Build a JavaScript tool that crawls a target URL, injects common XSS payloads into form fields and URL parameters, and reports which inputs are vulnerable.
project stats
800
total XP
5
stages
outcome
A working XSS scanner CLI tool with a structured findings report
explore more
Build a tool that ingests Apache/Nginx access logs, detects anomalous patterns (brute force, scanning, unusual user agents), and generates a threat summary report.
project stats
600
total XP
4
stages
outcome
A log analysis tool with anomaly detection and a structured threat report
explore more
Build a tool that audits a list of password hashes against common wordlists, checks for weak patterns, and produces a risk report.
project stats
500
total XP
4
stages
outcome
A password auditing tool with wordlist attack, pattern detection, and risk scoring
explore more
Build a CSRF token generation and validation library from scratch. Implement the synchronizer token pattern, double-submit cookie pattern, and a timing-safe comparison function. Then write a test harness that proves your implementation is resistant to known CSRF attack vectors.
project stats
1100
total XP
5
stages
outcome
A production-grade CSRF protection library with a full test suite and attack simulation harness
explore more
Build a network packet capture and analysis tool that reads PCAP files, parses Ethernet/IP/TCP/UDP headers, reconstructs HTTP sessions, and flags suspicious traffic patterns like port scans and cleartext credentials.
project stats
900
total XP
5
stages
outcome
A PCAP analysis tool that reconstructs sessions and surfaces suspicious traffic
explore more
Build a threat intelligence pipeline that ingests IOCs (IPs, domains, hashes) from multiple open-source feeds, deduplicates and normalizes them into a unified schema, scores each IOC by confidence and recency, and exposes a query API.
project stats
1000
total XP
5
stages
outcome
A live threat intel pipeline with multi-feed ingestion, IOC scoring, and a query API
explore more
Build a tool that audits JSON Web Tokens for common vulnerabilities: the 'none' algorithm bypass, weak HMAC secrets via dictionary attack, and algorithm confusion (RS256 → HS256). Understand why JWT implementation details matter.
project stats
750
total XP
5
stages
outcome
A JWT auditing tool that detects three classes of real-world JWT vulnerabilities
explore more
