security tooling and lab work

Projects

Defensive tools and lab systems documented as technical case studies: what they solve, how they work, and what still needs improvement.

Projects
2
Categories
2
Technologies
12

Filter

Attack-Defense CTF monitoring

AWD-Watchdog

A lightweight defensive toolkit that combines IDS alerts, web logs, file integrity monitoring, PCAP capture, and health checks for AWD rounds.

Security use case: It supports defensive monitoring, alert triage, evidence collection, and patch guidance. It does not automate attacks or exploit other teams.
PythonSuricataZeektcpdumpauditdinotifywaitShell
  • Parses Suricata eve.json alerts, Apache/Nginx access logs, and optional Zeek http.log data.
  • Ranks source IPs, attacked HTTP paths, services, and likely vulnerability classes.
  • Watches web and service folders for suspicious file changes using inotifywait.

Wireless intrusion detection

WaveSentinel / AirGuard WIDS

A defensive 802.11 monitoring system that captures monitor-mode traffic, raises wireless alerts, and presents analyst-friendly dashboard views.

Detection focus: The project focuses on deauthentication flood indicators, beacon flood behavior, suspicious 802.11 frame patterns, disassociation activity, and rogue AP or evil twin indicators shown in the alert workflow.
PythonScapyFlask802.11 monitor modeCSV/JSON logsHTML/CSS
  • Captures live 802.11 traffic from a monitor-mode wireless adapter.
  • Tracks access points, clients, beacon activity, deauthentication frames, and suspicious traffic patterns.
  • Provides Simple View and Analyst View dashboard modes for different audiences.

documentation index

Technical notes

Summary records for each project, kept separate from the full project pages.

AWD-Watchdog

Attack-Defense CTF monitoring 7 technologies public documentation

Overview

AWD-Watchdog is built for authorized Attack-Defense CTF environments where teams need fast visibility into who is hitting their box, which endpoint is under pressure, and whether service changes or outages need immediate action.

Problem

In AWD rounds, teams often split attention between patching, checking service health, watching logs, and collecting evidence. This toolkit pulls those signals into one defensive workflow so decisions can happen faster.

Workflow

  1. Collect network, web, and host signals from the challenge box.
  2. Classify activity such as SQL injection, command injection, traversal, upload abuse, or debug probing.
  3. Surface attacker IPs, target endpoints, and file-change evidence in the terminal dashboard.
  4. Use the alert context to patch, restart services, verify checkers, and improve rules.

Future improvements

  • Add richer web dashboard views for long-running competitions.
  • Export evidence into SIEM-friendly formats.
  • Expand competition playbooks and custom rule packs.
  • Harden service deployment profiles for repeat team use.

WaveSentinel / AirGuard WIDS

Wireless intrusion detection 6 technologies public documentation

Overview

WaveSentinel is a defensive wireless intrusion detection project for authorized lab environments. It monitors 802.11 frames, raises wireless alerts, stores runtime evidence, and presents findings through dashboard views.

Problem

Wireless labs generate noisy packet streams. WaveSentinel turns monitor-mode traffic into readable status, alert feeds, and analyst filters so suspicious behavior is easier to explain and review.

Workflow

  1. Enable monitor mode on a supported adapter and lock the capture channel.
  2. Capture IEEE 802.11 frames with Scapy and extract frame metadata.
  3. Apply detection rules for deauthentication floods, beacon floods, disassociation activity, and rogue AP or evil twin indicators.
  4. Persist alerts and device state into local CSV/JSON files.
  5. Render status, recommendations, filters, and alert feeds in the dashboard.

Future improvements

  • Tune thresholds across more adapters, channels, and crowded lab environments.
  • Add stronger rogue AP baselining and known-network comparison.
  • Improve packet capture summaries for replay-free lab demonstrations.
  • Package dashboard screenshots and operator guides for easier setup.