aicertificationcloud-engineeringcybercybersecuritycybersecurity-analystcybersecurity-certificationcybersecurity-certificationscybersecurity-educationcybersecurity-jobscybersecurity-portfoliocybersecurity-projectscybersecurity-toolsgrchackinglearningpentestingproject-repositoryprojetcspython
f0ce950ac8
Two independent audits of the same tree, one executed and one static. Both were
worth running: the static pass found seven real defects the executed pass missed,
including the worst one here, and the executed pass found three the static pass
could not see because seeing them required running Ruby.
The release workflow could publish from any branch. The publish job carried no ref
condition and its tag check read `[ tag != expected ] && [ event = push ]`, so on a
workflow_dispatch the second clause was false, the && never fired, and control fell
straight through to rubygems/release-gem. Anyone with the Actions tab could ship a
mutable branch checkout to rubygems.org. The job is now gated on a pushed
refs/tags/marshalsea-v* ref, the version check is unconditional, and the manifest is
audited before the push step with a negative control proving a drifted lib file
turns it red.
Three payloads ran attacker code while the detector reported proceed. A
String-subclass hash key reaching a user #eql?, measured {eql: 1}; a gadget nested
in a bare Array key, measured {hash: 1}, 22 bytes hand-built; and a Range whose
endpoints dispatch #<=>, measured {cmp: 1}. All three were accepted under
deny_sinks_only and under strict with the class allowlisted, which is the documented
normal usage. They are blocked under every policy now.
The oracle that missed them dumped `{ key => nil }`. One key means no bucket
collision, so #eql? could never fire in the probe no matter how many key shapes were
added. Blind by construction, the exact defect class this project already had a rule
about. The corpus went further and asserted the String-subclass case was a precision
control, a positive claim that rejecting it would be a false positive. It is a
reject now, and the key rules are re-derived from research 02 section 4.2 rather than
grown case by case.
Range endpoints marshal as bare `begin`/`end`, not `@begin`/`@end`, because Range
uses a marshal compat dumper. The first constant was wrong and the test caught it.
The scanner's reachability filter contradicted its own thesis. Requiring zero arity
for ungated entry points excluded eql?, ==, <=>, []=, method_missing and
respond_to_missing? entirely: 85 candidates across those rows, 0 reachable. Only
hash and to_s survived, and research 02 section 4.2 verified to_s is never an entry
point, so 11 of 18 reachable results were a method Marshal.load does not invoke.
Entry points are now a table carrying gate, format and the arity the deserializer
supplies; links are a third gate value and are reported separately instead of
scored as entry points. Gated hooks are arity-checked too, so an arity-0
marshal_load that would raise ArgumentError is no longer called reachable.
Marshal.load reaches a private self._load through rb_funcallv, which ignores
visibility, while singleton_methods(false) does not report it. Adding
singleton_class.private_instance_methods immediately found Time._load on a stock
image, a real stdlib sink the scanner had never seen. Prism is error tolerant and
parse_definitions consumed .value without checking failure?, so a tree recovered
from four syntax errors produced a confident touches_state verdict; it is a
suppression now.
The parser accepted ivar-name and struct-member-name slots holding a fixnum, a
string or an array, the detector said proceed, and CRuby then raised
ArgumentError, so the defended route answered 500. The parser stays forensic on
purpose, because a sink hidden where a symbol belongs must stay visible, so the
anomaly is labelled on Result and the detector rejects on it. The target also
rescues the loader rather than trusting inspection.
Three things the contract promised and did not have.
The headline payload was not a chain. It built an ERB object past the @_init guard
and then both demonstrations called def_method themselves, so the canary was not a
consequence of Marshal.load. Research 04 line 292 and 05 line 982 already said the
real chain reaches def_module through
ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy, and 05 line 1143 listed
reproducing it as open. erb-def-module does that: the proxy sits in hash-key
position, ungated #hash dispatch lands in method_missing, target calls
@instance.__send__(:def_module), and ERB compiles the payload inside Marshal.load
with no application call. The old builder stays as erb-def-method and is labelled a
primitive. Three things only execution showed: the proxy undefines
instance_variable_set so setup has to go through a bound Object method; a real
deprecator holds a Proc and cannot be dumped, so the chain hand-builds one with
@silenced true and warn short-circuits before touching @behavior; and building
{proxy => 1} fires the payload in the builder's own process, so serialize splices a
key-position stream from a standalone dump and refuses any graph carrying an object
link, whose index would shift behind the hash node.
LoadGuard is the M6 runtime guard. A TracePoint on :call fires before a method body
runs, which is the veto a Marshal.load proc cannot give you. It watches the gated
hooks plus method_missing and respond_to_missing?, because a hook list without those
two is evaded by a respond_to_missing? proxy. hash and eql? are opt-in behind
strict:, since they are among the hottest methods in Ruby and BoundaryDetector
already catches key-position dispatch before any bytes load. It raises a
StandardError, never a SecurityError that would skip every rescue in the stack.
Its cost is not 1.4x. That figure is a property of the payload that was measured,
not of the guard. Enabling a TracePoint costs a near-constant ~46 microseconds per
load, so the ratio is decided by how much work the load does: 185.9x on 3 bytes,
40.4x on a 45-byte session cookie, 1.1x on 46 KB, 1.0x on 488 KB. The lab's own use
case is a session cookie, which is the worst case. A dated correction is written
back into research 03.
The Psych half exists now. Psych::Inspector reads a document through parse_stream,
revives nothing, and reports every !ruby/* tag with the method it would dispatch,
bounded on bytes, depth, nodes, aliases and documents. psych-init-with is the
matching chain. The target grows /yaml/unsafe and /yaml/safe so the spine of this
project is executable over HTTP: the same ERB object reaches code execution through
YAML.unsafe_load, and YAML.safe_load refuses it by checking the tag before revival.
The gate proves both layers independently, including a document the inspector
approves that Psych still refuses, so neither can alibi the other.
The target ran attacker Ruby on Docker's default bridge with outbound access and
installed sinatra, rackup and webrick unversioned. It now runs on an internal
network with cap-drop ALL, no-new-privileges, pid and memory ceilings and pinned
versions, with a control proving it cannot reach off the host. Creating that network
also proved --internal blocks the published port, so the gate drives the target from
a second container on the same network instead. The HTTP gate asserted body prefixes
and never captured status; it asserts exact status and body per endpoint now, which
immediately caught a bug in this very change where a nil sentinel conflated "the
loader refused" with the legitimate value nil.
Smaller: Chains.all filtered out a Base that was never registered, so the filter was
inert and its test vacuous; chains are discovered by directory glob now, per the
design's no-registry-to-rot contract. AFFECTED was shallow frozen, and mutating
metadata[:affected][2] flipped affects?("5.0.0") from true to false. Limits.permissive
keeps a depth cap on purpose and now says so, because lifting it trades a rescuable
DepthLimitError for an uncatchable SystemStackError. The README claimed a fixnum
width rejection its own test proves is unreachable. Regexp options were discarded
while the node still reported fully_decoded?.
The README is rebuilt to the repository's shape, and Deserialization Gadget Lab
takes project 41 in the root table, replacing Ghost on the Wire. CHANGELOG.md is
dropped from the gem manifest, the metadata and the packaging gate.
Full gate: 78 PASS, 0 FAIL across six stages, up from 58. 267 tests across seven
suites, from 194. Lint 0 across 37 files. Every rule added here ships with the
mutant that kills it.
|
||
|---|---|---|
| .github | ||
| PROJECTS | ||
| RESOURCES | ||
| ROADMAPS | ||
| SYNOPSES | ||
| TEMPLATES | ||
| .clang-format | ||
| .gitguardian.yml | ||
| .gitignore | ||
| .gitmodules | ||
| .pre-commit-config.yaml | ||
| LICENSE | ||
| README.md | ||
README.md
Cybersecurity Projects 🐉
70 Cybersecurity Projects, Certification Roadmaps & Resources
Made possible by CertGames
View Complete Projects:
Currently building: DDoS Mitigation Tool
Quick Navigation
Projects
Hands-on cybersecurity projects with full source code, organized in four tiers — Foundations (pre-beginner, first-time programmers), Beginner, Intermediate, and Advanced.
Certification Roadmaps
10 structured career paths with certification guides for SOC Analyst, Pentester, Security Engineer, and more.
Learning Resources
Tools, courses, certifications, communities, and frameworks for cybersecurity professionals.
Projects
[!TIP] Want to be walked through building these instead of reading finished source? CertGames has guided project courses that build real security tools from scratch, step by step, with the concepts explained as you go. Same projects, less getting stuck. FREE
Foundations Projects
[!NOTE] Start here if this is your first time coding. The Foundations tier is pre-beginner — built for someone who has never written Python, has barely used a terminal, and is new to cybersecurity. Source files are heavily commented as a teaching aid, and every
learn/folder explains concepts from zero. Once you're comfortable here, the Beginner projects assume you already know the language and move faster.What makes Foundations different:
- Single-file projects — the entire tool lives in one readable Python file. No file-hopping.
- Heavy teaching comments — every line that introduces a new concept is annotated inline.
- Numpy-style docstrings on every function — what it does, why it exists, every parameter.
- Extra-deep
learn/folders — Python features and security concepts both explained from zero.- Senior-level code, beginner-level explanations — the code itself is still production-quality.
| Project | Info | What You'll Learn |
|---|---|---|
| Hash Identifier Identify hash types by prefix, length, and charset |
    |
Hash families (MD5, SHA, bcrypt, Argon2) • PHC string format • Pattern matching • Pure-function design Source Code | Docs |
| HTTP Headers Scanner Audit a URL's response headers for missing or weak security controls |
  |
HTTP fundamentals • Security headers (CSP, HSTS, X-Frame-Options) • httpx requests • Scored audits Source Code | Docs |
| Password Manager Encrypted local vault with master password unlock |
  |
Argon2id key derivation • AES-GCM authenticated encryption • Secure on-disk vaults • Master-password workflows Source Code | Docs |
Beginner Projects
| Project | Info | What You'll Learn |
|---|---|---|
| Simple Port Scanner Async TCP port scanner in C++ @deniskhud |
   |
TCP socket programming • Async I/O patterns • Service detection Source Code | Docs |
| Keylogger Capture keyboard events with timestamps |
|
Event handling • File I/O • Ethical considerations Source Code | Docs |
| Caesar Cipher CLI encryption/decryption tool |
|
Classical cryptography • Brute force attacks • CLI design Source Code | Docs |
| DNS Lookup CLI Tool Query DNS records with WHOIS |
 |
DNS protocols • WHOIS queries • Reverse DNS lookup Source Code | Docs |
| Simple Vulnerability Scanner Check software against CVE databases |
  |
CVE databases • Dependency scanning • Vulnerability assessment Source Code | Docs |
| Metadata Scrubber Tool Remove EXIF and privacy metadata @Heritage-XioN |
 |
EXIF data • Privacy protection • Batch processing Source Code | Docs |
| Network Traffic Analyzer Capture and analyze packets |
 |
Packet capture • Protocol analysis • Traffic visualization Source (C++) | Docs (C++) | Source (Python) | Docs (Python) |
| Hash Cracker Dictionary and brute-force cracking |
 |
Hash algorithms • Dictionary attacks • Password security Source Code | Docs |
| Steganography Multi-Tool Hide data in images, audio, QR, PDFs, text |
 |
Multi-format steganography • Encrypted AEAD envelope • Zero-width Unicode • Audio LSB • QR Reed-Solomon injection Source Code | Docs |
| Deserialization Gadget Lab Read untrusted Marshal and YAML without ever reviving it, then break it |
   |
Gadget chains • Marshal binary format • Gated vs ungated dispatch • TracePoint veto • CVE-2026-41316 Source Code | Docs  |
| Canary Token Generator Self-hosted honeytokens that alert on access |
 |
Deception defense • Honeytokens • MySQL wire protocol • PDF/DOCX patching • Webhook + Telegram alerting Source Code | Docs  |
| Phishing Domain Generator & Quishing Scanner Typosquat generation + QR phishing detection |
|
Homoglyph attacks • Typosquatting • QR code analysis • Domain intelligence Learn More |
| SSH Brute Force Detector Monitor and block SSH attacks |
|
Log parsing • Attack detection • Firewall automation Learn More |
| Simple C2 Beacon Command and Control beacon/server |
|
C2 architecture • MITRE ATT&CK • WebSocket protocol • XOR encoding Source Code | Docs |
| Base64 Encoder/Decoder Multi-format encoding tool |
 |
Base64/32 encoding • URL encoding • Auto-detection Source Code | Docs |
| Linux CIS Hardening Auditor CIS benchmark compliance checker |
 |
CIS benchmarks • System hardening • Compliance scoring • Shell scripting Source Code | Docs |
| Systemd Persistence Scanner Hunt Linux persistence mechanisms |
|
Persistence techniques • Systemd internals • Cron analysis • Threat hunting Source Code | Docs |
| Linux eBPF Security Tracer Real-time syscall tracing with eBPF |
 |
eBPF programs • Syscall tracing • BCC framework • Security observability Source Code | Docs |
| Trojan Application Builder Educational malware lifecycle demo |
|
Trojan anatomy • Data exfiltration • File encryption • Attack lifecycle Learn More |
| DNS Sinkhole Pi-hole-style malware domain blocker |
|
DNS protocol • Blocklist management • Query logging • Network defense Learn More |
| Firewall Rule Engine Parse and validate iptables/nftables rules |
 |
Firewall internals • Rule parsing • iptables/nftables • V language Source Code | Docs |
| LLM Prompt Injection Firewall Detect and block prompt injection attacks |
|
AI security • Prompt injection • Input sanitization • LLM defense Learn More |
Intermediate Projects
| Project | Info | What You'll Learn |
|---|---|---|
| Security News Scraper Aggregate cybersecurity news |
  |
Web scraping • CVE parsing • Database storage Source Code | Docs |
| Payload Obfuscation Engine Multi-layer payload obfuscation toolkit |
 |
Obfuscation techniques • Polymorphism • AV evasion • Signature detection Learn More |
| SIEM Dashboard Log aggregation with correlation |
 |
SIEM concepts • Log correlation • Full-stack development Source Code | Docs  |
| Token Abuse Playground 15+ token vulnerabilities to exploit and fix |
 |
JWT exploitation • OAuth attacks • Session security • Token forensics Learn More |
| Supply Chain Attack Simulator Fake PyPI package dependency confusion demo |
 |
Supply chain attacks • Dependency confusion • Package security • PyPI internals Learn More |
| DDoS Mitigation Tool Detect traffic spikes |
|
DDoS detection • Rate limiting • Anomaly detection Learn More |
| Secrets Scanner Scan codebases and git history for leaked secrets |
 |
Secret detection • Shannon entropy • HIBP k-anonymity • SARIF output Source Code | Docs |
| API Security Scanner Enterprise API vulnerability scanner |
|
OWASP API Top 10 • ML fuzzing • GraphQL/SOAP testing Source Code | Docs |
| Wireless Deauth Detector Monitor WiFi deauth attacks |
 |
Wireless security • Packet sniffing • Attack detection Learn More |
| Credential Enumeration Post-exploitation credential collection |
 |
Credential extraction • Browser forensics • Red team tooling • Nim language Source Code | Docs |
| Binary Analysis Tool Disassemble and analyze executables |
|
Binary analysis • String extraction • Malware detection Source Code | Docs  |
| Chaos Engineering Security Tool Inject security failures to test resilience |
|
Chaos engineering • Security resilience • Credential spraying • Auth testing Learn More |
| Credential Rotation Enforcer Track and enforce credential rotation policies |
 |
Credential hygiene • Secret rotation • Compliance dashboards • API integration Source Code | Docs |
| Race Condition Exploiter TOCTOU race condition attack & defense lab |
|
TOCTOU attacks • Double-spend bugs • Concurrent exploitation • Race visualization Learn More |
| JA3/JA4 TLS Fingerprinting Tool Fingerprint TLS clients by handshake |
|
TLS handshake analysis • JA3/JA4 hashing • Bot detection • Malware C2 identification Source Code | Docs  |
| Mobile App Security Analyzer Decompile and analyze mobile apps |
|
APK/IPA analysis • Reverse engineering • OWASP Mobile Learn More |
| DLP Scanner Data Loss Prevention for files, DBs, and traffic |
|
PII detection • GDPR/HIPAA compliance • Pattern matching • Data classification Source Code | Docs |
| Lua/Nginx Edge Backend Full CRUD backend via Lua in Nginx |
  |
Edge computing • OpenResty • Lua scripting • WAF • JWT at the edge Learn More |
| Privesc Playground 20+ privilege escalation paths to exploit |
|
SUID exploitation • Sudo abuse • Cron hijacking • GTFOBins • Capability abuse Learn More |
| SBOM Generator & Vulnerability Matcher Software Bill of Materials with CVE matching |
|
SPDX/CycloneDX formats • Dependency analysis • CVE databases • EO 14028 compliance Source Code | Docs |
| Subdomain Takeover Scanner Detect dangling DNS records |
|
DNS enumeration • CNAME analysis • Cloud resource claiming • Bug bounty Learn More |
| GraphQL Security Tester Automated GraphQL vulnerability testing |
|
Introspection attacks • Query depth DoS • Authorization bypass • Batching abuse Learn More |
| Docker Security Audit CIS Docker Benchmark scanner |
|
CIS benchmarks • Container security • Multiple output formats Source Code | Docs |
Advanced Projects
| Project | Info | What You'll Learn |
|---|---|---|
| API Rate Limiter Distributed rate limiting middleware |
   |
Token bucket algorithm • Distributed systems • Redis backend Source Code | Docs |
| Encrypted Chat Application Real-time E2EE messaging |
   |
Signal Protocol • Double Ratchet • WebAuthn • WebSockets Source Code | Docs |
| Exploit Development Framework Modular exploitation framework |
 |
Exploit development • Payload generation • Plugin architecture Learn More |
| AI Threat Detection ML-powered nginx threat detection |
 |
ML ensemble (AE + RF + IF) • ONNX inference • Real-time detection Source Code | Docs |
| Zingela Stateless Scanner Line-rate stateless mass TCP/UDP port scanner |
 |
Stateless SYN scanning • SipHash cookies • Cyclic-group permutation • AF_PACKET / AF_XDP Source Code | Docs |
| Bug Bounty Platform Full vulnerability disclosure platform |
 |
Full-stack development • CVSS scoring • Workflow automation Source Code | Docs  |
| Cloud Security Compliance Dashboard Multi-cloud compliance with CIS, SOC2, HIPAA |
 |
CIS benchmarks • SOC2/HIPAA compliance • Cost-security optimization • Drift detection Learn More |
| Malware Analysis Platform Automated sandbox analysis |
|
Malware analysis • Sandboxing • YARA rules • IOC extraction Learn More |
| Quantum Resistant Encryption Post-quantum cryptography |
|
Post-quantum algorithms • Hybrid encryption • Kyber/Dilithium Learn More |
| Zero Day Vulnerability Scanner Coverage-guided fuzzing |
|
Fuzzing • Vulnerability research • Crash triage Learn More |
| Distributed Password Cracker GPU-accelerated cracking |
 |
Distributed systems • GPU computing • Hash cracking Learn More |
| Kernel Rootkit Detection Detect kernel-level rootkits |
|
Kernel internals • Memory forensics • Rootkit detection Learn More |
| Blockchain Smart Contract Auditor Solidity vulnerability analysis |
 |
Smart contracts • Static analysis • Solidity security Learn More |
| Adversarial ML Attacker Generate adversarial examples |
 |
Adversarial ML • FGSM/DeepFool • Model robustness Learn More |
| Reverse-Engineering Reverse-engineering learning platform. |
|
Reverse Engineering • Disassembly • Dynamic & Static Analysis Source Code | Docs |
| Hardware Security Module Emulator Software HSM that compiles to a real PKCS#11 .so |
|
PKCS#11/Cryptoki C ABI (machine-checked vs OASIS headers) • AES-GCM/CBC • RSA/ECDSA/ECDH • Argon2id + encrypted-at-rest • driven by pkcs11-toolSource Code | Docs |
| Network Covert Channel Data exfiltration techniques |
|
Covert channels • Data exfiltration • Steganography Learn More |
| Automated Penetration Testing Full pentest automation |
|
Pentest automation • Recon to exploitation • Report generation Learn More |
| Haskell Reverse Proxy Functional reverse proxy with security middleware |
 |
Functional programming • Reverse proxy design • Security middleware • Haskell Source Code |
| "Monitor the Situation" Dashboard Real-time cyber threat situational awareness |
|
Threat intel feeds • EPSS/KEV/CVE velocity • BGP hijacks • WebSocket fan-out • 3D globe SOC view Source Code | Docs  |
| Honeypot Network Multi-service honeypot deployment & analysis |
|
Honeypot deployment • Attacker behavior analysis • IOC extraction • MITRE mapping Source Code | Docs  |
| Supply Chain Security Analyzer Dependency vulnerability analysis |
|
Supply chain security • Dependency analysis • Malicious packages Learn More |
Learn More
Certification Roadmaps - Career paths for SOC Analyst, Pentester, Security Engineer, GRC Analyst, and 6 more tracks
Learning Resources - Tools, courses, certifications, YouTube channels, Reddit communities, and security frameworks
CertGames - The platform I built to do all of this in one place: practice questions, Learn lessons, guided projects, and these roadmaps with progress tracking. FREE