Lab Portfolio — hands-on projects

"I built an isolated VirtualBox lab with Kali attacking Metasploitable 2. I ran the full kill chain — netdiscover and nmap for recon, found vsftpd 2.3.4 and Samba 3.x, exploited CVE-2011-2523 and CVE-2007-2447 via Metasploit, got a root shell, and extracted /etc/shadow. It was my first complete penetration test and made the MITRE ATT&CK kill chain concrete."

"I was given a PCAP from a phishing incident — customer data leaked to Pastebin. Using Wireshark and TShark I traced it backwards: found the phishing email, extracted a malicious PDF (41/64 VT detection, two Adobe Reader CVEs), found two compromised internal users, and traced 1.2 MB of PII being exfiltrated. Reconstructed the full five-phase attack timeline."

"I audited my own home network in Zürich using Kali in bridged mode. Found 10 live hosts, ran nmap service discovery, and found a real finding: a Bang & Olufsen BeoPlay A9 with an unauthenticated admin panel, SSL cert expired 1999. Also found UPnP enabled on the router. Documented a Hydra false positive to show the difference between noise and a real finding. Full written report with remediation."

"Two certificate analysis exercises. First: full port scan found 6 open ports, nmap NSE scripts extracted TLS certificates from each, found wildcard and expired certs, telnet HTTP probing. Second: sslyze deep analysis, 25 cipher suites audited via CSV, OpenSSL CRL revocation chain verification, revoked intermediate CA identified. PKI analysis from port discovery to chain of trust."

"I deployed Wazuh SIEM/XDR, enrolled Kali as an agent, and ran the full capability suite. Diagnosed a real service failure — indexer RAM saturation causing manager timeout — fixed with systemd delay. Results: 258 MITRE-tagged events, 190-control CIS Benchmark at 45%, 7,958 files under FIM, one High CVE. Architecturally identical to Microsoft Sentinel or Splunk."

"I built a complete phishing attack chain to understand how attacks are constructed — the foundation for defending against them. Infrastructure with Ngrok and Cloudflared, credential capture with Zphisher and SET, GoPhish campaign end-to-end, delivery via swaks, tracking opens and credential submissions. All six phases of MITRE T1566 covered and documented."

"I built a complete enterprise email security stack — Proxmox Mail Gateway, Postfix, Dovecot, SpamAssassin, ClamAV — from scratch in VirtualBox. Then ran the same attacks from Lab 06 through it and documented what was caught, what scored, and what got through. Offensive and defensive perspective on the same event chain."

"Two-phase exercise: SMB pentest to Pwn3d!, then full defender forensic reconstruction. Phase one: nmap found SMB signing not required, Hydra brute-forced bornia02, CrackMapExec RID brute got 5 accounts, achieved Pwn3d! as Administrator. Phase two: Eric Zimmerman tools parsed Prefetch, AmCache, and Event Logs — reconstructed the full attack chain from artifacts. Found Event 4740 lockout triggered in under one second."

"Used impacket-psexec to achieve SYSTEM shell on WIN10TEST via lateral movement. Two sessions — Defender caught the second one. Then forensics: Event 7045 in System.evtx (not Security), Event 4624 Type 3, Prefetch, registry service key survived cleanup. Critical finding: impacket drops a randomly named binary, not PSEXESVC.EXE — that's how defenders get fooled. Event Logs preserved the full chain even after self-cleanup."

"HSTS lab from Module 6. Part one: deployed Nginx in Docker, configured HSTS three ways — basic, includeSubDomains, preload — verified headers with curl. Part two: ran SSL stripping with mitmproxy to show exactly what HSTS prevents — credentials visible in plaintext at the attacker. Both offensive and defensive perspective on the same protection."

"Full DFIR engagement using KAPE — collected 3,303 artifacts, 1.6 GB in 13 minutes. Reconstructed the complete attack chain from Labs 8 and 9 across five forensic sources. Key organic finding: Event 4739 showed the attacker modified the lockout policy mid-attack to disable account lockout — T1562.001 defense evasion. Produced 22-tool SOC cheat sheet and nine interactive drill widgets."

"I ran a structured web app audit across two platforms — OWASP Juice Shop self-hosted in Docker, and the PortSwigger Web Security Academy — driving everything through Burp Suite. I exploited the OWASP Top 10 by hand: SQL injection (login auth-bypass and UNION-based extraction), XSS (DOM and reflected), broken access control (IDOR, forced browsing, path traversal), CSRF, and username enumeration. I automated a credential attack with Burp Intruder, then moved from guided labs toward real targets by registering on Swiss bug-bounty VDP programs."

"After learning to break web apps, I worked the defensive side as timed exam scenarios: diagnosing and fixing a broken Content Security Policy to shut down XSS, and hardening a web server's configuration and security headers. I turned each into a reusable playbook in Obsidian — a Web App Pentest playbook, a CSP playbook, and a Hardening playbook — so the fix is repeatable under exam pressure, not improvised."

"I was given a 128 MB Windows XP memory image. Standard process-tree analysis found nothing — names, paths, and parents were all legitimate, because Zeus hides by injecting into real processes. So I pivoted to behaviour: connscan showed svchost (PID 856) talking to a C2 server, which it has no business doing. malfind then proved injected code — an RWX private region starting with an MZ header. I extracted it with vaddump (not procdump, which only rebuilds the clean host shell) and confirmed Zeus/Zbot at 63 of 71 on VirusTotal. Following the persistence file led me to a second injected process, winlogon. The verdict came from the evidence chain, not the AV score."

"I stood up a Pi-hole DNS sinkhole on a Raspberry Pi 5 and hardened it like a production server: key-only SSH on a non-default port, UFW default-deny, fail2ban, and unattended security updates. It filters a 2.3-million-domain blocklist network-wide — around 24% of queries blocked, including Microsoft and Edge telemetry endpoints I confirmed in the query log. I reserved a static IP, wrote failover DNS scripts for my laptop, and verified the whole thing wasn't an exposed open resolver with an external GRC ShieldsUP! scan — all 1056 ports came back stealth."