Cybersecurity Projects 🐉

70 Cybersecurity Projects, Certification Roadmaps & Resources

View Complete Projects:

_{Currently building: DDoS Mitigation Tool}

Quick Navigation

Projects

Certification Roadmaps

Learning Resources

Projects

[!TIP]

Want to be walked through building these instead of reading finished source? CertGames has guided project courses that build real security tools from scratch, step by step, with the concepts explained as you go. Same projects, less getting stuck. FREE

Foundations Projects

[!NOTE]

Start here if this is your first time coding. The Foundations tier is pre-beginner — built for someone who has never written Python, has barely used a terminal, and is new to cybersecurity. Source files are heavily commented as a teaching aid, and every learn/ folder explains concepts from zero. Once you're comfortable here, the Beginner projects assume you already know the language and move faster.

> What makes Foundations different:

- Single-file projects — the entire tool lives in one readable Python file. No file-hopping.

- Heavy teaching comments — every line that introduces a new concept is annotated inline.

- Numpy-style docstrings on every function — what it does, why it exists, every parameter.

- Extra-deep learn/ folders — Python features and security concepts both explained from zero.

- Senior-level code, beginner-level explanations — the code itself is still production-quality.

| Project | Info | What You'll Learn | |---------|------|-------------------| | Hash Identifier
Identify hash types by prefix, length, and charset | !Step 1/3 !2-4h !Python !Foundations | Hash families (MD5, SHA, bcrypt, Argon2) • PHC string format • Pattern matching • Pure-function design
Source Code \| Docs | | HTTP Headers Scanner
Audit a URL's response headers for missing or weak security controls | !Step 2/3 !3-5h !Python !Foundations | HTTP fundamentals • Security headers (CSP, HSTS, X-Frame-Options) • httpx requests • Scored audits
Source Code \| Docs | | Password Manager
Encrypted local vault with master password unlock | !Step 3/3 !6-8h !Python !Foundations | Argon2id key derivation • AES-GCM authenticated encryption • Secure on-disk vaults • Master-password workflows
Source Code \| Docs |

Beginner Projects

| Project | Info | What You'll Learn | |---------|------|-------------------| | Simple Port Scanner
Async TCP port scanner in C++ @deniskhud | !2-4h !C++ !Beginner | TCP socket programming • Async I/O patterns • Service detection
Source Code \| Docs | | Keylogger
Capture keyboard events with timestamps | !1-2h !Python !Beginner | Event handling • File I/O • Ethical considerations
Source Code \| Docs | | Caesar Cipher
CLI encryption/decryption tool | !1-2h !Python !Beginner | Classical cryptography • Brute force attacks • CLI design
Source Code \| Docs | | DNS Lookup CLI Tool
Query DNS records with WHOIS | !2-3h !Python !Beginner | DNS protocols • WHOIS queries • Reverse DNS lookup
Source Code \| Docs | | Simple Vulnerability Scanner
Check software against CVE databases | !3-4h !Go !Beginner | CVE databases • Dependency scanning • Vulnerability assessment
Source Code \| Docs | | Network Traffic Analyzer
Capture and analyze packets | !3-5h !Python !C++ !Beginner | Packet capture • Protocol analysis • Traffic visualization
Source (C++) \| Docs (C++) \| Source (Python) \| Docs (Python) | | Hash Cracker
Dictionary and brute-force cracking | !3-4h !C++ !Beginner | Hash algorithms • Dictionary attacks • Password security
Source Code \| Docs | | Steganography Multi-Tool
Hide data in images, audio, QR, PDFs, text | !8-10h !Go !Beginner | Multi-format steganography • Encrypted AEAD envelope • Zero-width Unicode • Audio LSB • QR Reed-Solomon injection
Source Code \| Docs | | Deserialization Gadget Lab
Read untrusted Marshal and YAML without ever reviving it, then break it | !12-16h !Ruby !Docker !Beginner | Gadget chains • Marshal binary format • Gated vs ungated dispatch • TracePoint veto • CVE-2026-41316
Source Code \| Docs
| | Canary Token Generator
Self-hosted honeytokens that alert on access | !2-3h !Go !React !Docker !Beginner | Deception defense • Honeytokens • MySQL wire protocol • PDF/DOCX patching • Webhook + Telegram alerting
Source Code \| Docs
| | Phishing Domain Generator & Quishing Scanner
Typosquat generation + QR phishing detection | !2-3h !Python !Beginner | Homoglyph attacks • Typosquatting • QR code analysis • Domain intelligence
Learn More | | SSH Brute Force Detector
Monitor and block SSH attacks | !2-4h !Python !Beginner | Log parsing • Attack detection • Firewall automation
Learn More | | Simple C2 Beacon
Command and Control beacon/server | !3-5h !Python !React !Docker !Beginner | C2 architecture • MITRE ATT&CK • WebSocket protocol • XOR encoding
Source Code \| Docs | | Base64 Encoder/Decoder
Multi-format encoding tool | !1h !Python !Beginner | Base64/32 encoding • URL encoding • Auto-detection
Source Code \| Docs | | Linux CIS Hardening Auditor
CIS benchmark compliance checker | !3-4h !Bash !Beginner | CIS benchmarks • System hardening • Compliance scoring • Shell scripting
Source Code \| Docs | | Systemd Persistence Scanner
Hunt Linux persistence mechanisms | !2-3h !Go !Beginner | Persistence techniques • Systemd internals • Cron analysis • Threat hunting
Source Code \| Docs | | Linux eBPF Security Tracer
Real-time syscall tracing with eBPF | !2-3h !Python !C !Beginner | eBPF programs • Syscall tracing • BCC framework • Security observability
Source Code \| Docs | | Trojan Application Builder
Educational malware lifecycle demo | !2-3h !Python !Beginner | Trojan anatomy • Data exfiltration • File encryption • Attack lifecycle
Learn More | | DNS Sinkhole
Pi-hole-style malware domain blocker | !3-4h !Go !Beginner | DNS protocol • Blocklist management • Query logging • Network defense
Learn More | | Firewall Rule Engine
Parse and validate iptables/nftables rules | !2-3h !V !Beginner | Firewall internals • Rule parsing • iptables/nftables • V language
Source Code \| Docs | | LLM Prompt Injection Firewall
Sandbox the effects, not the prompt: fence untrusted text, authorize the tool calls, match the secret on the way out | !14-18h !Python !Docker !Beginner | Provenance fencing • Taint propagation • Unicode tag-block smuggling • Encoding closure • OWASP LLM01:2025
Source Code \| Docs
|

| Project | Info | What You'll Learn | |---------|------|-------------------| | Security News Scraper
Aggregate cybersecurity news | !3-4h !Go !Beginner | Web scraping • CVE parsing • Database storage
Source Code \| Docs | | Payload Obfuscation Engine
Multi-layer payload obfuscation toolkit | !2-4d !Go !Intermediate | Obfuscation techniques • Polymorphism • AV evasion • Signature detection
Learn More | | SIEM Dashboard
Log aggregation with correlation | !3-5d !Flask !React !Intermediate | SIEM concepts • Log correlation • Full-stack development
Source Code \| Docs
| | Token Abuse Playground
15+ token vulnerabilities to exploit and fix | !3-5d !FastAPI !React !Intermediate | JWT exploitation • OAuth attacks • Session security • Token forensics
Learn More | | Supply Chain Attack Simulator
Fake PyPI package dependency confusion demo | !2-4d !Python !Intermediate | Supply chain attacks • Dependency confusion • Package security • PyPI internals
Learn More | | DDoS Mitigation Tool
Detect traffic spikes | !2-4d !Go !Intermediate | DDoS detection • Rate limiting • Anomaly detection
Learn More | | Secrets Scanner
Scan codebases and git history for leaked secrets | !1-2d !Go !Intermediate | Secret detection • Shannon entropy • HIBP k-anonymity • SARIF output
Source Code \| Docs | | API Security Scanner
Enterprise API vulnerability scanner | !3-5d !FastAPI !React !Docker !Intermediate | OWASP API Top 10 • ML fuzzing • GraphQL/SOAP testing
Source Code \| Docs | | Wireless Deauth Detector
Monitor WiFi deauth attacks | !2-4d !Rust !Intermediate | Wireless security • Packet sniffing • Attack detection
Learn More | | Credential Enumeration
Post-exploitation credential collection | !2-4d !Nim !Intermediate | Credential extraction • Browser forensics • Red team tooling • Nim language
Source Code \| Docs | | Binary Analysis Tool
Disassemble and analyze executables | !3-5d !Rust !Intermediate | Binary analysis • String extraction • Malware detection
Source Code \| Docs
| | Chaos Engineering Security Tool
Inject security failures to test resilience | !3-5d !Go !Intermediate | Chaos engineering • Security resilience • Credential spraying • Auth testing
Learn More | | Credential Rotation Enforcer
Track and enforce credential rotation policies | !2-4d !Crystal !Intermediate | Credential hygiene • Secret rotation • Compliance dashboards • API integration
Source Code \| Docs | | Race Condition Exploiter
TOCTOU race condition attack & defense lab | !3-5d !FastAPI !React !Intermediate | TOCTOU attacks • Double-spend bugs • Concurrent exploitation • Race visualization
Learn More | | JA3/JA4 TLS Fingerprinting Tool
Fingerprint TLS clients by handshake | !2-4d !Rust !Intermediate | TLS handshake analysis • JA3/JA4 hashing • Bot detection • Malware C2 identification
Source Code \| Docs
| | Mobile App Security Analyzer
Decompile and analyze mobile apps | !3-5d !Python !Intermediate | APK/IPA analysis • Reverse engineering • OWASP Mobile
Learn More | | DLP Scanner
Data Loss Prevention for files, DBs, and traffic | !2-4d !Python !Intermediate | PII detection • GDPR/HIPAA compliance • Pattern matching • Data classification
Source Code \| Docs | | Lua/Nginx Edge Backend
Full CRUD backend via Lua in Nginx | !3-5d !Lua !Nginx !Intermediate | Edge computing • OpenResty • Lua scripting • WAF • JWT at the edge
Learn More | | Privesc Playground
20+ privilege escalation paths to exploit | !3-5d !Python !Intermediate | SUID exploitation • Sudo abuse • Cron hijacking • GTFOBins • Capability abuse
Learn More | | SBOM Generator & Vulnerability Matcher
Software Bill of Materials with CVE matching | !2-4d !Go !Intermediate | SPDX/CycloneDX formats • Dependency analysis • CVE databases • EO 14028 compliance
Source Code \| Docs | | Subdomain Takeover Scanner
Detect dangling DNS records | !2-4d !Go !Intermediate | DNS enumeration • CNAME analysis • Cloud resource claiming • Bug bounty
Learn More | | GraphQL Security Tester
Automated GraphQL vulnerability testing | !2-4d !Python !Intermediate | Introspection attacks • Query depth DoS • Authorization bypass • Batching abuse
Learn More | | Docker Security Audit
CIS Docker Benchmark scanner | !1-2d !Go !Docker !Intermediate | CIS benchmarks • Container security • Multiple output formats
Source Code \| Docs |

Advanced Projects

| Project | Info | What You'll Learn | |---------|------|-------------------| | API Rate Limiter
Distributed rate limiting middleware | !1w !Python !Redis !Advanced | Token bucket algorithm • Distributed systems • Redis backend
Source Code \| Docs | | Encrypted Chat Application
Real-time E2EE messaging | !1-2w !FastAPI !SolidJS !PostgreSQL !Advanced | Signal Protocol • Double Ratchet • WebAuthn • WebSockets
Source Code \| Docs | | Exploit Development Framework
Modular exploitation framework | !3-4w !C++ !Advanced | Exploit development • Payload generation • Plugin architecture
Learn More | | AI Threat Detection
ML-powered nginx threat detection | !3-4w !FastAPI !React !PyTorch !Advanced | ML ensemble (AE + RF + IF) • ONNX inference • Real-time detection
Source Code \| Docs | | Zingela Stateless Scanner
Line-rate stateless mass TCP/UDP port scanner | !1-2w !Zig !Advanced | Stateless SYN scanning • SipHash cookies • Cyclic-group permutation • AF_PACKET / AF_XDP
Source Code \| Docs | | Bug Bounty Platform
Full vulnerability disclosure platform | !2-3w !FastAPI !React !PostgreSQL !Advanced | Full-stack development • CVSS scoring • Workflow automation
Source Code \| Docs
| | Cloud Security Compliance Dashboard
Multi-cloud compliance with CIS, SOC2, HIPAA | !2-3w !Go !React !AWS !Advanced | CIS benchmarks • SOC2/HIPAA compliance • Cost-security optimization • Drift detection
Learn More | | Malware Analysis Platform
Automated sandbox analysis | !2-3w !Rust !Docker !Advanced | Malware analysis • Sandboxing • YARA rules • IOC extraction
Learn More | | Quantum Resistant Encryption
Post-quantum cryptography | !3-4w !Python !Advanced | Post-quantum algorithms • Hybrid encryption • Kyber/Dilithium
Learn More | | Zero Day Vulnerability Scanner
Coverage-guided fuzzing | !2-3w !Rust !C !Advanced | Keyless harness synthesis • Auto-build under ASAN • AFL++ campaigns • Stack-hash dedup • Magma-validated triage • Disclosure bundles
Source Code \| Docs | | Distributed Password Cracker
GPU-accelerated cracking | !3-4w !C++ !CUDA !Advanced | Distributed systems • GPU computing • Hash cracking
Learn More | | Kernel Rootkit Detection
Detect kernel-level rootkits | !2-3w !Rust !Advanced | Kernel internals • Memory forensics • Rootkit detection
Learn More | | Blockchain Smart Contract Auditor
Solidity vulnerability analysis | !3-4w !Python !Solidity !Advanced | Smart contracts • Static analysis • Solidity security
Learn More | | Adversarial ML Attacker
Generate adversarial examples | !3-4w !Python !TensorFlow !Advanced | Adversarial ML • FGSM/DeepFool • Model robustness
Learn More | | Reverse-Engineering
Reverse-engineering learning platform. | !3-4w !C !Advanced | Reverse Engineering • Disassembly • Dynamic & Static Analysis
Source Code \| Docs | Hardware Security Module Emulator
Software HSM that compiles to a real PKCS#11 .so | !2-3w !Zig !Advanced | PKCS#11/Cryptoki C ABI (machine-checked vs OASIS headers) • AES-GCM/CBC • RSA/ECDSA/ECDH • Argon2id + encrypted-at-rest • driven by pkcs11-tool
Source Code \| Docs | | Network Covert Channel
Data exfiltration techniques | !3-4w !Rust !Advanced | Covert channels • Data exfiltration • Steganography
Learn More | | Automated Penetration Testing
Full pentest automation | !3-4w !Python !Advanced | Pentest automation • Recon to exploitation • Report generation
Learn More | | Haskell Reverse Proxy
Functional reverse proxy with security middleware | !2-3w !Haskell !Advanced | Functional programming • Reverse proxy design • Security middleware • Haskell
Source Code | | "Monitor the Situation" Dashboard
Real-time cyber threat situational awareness | !3-4w !Go !React !PostgreSQL !Advanced | Threat intel feeds • EPSS/KEV/CVE velocity • BGP hijacks • WebSocket fan-out • 3D globe SOC view
Source Code \| Docs
| | Honeypot Network
Multi-service honeypot deployment & analysis | !2-3w !Go !React !Docker !Advanced | Honeypot deployment • Attacker behavior analysis • IOC extraction • MITRE mapping
Source Code \| Docs
| | Supply Chain Security Analyzer
Dependency vulnerability analysis | !2-3w !Go !Advanced | Supply chain security • Dependency analysis • Malicious packages
Learn More |

Learn More

Certification Roadmaps - Career paths for SOC Analyst, Pentester, Security Engineer, GRC Analyst, and 6 more tracks

Learning Resources - Tools, courses, certifications, YouTube channels, Reddit communities, and security frameworks

CertGames - The platform I built to do all of this in one place: practice questions, Learn lessons, guided projects, and these roadmaps with progress tracking. FREE

License

AGPL 3.0.