4 directories — ongoing work, not writeups
honeypot-telemetry/ACTIVE · 14mo
Eight containerized sensors across SSH, telnet, and HTTP. Current work is getting past commodity crypto-miner drops toward hands-on-keyboard activity.
cowrie · docker · iptables · systemd
triage-tooling/ACTIVE
A hash lookup pipeline querying MalwareBazaar and VirusTotal with deduplication and rate limiting, so a day's captures resolve to known families before I open a disassembler.
python · bash · requests
malvertising/EARLY
Independent hunting of malicious ad campaigns. Same collection problem as the honeypots, different surface.
in progress
re-practice/ONGOING
Assembly, binary exploitation, and whatever the last CTF broke my brain with. Writeups land here when the challenge is retired.
gdb · ghidra · pwntools