Projects

Built a centralized login and Identity Management (IAM) gateway on a Raspberry Pi Zero W, featuring custom multi-factor authentication (MFA) and a hardened network footprint.

• LDAP Centralized Directory: Set up an OpenLDAP server (slapd) to act as a secure, centralized database for user profiles and credentials.
• Custom FastAPI Backend: Wrote a Python API using FastAPI to handle a "double-bind" authentication flow—first connecting as an admin to check user permissions, then verifying the user's login credentials.
• Role-Based MFA Enforcement: Programmed the backend to read specific user attributes from LDAP. Built custom logic that automatically bypasses MFA for standard users but strictly requires a 6-digit code for admin users.
• TOTP Enrollment & Storage: Integrated pyotp to generate secret keys and handle MFA verification. Built an endpoint that outputs a QR-code-compatible URI (tested with Google Authenticator and 1Password) and saves the secret directly to the user's LDAP profile.
• Network & Traffic Hardening: Locked down the system using Nginx as a reverse proxy to manage connections, OpenSSL to generate self-signed certificates for HTTPS encryption, and UFW (Uncomplicated Firewall) to block all ports except SSH and web traffic (22, 80, 443).
• Process Management & Auditing: Set up a custom Systemd service to keep the app running continuously in the background and used Nmap to scan the device and verify that only the intended network ports were exposed.

This project documents the complete process of replacing a device's restrictive native ChromeOS with a full Linux Mint installation. It details a structured, four-phase deployment covering hardware compatibility verification, developer restrictions bypass (including hardware write-protection disabling), firmware flashing via MrChromebox UEFI, and final operating system installation and optimization.

I implemented a network-wide DNS-based ad blocker using Pi-hole on a Raspberry Pi Zero W. This project enhances my home network privacy and security by preventing tracking and malicious domains from loading at the DNS level, while simultaneously improving network performance by reducing bandwidth consumption from unwanted content. I figured it could also help my family when browsing ad-filled websites as well as some streaming services.

Deployed a multi-tiered homelab environment to simulate an enterprise network, focusing on strict traffic control, system administration, and centralized security monitoring.

• Network Segmentation: Configured a third-party router and managed switch to establish distinct VLANs (Management, Production, Test Labs), enforcing the principle of least privilege.
• Firewall Access Control: Implemented granular ingress and egress firewall rules to restrict inter-VLAN routing and isolate testing environments.
• Infrastructure Provisioning: Deployed a fleet of mini-servers managing core network services, directory services, and reverse proxies.
• SIEM Integration: Integrated a centralized SIEM to aggregate logs from firewalls, switches, and servers for real-time traffic analysis and security auditing.

Engaged in continuous offensive security training, identifying, exploiting, and documenting critical vulnerabilities across simulated corporate networks and standalone target machines.

• Reconnaissance: Performed active and passive footprinting using utilities like nmap and Gobuster to map attack surfaces, open ports, and running services.
• Vulnerability Analysis: Checked network footprints against exploit databases to identify unpatched software, misconfigurations, and weak credentials.
• Initial Access: Executed targeted exploits (such as RCE, SQLi, and broken access controls) to bypass security controls and gain footholds on target systems.
• Privilege Escalation: Conducted internal system enumeration to leverage local misconfigurations and SUID permissions, successfully elevating privileges to root/administrator.