Projects, with the evidence behind them
Substantial projects and assessments live here. Each case explains the question, method, evidence, and what the work taught me.
VulnBank — Application Security Assessment
“Can I trace an application security issue from request to root cause?”
webapi
Key findings
- Team engagement of 12 testers, rated Critical overall
- Financial manipulation and account takeover paths
- Mobile and source-code security review
critical
completedOpen case
vAPI — API Security Assessment
“How much trust does an API place in client-controlled requests?”
apiweb
Key findings
- 13 confirmed findings across API and Arena challenges
- Authentication and authorization failure analysis
- Evidence-driven remediation and reporting
critical
completedOpen case
crAPI — API Security Investigation
“How much trust does the application place in client-controlled API requests?”
apiweb
Key findings
- BOLA/IDOR on vehicle data
- JWT alg:none token acceptance
- Mass assignment and injection
critical
completedOpen case
OWASP Juice Shop — Web Application Security
“What changes when the browser is no longer treated as a trusted boundary?”
web
Key findings
- HTTP request analysis
- Client/server trust boundaries
- Manual vulnerability validation
completedOpen case
Windows Authentication Detection & Triage Lab
“What does a failed logon look like to the analyst, and how do they decide what it means?”
defensivedetection
Key findings
- Two cases: local triage, then a real remote attack
- Correlated 9 failures to a success from one source
- Caught Wazuh mislabelling a brute force as pass-the-hash
in progressOpen case
No cases in this domain yet.