python) \| Docs (Python)
Hash Cracker Dictionary and brute-force cracking		Hash algorithms • Dictionary attacks • Password security Source Code \| Docs
Steganography Multi-Tool Hide data in images, audio, QR, PDFs, text		Multi-format steganography • Zero-width Unicode • Audio LSB • QR exploitation Learn More
Ghost on the Wire L2 attack & defense: MAC spoofing + ARP detection		ARP protocol • MAC spoofing • MITM detection • L2 trust mapping Learn More
Canary Token Generator Self-hosted honeytokens that alert on access		Deception defense • Honeytokens • Webhook alerting • Intrusion detection Learn More
Security News Scraper Aggregate cybersecurity news		Web scraping • CVE parsing • Database storage Learn More
Phishing Domain Generator & Quishing Scanner Typosquat generation + QR phishing detection		Homoglyph attacks • Typosquatting • QR code analysis • Domain intelligence Learn More
SSH Brute Force Detector Monitor and block SSH attacks		Log parsing • Attack detection • Firewall automation Learn More
Simple C2 Beacon Command and Control beacon/server		C2 architecture • MITRE ATT&CK • WebSocket protocol • XOR encoding Source Code \| Docs
Base64 Encoder/Decoder Multi-format encoding tool		Base64/32 encoding • URL encoding • Auto-detection Source Code \| Docs
Linux CIS Hardening Auditor CIS benchmark compliance checker		CIS benchmarks • System hardening • Compliance scoring • Shell scripting Source Code \| Docs
Systemd Persistence Scanner Hunt Linux persistence mechanisms		Persistence techniques • Systemd internals • Cron analysis • Threat hunting Source Code \| Docs
Linux eBPF Security Tracer Real-time syscall tracing with eBPF		eBPF programs • Syscall tracing • BCC framework • Security observability Source Code \| Docs
Trojan Application Builder Educational malware lifecycle demo		Trojan anatomy • Data exfiltration • File encryption • Attack lifecycle Learn More
DNS Sinkhole Pi-hole-style malware domain blocker		DNS protocol • Blocklist management • Query logging • Network defense Learn More
Firewall Rule Engine Parse and validate iptables/nftables rules		Firewall internals • Rule parsing • iptables/nftables • V language Source Code \| Docs
LLM Prompt Injection Firewall Detect and block prompt injection attacks		AI security • Prompt injection • Input sanitization • LLM defense Learn More

Intermediate Projects

Project	Info	What You'll Learn
Payload Obfuscation Engine Multi-layer payload obfuscation toolkit		Obfuscation techniques • Polymorphism • AV evasion • Signature detection Learn More
SIEM Dashboard Log aggregation with correlation		SIEM concepts • Log correlation • Full-stack development Source Code \| Docs
Token Abuse Playground 15+ token vulnerabilities to exploit and fix		JWT exploitation • OAuth attacks • Session security • Token forensics Learn More
Supply Chain Attack Simulator Fake PyPI package dependency confusion demo		Supply chain attacks • Dependency confusion • Package security • PyPI internals Learn More
DDoS Mitigation Tool Detect traffic spikes		DDoS detection • Rate limiting • Anomaly detection Learn More
Secrets Scanner Scan codebases and git history for leaked secrets		Secret detection • Shannon entropy • HIBP k-anonymity • SARIF output Source Code \| Docs
API Security Scanner Enterprise API vulnerability scanner		OWASP API Top 10 • ML fuzzing • GraphQL/SOAP testing Source Code \| Docs
Wireless Deauth Detector Monitor WiFi deauth attacks		Wireless security • Packet sniffing • Attack detection Learn More
Credential Enumeration Post-exploitation credential collection		Credential extraction • Browser forensics • Red team tooling • Nim language Source Code \| Docs
Binary Analysis Tool Disassemble and analyze executables		Binary analysis • String extraction • Malware detection Source Code \| Docs
Chaos Engineering Security Tool Inject security failures to test resilience		Chaos engineering • Security resilience • Credential spraying • Auth testing Learn More
Credential Rotation Enforcer Track and enforce credential rotation policies		Credential hygiene • Secret rotation • Compliance dashboards • API integration Source Code \| Docs
Race Condition Exploiter TOCTOU race condition attack & defense lab		TOCTOU attacks • Double-spend bugs • Concurrent exploitation • Race visualization Learn More
Self-Hosted Shodan Clone Internet-connected device search engine		Service fingerprinting • Network scanning • OSINT • Search engine design Learn More
JA3/JA4 TLS Fingerprinting Tool Fingerprint TLS clients by handshake		TLS handshake analysis • JA3/JA4 hashing • Bot detection • Malware C2 identification Learn More
Mobile App Security Analyzer Decompile and analyze mobile apps		APK/IPA analysis • Reverse engineering • OWASP Mobile Learn More
DLP Scanner Data Loss Prevention for files, DBs, and traffic		PII detection • GDPR/HIPAA compliance • Pattern matching • Data classification Source Code \| Docs
Lua/Nginx Edge Backend Full CRUD backend via Lua in Nginx		Edge computing • OpenResty • Lua scripting • WAF • JWT at the edge Learn More
Privesc Playground 20+ privilege escalation paths to exploit		SUID exploitation • Sudo abuse • Cron hijacking • GTFOBins • Capability abuse Learn More
SBOM Generator & Vulnerability Matcher Software Bill of Materials with CVE matching		SPDX/CycloneDX formats • Dependency analysis • CVE databases • EO 14028 compliance Source Code \| Docs
Subdomain Takeover Scanner Detect dangling DNS records		DNS enumeration • CNAME analysis • Cloud resource claiming • Bug bounty Learn More
GraphQL Security Tester Automated GraphQL vulnerability testing		Introspection attacks • Query depth DoS • Authorization bypass • Batching abuse Learn More
Docker Security Audit CIS Docker Benchmark scanner		CIS benchmarks • Container security • Multiple output formats Source Code \| Docs

Advanced Projects

Project	Info	What You'll Learn
API Rate Limiter Distributed rate limiting middleware		Token bucket algorithm • Distributed systems • Redis backend Source Code \| Docs
Encrypted Chat Application Real-time E2EE messaging		Signal Protocol • Double Ratchet • WebAuthn • WebSockets Source Code \| Docs
Exploit Development Framework Modular exploitation framework		Exploit development • Payload generation • Plugin architecture Learn More
AI Threat Detection ML-powered nginx threat detection		ML ensemble (AE + RF + IF) • ONNX inference • Real-time detection Source Code
Bug Bounty Platform Full vulnerability disclosure platform		Full-stack development • CVSS scoring • Workflow automation Source Code \| Docs
Cloud Security Compliance Dashboard Multi-cloud compliance with CIS, SOC2, HIPAA		CIS benchmarks • SOC2/HIPAA compliance • Cost-security optimization • Drift detection Learn More
Malware Analysis Platform Automated sandbox analysis		Malware analysis • Sandboxing • YARA rules • IOC extraction Learn More
Quantum Resistant Encryption Post-quantum cryptography		Post-quantum algorithms • Hybrid encryption • Kyber/Dilithium Learn More
Zero Day Vulnerability Scanner Coverage-guided fuzzing		Fuzzing • Vulnerability research • Crash triage Learn More
Distributed Password Cracker GPU-accelerated cracking		Distributed systems • GPU computing • Hash cracking Learn More
Kernel Rootkit Detection Detect kernel-level rootkits		Kernel internals • Memory forensics • Rootkit detection Learn More
Blockchain Smart Contract Auditor Solidity vulnerability analysis		Smart contracts • Static analysis • Solidity security Learn More
Adversarial ML Attacker Generate adversarial examples		Adversarial ML • FGSM/DeepFool • Model robustness Learn More
Advanced Persistent Threat Simulator Multi-stage APT simulation		APT techniques • C2 infrastructure • Lateral movement Learn More
Hardware Security Module Emulator Software HSM with PKCS#11		HSM concepts • PKCS#11 interface • Cryptographic operations Learn More
Network Covert Channel Data exfiltration techniques		Covert channels • Data exfiltration • Steganography Learn More
Automated Penetration Testing Full pentest automation		Pentest automation • Recon to exploitation • Report generation Learn More
Haskell Reverse Proxy Functional reverse proxy with security middleware		Functional programming • Reverse proxy design • Security middleware • Haskell Source Code
"Monitor the Situation" Dashboard Real-time cyber threat situational awareness		Threat intel feeds • EPSS/KEV/CVE velocity • BGP hijacks • WebSocket fan-out • 3D globe SOC view Source Code \| Docs
Honeypot Network Multi-service honeypot deployment & analysis		Honeypot deployment • Attacker behavior analysis • IOC extraction • MITRE mapping Source Code \| Docs
Supply Chain Security Analyzer Dependency vulnerability analysis		Supply chain security • Dependency analysis • Malicious packages Learn More