Reverse Engineering Anti-Bot Systems

Static and dynamic analysis of Cloudflare Turnstile and reCAPTCHA Enterprise.

[ read writeup ]

Securing FIDO2 Credentials Using Intel SGX

Virtual FIDO2 authenticator backed by an Intel SGX enclave: sealed SQLite credential store, CTAP2 with discoverable credentials, HID interface forwarding to the enclave service, and DCAP-based remote attestation. Supports cross-device credential migration.

[ doc ]

Attacks on FIDO2 CTAP — Survey & PoC

Researched MitM attacks on CTAP DH key exchange and insecure option abuse. Built a custom CTAP client to reproduce session hijacking against real authenticators (YubiKey, Feitian).

Selective Identity Disclosure

Four-app system for Digital Citizen Card holders to selectively disclose identity attributes. Handles issuance, selective DCC generation, digital signatures, and attribute hashing.

Shuffle AES Implementation

Modified AES variant in C, then reproduced using NI assembly instructions. Validated against OpenSSL; PBKDF2 for key derivation.

Vulnerable Social Network

Intentionally introduced XSS, SQLi, CSRF, template injection, and crypto weaknesses into a social network app; then performed offensive analysis of other groups' apps.

Malware Analysis — Tampered Linux ELF

Static analysis and code inspection to uncover hidden payloads and evasion techniques in a Linux binary disguised as a game. Analysed execution flow, network activity, and API usage.

Malicious Android App Reverse

Static and dynamic analysis of a trojanised Aveiro tourism app. Uncovered hidden functionality via permission analysis, execution flow tracing, and API monitoring.

Embedded Thermal Controller RE

Reverse-engineered a PIC32MX-based thermal chamber: temperature regulation logic, RS-232 protocol, EEPROM usage, and dual-zone heating via OC1/OC2 outputs.

Redundant Network Infrastructure

High-availability network with load balancers, stateful firewalls, VLANs, DMZ, and Internet connectivity in GNS3. Validated redundancy, traffic segmentation, and DDoS mitigation.

CTF — pwn & web

First hands-on CTF as part of the master's programme. Solved pwn and web challenges; first exposure to CTF-style offensive security.

Website Detective

Full-stack domain analyser returning a quality/trust score. Distributed workers cover blocklists, cookies, SSL/TLS, security.txt, page rank, carbon footprint. ML classifier labels domains Good/Bad.

URL Malicious/Benign Classifier

URL classification using page content vectors and sentiment polarity. Evaluated LR, NN, Gradient Boosting, Random Forest, and KNN with confusion matrices and learning curves.

Face Detection via Transfer Learning

Pre-trained CNN fine-tuned to detect faces and predict bounding boxes from varied real-world images. Replaced initial custom CNN due to compute constraints.

DigDug AI Agent

A* agent for DigDug. At each step a graph is constructed, shortest paths to enemies computed, and undesired positions penalised with increased traversal costs.

Sunday Crypto

Real-time cryptocurrency tracker with buy/sell and automated price-triggered actions. CoinGecko API, Spring Boot, MySQL, RabbitMQ, WebSockets, Docker.

Karaoke — Distributed Audio System

Client-server audio source separation. Chunks distributed to clients for processing (bass, vocals, drums); results reassembled server-side for download.