[subject_003] // Custom Scripts & Hacking Hardware

Hands-on Projects.

A showcase of automated reconnaissance scripts, hardware research modules, and vulnerability sandbox lab builds.

[001] / repositories

ReconScanner Python

Multi-threaded TCP port scanner & service fingerprinting. Automates banner grabbing and web directory enumeration.

Reconnaissance Sockets Automation

NFCEmulator C++

Hardware verification with ESP32, Arduino & PN532. Parses tag responses, extracts UID metadata, emulates HF/LF tags.

Arduino ESP32 Hardware

SecLab Docker

Lightweight pentest lab deployable in one command. Docker-based exploit testing and CTF setup checks.

Docker Vulnerability Bash

Network Traffic Analysis Lab Wireshark/Zeek

Analyzed malicious PCAPs using Wireshark and Zeek to identify DNS tunneling, HTTP attacks, C2 communication, and suspicious activity. Documented IOCs and mitigation recommendations.

PCAP DNS Tunneling C2

Log Analysis & Threat Hunting Lab Sigma

Investigated Windows Event Logs and web server logs for authentication failures, suspicious processes, and privilege escalation. Created custom Sigma rules for attack detection.

Windows Event Logs Sigma Threat Hunting

Python Security Tools Python

Developed a multi-threaded TCP port scanner with service detection and an asynchronous web enumeration tool for reconnaissance and CTF environments.

Port Scanner Async CTF

WinEventDump Python

Built a Python tool for EVTX analysis, threat detection, event classification, and forensic data export.

EVTX Forensics Threat Detection

XSS Laboratories HTML/JS

Developed hands-on labs covering Reflected, Stored, and DOM-based XSS, filter evasion, exploitation, and mitigation.

XSS Web Security Labs

NFC Security Research C++

Built an NFC testing environment using ESP32/Arduino and PN532 to study UID extraction, tag behavior, and emulation vulnerabilities.

ESP32 PN532 RFID

Python · Reconnaissance

ReconScanner

Python

Reconnaissance Sockets Automation

A multi-threaded TCP port scanner and service fingerprinting tool that automates banner grabbing and web directory enumeration.

What it does

ReconScanner performs fast SYN scans using customizable thread pools, trading raw speed for configurability depending on the target's size and sensitivity.

Once a port responds, it extracts the service banner and hands off to a lightweight HTTP directory buster, so reconnaissance and enumeration happen in a single pass instead of two separate tool runs.

Key features

JSON output for easy piping into other tools
Real-time progress reporting during long scans
A CVE lookup placeholder for future integration with vulnerability databases

It's been used in internal pentests as a first-pass recon step before deeper manual testing begins.

C++ · Hardware

NFCEmulator

C++

Arduino ESP32 Hardware

Hardware verification work built on ESP32, Arduino, and the PN532 module — parsing tag responses, extracting UID metadata, and emulating HF/LF tags.

What it does

NFCEmulator emulates MIFARE Classic and low-frequency tags, with firmware design inspired by the Proxmark3 project.

The goal was a cheap, reproducible setup for testing how access-control hardware reacts to cloned or malformed tag data, without needing a commercial-grade rig.

Use cases

Physical security audits of badge and access systems
Cloning research for understanding tag vulnerabilities
IoT protocol fuzzing against NFC/RFID readers

Docker · Vulnerability Lab

SecLab

Docker

Docker Vulnerability Bash

A lightweight pentest lab that deploys in a single command — Docker-based exploit testing and CTF setup checks, ready in minutes.

What it does

SecLab bundles intentionally vulnerable services like DVWA and Juice Shop together with attacker tooling, so a full practice environment spins up without manually wiring containers together each time.

Included

Isolated networks per scenario, so labs don't interfere with each other
Automated scoring scripts for tracking progress through challenges
Customizable scenarios for red team / blue team practice

It's primarily meant as a fast way to reset to a clean state between practice sessions, rather than a long-running production-style lab.

Wireshark / Zeek · Network Forensics

Network Traffic Analysis Lab

Wireshark/Zeek

PCAP DNS Tunneling C2

Analyzed malicious PCAPs using Wireshark and Zeek to identify DNS tunneling, HTTP attacks, C2 communication, and suspicious activity. Documented IOCs and mitigation recommendations.

What it covers

This lab focuses on real-world traffic analysis: dissecting DNS tunneling patterns, reconstructing HTTP-based attacks, and detecting command-and-control channels through behavioral indicators.

Zeek scripts were used to extract protocol metadata while Wireshark provided deep packet inspection for suspicious flows. IOCs were cataloged and mapped to mitigation strategies.

Key outcomes

Identified DNS tunneling via abnormally long TXT queries and high-entropy subdomains
Detected HTTP attacks including SQLi and webshell upload attempts
Isolated C2 beaconing using periodic connections and JA3 fingerprints

Sigma · Threat Hunting

Log Analysis & Threat Hunting Lab

Sigma

Windows Event Logs Sigma Threat Hunting

Investigated Windows Event Logs and web server logs for authentication failures, suspicious processes, and privilege escalation. Created custom Sigma rules for attack detection.

What it does

This lab simulates a threat hunting workflow: ingesting Windows Security, System, and web server logs to surface signs of intrusion. Custom Sigma rules were authored to detect common attack patterns.

Detection highlights

Detected brute-force attempts via failed logon events (4625) and successful logon after multiple failures
Identified suspicious process creation (4688) including encoded PowerShell commands
Flagged privilege escalation through special privileges assigned (4672) and token manipulation
Created Sigma rules for web shell activity and unusual parent-child process relationships

Python · Reconnaissance & CTF

Python Security Tools

Python

Port Scanner Async CTF

Developed a multi-threaded TCP port scanner with service detection and an asynchronous web enumeration tool for reconnaissance and CTF environments.

What it does

This toolkit includes a high-speed TCP port scanner using threading for concurrency, with optional banner grabbing and service fingerprinting. A companion async web enumeration tool brute-forces directories and files, built for speed in CTF and lab environments.

Key features

Multi-threaded scanner with adjustable thread pool size
Service detection via banner grabbing and probe matching
Asynchronous web fuzzer using aiohttp for high concurrency
Modular design for easy extension and integration into other pipelines

Python · Windows Forensics

WinEventDump — Windows Forensics Tool

Python

EVTX Forensics Threat Detection

Built a Python tool for EVTX analysis, threat detection, event classification, and forensic data export.

What it does

WinEventDump parses Windows Event Log (EVTX) files to extract, classify, and surface security-relevant events. It applies heuristic rules to identify suspicious activity and supports exporting filtered data for further analysis.

Capabilities

Fast EVTX parsing with support for large log files
Threat detection rules for common attack patterns (e.g., log clearing, service installation, scheduled tasks)
Event classification and tagging for easier triage
Export to JSON/CSV for integration with SIEM or forensic tools

HTML / JavaScript · Web Security

XSS Laboratories — Web Security Labs

HTML/JS

XSS Web Security Labs

Developed hands-on labs covering Reflected, Stored, and DOM-based XSS, filter evasion, exploitation, and mitigation.

What it includes

XSS Laboratories provides a series of interactive challenges that demonstrate each type of cross-site scripting. Each lab includes a vulnerable implementation, exploitation steps, and recommended mitigations.

Lab modules

Reflected XSS: from basic payload to filter bypass techniques
Stored XSS: persistent attack vectors and session hijacking scenarios
DOM-based XSS: client-side sinks and source manipulation
Mitigation: output encoding, CSP, and secure coding practices

C++ · NFC / RFID Security

NFC Security Research

C++

ESP32 PN532 RFID

Built an NFC testing environment using ESP32/Arduino and PN532 to study UID extraction, tag behavior, and emulation vulnerabilities.

What it does

This research platform uses an ESP32 and PN532 NFC module to read, parse, and emulate various RFID/NFC tags. It focuses on understanding how UIDs are structured and how access control systems may be bypassed or spoofed.

Research areas

UID extraction and metadata analysis from MIFARE Classic and Ultralight tags
Tag emulation for testing reader behavior and potential cloning attacks
Protocol fuzzing to identify parsing vulnerabilities in NFC readers
Low-cost hardware alternative to commercial NFC research tools