Repository navigation
Expand file tree
/
Copy pathindex.html
More file actions
1262 lines (1157 loc) · 70.6 KB
/
Copy pathindex.html
File metadata and controls
1262 lines (1157 loc) · 70.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!doctype html>
<html lang="en" data-theme="auto">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
<title>Rahil Sahu — Application Security Engineer / Penetration Tester</title>
<meta name="description" content="Rahil Sahu is an Application Security Engineer in Indore, India, specialising in VAPT and security architecture review for web, API, mobile and network. 4+ years, 700+ validated findings, CEH-certified.">
<meta name="author" content="Rahil Sahu">
<link rel="canonical" href="https://rahilsahu.github.io/">
<!-- Security headers deliverable via meta (GitHub Pages does not permit custom HTTP headers).
HSTS and X-Frame-Options must be set at the server / edge; frame-ancestors covers framing. -->
<!-- CSP: the inline hash below covers the JSON-LD Person block only. Recompute if that block changes. -->
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' 'sha256-zPXuOCJPYXerAUbF6aGOjyPkcseN+qzuxT5hQcKkTB8='; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://api.web3forms.com; base-uri 'self'; form-action https://api.web3forms.com; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests">
<meta http-equiv="X-Content-Type-Options" content="nosniff">
<meta name="referrer" content="strict-origin-when-cross-origin">
<meta http-equiv="Permissions-Policy" content="camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()">
<!-- Open Graph / social -->
<meta property="og:type" content="profile">
<meta property="og:title" content="Rahil Sahu — Application Security Engineer">
<meta property="og:description" content="VAPT and security architecture: web, API, mobile, network. 4+ years, 700+ validated findings.">
<meta property="og:url" content="https://rahilsahu.github.io/">
<meta property="og:locale" content="en_IN">
<meta name="twitter:card" content="summary">
<!-- Icons & manifest -->
<link rel="icon" href="assets/favicon.svg" type="image/svg+xml">
<link rel="manifest" href="site.webmanifest">
<meta name="theme-color" content="#0B0F14" media="(prefers-color-scheme: dark)">
<meta name="theme-color" content="#F2F0E9" media="(prefers-color-scheme: light)">
<link rel="stylesheet" href="assets/styles.css?v=20261108a">
<link rel="stylesheet" href="assets/palette.css?v=20261108a">
<!-- Additive enhancement layer: book cover page-turn, liquid glass, ambient graphics.
enhance.js is intentionally NOT deferred — it sets the boot class before first
paint so the page never flashes ahead of the cover. Both files are same-origin,
so the existing CSP ('self') already covers them. -->
<link rel="stylesheet" href="assets/enhance.css?v=20261108a">
<script src="assets/enhance.js?v=20261108a"></script>
<!-- JSON-LD: Person -->
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "Person",
"name": "Rahil Sahu",
"jobTitle": "Application Security Engineer",
"url": "https://rahilsahu.github.io/",
"sameAs": [
"https://www.linkedin.com/in/rahilsahu",
"https://github.com/RahilSahu"
],
"address": {
"@type": "PostalAddress",
"addressLocality": "Indore",
"addressRegion": "Madhya Pradesh",
"addressCountry": "IN"
},
"knowsAbout": [
"Penetration Testing", "VAPT", "OWASP Top 10", "API Security",
"Mobile Security", "Cloud Security", "ISO 27001", "SIEM", "SAST/DAST",
"Security Architecture Review", "Threat Modeling", "Product Security",
"Secure SDLC", "Authentication Architecture", "RBAC"
]
}
</script>
</head>
<body>
<div id="veil" aria-hidden="true"><span class="veil-mark">[rs]</span></div>
<div class="scroll-progress" id="scrollProgress" aria-hidden="true"></div>
<canvas id="matrixCanvas" class="matrix-canvas" aria-hidden="true"></canvas>
<a class="skip-link" href="#main">Skip to content</a>
<header class="site-header">
<div class="wrap header-inner">
<a class="brand" href="#top" aria-label="Rahil Sahu — home">
<span class="brand-mark" aria-hidden="true">
<span class="brand-bracket">[</span><span class="brand-initials">rs</span><span class="brand-bracket">]</span>
</span>
<span class="brand-text">
<span class="brand-name">Rahil Sahu</span>
<span class="brand-role">Application Security Engineer</span>
</span>
</a>
<nav class="site-nav" id="primaryNav" aria-label="Primary">
<a href="#practice">Practice</a>
<a href="#experience">Experience</a>
<a href="#projects">Projects</a>
<a href="#toolchain">Toolchain</a>
<a href="#credentials">Credentials</a>
<a href="#playground">Playground</a>
<a href="lab.html">Lab</a>
<a href="#learn">Learn</a>
<a href="#ai-sec">AI</a>
<a href="#engagement">Contact</a>
<a href="automation.html">Automation</a>
<a href="matrix.html">Matrix</a>
</nav>
<div class="header-actions">
<a class="btn btn-ghost btn-small" href="resume.pdf" download="Rahil_Sahu_Resume.pdf">Résumé</a>
<button class="nav-toggle" id="navToggle" type="button" aria-label="Toggle navigation menu" aria-expanded="false" aria-controls="primaryNav">
<span aria-hidden="true"></span>
</button>
<button class="fx-toggle" id="fxToggle" type="button" aria-label="Toggle matrix animation" aria-pressed="true" title="Toggle matrix rain">
<span class="fx-dot" aria-hidden="true"></span>
<span class="fx-label">fx</span>
</button>
<button class="theme-toggle" id="themeToggle" type="button" aria-label="Toggle colour theme" aria-pressed="false">
<span class="theme-toggle-track" aria-hidden="true"></span>
<span class="theme-toggle-label" data-label-light="light" data-label-dark="dark">auto</span>
</button>
</div>
</div>
</header>
<main id="main">
<!-- ================== 00 · HERO ================== -->
<section class="hero" id="top" aria-labelledby="hero-title">
<div class="wrap hero-grid">
<div class="hero-copy">
<p class="section-tag"><span class="section-tag-num">00</span> engagement summary</p>
<p class="avail-badge"><span class="avail-dot" aria-hidden="true"></span>Open to remote roles</p>
<h1 class="hero-title" id="hero-title" data-glitch="Adversarial testing">
<span class="hero-title-accent" aria-hidden="true"></span>
Adversarial testing<br>
for teams that ship.
</h1>
<p class="hero-lead">
I'm Rahil Sahu — an Application Security Engineer based in Indore, India.
I run VAPT on web, API and mobile applications, validate real exploitability,
and translate findings into remediation that fits engineering deadlines.
I'm currently open to full-time remote roles in penetration testing and application security.
</p>
<div class="hero-metrics" role="list" aria-label="Career metrics">
<div class="metric" role="listitem">
<span class="metric-value" data-count-to="700">700<span class="metric-plus">+</span></span>
<span class="metric-label">validated findings</span>
</div>
<div class="metric" role="listitem">
<span class="metric-value" data-count-to="86">86</span>
<span class="metric-label">Critical <span class="sev-dot sev-crit" aria-hidden="true"></span></span>
</div>
<div class="metric" role="listitem">
<span class="metric-value" data-count-to="194">194</span>
<span class="metric-label">High <span class="sev-dot sev-high" aria-hidden="true"></span></span>
</div>
<div class="metric" role="listitem">
<span class="metric-value" data-count-to="300">300<span class="metric-plus">+</span></span>
<span class="metric-label">TPRM assessments</span>
</div>
<div class="metric" role="listitem">
<span class="metric-value" data-count-to="4">4<span class="metric-plus">+</span></span>
<span class="metric-label">years in practice</span>
</div>
</div>
<div class="hero-actions">
<a class="btn btn-primary" href="#engagement">Request an engagement</a>
<a class="btn btn-ghost" href="resume.pdf" download="Rahil_Sahu_Resume.pdf">Download résumé (PDF)</a>
</div>
</div>
<aside class="hero-terminal" aria-label="Example engagement output">
<div class="terminal">
<div class="terminal-chrome">
<span class="terminal-dot" aria-hidden="true"></span>
<span class="terminal-dot" aria-hidden="true"></span>
<span class="terminal-dot" aria-hidden="true"></span>
<span class="terminal-title">engagement.log</span>
<button class="terminal-copy" id="terminalCopy" type="button" aria-label="Copy sample output">copy</button>
</div>
<pre class="terminal-body" id="terminalBody" aria-hidden="false"><span class="tp">rahil@lab</span>:<span class="tc">~/engagements/2026-Q2</span>$ ./run --scope target.example
<span class="tm">[+]</span> passive recon complete <span class="tm">247</span> endpoints
<span class="tm">[+]</span> fingerprint nginx 1.24.0 / node 18.x
<span class="tm">[+]</span> owasp top 10 mapped 10/10 checks queued
<span class="tm">[+]</span> owasp api top 10 mapped 10/10 checks queued
<span class="tm">[+]</span> authenticated crawl burp + custom fuzzers
<span class="tw">[!]</span> <span class="sc">critical</span> broken access control auth-bypass on /admin/users/:id
<span class="tw">[!]</span> <span class="sh">high</span> ssrf via redirect_uri callback to metadata endpoint
<span class="tw">[!]</span> <span class="sh">high</span> insecure direct object ref host header trust in reset flow
<span class="tw">[!]</span> <span class="sm">medium</span> weak jwt signature check alg=none accepted by /v2/session
<span class="tm">[+]</span> retested after fix 7 days, all resolved
<span class="tm">[+]</span> report drafted findings/2026-Q2-target.pdf</pre>
</div>
<p class="terminal-note">Illustrative output. Real engagements are covered by NDA.</p>
</aside>
</div>
</section>
<!-- ================== 01 · PRACTICE ================== -->
<section class="section" id="practice" aria-labelledby="practice-title">
<div class="wrap">
<p class="section-tag"><span class="section-tag-num">01</span> practice areas</p>
<h2 class="section-title" id="practice-title">What I test, and how I test it.</h2>
<p class="section-lead">Every engagement is scoped to a recognised standard so findings translate cleanly into a remediation plan the team can act on.</p>
<div class="matrix-wrap">
<table class="matrix">
<thead>
<tr>
<th scope="col">Scope</th>
<th scope="col">Standard</th>
<th scope="col">Primary tools</th>
<th scope="col">Deliverable</th>
</tr>
</thead>
<tbody>
<tr>
<th scope="row"><span class="matrix-scope">Web applications</span></th>
<td data-label="Standard">OWASP Top 10 · WSTG</td>
<td data-label="Primary tools">Burp Suite, SQLMap, Nuclei, Nessus</td>
<td data-label="Deliverable">Prioritised findings + retest</td>
</tr>
<tr>
<th scope="row"><span class="matrix-scope">APIs (REST / GraphQL)</span></th>
<td data-label="Standard">OWASP API Security Top 10</td>
<td data-label="Primary tools">Burp Suite, HTTPx, custom Python fuzzers</td>
<td data-label="Deliverable">Risk-scored report + secure spec review</td>
</tr>
<tr>
<th scope="row"><span class="matrix-scope">Mobile (Android / iOS)</span></th>
<td data-label="Standard">OWASP MASVS / MSTG</td>
<td data-label="Primary tools">MobSF, Frida, Objection, JADX</td>
<td data-label="Deliverable">Static + dynamic review, hooks and PoC</td>
</tr>
<tr>
<th scope="row"><span class="matrix-scope">Network & infrastructure</span></th>
<td data-label="Standard">PTES · NIST SP 800-115</td>
<td data-label="Primary tools">Nmap, Nessus, Wireshark, Metasploit</td>
<td data-label="Deliverable">External + internal, hardening guidance</td>
</tr>
<tr>
<th scope="row"><span class="matrix-scope">Cloud (Azure / AWS / GCP)</span></th>
<td data-label="Standard">CIS Benchmarks · CSA CCM</td>
<td data-label="Primary tools">SentinelOne CSPM, CloudBrute, native tooling</td>
<td data-label="Deliverable">Config review + IAM + logging validation</td>
</tr>
<tr>
<th scope="row"><span class="matrix-scope">Security architecture</span></th>
<td data-label="Standard">Threat modelling · secure design review</td>
<td data-label="Primary tools">Data-flow & trust-boundary analysis, design walkthroughs</td>
<td data-label="Deliverable">Threats + required controls, pre-implementation</td>
</tr>
<tr>
<th scope="row"><span class="matrix-scope">Source code review</span></th>
<td data-label="Standard">Secure SDLC · CWE Top 25</td>
<td data-label="Primary tools">SonarQube, SonarCloud, Snyk, CodeAnt.ai</td>
<td data-label="Deliverable">Findings mapped to code, PR-ready fixes</td>
</tr>
</tbody>
</table>
</div>
<div class="sevdist" role="img" aria-label="Validated findings by severity: 86 critical, 194 high, 420 medium and low, out of more than 700 total">
<p class="sevdist-title">700+ validated findings, by severity</p>
<div class="sevdist-row">
<span class="sevdist-label">Critical</span>
<span class="sevdist-bar" aria-hidden="true"><span class="sevdist-fill sev-crit sev-w-crit"></span></span>
<span class="sevdist-num">86</span>
</div>
<div class="sevdist-row">
<span class="sevdist-label">High</span>
<span class="sevdist-bar" aria-hidden="true"><span class="sevdist-fill sev-high sev-w-high"></span></span>
<span class="sevdist-num">194</span>
</div>
<div class="sevdist-row">
<span class="sevdist-label">Medium / Low</span>
<span class="sevdist-bar" aria-hidden="true"><span class="sevdist-fill sev-medlow sev-w-medlow"></span></span>
<span class="sevdist-num">420+</span>
</div>
</div>
<h3 class="sub-title">Security architecture & design review</h3>
<p class="section-lead">Engaged before code is written: reviewing proposed designs, modelling threats and defining the controls a feature needs, so architectural risk is closed at design time rather than found in a pentest.</p>
<div class="also-grid">
<div class="also-card">
<h3 class="also-title">Authentication architecture</h3>
<p>JWT design and review across token lifecycle, expiry, refresh-token handling, signature validation, claims, key management and secure storage. MFA review covering enrollment, OTP/TOTP handling, recovery, session binding and bypass paths.</p>
</div>
<div class="also-card">
<h3 class="also-title">Authorization & trust boundaries</h3>
<p>RBAC and least-privilege design, API authorization, session management. Trust-boundary and data-flow review targeting broken access control, IDOR/BOLA, privilege escalation and authentication bypass before they ship.</p>
</div>
<div class="also-card">
<h3 class="also-title">File handling & data protection</h3>
<p>Upload architecture controls: file-type validation, content inspection, size limits, secure storage, access control, filename handling and prevention of malicious file execution — plus encryption and sensitive-data protection requirements.</p>
</div>
<div class="also-card">
<h3 class="also-title">Threat modelling</h3>
<p>Attack-surface analysis across application components, APIs, authentication flows and data-processing workflows, with security requirements defined per feature and reusable design patterns fed back to the teams.</p>
</div>
</div>
<h3 class="sub-title">Beyond testing</h3>
<div class="also-grid">
<div class="also-card">
<h3 class="also-title">Security programme support</h3>
<p>Third-party risk management, ISO 27001 / GDPR / HIPAA evidence gathering, and 300+ vendor security questionnaires completed end-to-end.</p>
</div>
<div class="also-card">
<h3 class="also-title">SecOps & monitoring</h3>
<p>Wazuh SIEM deployment (Docker) with VirusTotal integration, Cloudflare WAF tuning, SentinelOne EDR/CSPM operation, DefectDojo for vulnerability management.</p>
</div>
<div class="also-card">
<h3 class="also-title">Awareness & training</h3>
<p>GoPhish and Evilginx phishing simulations, secure coding sessions for engineering teams, and remediation walkthroughs with developers.</p>
</div>
</div>
</div>
</section>
<!-- ================== 02 · EXPERIENCE ================== -->
<section class="section section-alt" id="experience" aria-labelledby="experience-title">
<div class="wrap">
<p class="section-tag"><span class="section-tag-num">02</span> engagements</p>
<h2 class="section-title" id="experience-title">Where I've done the work.</h2>
<ol class="timeline">
<li class="timeline-item">
<div class="timeline-meta">
<span class="timeline-date">May 2024 — present</span>
<span class="timeline-loc">Indore, India</span>
</div>
<div class="timeline-body">
<h3 class="timeline-role">Penetration Tester</h3>
<p class="timeline-org">TeamLease RegTech Pvt. Ltd.</p>
<ul class="timeline-points">
<li>Sole information-security resource: end-to-end responsibility across programme, tooling and validation.</li>
<li>Ran VAPT across web, mobile (Android/iOS) and API surfaces; reported <strong>86 Critical</strong> and <strong>194 High</strong> findings against OWASP Top 10 and API Security Top 10.</li>
<li>Own security architecture and design review: threat modelling, JWT and MFA authentication design, RBAC and API authorization, file-upload controls and trust-boundary analysis — carried out at design time with product and engineering.</li>
<li>Deployed Wazuh SIEM in Docker with VirusTotal integration; operated Cloudflare WAF, SentinelOne EDR/CSPM, and DefectDojo for vulnerability lifecycle management on Microsoft Azure infrastructure.</li>
<li>Stood up secure remote access via JumpServer and OpenRport; implemented SAST/DAST with SonarQube, SonarCloud, Snyk and CodeAnt.ai.</li>
<li>Ran phishing simulations with GoPhish and Evilginx; completed <strong>300+ TPRM</strong> vendor assessments; led secure coding training and cross-team remediation.</li>
</ul>
</div>
</li>
<li class="timeline-item">
<div class="timeline-meta">
<span class="timeline-date">Sep 2022 — May 2024</span>
<span class="timeline-loc">Indore, India</span>
</div>
<div class="timeline-body">
<h3 class="timeline-role">Cyber Security Analyst</h3>
<p class="timeline-org">Softude Infotech Pvt. Ltd.</p>
<ul class="timeline-points">
<li>Ran VAPT for web, mobile and API applications; primary point of contact for external engagements, retesting and remediation validation.</li>
<li>Automated secure backup, encryption and cloud transfer flows in Python across AWS services.</li>
<li>Participated in ISO 27001 audits and ensured alignment with GDPR handling requirements.</li>
<li>Ran GoPhish phishing campaigns and delivered secure-coding sessions to engineering teams.</li>
</ul>
</div>
</li>
<li class="timeline-item">
<div class="timeline-meta">
<span class="timeline-date">Aug 2021 — Nov 2021</span>
<span class="timeline-loc">Internship</span>
</div>
<div class="timeline-body">
<h3 class="timeline-role">Java Developer Intern</h3>
<p class="timeline-org">Collexa Technologies Pvt. Ltd.</p>
<ul class="timeline-points">
<li>Built Java applications using OOP principles and core data structures.</li>
<li>Shipped a Library Management System with modular class design and exception handling.</li>
</ul>
</div>
</li>
</ol>
</div>
</section>
<!-- ================== 03 · PROJECTS ================== -->
<section class="section section-alt" id="projects" aria-labelledby="projects-title">
<div class="wrap">
<p class="section-tag"><span class="section-tag-num">03</span> personal projects</p>
<h2 class="section-title" id="projects-title">Things I built to make the job easier.</h2>
<p class="section-lead">
Side projects, all vibe-coded and all GUI-first — built so a tester (or a student) can run them without touching a terminal.
The security tooling exists to exercise my own lab and authorised engagements; none of it is published as a ready-to-run weapon.
</p>
<!-- Featured -->
<article class="proj-feature">
<div class="proj-feature-head">
<span class="proj-kind">web application · education</span>
<span class="proj-badge is-flagship">flagship</span>
</div>
<h3 class="proj-feature-title">StudyFree GPT</h3>
<p class="proj-feature-lead">
A free education ecosystem for Indian competitive-exam aspirants, built around one rule: optimise for what a student
actually learns, not for time-on-app. No AI model is hosted — students bring their own API keys and unlock only the
features they want to pay for, so the platform stays free to run and free to use.
</p>
<div class="proj-feature-grid">
<div class="proj-feature-col">
<p class="proj-col-title">What it does</p>
<ul class="proj-points">
<li>Built-in syllabus coverage with per-topic progress tracking.</li>
<li>AI-generated study roadmap that adapts as the student's performance data comes in.</li>
<li>Learning-pattern analysis that reshapes pace, sequencing and revision intervals per student.</li>
<li>Current-affairs feed powered by the student's own Gemini key.</li>
<li>Personal tutor mode powered by the student's own OpenAI key.</li>
<li>Two roles — student and admin — with separate surfaces and separate privileges.</li>
</ul>
</div>
<div class="proj-feature-col">
<p class="proj-col-title">How it's built</p>
<ul class="proj-points">
<li>Bring-your-own-key model: no vendor keys on the server, no inference costs, no lock-in.</li>
<li>All data at rest encrypted; credentials hashed; student API keys stored encrypted and scoped to that student.</li>
<li>Role separation and least privilege enforced server-side, not in the UI.</li>
<li>Architected to scale from MVP to an enterprise-grade ecosystem without a rewrite.</li>
</ul>
</div>
</div>
<ul class="proj-stack" aria-label="Focus areas">
<li>bring-your-own-key AI</li>
<li>encryption at rest</li>
<li>RBAC</li>
<li>adaptive learning</li>
<li>secure-by-design</li>
</ul>
</article>
<!-- Tools -->
<div class="proj-grid">
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">appsec tooling</span>
<span class="proj-badge">GUI</span>
</div>
<h3 class="proj-title">Bulk URL Checker</h3>
<p class="proj-desc">
Takes a list of URLs from CSV, XLSX or TXT, hits them all in one run, and records status code, response headers and
timing for each. Produces a detailed report, with optional automated PoC screenshots per URL — which turns an
afternoon of manual triage into a single click.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>csv / xlsx / txt input</li>
<li>header & status capture</li>
<li>PoC screenshots</li>
</ul>
</article>
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">upload testing</span>
<span class="proj-badge">GUI</span>
</div>
<h3 class="proj-title">Malicious File Generator</h3>
<p class="proj-desc">
Embeds test payloads into arbitrary file types to exercise file-upload controls end to end — extension allow-lists,
MIME and magic-byte validation, AV and sandbox scanning, and what the application does with a file once it lands.
Built for authorised assessments against my own lab and in-scope targets.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>polyglot / embedded payloads</li>
<li>content-type validation</li>
<li>OWASP file upload</li>
</ul>
</article>
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">upload testing</span>
<span class="proj-badge">GUI</span>
</div>
<h3 class="proj-title">RLO Filename Spoof Generator</h3>
<p class="proj-desc">
Generates filenames carrying the Unicode right-to-left override character (U+202E) to demonstrate extension spoofing
— <code>invoice<U+202E>fdp.exe</code> renders as <code>invoiceexe.pdf</code> in most file pickers and mail
clients while still executing as a binary. Useful for proving that an upload filter reads the displayed name rather
than the real one, and for phishing-awareness demos.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>U+202E</li>
<li>MITRE T1036.002</li>
<li>filter bypass PoC</li>
</ul>
</article>
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">upload testing</span>
<span class="proj-badge">GUI</span>
</div>
<h3 class="proj-title">File Size Inflator</h3>
<p class="proj-desc">
Pads any file type with dummy data up to a target size on demand. Written for the boring half of upload testing:
finding the real size ceiling, checking whether the limit is enforced server-side or only in JavaScript, and seeing
how WAF body caps, timeouts and storage quotas behave at the boundary.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>arbitrary file types</li>
<li>exact target size</li>
<li>limit & quota testing</li>
</ul>
</article>
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">browser extension</span>
<span class="proj-badge">Chromium</span>
</div>
<h3 class="proj-title">Ad Blocker Extension</h3>
<p class="proj-desc">
A request-filtering extension for Chromium-based browsers that removes roughly 80% of ad placements on the sites I use
daily. Built mostly to understand the filtering pipeline from the inside — rule matching, request interception and
what the browser will and won't let an extension block.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>request filtering</li>
<li>rule matching</li>
<li>~80% block rate</li>
</ul>
</article>
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">browser extension</span>
<span class="proj-badge">Chromium</span>
</div>
<h3 class="proj-title">Meeting Attendance Recorder</h3>
<p class="proj-desc">
Captures the attendee roster of a live browser-based meeting — every participant who joined, the total head count,
and how long each person actually stayed — then exports it as a clean attendance register. Replaces scrolling the
participant panel and counting by hand at the end of a session.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>join / leave timestamps</li>
<li>per-person dwell time</li>
<li>exportable register</li>
</ul>
</article>
</div>
<!-- Open source on GitHub -->
<h3 class="proj-subhead">Open source on GitHub</h3>
<p class="section-lead">
Everything below is public, MIT-licensed and tested — the code is the claim.
Full list on <a href="https://github.com/RahilSahu" target="_blank" rel="noopener">github.com/RahilSahu</a>.
</p>
<div class="proj-grid">
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">open source community</span>
<span class="proj-badge is-flagship">merged PR</span>
</div>
<h3 class="proj-title">OWASP Cheat Sheet Series</h3>
<p class="proj-desc">
Reviewer on PR #2908, “NPM Security: inspecting a project you did not write” — invited to
review by the maintainer, verified the sources, and caught two completeness gaps (the .yarnrc registry
check and link: dependency specs) that the author then added. Merged into the OWASP Cheat Sheet Series
in November 2026.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>code review</li>
<li>NPM security</li>
<li>OWASP</li>
</ul>
<p class="proj-links"><a class="proj-repo" href="https://github.com/OWASP/CheatSheetSeries/pull/2908" target="_blank" rel="noopener">Merged pull request</a></p>
</article>
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">ai security platform</span>
<span class="proj-badge is-flagship">flagship</span>
</div>
<h3 class="proj-title">Aegis Security Platform</h3>
<p class="proj-desc">
Scanners find; Aegis proves. It ingests Nuclei, ZAP, Burp and generic scanner output, dedupes the same
issue across tools, then verifies every finding with deterministic, non-destructive checks before AI
triage writes a word — the AI can never set the verification status. Evidence-grade reports in
Markdown, HTML and JSON, with a retest loop that diffs fixed, persistent and regressed findings.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>cross-tool dedupe</li>
<li>deterministic verification</li>
<li>AI triage</li>
<li>retest diffing</li>
</ul>
<p class="proj-links"><a class="proj-repo" href="https://github.com/RahilSahu/aegis-security-platform" target="_blank" rel="noopener">GitHub repo</a></p>
</article>
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">ai product</span>
<span class="proj-badge">live demo</span>
</div>
<h3 class="proj-title">AdaptiveChat</h3>
<p class="proj-desc">
A chatbot that sets its own temperature for every message — facts run cold, brainstorming runs
hot — behind input and output guardrails, orchestrated as a LangGraph state machine. Upload
documents and answers come from your files with cited sources. Bring your own API key in the browser;
nothing is stored server-side.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>self-adjusting temperature</li>
<li>LangGraph orchestration</li>
<li>document RAG</li>
<li>bring-your-own-key</li>
</ul>
<p class="proj-links"><a class="proj-repo" href="https://github.com/RahilSahu/adaptive-llm-chatbot" target="_blank" rel="noopener">GitHub repo</a> <a class="proj-repo" href="https://adaptivechat.vercel.app" target="_blank" rel="noopener">Live demo</a></p>
</article>
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">systems</span>
<span class="proj-badge">pure stdlib</span>
</div>
<h3 class="proj-title">Distributed Task Queue</h3>
<p class="proj-desc">
A production-shaped task queue in pure Python standard library — no dependencies. Priority and
FIFO leasing with owner-checked ack, fail and heartbeat, exponential-backoff retries into a
dead-letter queue, delayed jobs and atomic JSON persistence with at-least-once delivery semantics.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>priority leasing</li>
<li>dead-letter queue</li>
<li>backoff retries</li>
<li>zero dependencies</li>
</ul>
<p class="proj-links"><a class="proj-repo" href="https://github.com/RahilSahu/distributed-task-queue" target="_blank" rel="noopener">GitHub repo</a></p>
</article>
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">cloud security</span>
<span class="proj-badge">4 clouds</span>
</div>
<h3 class="proj-title">Cloud Misconfiguration Scanner</h3>
<p class="proj-desc">
Finds the exposures that turn into breaches: unauthenticated public-access checks plus offline
analysers for AWS, Azure, GCP and OCI policies, security groups and firewalls. Runs against a whole
fleet from one targets file and exports a JSON report.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>AWS · Azure · GCP · OCI</li>
<li>public exposure checks</li>
<li>fleet mode</li>
</ul>
<p class="proj-links"><a class="proj-repo" href="https://github.com/RahilSahu/cloud-misconfiguration-scanner" target="_blank" rel="noopener">GitHub repo</a></p>
</article>
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">appsec tooling</span>
<span class="proj-badge">10 tools</span>
</div>
<h3 class="proj-title">Zero-Dependency Security Tools</h3>
<p class="proj-desc">
A shelf of small, single-purpose tools that run anywhere Python does: HTTP security headers checker,
TLS certificate inspector, DNS and email-auth checker, JWT analyzer, CORS misconfiguration checker,
bulk URL checker, port scanner lite and more. Every tool ships with offline unit tests.
</p>
<ul class="proj-stack" aria-label="Capabilities">
<li>zero dependencies</li>
<li>offline tests</li>
<li>MIT licensed</li>
</ul>
<p class="proj-links"><a class="proj-repo" href="https://github.com/RahilSahu?tab=repositories" target="_blank" rel="noopener">Browse the repositories</a></p>
</article>
<article class="proj-card">
<div class="proj-head">
<span class="proj-kind">writing</span>
<span class="proj-badge">blog</span>
</div>
<h3 class="proj-title">AppSec Field Notes</h3>
<p class="proj-desc">
Original notes from real engagements, written to be used: an HTTP security headers audit, a file
upload testing checklist, a JWT audit walkthrough, SPF, DKIM and DMARC explained from the
attacker's side, and how RLO filename spoofing hides a file's true type.
</p>
<ul class="proj-stack" aria-label="Topics">
<li>HTTP headers</li>
<li>file uploads</li>
<li>JWT</li>
<li>email auth</li>
</ul>
<p class="proj-links"><a class="proj-repo" href="https://github.com/RahilSahu/appsec-field-notes" target="_blank" rel="noopener">GitHub repo</a></p>
</article>
</div>
</div>
</section>
<!-- ================== 04 · TOOLCHAIN ================== -->
<section class="section" id="toolchain" aria-labelledby="toolchain-title">
<div class="wrap">
<p class="section-tag"><span class="section-tag-num">04</span> toolchain</p>
<h2 class="section-title" id="toolchain-title">What's in the kit.</h2>
<p class="section-lead">Filter by category to see the tools I use day-to-day.</p>
<div class="tool-filters" role="tablist" aria-label="Filter tools by category">
<button type="button" class="tool-filter is-active" role="tab" aria-selected="true" data-filter="all">All</button>
<button type="button" class="tool-filter" role="tab" aria-selected="false" data-filter="web">Web & API</button>
<button type="button" class="tool-filter" role="tab" aria-selected="false" data-filter="net">Network</button>
<button type="button" class="tool-filter" role="tab" aria-selected="false" data-filter="mob">Mobile</button>
<button type="button" class="tool-filter" role="tab" aria-selected="false" data-filter="recon">Recon / OSINT</button>
<button type="button" class="tool-filter" role="tab" aria-selected="false" data-filter="ai">AI Security</button>
<button type="button" class="tool-filter" role="tab" aria-selected="false" data-filter="plat">Platforms</button>
<button type="button" class="tool-filter" role="tab" aria-selected="false" data-filter="dev">DevOps / Scripting</button>
</div>
<ul class="tool-grid" id="toolGrid">
<li class="tool" data-cats="web"><span class="tool-name">Burp Suite</span><span class="tool-kind">proxy · fuzzer</span></li>
<li class="tool" data-cats="web"><span class="tool-name">SQLMap</span><span class="tool-kind">sqli</span></li>
<li class="tool" data-cats="web"><span class="tool-name">Nuclei</span><span class="tool-kind">templated scanner</span></li>
<li class="tool" data-cats="web"><span class="tool-name">HTTPx</span><span class="tool-kind">http toolkit</span></li>
<li class="tool" data-cats="web net"><span class="tool-name">Nessus</span><span class="tool-kind">vuln scanner</span></li>
<li class="tool" data-cats="web"><span class="tool-name">Acunetix</span><span class="tool-kind">DAST</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">AWS</span><span class="tool-kind">cloud infra</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">GCP</span><span class="tool-kind">cloud infra</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">OpenRport</span><span class="tool-kind">remote access</span></li>
<li class="tool" data-cats="plat recon"><span class="tool-name">VirusTotal</span><span class="tool-kind">threat intel</span></li>
<li class="tool" data-cats="net"><span class="tool-name">Nmap</span><span class="tool-kind">discovery</span></li>
<li class="tool" data-cats="net"><span class="tool-name">Wireshark</span><span class="tool-kind">pcap analysis</span></li>
<li class="tool" data-cats="net"><span class="tool-name">Metasploit</span><span class="tool-kind">exploitation</span></li>
<li class="tool" data-cats="net"><span class="tool-name">WinPEAS</span><span class="tool-kind">post-exploit</span></li>
<li class="tool" data-cats="net"><span class="tool-name">AccessChk</span><span class="tool-kind">windows acl</span></li>
<li class="tool" data-cats="mob"><span class="tool-name">MobSF</span><span class="tool-kind">static + dynamic</span></li>
<li class="tool" data-cats="mob"><span class="tool-name">Frida</span><span class="tool-kind">hooking</span></li>
<li class="tool" data-cats="mob"><span class="tool-name">Objection</span><span class="tool-kind">runtime</span></li>
<li class="tool" data-cats="mob"><span class="tool-name">JADX</span><span class="tool-kind">reverse</span></li>
<li class="tool" data-cats="recon"><span class="tool-name">Subfinder</span><span class="tool-kind">subdomains</span></li>
<li class="tool" data-cats="recon"><span class="tool-name">Amass</span><span class="tool-kind">attack surface</span></li>
<li class="tool" data-cats="recon"><span class="tool-name">CloudBrute</span><span class="tool-kind">cloud recon</span></li>
<li class="tool" data-cats="ai"><span class="tool-name">HexStrike.ai</span><span class="tool-kind">ai-augmented offensive</span></li>
<li class="tool" data-cats="ai plat"><span class="tool-name">CodeAnt.ai</span><span class="tool-kind">ai SAST</span></li>
<li class="tool" data-cats="ai"><span class="tool-name">Venice AI</span><span class="tool-kind">uncensored llm</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">Wazuh</span><span class="tool-kind">SIEM</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">Cloudflare</span><span class="tool-kind">WAF</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">SentinelOne</span><span class="tool-kind">EDR · CSPM</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">DefectDojo</span><span class="tool-kind">vuln mgmt</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">SonarQube</span><span class="tool-kind">SAST</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">Snyk</span><span class="tool-kind">SCA</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">JumpServer</span><span class="tool-kind">PAM</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">GoPhish</span><span class="tool-kind">phishing sim</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">Evilginx</span><span class="tool-kind">phishing sim</span></li>
<li class="tool" data-cats="plat"><span class="tool-name">Azure</span><span class="tool-kind">cloud infra</span></li>
<li class="tool" data-cats="dev"><span class="tool-name">Docker</span><span class="tool-kind">containers</span></li>
<li class="tool" data-cats="dev"><span class="tool-name">Git</span><span class="tool-kind">vcs</span></li>
<li class="tool" data-cats="dev"><span class="tool-name">Python</span><span class="tool-kind">automation</span></li>
<li class="tool" data-cats="dev"><span class="tool-name">Kali Linux</span><span class="tool-kind">workstation</span></li>
</ul>
</div>
</section>
<!-- ================== 05 · CREDENTIALS ================== -->
<section class="section section-alt" id="credentials" aria-labelledby="credentials-title">
<div class="wrap">
<p class="section-tag"><span class="section-tag-num">05</span> credentials</p>
<h2 class="section-title" id="credentials-title">Certifications & education.</h2>
<div class="cred-grid">
<article class="cred">
<header class="cred-head">
<span class="cred-tag">EC-Council</span>
<span class="cred-status is-active">Active</span>
</header>
<h3 class="cred-title">Certified Ethical Hacker (CEH)</h3>
<dl class="cred-meta">
<div><dt>Issued</dt><dd>Aug 2024</dd></div>
<div><dt>Expires</dt><dd>Aug 2027</dd></div>
<div><dt>Credential ID</dt><dd>ECC1859370462</dd></div>
</dl>
</article>
<article class="cred">
<header class="cred-head">
<span class="cred-tag">The SecOps Group</span>
<span class="cred-status is-active">Active</span>
</header>
<h3 class="cred-title">Certified Cloud Security Practitioner — AWS</h3>
<dl class="cred-meta">
<div><dt>Issued</dt><dd>May 2023</dd></div>
<div><dt>Credential ID</dt><dd>7476871</dd></div>
</dl>
</article>
<article class="cred">
<header class="cred-head">
<span class="cred-tag">The SecOps Group</span>
<span class="cred-status is-active">Active</span>
</header>
<h3 class="cred-title">Certified AppSec Practitioner (CAP)</h3>
<dl class="cred-meta">
<div><dt>Issued</dt><dd>Feb 2023</dd></div>
<div><dt>Credential ID</dt><dd>7040395</dd></div>
</dl>
</article>
<article class="cred">
<header class="cred-head">
<span class="cred-tag">Purple Academy</span>
<span class="cred-status is-active">Active</span>
</header>
<h3 class="cred-title">Modern Log Management Fundamentals</h3>
<dl class="cred-meta">
<div><dt>Issued</dt><dd>Aug 2023</dd></div>
<div><dt>Credential ID</dt><dd>64d480dfcb78e8279018f9</dd></div>
</dl>
</article>
</div>
<div class="edu-block">
<h3 class="edu-title">Education</h3>
<ul class="edu-list">
<li>
<span class="edu-degree">B.Tech, Computer Science & Engineering</span>
<span class="edu-org">ADINA Institute of Science and Technology</span>
<span class="edu-date">Jun 2018 — May 2022</span>
</li>
<li>
<span class="edu-degree">Higher Secondary (PCM)</span>
<span class="edu-org">Joy Campion Public School</span>
<span class="edu-date">May 2016 — May 2018</span>
</li>
</ul>
</div>
</div>
</section>
<!-- ================== 06 · PLAYGROUND ================== -->
<section class="section section-playground" id="playground" aria-labelledby="playground-title">
<div class="scanlines" aria-hidden="true"></div>
<div class="wrap">
<p class="section-tag"><span class="section-tag-num">06</span> hands-on</p>
<h2 class="section-title" id="playground-title">Playground — try it yourself.</h2>
<p class="section-lead">
Four small challenges rendered entirely in your browser. No servers, no tracking, no execution of your input — each check is client-side and read-only.
Solve them for practice, or peek at the hint if you get stuck.
</p>
<div class="ctf-grid">
<!-- Challenge 1: XSS Filter Bypass -->
<article class="ctf" data-challenge="xss">
<header class="ctf-head">
<span class="ctf-num">#01</span>
<span class="ctf-diff sev-high" title="High difficulty">HIGH</span>
<h3 class="ctf-title">Bypass the sanitiser</h3>
</header>
<p class="ctf-brief">
A junior dev wrote this "XSS filter". It strips <code><script></code>, <code>onerror=</code>, <code>onload=</code>, and <code>javascript:</code>.
Submit a payload that would still execute JavaScript.
</p>
<pre class="ctf-code"><span class="tp">function</span> sanitise(input) {
<span class="tc">return</span> input
.replace(<span class="ts">/<script>/gi</span>, <span class="ts">''</span>)
.replace(<span class="ts">/onerror=/gi</span>, <span class="ts">''</span>)
.replace(<span class="ts">/onload=/gi</span>, <span class="ts">''</span>)
.replace(<span class="ts">/javascript:/gi</span>, <span class="ts">''</span>);
}</pre>
<div class="ctf-io">
<label class="visually-hidden" for="ctf-xss-in">XSS payload</label>
<input type="text" id="ctf-xss-in" class="ctf-input" placeholder="<your payload here>" spellcheck="false" autocomplete="off">
<button type="button" class="btn btn-primary btn-small ctf-submit" data-target="xss">Test</button>
<button type="button" class="btn btn-ghost btn-small ctf-hint" data-target="xss">Hint</button>
</div>
<p class="ctf-result" data-result="xss" role="status" aria-live="polite"></p>
</article>
<!-- Challenge 2: Hidden Flag Hunt -->
<article class="ctf" data-challenge="flag" data-hidden-flag="FLAG{v13w-s0urc3-1s-y0ur-fr13nd}">
<header class="ctf-head">
<span class="ctf-num">#02</span>
<span class="ctf-diff sev-low" title="Easy">EASY</span>
<h3 class="ctf-title">Find the flag</h3>
</header>
<p class="ctf-brief">
A flag in the format <code>FLAG{...}</code> is hidden somewhere in this challenge card. Not in visible text.
Inspect the DOM (browser DevTools → Elements) and submit it.
</p>
<!-- FLAG{v13w-s0urc3-1s-y0ur-fr13nd} -->
<p class="ctf-brief ctf-muted">There is nothing to see here — keep looking with the right tool.</p>
<div class="ctf-io">
<label class="visually-hidden" for="ctf-flag-in">Flag value</label>
<input type="text" id="ctf-flag-in" class="ctf-input" placeholder="FLAG{...}" spellcheck="false" autocomplete="off">
<button type="button" class="btn btn-primary btn-small ctf-submit" data-target="flag">Submit</button>
<button type="button" class="btn btn-ghost btn-small ctf-hint" data-target="flag">Hint</button>
</div>
<p class="ctf-result" data-result="flag" role="status" aria-live="polite"></p>
</article>
<!-- Challenge 3: JWT Analysis -->
<article class="ctf" data-challenge="jwt">
<header class="ctf-head">
<span class="ctf-num">#03</span>
<span class="ctf-diff sev-med" title="Medium">MED</span>
<h3 class="ctf-title">Read the JWT</h3>
</header>
<p class="ctf-brief">
A production app issues this token. Decode the payload and submit the <code>role</code> claim value (lowercase).
</p>
<pre class="ctf-code" id="ctf-jwt-token">eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJyYWhpbCIsInJvbGUiOiJndWVzdCIsImV4cCI6MTc5MzQ1Njc4OX0.k9F3fD7pQr4wJ8mV2nA6xL1zK5tHbG0uYcRvE8sMdIQ</pre>
<div class="ctf-io">
<label class="visually-hidden" for="ctf-jwt-in">Role claim</label>
<input type="text" id="ctf-jwt-in" class="ctf-input" placeholder="role value" spellcheck="false" autocomplete="off">
<button type="button" class="btn btn-primary btn-small ctf-submit" data-target="jwt">Submit</button>
<button type="button" class="btn btn-ghost btn-small ctf-hint" data-target="jwt">Hint</button>
</div>
<p class="ctf-result" data-result="jwt" role="status" aria-live="polite"></p>
</article>
<!-- Challenge 4: Cipher chain -->
<article class="ctf" data-challenge="cipher">
<header class="ctf-head">
<span class="ctf-num">#04</span>
<span class="ctf-diff sev-med" title="Medium">MED</span>
<h3 class="ctf-title">Peel the encoding</h3>
</header>
<p class="ctf-brief">
This ciphertext was base64-encoded twice, then ROT13'd on the outside. Recover the flag.
</p>
<pre class="ctf-code" id="ctf-cipher-token">Hzg4DyVmqQOwoJfjJwWIqR0lAJcvZyWjLz1wqTWRHwIAZ0c6MyR9CD==</pre>
<div class="ctf-io">
<label class="visually-hidden" for="ctf-cipher-in">Recovered flag</label>
<input type="text" id="ctf-cipher-in" class="ctf-input" placeholder="FLAG{...}" spellcheck="false" autocomplete="off">
<button type="button" class="btn btn-primary btn-small ctf-submit" data-target="cipher">Submit</button>
<button type="button" class="btn btn-ghost btn-small ctf-hint" data-target="cipher">Hint</button>
</div>
<p class="ctf-result" data-result="cipher" role="status" aria-live="polite"></p>
</article>
</div>
<p class="ctf-footnote">
<span class="sev-dot sev-info" aria-hidden="true"></span>
Every check runs locally. Your input never leaves this tab — verify in DevTools → Network.
</p>
</div>
</section>
<!-- ================== 07 · LEARN ================== -->
<section class="section section-alt" id="learn" aria-labelledby="learn-title">
<div class="wrap">
<p class="section-tag"><span class="section-tag-num">07</span> resources</p>
<h2 class="section-title" id="learn-title">Learn offensive security — free.</h2>
<p class="section-lead">
Curated free platforms that carried me through 4+ years of practice. Everything below is either free-tier or fully free. Pick one, don't jump between five.
</p>
<div class="learn-grid">
<a class="learn-card" href="https://portswigger.net/web-security" rel="noopener noreferrer" target="_blank">
<div class="learn-head">
<span class="learn-kind">web · foundational</span>
<span class="learn-badge">free</span>
</div>
<h3 class="learn-title">PortSwigger Web Security Academy</h3>
<p class="learn-desc">The definitive free web-hacking curriculum. Interactive labs mapped to OWASP Top 10. Start here.</p>
<span class="learn-link">portswigger.net/web-security →</span>
</a>
<a class="learn-card" href="https://tryhackme.com/" rel="noopener noreferrer" target="_blank">
<div class="learn-head">
<span class="learn-kind">guided rooms</span>
<span class="learn-badge">freemium</span>
</div>
<h3 class="learn-title">TryHackMe</h3>
<p class="learn-desc">Beginner-friendly guided rooms with structured learning paths. Great for building foundational skills.</p>
<span class="learn-link">tryhackme.com →</span>
</a>
<a class="learn-card" href="https://www.hackthebox.com/" rel="noopener noreferrer" target="_blank">
<div class="learn-head">
<span class="learn-kind">CTF · boxes</span>
<span class="learn-badge">freemium</span>
</div>
<h3 class="learn-title">HackTheBox</h3>
<p class="learn-desc">Real vulnerable machines. Steeper curve than THM — retire boxes are free, active boxes require VIP.</p>
<span class="learn-link">hackthebox.com →</span>
</a>
<a class="learn-card" href="https://pentesterlab.com/exercises" rel="noopener noreferrer" target="_blank">
<div class="learn-head">
<span class="learn-kind">web · code review</span>
<span class="learn-badge">freemium</span>