Differential HTTP analysis engine. Research on request smuggling by comparing parser interpretations across Nginx, HAProxy, and Gunicorn using AFL++.

• Fuzzing: Differential analysis using AFL++ on multiple targets.
• Trophies: Found vulnerabilities in HAProxy (CVE-2023-40225) and others.
• Environment: Composable Docker architecture with custom Python REPL.

Built because I got tired of guessing password strength. Entropy scoring that actually works, pattern recognition for keyboard walks, predictable substitutions. Estimates real-world crack time using GPU benchmarks.

• Scoring: entropy-based strength with practical heuristics.
• Patterns: detects keyboard walks and common substitution habits.
• Estimation: crack-time approximation using GPU benchmark baselines.

My first real security tool. Automates the boring part, testing. Finds SQLi, XSS, CSRF, path traversal, parameter pollution. The insight: generate context-aware payloads.

• Automation: crawl + test loop to reduce manual recon.
• Coverage: targets SQLi, XSS, CSRF, traversal, parameter pollution.
• Payloads: context-aware generation rather than naive fuzzing.

LSB steganography, EXIF manipulation, metadata injection. Hide data in images imperceptibly — the eye won't catch what statistics can't explain.

• Techniques: LSB steganography + EXIF/metadata manipulation.
• Workflow: hide + extract utilities designed for real scenarios.

Passion project. Interactive fiction engine built on state machines. Branching dialogue with real consequences. Built to prove a thesis: games and serious tools are the same architecture.

• Core: state-machine driven story logic.
• Design: branching dialogue with meaningful consequences.
• Architecture: tool-like structure applied to game systems.