Use this page to track daily breakthroughs, code snippets, and challenges.

---

• Date: July 15, 2026
• What I Did: Installed Git, initialized my repository, and built this Wiki system.
• Key Concept: Git version control allows me to track changes and keep a green streak on GitHub.
• Code Snippet:

  git commit -m "Day 1: Initial commit and wiki setup"

• Date: July 16, 2026
• What I Did: Learned about string and integer data types, handling user input, and formatted string outputs (f-strings).
• Key Concept: input() always captures data as a string, so we must use int() if we need to convert it to a number.
• Code Snippet:

  analyst_name = input("Enter your Analyst Name: ")
  print(f"Welcome,  + analyst_name + "!")

• Date: July 17, 2026
• What I Did: Learned how programs make decisions using if, elif, and else. Used the len() function to calculate string length.
• Key Concept: Indentation matters in Python. Logical blocks of code run only when their specific condition evaluates to true.
• Code Snippet:

  if len(password) < 8:
      print("Weak password!")

• Date: July 18, 2026
• What I Did: Learned how to automate repetitive workflows using Python for loops and the range() function. Simulated a sweep of network ports.
• Key Concept: Iteration allows code blocks to sweep through data ranges rapidly, matching patterns to scale tasks like security auditing.
• Code Snippet:

  for port in range(1, 31):
      if port == 27:
          print(f"Port {port}: Vulnerable Telnet detected!")

---

• Date: July 19, 2026
• What I Did: Mastered Python dictionaries to map key-value pairings for network inventory tracking.
• Key Concept: Dictionaries provide incredibly fast lookups by using distinct keys to pull associated data fields instantly.
• Code Snippet:

  protocol_ports = {"SSH": 22, "HTTP": 80}
  print(protocol_ports["SSH"])

---

• Date: July 20, 2026
• What I Did: Learned how to create modular, reusable code using Python def functions, parameters, and return statements.
• Key Concept: Packaging logic into functions eliminates code duplication and simplifies building complex multi-step automation tools.
• Code Snippet:

  def check_integrity(original, current):
      return original == current

---

• Date: July 22, 2026
• What I Did: Mastered string parsing using Python's .split() method to extract specific fields (timestamps, usernames, IP addresses) from raw log entries.
• Key Concept: Splitting raw text into structured lists allows security scripts to extract target values by index position for automated alerting or blocking lists.
• Code Snippet:

  fields = log_line.split()
  ip_address = fields[4]

---

• Date: July 23, 2026
• What I Did: Used Python dictionaries to aggregate log data and count the frequency of events per IP address. Built threshold-based alert logic.
• Key Concept: Counting frequencies allows security analysts to distinguish between normal user errors and high-volume brute-force attacks.
• Code Snippet:

  if ip in ip_counts:
      ip_counts[ip] += 1
  else:
      ip_counts[ip] = 1

---

• Date: July 25, 2026
• What I Did: Learned how to use try, except, and finally blocks to handle runtime errors gracefully without letting scripts crash.
• Key Concept: Production-grade security tools must anticipate environment failures (like missing files or permission denials) and recover safely.
• Code Snippet:

  try:
      with open("log.txt", "r") as f:
          f.read()
  except FileNotFoundError:
      print("Error: File missing!")

---

• Date: July 26, 2026
• What I Did: Learned the fundamentals of Object-Oriented Programming by creating custom Python classes (class), constructors (__init__), and object methods to model security alerts.
• Key Concept: OOP allows developers to structure complex security applications by grouping data and behaviors into reusable, modular object blueprints.
• Code Snippet:

  class SecurityAlert:
      def __init__(self, ip, severity):
          self.ip = ip
          self.severity = severity

---

• Date: July 28, 2026
• What I Did: Explored Object-Oriented Inheritance by building a base Threat class and specialized child classes (BruteForceThreat, MalwareThreat) using super().
• Key Concept: Inheritance prevents code duplication by allowing specialized classes to inherit attributes and methods from a common parent blueprint.
• Code Snippet:

  class BruteForceThreat(Threat):
      def __init__(self, ip, attempts):
          super().__init__("Brute-Force", "High", ip)
          self.attempts = attempts

---

• Date: July 29, 2026
• What I Did: Mastered encapsulation by hiding object data using private attributes (__) and creating controlled getter and setter methods with input validation.
• Key Concept: Encapsulation prevents unauthorized external modification of sensitive object properties, ensuring system integrity and secure state management.
• Code Snippet:

  class FirewallRule:
      def __init__(self, ip):
          self.__ip_address = ip  # Private attribute
          
      def set_action(self, action):
          if action in ["ALLOW", "BLOCK"]:
              self.__action = action

---

• Date: July 30, 2026
• What I Did: Mastered polymorphism by creating distinct threat classes that share a common method name (analyze()), allowing uniform execution across mixed object lists.
• Key Concept: Polymorphism lets security automation scripts process diverse types of threat data through a single, unified interface without writing complex conditional type checks.
• Code Snippet:

  for threat in security_queue:
      threat.analyze()  # Automatically calls the correct specialized method

---

• Date: July 31, 2026
• What I Did: Learned the fundamentals of network programming using Python's socket library, creating a TCP client to initiate and handle server connections.
• Key Concept: Sockets act as endpoints for network communication, allowing security tools to interact directly with network services, ports, and protocols.
• Code Snippet:

  import socket
  client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  client.connect(("127.0.0.1", 80))

---

• Date: August 2, 2026
• What I Did: Combined loops, sockets, and error handling to build an automated TCP port scanner that sweeps through target ports and identifies active services.
• Key Concept: Using socket connection checks programmatically allows security professionals to map network attack surfaces and audit open ports.
• Code Snippet:

  result = scanner_socket.connect_ex((target_host, port))
  if result == 0:
      print("Port is open!")

---

• Date: August 2, 2026
• What I Did: Implemented Python's threading library to execute concurrent port scans, dramatically increasing execution speed.
• Key Concept: Multithreading allows security scripts to perform multiple network requests simultaneously rather than waiting for each connection sequentially.
• Code Snippet:

  t = threading.Thread(target=scan_port, args=(port,))
  t.start()

---

• Date: August 3, 2026
• What I Did: Explored network packet sniffing concepts using Python raw sockets (SOCK_RAW) to capture live data packets at the network layer.
• Key Concept: Raw sockets bypass normal TCP/UDP protocol stacks to inspect raw network frames, serving as the foundational mechanism behind packet analyzers and intrusion detection systems.
• Code Snippet:

  sniffer = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_IP)
  sniffer.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

---

• Date: August 4, 2026
• What I Did: Built an IP header packet parser using Python's struct module to unpack binary network data into readable fields like source IP, destination IP, and TTL.
• Key Concept: Packet parsing allows security tools to inspect raw network traffic byte by byte to extract valuable metadata for intrusion analysis.
• Code Snippet:

  unpacked_data = struct.unpack('!BBHHHBBH4s4s', packet_bytes[:20])
  src_ip = socket.inet_ntoa(unpacked_data[8])

---

• Date: August 5, 2026
• What I Did: Built a behavioral monitoring script in Python to track connection requests per source IP and trigger alerts when traffic volumes exceed safety thresholds.
• Key Concept: Defensive monitoring relies heavily on state tracking and behavioral thresholds rather than just single-packet inspection to catch potential denial-of-service (DoS) activities.
• Code Snippet:

  ip_connection_counts[src_ip] += 1
  if ip_connection_counts[src_ip] > THRESHOLD:
      print(f"🚨 [ALERT]: Potential SYN Flood detected from {src_ip}!")

---

• Date: August 6, 2026
• What I Did: Built a File Integrity Monitor in Python using SHA-256 cryptographic hashing to detect unauthorized modifications to critical system files.
• Key Concept: File integrity monitoring is a core defensive control used to spot tampering, malware installation, or unauthorized configuration changes by tracking hash discrepancies against a known baseline.
• Code Snippet:

  sha256_hash = hashlib.sha256()
  with open(filepath, "rb") as f:
      sha256_hash.update(f.read())
  current_hash = sha256_hash.hexdigest()

---

• Date: August 7, 2026
• What I Did: Built a Python tool to evaluate password complexity using regular expressions and generate secure SHA-256 hashes for credential storage demonstration.
• Key Concept: Enforcing strict password policies and utilizing one-way cryptographic hashing are foundational controls for preventing credential stuffing and brute-force attacks.
• Code Snippet:

  if re.search(r"[A-Z]", password) and len(password) >= 12:
      score += 2
  hashed_value = hashlib.sha256(password.encode('utf-8')).hexdigest()

---

• Date: August 8, 2026
• What I Did: Built a log parsing tool in Python to read authentication logs, extract source IP addresses from failed login entries, and flag potential brute-force attacks.
• Key Concept: Automated log analysis allows security analysts to sift through thousands of event lines rapidly to detect malicious activities and unauthorized access patterns.
• Code Snippet:

  if "FAILED password" in line:
      ip_address = line.strip().split()[-1]
      failed_attempts[ip_address] += 1

---

• Date: August 9, 2026
• What I Did: Built a mock threat intelligence integration script in Python to query IP reputation statuses and community attack reports.
• Key Concept: Integrating threat intelligence APIs into security monitoring tools provides vital external context to internal log alerts, helping analysts prioritize high-risk threats.
• Code Snippet:

  intel_data = mock_threat_intel_db.get(ip_address, {"status": "Unknown", "reports": 0})

---

• Date: August 10, 2026
• What I Did: Built a Python banner grabber tool using sockets to connect to network services and extract software version metadata.
• Key Concept: Banner grabbing is an essential reconnaissance technique used to identify underlying service versions and spot outdated or vulnerable software configurations.
• Code Snippet:

  sock.connect((ip, port))
  banner = sock.recv(1024).decode('utf-8', errors='ignore').strip()

---

• Date: August 11, 2026
• What I Did: Built a web security auditing script in Python to inspect HTTP response headers and check for critical controls like HSTS, CSP, and X-Frame-Options.
• Key Concept: HTTP security headers are crucial defenses implemented at the server level to protect web applications against client-side attacks like XSS, clickjacking, and protocol downgrade exploits.
• Code Snippet:

  req = urllib.request.Request(url, headers={'User-Agent': 'SecurityAuditBot/1.0'})
  with urllib.request.urlopen(req) as response:
      headers = response.headers
      if 'Content-Security-Policy' in headers:
          print("CSP is present!")

---

• Date: August 12, 2026
• What I Did: Built a content discovery tool in Python using urllib to iterate through common path wordlists and analyze HTTP response status codes.
• Key Concept: Web directory enumeration helps security professionals identify forgotten or hidden administrative panels, configuration files, and backup paths during authorized security assessments.
• Code Snippet:

  full_url = f"{url}/{path}"
  req = urllib.request.Request(full_url, headers={'User-Agent': 'SecurityAuditBot/1.0'})
  response = urllib.request.urlopen(req)

---

• Date: August 13, 2026
• What I Did: Built an input validation script in Python using regular expressions to detect common SQL injection signatures and malicious query patterns.
• Key Concept: SQL injection exploits unvalidated user input to manipulate database commands. Defensive filters rely on pattern matching and strict input validation to catch attacks at the application perimeter.
• Code Snippet:

  sql_patterns = [r"(\%27)|(\')", r"(\bOR\b.*=)", r"(\bUNION\b.*\bSELECT\b)"]
  if re.search(pattern, user_input, re.IGNORECASE):
      print("Potential SQL Injection detected!")

---

• Date: August 14, 2026
• What I Did: Built a web input sanitization script in Python using regular expressions to detect common Cross-Site Scripting (XSS) signatures and injection vectors.
• Key Concept: XSS targets browser execution by injecting unauthorized scripts into web app outputs. Defensive layers rely on robust pattern filters and proper data encoding.
• Code Snippet:

  xss_patterns = [r"<script.*?>.*?</script.*?>", r"javascript:", r"onerror\s*="]
  if re.search(pattern, user_input, re.IGNORECASE):
      print("Potential XSS pattern detected!")

---

• Date: August 15, 2026
• What I Did: Built a consolidated Python security auditing script that merges SQL Injection and XSS detection modules into a unified threat scanner.
• Key Concept: Production-grade security tools combine multiple validation rules and check modules to inspect application inputs comprehensively across different vulnerability categories.
• Code Snippet:

  if check_sqli(payload):
      print("SQL Injection detected!")
  elif check_xss(payload):
      print("XSS detected!")

---

• Date: August 16, 2026
• What I Did: Built a source code auditing script in Python using regular expressions to detect hardcoded passwords, API keys, and cloud credentials.
• Key Concept: DevSecOps security tools scan source code repositories prior to deployment to prevent accidental credential leaks and enforce safe environment variable configurations.
• Code Snippet:

  secret_patterns = [r"password\s*=\s*['\"].*?['\"]", r"AKIA[0-9A-Z]{16}"]
  if re.search(pattern, line, re.IGNORECASE):
      findings.append((line_num, line.strip()))

---

• Date: August 17, 2026
• What I Did: Built a dependency auditing script in Python to scan project requirements against a mock vulnerability database and flag outdated packages tied to known CVEs.
• Key Concept: Software Composition Analysis (SCA) is a vital DevSecOps control used to secure third-party open-source components before code reaches production.
• Code Snippet:

  if vulnerability_database[name]["vulnerable_version"] == version:
      print(f"🚨 [ALERT]: Vulnerable package found: {name} | CVE: {cve}")

---

• Date: August 18, 2026
• What I Did: Built a configuration auditing script in Python to evaluate server settings against security baselines and flag infrastructure misconfigurations.
• Key Concept: Infrastructure hardening and compliance auditing ensure that servers and cloud resources follow least-privilege and secure defaults before going live.
• Code Snippet:

  if current_value != expected_value:
      print(f"Misconfiguration detected in {setting}: {rule['risk']}")

---

• Date: August 19, 2026
• What I Did: Built a container security auditing script in Python to scan Dockerfiles for common security anti-patterns like root execution and mutable tags.
• Key Concept: Container hardening ensures that applications running in isolated environments adhere to least-privilege principles and secure build practices.
• Code Snippet:

  if "FROM" in line_str and ":latest" in line_str:
      print("Warning: Uses ':latest' tag.")
  elif "USER root" in line_str:
      print("High Risk: Container runs as root.")

---

• Date: August 20, 2026
• What I Did: Built a CI/CD pipeline auditing script in Python to scan YAML workflow files for dangerous triggers like pull_request_target and insecure secret handling.
• Key Concept: Securing CI/CD pipelines prevents malicious actors from exploiting automated build runners to steal repository secrets or gain unauthorized write access.
• Code Snippet:

  if "pull_request_target:" in content:
      print("High Risk: Workflow uses pull_request_target trigger.")

---

• Date: August 21, 2026
• What I Did: Built a log analysis script in Python to parse authentication logs, track failed login frequencies per IP address, and flag potential brute-force attacks.
• Key Concept: Security Information and Event Management (SIEM) systems use threshold-based detection rules to identify automated credential attacks from server log streams.
• Code Snippet:

  if "Failed login" in log:
      ip_address = log.split("from")[-1].strip()
      failed_attempts[ip_address] = failed_attempts.get(ip_address, 0) + 1

---

---

• Date: August 22, 2026
• What I Did: Built a web log analysis script in Python to parse HTTP access logs, count 4xx error responses per IP address, and detect automated reconnaissance or directory scanning.
• Key Concept: Monitoring spikes in HTTP client errors (like 404 Not Found and 403 Forbidden) allows security teams to catch attackers probing applications during the reconnaissance phase.
• Code Snippet:

  if status_code.startswith("4"):
      error_counts[ip] = error_counts.get(ip, 0) + 1

---

• Date: August 23, 2026
• What I Did: Built a log analysis script in Python to parse HTTP access logs and detect automated scanning tools, scripts, and vulnerability scanners through User-Agent signatures.
• Key Concept: Attackers and automated scanners often leave recognizable signatures in HTTP User-Agent headers, allowing SIEM tools to filter out unauthorized traffic.
• Code Snippet:

  suspicious_ua_patterns = [r"python-requests", r"sqlmap", r"curl", r"nikto"]
  if re.search(pattern, user_agent, re.IGNORECASE):
      findings.append((ip, user_agent, pattern))

---

• Date: August 24, 2026
• What I Did: Built a centralized SIEM log aggregation script in Python to ingest multi-source logs, correlate security events, and output a unified threat metrics dashboard.
• Key Concept: Centralized SIEM platforms combine authentication logs, web access logs, and tool signatures to give analysts a complete picture of ongoing threat campaigns.
• Code Snippet:

  events, logins, errors, bots, ips = run_siem_analysis(enterprise_logs)
  print(f"Total Events: {events} | Flagged IPs: {list(ips)}")

---

• Date: August 25, 2026
• What I Did: Built a threat intelligence matching script in Python to scan internal system artifacts (IPs and file hashes) against a simulated IOC database.
• Key Concept: Threat intelligence feeds provide real-time indicators of compromise, allowing automated security tools to detect known malicious actors and malware variants across infrastructure.
• Code Snippet:

  if artifact_type == "ip" and value in feed["ips"]:
      print(f"Malicious IP match found: {value}")

---

• Date: August 26, 2026
• What I Did: Built a Python endpoint security script using regular expressions to simulate YARA-style malware signature matching and string detection.
• Key Concept: Malware analysis tools use signature rules to scan files for known malicious strings, obfuscation patterns, and ransom notes across endpoint file systems.
• Code Snippet:

  for sig in signatures:
      if re.search(sig, content, re.IGNORECASE):
          matches_found.append((malware_name, sig))

---

• Date: August 27, 2026
• What I Did: Built an endpoint security script in Python to parse process execution telemetry and detect malicious "Living off the Land" command-line abuse (like encoded PowerShell and Certutil downloads).
• Key Concept: Monitoring process creation telemetry helps security teams catch attackers abusing native operating system tools for payload delivery and execution.
• Code Snippet:

  suspicious_cmd_patterns = [r"-enc\b", r"certutil\.exe.*-urlcache"]
  if re.search(pattern, log, re.IGNORECASE):
      alerts.append((log, pattern))

---

• Date: August 30, 2026
• What I Did: Built an endpoint security script in Python to audit system startup persistence locations (registry keys and startup folders) against a whitelisted application baseline.
• Key Concept: Threat actors use startup persistence mechanisms to ensure their malware or backdoors survive system reboots, making automated persistence auditing crucial for endpoint defense.
• Code Snippet:

  if path not in whitelisted_paths:
      print(f"Suspicious persistence mechanism found: {name} at {path}")

---

• Date: August 31, 2026
• What I Did: Built an endpoint security script in Python to audit process module load events (ImageLoad telemetry) and detect unauthorized or suspicious DLL loading.
• Key Concept: Attackers use techniques like DLL sideloading and injection to force legitimate processes to execute untrusted code libraries, making module auditing essential for endpoint visibility.
• Code Snippet:

  is_trusted = any(path.startswith(td) for td in trusted_dirs)
  if not is_trusted:
      print(f"Suspicious module load detected: {dll_name} at {path}")

---

• Date: September 1, 2026
• What I Did: Built an endpoint security script in Python to parse active process network connection logs and detect suspicious Command and Control (C2) communication patterns.
• Key Concept: Monitoring outbound socket telemetry helps security teams catch malware beaconing to external servers over suspicious ports or known threat IP addresses.
• Code Snippet:

  if dest_ip in indicators["ips"] or port in indicators["ports"]:
      print(f"C2 Alert: Suspicious network connection from {process} to {dest_ip}:{port}")

---

• Date: September 2, 2026
• What I Did: Built a File Integrity Monitoring script in Python to compute and compare cryptographic file hashes against a trusted baseline, detecting unauthorized system file modifications.
• Key Concept: File Integrity Monitoring (FIM) uses hashing algorithms to track changes to sensitive system files and configurations, providing early detection of rootkits and tampering.
• Code Snippet:

  if current_hash != original_hash:
      print(f"Tampering Alert: File modification detected in {filepath}")

---

• Date: September 3, 2026
• What I Did: Built a network forensics script in Python to parse packet traffic logs, track data transfer sizes, and detect potential data exfiltration events.
• Key Concept: Network packet analysis allows security teams to identify anomalous data spikes and unauthorized outbound transfers during an incident investigation.
• Code Snippet:

  if size > size_threshold_bytes:
      print(f"Exfiltration Alert: Large packet size from {src} to {dest}")

---

• Date: September 4, 2026
• What I Did: Built a network forensics script in Python to parse DNS query logs, measure subdomain lengths, and detect covert DNS tunneling and data exfiltration.
• Key Concept: Attackers use DNS tunneling to bypass firewalls by encoding data inside query subdomains. Monitoring query lengths helps defenders catch this stealthy exfiltration vector.
• Code Snippet:

  if len(domain) > length_threshold:
      print(f"DNS Tunneling Alert: Long query detected from {src}: {domain}")

---

• Date: September 5, 2026
• What I Did: Built a network forensics script in Python to parse packet logs, track TCP SYN flag frequencies per source IP, and detect potential volumetric Denial of Service (DoS) attacks.
• Key Concept: TCP SYN floods overwhelm server connection tables by initiating handshakes without completing them. Monitoring SYN packet ratios helps defenders catch DoS attempts early.
• Code Snippet:

  if pkt["flag"] == "SYN":
      syn_counts[src] = syn_counts.get(src, 0) + 1

---

• Date: September 6, 2026
• What I Did: Built a comprehensive network forensics capstone script in Python to consolidate packet exfiltration tracking, DNS tunneling detection, and TCP SYN flood analysis into a unified security auditor.
• Key Concept: Enterprise network monitoring requires unified pipelines that analyze multi-vector traffic simultaneously to catch complex exfiltration and denial-of-service campaigns.
• Code Snippet:

  exfil_total, dns_total, dos_total = run_network_audit(network_stream)
  print(f"Total network anomalies detected: {exfil_total + dns_total + dos_total}")

---

• Date: September 7, 2026
• What I Did: Built a cloud security script in Python to parse and audit simulated AWS S3 bucket access policies for public exposure risks and wildcard principals.
• Key Concept: Misconfigured cloud storage permissions can expose sensitive enterprise data to the internet. Automated IAM and storage auditing helps prevent unauthorized exposure.
• Code Snippet:

  if principal == "*" or (isinstance(principal, dict) and principal.get("AWS") == "*"):
      print(f"Critical Risk: S3 Bucket '{bucket}' is publicly exposed!")

---

• Date: September 8, 2026
• What I Did: Built a cloud security script in Python to parse simulated AWS CloudTrail logs and detect high-risk administrative API calls (such as backdoor access key creation and logging disruption).
• Key Concept: Monitoring CloudTrail management events allows security teams to identify compromised cloud accounts and privilege escalation attempts in real time.
• Code Snippet:

  if event_name in sensitive_events:
      print(f"High-Risk Cloud Event: {event_name} performed by {username} from {source_ip}")

---

• Date: September 9, 2026
• What I Did: Built a cloud security script in Python to scan source code and configuration files for hardcoded Azure storage account access keys and connection strings.
• Key Concept: Secret sprawl in code repositories is a major entry point for cloud attackers. Automated scanning helps catch credentials before they reach production.
• Code Snippet:

  azure_key_pattern = r"AccountKey=[A-Za-z0-9+/=]{20,}"
  if re.search(azure_key_pattern, content):
      print(f"Secret Leak: Hardcoded Azure credential found in {path}")

---

• Date: September 10, 2026
• What I Did: Built a cloud security script in Python to parse simulated cloud security group rules and detect overly permissive inbound access to sensitive ports (SSH/RDP) from 0.0.0.0/0.
• Key Concept: Misconfigured cloud firewalls that expose administrative ports to the public internet are a leading entry point for brute-force attacks and cloud compromises.
• Code Snippet:

  if port in restricted_ports and cidr == "0.0.0.0/0":
      print(f"Exposure Alert: Security Group '{group_name}' exposes port {port} to the world.")

---

• Date: September 11, 2026
• What I Did: Built a container security script in Python to audit simulated Kubernetes RBAC policies and detect dangerous wildcard permissions granting access to secrets and pods.
• Key Concept: Overly permissive Kubernetes role-based access control (RBAC) allows compromised pods to escalate privileges and compromise the entire cluster.
• Code Snippet:

  if "*" in verbs and ("secrets" in resources or "*" in resources):
      print(f"Privilege Escalation Risk: Role '{role_name}' is dangerously permissive!")

---

• Date: September 12, 2026
• What I Did: Built a cloud security script in Python to audit AWS EC2 instance metadata service (IMDS) configurations and detect insecure IMDSv1 usage vulnerable to SSRF credential theft.
• Key Concept: Insecure IMDSv1 configurations allow applications affected by Server-Side Request Forgery (SSRF) to read temporary IAM credentials from the local metadata IP address. Enforcing IMDSv2 mitigates this risk.
• Code Snippet:

  if endpoint == "enabled" and tokens == "optional":
      print(f"Vulnerability Detected: Instance '{name}' uses insecure IMDSv1!")

---

• Date: September 13, 2026
• What I Did: Built a cloud security capstone script in Python to consolidate S3 public access checks, firewall ingress auditing, and IMDSv1 vulnerability detection into a unified compliance tool.
• Key Concept: Cloud Security Posture Management (CSPM) tools automate multi-vector compliance checks to catch storage misconfigurations, network exposure, and metadata risks before exploitation.
• Code Snippet:

  s3_total, firewall_total, imds_total = audit_cloud_posture(cloud_infrastructure)
  print(f"Total cloud misconfigurations found: {s3_total + firewall_total + imds_total}")

---

• Date: September 14, 2026
• What I Did: Built a threat intelligence script in Python to ingest malicious indicator feeds and cross-reference them against server access logs to detect active compromises.
• Key Concept: Threat intelligence feeds supply known malicious indicators (IPs, domains, hashes) that security teams use to automate log correlation and threat hunting.
• Code Snippet:

  if client_ip in feed["malicious_ips"] or domain in feed["malicious_domains"]:
      print(f"Threat Match Detected: Malicious indicator found for IP {client_ip}")

---

• Date: September 15, 2026
• What I Did: Built a threat hunting script in Python to scan simulated endpoint file system inventories against threat intelligence SHA-256 hash blacklists.
• Key Concept: Cryptographic file hashes provide immutable digital fingerprints that allow security analysts to detect known malware regardless of filename modifications.
• Code Snippet:

  if file_hash in malicious_hashes:
      print(f"Malware Threat Detected: Known malicious file hash matched at {path}")

---

• Date: September 16, 2026
• What I Did: Built a threat hunting script in Python to scan endpoint process creation logs for malicious usage of Living off the Land binaries (LOLBins) like certutil and powershell.
• Key Concept: Threat actors use built-in administrative tools to evade antivirus detection. Monitoring command-line telemetry helps security analysts catch LOLBin abuse and evasion tactics.
• Code Snippet:

  if sig["tool"] == proc and sig["indicator"].lower() in cmd.lower():
      print(f"LOLBin Threat Detected: Suspicious administrative tool abuse by {proc}")

---

• Date: September 17, 2026
• What I Did: Built an Incident Response (IR) script in Python to automate host triage collection, scanning running processes, active network connections, and user sessions for compromise indicators.
• Key Concept: During a security incident, capturing volatile system state before shutting down or rebooting is vital for preserving forensic evidence.
• Code Snippet:

  if pname in suspicious_indicators or port == 4444:
      print(f"Triage Alert: High-risk anomaly indicator detected for process {pname}")

---

• Date: September 18, 2026
• What I Did: Built a digital forensics and incident response script in Python to parse simulated Windows Security Event Logs (Event ID 4625) and detect brute-force and password-spraying attacks.
• Key Concept: Monitoring failed authentication events and tracking attempt frequencies by source IP allows SOC analysts to spot unauthorized credential access attempts early.
• Code Snippet:

  if count >= threshold:
      print(f"Brute-Force Alert: Multiple authentication failures detected from IP {ip}")

---

• Date: September 19, 2026
• What I Did: Built a digital forensics script in Python to parse simulated Windows Registry Run Key hive exports and detect malicious startup persistence mechanisms.
• Key Concept: Attackers establish persistence by hooking into registry startup keys so malware executes automatically upon reboot. Analyzing these paths helps DFIR analysts uncover hidden backdoors.
• Code Snippet:

  is_suspicious = any(indicator in path_lower for indicator in suspicious_path_indicators)
  if is_suspicious:
      print(f"Persistence Alert: Suspicious startup entry detected at {path}")

---

• Date: September 20, 2026
• What I Did: Built a digital forensics script in Python to parse simulated web browser download history databases and flag malicious files and staging URLs.
• Key Concept: Browser artifact analysis allows DFIR analysts to reconstruct how an attacker downloaded initial access payloads and tools onto a compromised workstation.
• Code Snippet:

  if danger == "DANGEROUS":
      print(f"Forensic Alert: Malicious file download identified from {url}")

---

• Date: September 21, 2026
• What I Did: Built a digital forensics script in Python to parse simulated PowerShell command history logs and detect malicious execution artifacts such as IEX downloads and encoded commands.
• Key Concept: PowerShell telemetry provides deep visibility into post-exploitation activity. Analyzing command history and script block logs helps DFIR analysts reconstruct attacker actions.
• Code Snippet:

  matched_indicators = [ind for ind in suspicious_indicators if ind in cmd_lower]
  if matched_indicators:
      print(f"Forensic Alert: Suspicious PowerShell execution detected for user {user}")

---

• Date: September 22, 2026
• What I Did: Built a digital forensics script in Python to parse simulated Windows Scheduled Tasks inventory data and detect malicious persistence mechanisms hiding in task triggers.
• Key Concept: Attackers use the Task Scheduler to ensure malware automatically executes upon system startup or logon. Auditing task action paths helps DFIR analysts uncover hidden backdoors.
• Code Snippet:

  is_suspicious = any(indicator in path_lower for indicator in suspicious_path_indicators)
  if is_suspicious:
      print(f"Persistence Alert: Suspicious scheduled task detected for {name}")

---

• Date: September 23, 2026
• What I Did: Built a network forensics script in Python to parse simulated firewall connection logs and detect suspicious outbound Command and Control (C2) traffic.
• Key Concept: Monitoring outbound connection ports and data transfer volumes helps incident responders spot malware beaconing out to external infrastructure.
• Code Snippet:

  if port in suspicious_ports:
      print(f"C2 Alert: Suspicious outbound network connection detected to {dst}:{port}")

---

• Date: September 24, 2026
• What I Did: Built a digital forensics script in Python to merge multi-artifact logs (browser history, process execution, registry persistence, and firewall traffic) into a unified chronological timeline.
• Key Concept: Timeline analysis allows incident responders to stitch together disparate evidence sources to reconstruct the complete lifecycle of a cyber attack.
• Code Snippet:

  sorted_timeline = sorted(evidence, key=lambda x: x["timestamp"])
  for event in sorted_timeline:
      print(f"Time: {event['timestamp']} | Source: {event['source']}")

---

• Date: September 25, 2026
• What I Did: Built an Incident Response automation script in Python to execute rapid containment playbooks—terminating malicious processes, isolating network hosts, disabling compromised accounts, and blocking C2 IPs.
• Key Concept: Minimizing Mean Time to Contain (MTTC) is critical during an active breach. Automating standard containment playbooks prevents attackers from moving laterally.
• Code Snippet:

  print(f"Action 1: Terminating malicious process '{incident['threat_process']}' (PID: {incident['process_pid']})...")
  print(f"Action 2: Isolating host '{incident['compromised_host']}' from network...")

---

• Date: September 26, 2026
• What I Did: Built a vulnerability assessment script in Python to scan target ports, check connectivity, and extract service version banners for security auditing.
• Key Concept: Port scanning and banner grabbing are foundational techniques for asset discovery, allowing security analysts to identify outdated software versions and potential vulnerabilities.
• Code Snippet:

  result = sock.connect_ex((host, port))
  if result == 0:
      banner = sock.recv(1024).decode().strip()
      print(f"Port {port} is open with banner: {banner}")

---

• Date: September 27, 2026
• What I Did: Built a vulnerability management script in Python to cross-reference service version banners against a simulated CVE database, automatically identifying high-risk software flaws.
• Key Concept: Automated CVE matching enables security auditors to rapidly assess risk exposure and prioritize patching across enterprise assets without running active exploits.
• Code Snippet:

  if banner in vuln_db:
      cve_info = vuln_db[banner]
      print(f"Vulnerability Detected: {cve_info['cve']} ({cve_info['severity']})")

---

• Date: September 28, 2026
• What I Did: Built a web application reconnaissance script in Python to fuzz target URLs with common directory wordlists and analyze HTTP status codes for hidden endpoints.
• Key Concept: Content discovery and fuzzing help penetration testers uncover hidden administrative panels, configuration files, and backup archives that could introduce severe security risks.
• Code Snippet:

  status_code = responses.get(path, 404)
  if status_code in [200, 403]:
      print(f"Discovered endpoint: {full_url} with status {status_code}")

---

• Date: September 29, 2026
• What I Did: Built a web vulnerability assessment script in Python to test input parameters against common SQL injection payloads and detect insecure database query handling.
• Key Concept: SQL Injection allows attackers to manipulate backend database queries through unsanitized inputs. Identifying these flaws helps developers enforce prepared statements.
• Code Snippet:

  if any(p in value for p in ["' OR '1'='1", "1=1 --"]):
      print(f"Vulnerability Detected: SQL Injection in parameter {param}")

---

• Date: September 30, 2026
• What I Did: Built a web vulnerability assessment script in Python to test form parameters against common Cross-Site Scripting (XSS) payloads and detect unescaped output rendering.
• Key Concept: XSS vulnerabilities occur when applications echo user input without proper encoding, allowing malicious scripts to execute in client browsers. Identifying these flaws helps enforce output sanitization.
• Code Snippet:

  if any(payload in value for payload in ["<script>", "onerror="]):
      print(f"Vulnerability Detected: XSS reflection in parameter {param}")

---

• Date: September 30, 2026
• What I Did: Built a web application security auditing script in Python to check server response headers for missing defensive controls like CSP, HSTS, and X-Frame-Options.
• Key Concept: HTTP security headers instruct browsers to enforce security boundaries. Auditing these headers helps security engineers spot misconfigurations that expose users to browser-based attacks.
• Code Snippet:

  for req_header in required_security_headers:
      if req_header not in headers:
          missing_headers.append(req_header)

---

• Date: October 1, 2026
• What I Did: Built a web vulnerability assessment script in Python to test input parameters against path traversal payloads (../) and detect Local File Inclusion (LFI) flaws.
• Key Concept: Directory traversal vulnerabilities allow attackers to bypass file access controls and read sensitive operating system files due to unsanitized input paths.
• Code Snippet:

  if ".." in value and ("/etc/" in value or "Windows" in value):
      print(f"Vulnerability Detected: LFI exposure in parameter {param}")

---

• Date: October 3, 2026
• What I Did: Built a web vulnerability assessment script in Python to test input parameters against shell metacharacters and detect OS Command Injection flaws.
• Key Concept: OS Command Injection occurs when user data is passed directly to a system shell, allowing attackers to achieve remote code execution (RCE).
• Code Snippet:

  if any(char in value for char in [";", "&", "|", "`"]):
      print(f"Vulnerability Detected: Command injection in parameter {param}")

---

• Date: October 4, 2026
• What I Did: Built a web application security auditing script in Python to test API responses for dangerous Cross-Origin Resource Sharing (CORS) misconfigurations, such as reflected arbitrary origins with credentials enabled.
• Key Concept: Improper CORS implementation allows malicious third-party websites to read sensitive user data and API responses via authorized browser sessions.
• Code Snippet:

  if acao == origin and acac.lower() == "true":
      print("Vulnerability Detected: Critical CORS Misconfiguration (Arbitrary Origin Reflection with Credentials)")

---

• Date: October 5, 2026
• What I Did: Built a web application security script in Python to test URL fetcher parameters against internal IP addresses and cloud metadata endpoints to detect SSRF flaws.
• Key Concept: SSRF vulnerabilities allow attackers to coerce backend servers into making unauthorized requests to internal infrastructure or metadata services.
• Code Snippet:

  if any(indicator in value for indicator in ssrf_indicators):
      print(f"Vulnerability Detected: SSRF exposure in parameter {param}")

---

• Date: October 6, 2026
• What I Did: Built a web application security script in Python to test XML payload requests against dangerous DOCTYPE and external entity definitions to detect XXE flaws.
• Key Concept: XXE vulnerabilities occur when XML parsers improperly evaluate external entity references, allowing attackers to read local files or trigger SSRF.
• Code Snippet:

  if any(ind in payload_lower for ind in ["<!entity", "system 'file://"]):
      print(f"Vulnerability Detected: XXE flaw in endpoint {endpoint}")

---

• Date: October 7, 2026
• What I Did: Built an API security assessment script in Python to test object identifiers across user session contexts and detect IDOR / BOLA vulnerabilities.
• Key Concept: IDOR vulnerabilities occur when applications accept direct object references without verifying if the user has authorization to access that specific resource.
• Code Snippet:

  if session != owner:
      print(f"Vulnerability Detected: IDOR flaw on endpoint {endpoint} for resource {req_id}")

---

• Date: October 8, 2026
• What I Did: Built an API security script in Python to audit JSON Web Tokens (JWTs) for unsecured algorithm settings (none) and weak symmetric signing keys.
• Key Concept: JWT misconfigurations—such as accepting unsigned tokens or using guessable secrets—allow attackers to forge administrator credentials and bypass authentication.
• Code Snippet:

  if algo.lower() == "none":
      print("Vulnerability Detected: Unsecured JWT algorithm 'none'")
  elif secret in weak_secrets_wordlist:
      print("Vulnerability Detected: Weak symmetric signing secret")

---

• Date: October 9, 2026
• What I Did: Built a web application security auditing script in Python to test state-changing endpoints for anti-CSRF token validation and SameSite cookie attributes.
• Key Concept: Cross-Site Request Forgery allows attackers to force authenticated users into executing unwanted actions. Auditing token requirements and cookie flags helps prevent these attacks.
• Code Snippet:

  if not token_present or samesite.lower() == "none":
      print(f"Vulnerability Detected: Inadequate CSRF protection on {ep}")

---

• Date: October 10, 2026
• What I Did: Built an API security assessment script in Python to test update request payloads for unauthorized parameter bindings and detect Mass Assignment (over-binding) flaws.
• Key Concept: Mass assignment vulnerabilities occur when APIs blindly bind user input to database objects, allowing attackers to inject sensitive properties like admin flags or roles.
• Code Snippet:

  injected_sensitive_fields = [key for key in payload.keys() if key in sensitive_attributes]
  if injected_sensitive_fields:
      print("Vulnerability Detected: Mass Assignment over-binding flaw")

---

• Date: October 11, 2026
• What I Did: Built an API security assessment script in Python to simulate rapid-fire request bursts and test authentication endpoints for missing rate-limiting controls.
• Key Concept: Lack of rate limiting on login and MFA endpoints allows attackers to execute high-speed brute-force attacks and credential stuffing without restriction.
• Code Snippet:

  rate_limited = any(status == 429 for status in statuses)
  if not rate_limited:
      print("Vulnerability Detected: Missing Rate Limiting / Brute-Force Protection")

---

• Date: October 13, 2026
• What I Did: Built a web application security script in Python to audit multi-step transaction workflows for step-bypass and business logic state flaws.
• Key Concept: Business logic vulnerabilities occur when applications trust client-side sequencing without enforcing strict server-side state validation, enabling workflow bypasses like skipping payments.
• Code Snippet:

  if "Subscription" in name and "payment_processed" not in prereqs:
      print("Vulnerability Detected: Business Logic Workflow Bypass")

---

• Date: October 13, 2026
• What I Did: Built a web application security script in Python to test file upload endpoints against executable extensions and double-extension bypasses to detect unrestricted file upload flaws.
• Key Concept: Unrestricted file uploads occur when applications fail to validate file types or store uploads within web-accessible directories, allowing attackers to deploy web shells for Remote Code Execution.
• Code Snippet:

  is_dangerous = any(filename.lower().endswith(ext) for ext in dangerous_extensions)
  if is_dangerous:
      print("Vulnerability Detected: Unrestricted File Upload Flaw")

---

• Date: October 14, 2026
• What I Did: Built a web application security auditing script in Python to check server response headers for framing controls (X-Frame-Options and CSP frame-ancestors) to detect clickjacking flaws.
• Key Concept: Clickjacking tricks users into interacting with hidden UI layers. Auditing framing response headers ensures web pages cannot be loaded inside unauthorized third-party iframes.
• Code Snippet:

  if not has_xfo_protection and not has_csp_protection:
      print("Vulnerability Detected: Potential Clickjacking Flaw")

---

• Date: October 15, 2026
• What I Did: Built a web application security script in Python to test navigation and login parameters against external URLs and protocol-relative strings to detect Open Redirect flaws.
• Key Concept: Open redirect vulnerabilities occur when applications accept unvalidated destination URLs, enabling attackers to weaponize trusted domains for phishing campaigns.
• Code Snippet:

  is_external = val.startswith("http://") or val.startswith("https://") or val.startswith("//")
  if is_external and domain not in val:
      print("Vulnerability Detected: Open Redirect Flaw")

---

• Date: October 16, 2026
• What I Did: Built a penetration testing reconnaissance script in Python to automate subdomain discovery using prefix wordlists and flag exposed administrative or staging hosts.
• Key Concept: Subdomain enumeration maps an organization's external attack surface to uncover forgotten, unpatched, or misconfigured web properties.
• Code Snippet:

  for prefix in wordlist:
      hostname = f"{prefix}.{domain}"
      if hostname in active_subdomains_mock:
          discovered_hosts.append(hostname)

---

• Date: October 17, 2026
• What I Did: Built a web infrastructure security script in Python to audit HTTPS endpoints for deprecated TLS versions, expired certificates, and self-signed trust issues.
• Key Concept: Transport Layer Security (TLS) auditing protects data in transit by enforcing modern cryptographic standards and valid certificate trust chains.
• Code Snippet:

  if tls in ["TLSv1.0", "TLSv1.1"] or expired or self_signed:
      print("Vulnerability Detected: TLS / Certificate Security Flaw")