Welcome to my security research repository. This space serves as an ongoing technical journal and portfolio where I design, build, and analyze self-contained laboratories to evaluate cryptographic implementations, software logic flaws, and advanced red-team exploit vectors.
The objective of this repository is to demonstrate practical cybersecurity concepts, moving past theoretical definitions into fully functional proof-of-concept (PoC) code.
- Directory Location:
/PQC-SideChannel-Bypass - Primary Concepts:
ML-KEM-768,AES-GCM-256,CWE-532(Insecure Logging), Cryptographic Bypass. - Core Vulnerability: A hybrid post-quantum data pipeline is completely neutralized due to an administrative logging flaw that leaks ephemeral symmetric key material to a plaintext file.
- Key Takeaway: Algorithmic strength (even NIST-standardized quantum defenses) cannot compensate for insecure implementation logic.
- Directory Location:
/2026-06-26 - Semantic Hijacking IPI Lab for PISA - Primary Concepts: Indirect Prompt Injection (IPI), Context Window Unification, Compliance Bias, Fragmented Exfiltration.
- Core Vulnerability: An LLM agent reconstructs functional exfiltration strings from fragmented inputs across separate files, bypassing static signature filters.
- Key Takeaway: Structural instruction adherence can override data safety parameters when context is unified across disparate sources.
- Directory Location:
/2026-07-03 - AI & Infra-Homelab - Primary Concepts:
CWE-78(Command Injection),CWE-918(SSRF),CWE-502(Insecure Deserialization), Docker Socket Breakout, Network Segmentation. - Core Vulnerability: A three-tier AI microservice stack with isolated Docker networks is fully compromised through chained traditional attacks—from perimeter injection to host escape via a mounted Docker daemon socket.
- Key Takeaway: AI-adjacent infrastructure inherits classical web and container flaws; network segmentation alone cannot stop dual-homed SSRF pivoting.
- Directory Location:
/2026-07-09 - IMDSv2 SSRF & AI Training Data Poisoning Lab - Primary Concepts: Cloud storage IAM misconfiguration, IMDSv2 credential theft (
CWE-918+CWE-532), AI training-data poisoning via leaked session tokens. - Core Vulnerability: A dual-homed FastAPI AI gateway trusts attacker-controlled
storage_pathvalues with an over-privileged role, leaks temporary IAM credentials through an SSRF→IMDS diagnostics probe, and enables a secondary cloud pivot that overwrites secure fine-tuning corpora. - Key Takeaway: AI data planes fail the same way cloud control planes do — over-privileged roles, metadata exposure, and unauthenticated object writes compound into full pipeline compromise without a single classical RCE.
More laboratory experiments added continuously as research progresses...
The labs and source code provided across this repository are created strictly for educational, research, and defensive compilation purposes.
- All target systems and architectural flaws are simulated locally in controlled environments.
- The techniques illustrated are designed to help security engineers, developers, and researchers understand implementation vulnerabilities to build more resilient software development lifecycles (SDLC).
Maintained by: JMak-Security
Continuous learning through breaking, fixing, and securing.