A detailed look at every project in the lab.
Built a Dockerized black-box fuzzing harness with a 4-person team for COMP6447 (UNSW) that combines mutation-based and format-aware generation fuzzing to crash 64-bit Linux ELF binaries across JSON, XML, CSV, PDF, JPEG, and raw ELF inputs.
Built a hardware-based wireless lab using Raspberry Pi to simulate Evil Twin attacks and capture WPA2 handshakes for offline cracking.
Conducted web pentesting covering OWASP Top 10 (SQLi, XSS, IDOR, SSRF) using Burp Suite on DVWA and HackTheBox platforms.
Developed a Windows malware simulation in an isolated lab demonstrating the full attack chain: registry persistence, MSBuild-based defense evasion, DPAPI/AES-GCM browser credential theft, keystroke logging, and C2 exfiltration to a remote webhook.
Sanitized, NDA-compliant adversarial testing framework for frontier LLMs — covering jailbreak taxonomy, prompt injection, automated adversarial suites, and multimodal attack surface analysis.
Interactive browser-based tool that demonstrates everything a website can legitimately collect from your browser — IP, hardware, GPU, fingerprint and more. No dependencies, no tracking.
Embedded automated vulnerability scans (SAST, dependency checks) into CI/CD pipelines, reducing insecure code merges across ML microservices at Dell Technologies.
An interactive JSON Web Token analysis tool. Paste a token to decode its claims, surface signing and configuration weaknesses, recover weak HMAC secrets by dictionary attack, and forge a valid token to demonstrate the impact — a from-scratch JOSE implementation with no cryptographic dependencies.
An interactive, fully client-side lab covering six SQL injection classes — pick an attack, craft a payload, and watch the query, database, and result set react in real time.
Fine-tuned and benchmarked five transformer architectures (T5, FLAN-T5, CodeT5, BART) to translate natural language questions into SQL, with a full training/evaluation pipeline, REST API, and Gradio UI — a solo research project for COMP9444 (UNSW).