aicertificationcloud-engineeringcybercybersecuritycybersecurity-analystcybersecurity-certificationcybersecurity-certificationscybersecurity-educationcybersecurity-jobscybersecurity-portfoliocybersecurity-projectscybersecurity-toolsgrchackinglearningpentestingproject-repositoryprojetcspython
8d7b114fb9
B17 through B30, fourteen items. Every one reproduced before it was touched and mutation-proven after. 194 tests from 119, rubocop 903 offenses to 0, all six gate stages green. One rule runs through all of it: nothing may present a guess, a default, or a swallowed error as a verdict. Decision states (B19). Under POLICY_OBSERVE_AND_LOG a payload carrying a live Gem::Requirement#marshal_load snapshot reported accepted? true AND rejected? false, so both obvious caller shapes loaded it. The predicate pair could not express the third outcome, so there was no safe branch to pick - the prior note claiming target/app.rb sidestepped this by branching on rejected? was wrong, and both forms were byte-for-byte equivalent in outcome. accepted?, rejected? and would_reject? are removed rather than redefined, so copying `if d.accepted?` now raises NoMethodError instead of silently changing meaning. One state validated in the constructor, three exclusive predicates, and proceed? is the only one that may gate a Marshal.load. Observe-and-log stays non-blocking and still hands back its snapshot; the monitoring caller writes `proceed? || observed?` and names the state out loud. Scanner error accounting (B18). Five rescues returned nil, [] or false and told nobody. They now record site, subject and error class, and Report exposes suppressed_count, suppressions_by_site, complete? and candidates_lost?. Wiring the counter immediately surfaced 3 suppressions on a stock image that had always been invisible: <internal:symbol>, <internal:pathname_builtin> and <internal:ractor> all fail Prism.parse_file with ENOENT because Ruby hands out those paths but they are not files. The fourth state (B29). Those 3 suppressions were also 7 wrong answers - candidates scored "does not touch state", indistinguishable from analysed and inert, and 4 zero-arity ungated ones silently dropped from reachable. touches_state is now four-state. A source that was given and could not be parsed fails OPEN and stays reachable, because a scanner that discards what it failed to analyse is the exact failure mode B18 names. A C-defined method with no Ruby source at all is reported as unanalysable instead: 132 of 173 candidates, and failing open there would take reachable from 25 to 74 of 165 ungated and stop the filter filtering. Report#unanalysable and #fully_analysed? state the real coverage - 33 of 173 - rather than implying the filter saw everything. The 5 recovered candidates were verified by executing them, not by reading source we could not read; one of them, ERB::Compiler::PercentLine#to_s, is an alias of an attr_reader, which is a second and distinct analysis gap. Reason escaping (B20). Reject reasons interpolated raw attacker bytes into a caller-supplied reporter. A class name carrying CR, LF, ESC and NUL turned one reporter call into three log lines, the middle one forging a successful authentication. All three interpolation sites now truncate at 96 bytes and inspect the binary form, so no byte below 0x20 survives and the value is quote-delimited. Target hardening (B21, B22). The defended endpoint returned HTTP 500 with a source line for three roots the detector had just accepted, leaking paths the same way the B3 mutant did. show_exceptions is off, the shape is checked, and the gate now greps every error body for source paths. ALLOWED_CLASSES could never match anything, measured: a benign session cookie carries zero class names. It is PERMITTED_CLASS_NAMES = [] now, which is what the app actually requires and is strictly tighter - the old list admitted a C-wrapped String, and under a mutant restoring it only the new shape check stopped that payload. Gated agreement (B23). GATED_SINK_TAGS omitted TAG_DATA while the scanner listed _load_data. The scanner was right, and this is now execution evidence rather than a reading of marshal.c: a hand-built d stream naming Thread::Mutex, a real C-level T_DATA, raises TypeError naming the missing _load_data, while the same stream naming String dies earlier at "dump format error" - which is why the previous attempt could not see it. A test compares both definitions directly so they cannot drift again. Float fidelity (B17). read_float returned nil for seven body forms Marshal.load accepts, two more than the finding listed. Ruby uses its own ruby_strtod, so "INF" is 0.0 while "inf" is Infinity, and String#to_f turns out to be that same function. Ruby's legacy binary mantissa is NOT decoded: a model fitted to four oracle points passed a 25-case table and then failed 930 of 5000 randomised cases, and marshal.c is not available in these images. Since 0 of 209 Marshal.dump outputs contain a NUL, no living Ruby emits that form, so the parser records the strtod prefix and flags Node#undecoded_tail instead. A plausible wrong number is worse than a labelled non-answer. Final differential: 2919 agreed exactly, 2081 flagged, 0 claimed-and-wrong. Hygiene (B24, B25, B27, B28). PRIMITIVE_CLASS_NAMES and NAMESPACE_SEPARATOR had one reference each, their own definition. BIGNUM_SIGN_POSITIVE is live and stays. The width > FIXNUM_MAX_WIDTH guard is unreachable for all 256 possible marker bytes, checked exhaustively, and raised the wrong error class; it is replaced by a test that derives widths from real Marshal.dump output. The symlink and object-link bounds checks no longer lean on negative-index wraparound. The parse graph is sealed before it is returned - every node, its collections and its scalars frozen - and the whole suite stayed green first try, which proves nothing downstream was mutating it. exploit-gate.sh pins both sides now, 4.0.2-slim erb 6.0.1 FIRED against 4.0.6-slim erb 6.0.1.1 BLOCKED; the finding's claim about detector-gate.sh was wrong, it never had a patched side. Lint (B30). just lint used a --network none runner, so gem install could never reach RubyGems, the && short-circuited, and the recipe exited 2 while printing absolutely nothing. That is the fourth instance of a dropped return value hiding a failure in this project. It is loud now. The config had never been validated against a real run: 903 offenses, dominated by a quote style the codebase does not use. frozen_string_literal was verified safe by running the whole suite under RUBYOPT=--enable-frozen-string-literal BEFORE the change, so ~247 offenses were retired by fixing code rather than silencing a cop. Every remaining disabled cop carries a reason. |
||
|---|---|---|
| .github | ||
| PROJECTS | ||
| RESOURCES | ||
| ROADMAPS | ||
| SYNOPSES | ||
| TEMPLATES | ||
| .clang-format | ||
| .gitguardian.yml | ||
| .gitignore | ||
| .gitmodules | ||
| .pre-commit-config.yaml | ||
| LICENSE | ||
| README.md | ||
README.md
Cybersecurity Projects 🐉
70 Cybersecurity Projects, Certification Roadmaps & Resources
Made possible by CertGames
View Complete Projects:
Currently building: DDoS Mitigation Tool
Quick Navigation
Projects
Hands-on cybersecurity projects with full source code, organized in four tiers — Foundations (pre-beginner, first-time programmers), Beginner, Intermediate, and Advanced.
Certification Roadmaps
10 structured career paths with certification guides for SOC Analyst, Pentester, Security Engineer, and more.
Learning Resources
Tools, courses, certifications, communities, and frameworks for cybersecurity professionals.
Projects
[!TIP] Want to be walked through building these instead of reading finished source? CertGames has guided project courses that build real security tools from scratch, step by step, with the concepts explained as you go. Same projects, less getting stuck. FREE
Foundations Projects
[!NOTE] Start here if this is your first time coding. The Foundations tier is pre-beginner — built for someone who has never written Python, has barely used a terminal, and is new to cybersecurity. Source files are heavily commented as a teaching aid, and every
learn/folder explains concepts from zero. Once you're comfortable here, the Beginner projects assume you already know the language and move faster.What makes Foundations different:
- Single-file projects — the entire tool lives in one readable Python file. No file-hopping.
- Heavy teaching comments — every line that introduces a new concept is annotated inline.
- Numpy-style docstrings on every function — what it does, why it exists, every parameter.
- Extra-deep
learn/folders — Python features and security concepts both explained from zero.- Senior-level code, beginner-level explanations — the code itself is still production-quality.
| Project | Info | What You'll Learn |
|---|---|---|
| Hash Identifier Identify hash types by prefix, length, and charset |
    |
Hash families (MD5, SHA, bcrypt, Argon2) • PHC string format • Pattern matching • Pure-function design Source Code | Docs |
| HTTP Headers Scanner Audit a URL's response headers for missing or weak security controls |
  |
HTTP fundamentals • Security headers (CSP, HSTS, X-Frame-Options) • httpx requests • Scored audits Source Code | Docs |
| Password Manager Encrypted local vault with master password unlock |
  |
Argon2id key derivation • AES-GCM authenticated encryption • Secure on-disk vaults • Master-password workflows Source Code | Docs |
Beginner Projects
| Project | Info | What You'll Learn |
|---|---|---|
| Simple Port Scanner Async TCP port scanner in C++ @deniskhud |
   |
TCP socket programming • Async I/O patterns • Service detection Source Code | Docs |
| Keylogger Capture keyboard events with timestamps |
|
Event handling • File I/O • Ethical considerations Source Code | Docs |
| Caesar Cipher CLI encryption/decryption tool |
|
Classical cryptography • Brute force attacks • CLI design Source Code | Docs |
| DNS Lookup CLI Tool Query DNS records with WHOIS |
 |
DNS protocols • WHOIS queries • Reverse DNS lookup Source Code | Docs |
| Simple Vulnerability Scanner Check software against CVE databases |
  |
CVE databases • Dependency scanning • Vulnerability assessment Source Code | Docs |
| Metadata Scrubber Tool Remove EXIF and privacy metadata @Heritage-XioN |
 |
EXIF data • Privacy protection • Batch processing Source Code | Docs |
| Network Traffic Analyzer Capture and analyze packets |
 |
Packet capture • Protocol analysis • Traffic visualization Source (C++) | Docs (C++) | Source (Python) | Docs (Python) |
| Hash Cracker Dictionary and brute-force cracking |
 |
Hash algorithms • Dictionary attacks • Password security Source Code | Docs |
| Steganography Multi-Tool Hide data in images, audio, QR, PDFs, text |
 |
Multi-format steganography • Encrypted AEAD envelope • Zero-width Unicode • Audio LSB • QR Reed-Solomon injection Source Code | Docs |
| Ghost on the Wire L2 attack & defense: MAC spoofing + ARP detection |
|
ARP protocol • MAC spoofing • MITM detection • L2 trust mapping Learn More |
| Canary Token Generator Self-hosted honeytokens that alert on access |
  |
Deception defense • Honeytokens • MySQL wire protocol • PDF/DOCX patching • Webhook + Telegram alerting Source Code | Docs  |
| Phishing Domain Generator & Quishing Scanner Typosquat generation + QR phishing detection |
|
Homoglyph attacks • Typosquatting • QR code analysis • Domain intelligence Learn More |
| SSH Brute Force Detector Monitor and block SSH attacks |
|
Log parsing • Attack detection • Firewall automation Learn More |
| Simple C2 Beacon Command and Control beacon/server |
|
C2 architecture • MITRE ATT&CK • WebSocket protocol • XOR encoding Source Code | Docs |
| Base64 Encoder/Decoder Multi-format encoding tool |
 |
Base64/32 encoding • URL encoding • Auto-detection Source Code | Docs |
| Linux CIS Hardening Auditor CIS benchmark compliance checker |
 |
CIS benchmarks • System hardening • Compliance scoring • Shell scripting Source Code | Docs |
| Systemd Persistence Scanner Hunt Linux persistence mechanisms |
|
Persistence techniques • Systemd internals • Cron analysis • Threat hunting Source Code | Docs |
| Linux eBPF Security Tracer Real-time syscall tracing with eBPF |
 |
eBPF programs • Syscall tracing • BCC framework • Security observability Source Code | Docs |
| Trojan Application Builder Educational malware lifecycle demo |
|
Trojan anatomy • Data exfiltration • File encryption • Attack lifecycle Learn More |
| DNS Sinkhole Pi-hole-style malware domain blocker |
|
DNS protocol • Blocklist management • Query logging • Network defense Learn More |
| Firewall Rule Engine Parse and validate iptables/nftables rules |
 |
Firewall internals • Rule parsing • iptables/nftables • V language Source Code | Docs |
| LLM Prompt Injection Firewall Detect and block prompt injection attacks |
|
AI security • Prompt injection • Input sanitization • LLM defense Learn More |
Intermediate Projects
| Project | Info | What You'll Learn |
|---|---|---|
| Security News Scraper Aggregate cybersecurity news |
  |
Web scraping • CVE parsing • Database storage Source Code | Docs |
| Payload Obfuscation Engine Multi-layer payload obfuscation toolkit |
 |
Obfuscation techniques • Polymorphism • AV evasion • Signature detection Learn More |
| SIEM Dashboard Log aggregation with correlation |
 |
SIEM concepts • Log correlation • Full-stack development Source Code | Docs  |
| Token Abuse Playground 15+ token vulnerabilities to exploit and fix |
 |
JWT exploitation • OAuth attacks • Session security • Token forensics Learn More |
| Supply Chain Attack Simulator Fake PyPI package dependency confusion demo |
 |
Supply chain attacks • Dependency confusion • Package security • PyPI internals Learn More |
| DDoS Mitigation Tool Detect traffic spikes |
|
DDoS detection • Rate limiting • Anomaly detection Learn More |
| Secrets Scanner Scan codebases and git history for leaked secrets |
 |
Secret detection • Shannon entropy • HIBP k-anonymity • SARIF output Source Code | Docs |
| API Security Scanner Enterprise API vulnerability scanner |
|
OWASP API Top 10 • ML fuzzing • GraphQL/SOAP testing Source Code | Docs |
| Wireless Deauth Detector Monitor WiFi deauth attacks |
 |
Wireless security • Packet sniffing • Attack detection Learn More |
| Credential Enumeration Post-exploitation credential collection |
 |
Credential extraction • Browser forensics • Red team tooling • Nim language Source Code | Docs |
| Binary Analysis Tool Disassemble and analyze executables |
|
Binary analysis • String extraction • Malware detection Source Code | Docs  |
| Chaos Engineering Security Tool Inject security failures to test resilience |
|
Chaos engineering • Security resilience • Credential spraying • Auth testing Learn More |
| Credential Rotation Enforcer Track and enforce credential rotation policies |
 |
Credential hygiene • Secret rotation • Compliance dashboards • API integration Source Code | Docs |
| Race Condition Exploiter TOCTOU race condition attack & defense lab |
|
TOCTOU attacks • Double-spend bugs • Concurrent exploitation • Race visualization Learn More |
| JA3/JA4 TLS Fingerprinting Tool Fingerprint TLS clients by handshake |
|
TLS handshake analysis • JA3/JA4 hashing • Bot detection • Malware C2 identification Source Code | Docs  |
| Mobile App Security Analyzer Decompile and analyze mobile apps |
|
APK/IPA analysis • Reverse engineering • OWASP Mobile Learn More |
| DLP Scanner Data Loss Prevention for files, DBs, and traffic |
|
PII detection • GDPR/HIPAA compliance • Pattern matching • Data classification Source Code | Docs |
| Lua/Nginx Edge Backend Full CRUD backend via Lua in Nginx |
  |
Edge computing • OpenResty • Lua scripting • WAF • JWT at the edge Learn More |
| Privesc Playground 20+ privilege escalation paths to exploit |
|
SUID exploitation • Sudo abuse • Cron hijacking • GTFOBins • Capability abuse Learn More |
| SBOM Generator & Vulnerability Matcher Software Bill of Materials with CVE matching |
|
SPDX/CycloneDX formats • Dependency analysis • CVE databases • EO 14028 compliance Source Code | Docs |
| Subdomain Takeover Scanner Detect dangling DNS records |
|
DNS enumeration • CNAME analysis • Cloud resource claiming • Bug bounty Learn More |
| GraphQL Security Tester Automated GraphQL vulnerability testing |
|
Introspection attacks • Query depth DoS • Authorization bypass • Batching abuse Learn More |
| Docker Security Audit CIS Docker Benchmark scanner |
|
CIS benchmarks • Container security • Multiple output formats Source Code | Docs |
Advanced Projects
| Project | Info | What You'll Learn |
|---|---|---|
| API Rate Limiter Distributed rate limiting middleware |
   |
Token bucket algorithm • Distributed systems • Redis backend Source Code | Docs |
| Encrypted Chat Application Real-time E2EE messaging |
   |
Signal Protocol • Double Ratchet • WebAuthn • WebSockets Source Code | Docs |
| Exploit Development Framework Modular exploitation framework |
 |
Exploit development • Payload generation • Plugin architecture Learn More |
| AI Threat Detection ML-powered nginx threat detection |
 |
ML ensemble (AE + RF + IF) • ONNX inference • Real-time detection Source Code | Docs |
| Zingela Stateless Scanner Line-rate stateless mass TCP/UDP port scanner |
 |
Stateless SYN scanning • SipHash cookies • Cyclic-group permutation • AF_PACKET / AF_XDP Source Code | Docs |
| Bug Bounty Platform Full vulnerability disclosure platform |
 |
Full-stack development • CVSS scoring • Workflow automation Source Code | Docs  |
| Cloud Security Compliance Dashboard Multi-cloud compliance with CIS, SOC2, HIPAA |
 |
CIS benchmarks • SOC2/HIPAA compliance • Cost-security optimization • Drift detection Learn More |
| Malware Analysis Platform Automated sandbox analysis |
|
Malware analysis • Sandboxing • YARA rules • IOC extraction Learn More |
| Quantum Resistant Encryption Post-quantum cryptography |
|
Post-quantum algorithms • Hybrid encryption • Kyber/Dilithium Learn More |
| Zero Day Vulnerability Scanner Coverage-guided fuzzing |
|
Fuzzing • Vulnerability research • Crash triage Learn More |
| Distributed Password Cracker GPU-accelerated cracking |
 |
Distributed systems • GPU computing • Hash cracking Learn More |
| Kernel Rootkit Detection Detect kernel-level rootkits |
|
Kernel internals • Memory forensics • Rootkit detection Learn More |
| Blockchain Smart Contract Auditor Solidity vulnerability analysis |
 |
Smart contracts • Static analysis • Solidity security Learn More |
| Adversarial ML Attacker Generate adversarial examples |
 |
Adversarial ML • FGSM/DeepFool • Model robustness Learn More |
| Reverse-Engineering Reverse-engineering learning platform. |
|
Reverse Engineering • Disassembly • Dynamic & Static Analysis Source Code | Docs |
| Hardware Security Module Emulator Software HSM that compiles to a real PKCS#11 .so |
|
PKCS#11/Cryptoki C ABI (machine-checked vs OASIS headers) • AES-GCM/CBC • RSA/ECDSA/ECDH • Argon2id + encrypted-at-rest • driven by pkcs11-toolSource Code | Docs |
| Network Covert Channel Data exfiltration techniques |
|
Covert channels • Data exfiltration • Steganography Learn More |
| Automated Penetration Testing Full pentest automation |
|
Pentest automation • Recon to exploitation • Report generation Learn More |
| Haskell Reverse Proxy Functional reverse proxy with security middleware |
 |
Functional programming • Reverse proxy design • Security middleware • Haskell Source Code |
| "Monitor the Situation" Dashboard Real-time cyber threat situational awareness |
|
Threat intel feeds • EPSS/KEV/CVE velocity • BGP hijacks • WebSocket fan-out • 3D globe SOC view Source Code | Docs  |
| Honeypot Network Multi-service honeypot deployment & analysis |
|
Honeypot deployment • Attacker behavior analysis • IOC extraction • MITRE mapping Source Code | Docs  |
| Supply Chain Security Analyzer Dependency vulnerability analysis |
|
Supply chain security • Dependency analysis • Malicious packages Learn More |
Learn More
Certification Roadmaps - Career paths for SOC Analyst, Pentester, Security Engineer, GRC Analyst, and 6 more tracks
Learning Resources - Tools, courses, certifications, YouTube channels, Reddit communities, and security frameworks
CertGames - The platform I built to do all of this in one place: practice questions, Learn lessons, guided projects, and these roadmaps with progress tracking. FREE