>_ Prathab

Cloud Security & AI/ML for Cybersecurity

Securing cloud infrastructure, hunting threats, and applying ML to security problems.

M.Tech in Cybersecurity Engineering, with hands-on work spanning AWS security, SIEM-based threat hunting, digital forensics, applied cryptography, web application security, and machine learning for malware and fraud detection.

27Labs documented
7Security domains
1Live production app

Skills

Cloud & Container

AWS IAM VPC S3 / EC2 Docker

Threat Hunting & DFIR

Wazuh Wireshark Autopsy FTK Imager VirusTotal Shodan

AppSec & Network

SQLi / XSS / CSRF Scapy iptables

AI/ML for Security

scikit-learn PyTorch XGBoost pandas

Languages

Python PowerShell Bash

Projects

Wardrobe — private closet catalog

Upload a photo or paste a product link, auto-detect the dominant color, tag the type, and search "blue top" later. Built and deployed solo, end to end — including provisioning the VM and cutting its TLS certificate.

Node.js / Express SQLite nginx + Let's Encrypt Multi-user, SSRF-guarded
Live site ↗ Source ↗

Labs

Hands-on labs from an M.Tech Cybersecurity program, grouped by domain.

Threat Hunting & Detection

Hunt

DNS Resolution Monitoring

CAA-record analysis for TLS-interception detection, plus a passive-DNS hunt for the SolarWinds/SUNBURST C2 domain.

digPassive DNS
Hunt

DNS Threat Analysis

tshark-driven pcap analysis that surfaced a live phishing domain impersonating a major Chilean bank, confirmed against real query traffic.

tsharkWireshark
Hunt

Wazuh Threat Hunting

Hunted brute-force logons, a port scan, and malware alerts by querying Wazuh's indexer API directly with curl.

WazuhOpenSearch
Hunt

Threat Intel: VirusTotal & Shodan

Traced a malicious hash to the SystemBC backdoor trojan, then pivoted to Shodan to profile its C2 infrastructure.

VirusTotalShodan

Cloud Security

Cloud

AWS Environment & IAM Setup

Stood up a Kali attack VM and AWS account with scoped IAM access keys.

AWS IAMKali Linux
Cloud

VPC & Network Architecture

Built a segmented AWS network: public/private subnets across two AZs, a NAT gateway, and a default-deny NACL.

VPCNACLs
Cloud

AWS Misconfigurations (flaws.cloud)

Worked the well-known flaws.cloud series: public S3 buckets, leaked git credentials, EC2 metadata SSRF, and an over-permissioned IAM policy.

AWS CLIS3IAM
Cloud

Docker Container Security

Built and published Docker images, then demonstrated the supply-chain risk by containerizing a keylogger and capturing live keystrokes from it.

DockerDocker Hub

AI/ML for Cybersecurity

AI/ML

Colab & ML Fundamentals

Compared SVM, Decision Tree, KNN, and Naive Bayes on IoT device classification, plus a manual PyTorch linear regression.

scikit-learnPyTorch
AI/ML

Phishing Website Detection

Decision Tree vs. Random Forest on 11,430 URLs, tuned via grid search. Random Forest reached 96% accuracy, 0.99 ROC-AUC.

scikit-learn
AI/ML

Online Payment Fraud Detection

Four models on 2.5M+ transactions at a 0.13% fraud rate. Random Forest hit 100% precision, 99.4% recall.

scikit-learnXGBoost
AI/ML

Static Android Malware Analysis

Five models classifying apps by permissions — the simplest one (Logistic Regression) won, missing only 2 of 42 malware apps.

scikit-learnKeras
AI/ML

K-Means Malware Clustering

Unsupervised clustering of 9,932 unlabeled PE files, validated with silhouette scores and a feature-redundancy stress test.

scikit-learn

Digital Forensics

DFIR

Disk Acquisition (FTK Imager)

Acquired and hash-verified a forensic image of an 8GB drive, weighing logical vs. physical imaging and format trade-offs.

FTK Imagerdd
DFIR

Case Investigation (Autopsy)

Full forensic workup of a suspect disk image: registry analysis, deleted files, malware indicators, browser history.

Autopsy
DFIR

Deleted-Data Recovery & Carving

Recovered deleted evidence across four seized drives — including manually carving a PDF from raw hex signatures.

PhotorecHex editor
DFIR

Colonial Pipeline Case Study

Incident-response critique of the 2021 ransomware attack — what failed, and the controls that would've prevented it.

Incident Response

Applied Cryptography

Crypto

MD5 Collision Attacks

Generated real MD5 collisions — including two executables that share a hash but run different code.

Hash collisions
Crypto

SHA-256 Length-Extension Attack

Forged a valid MAC against a naive keyed hash construction, then verified HMAC closes the hole.

HMAC

Web Application Security

AppSec

SQL Injection

Bypassed login and hijacked another user's account via UPDATE-statement injection, then fixed it with prepared statements.

MySQLPHP
AppSec

Cross-Site Scripting (XSS)

Recreated the 2005 Samy MySpace worm — cookie theft, forged requests, and a self-propagating XSS worm.

ElggJavaScript
AppSec

Cross-Site Request Forgery (CSRF)

Forged GET and POST requests to hijack a profile, then verified secret-token and SameSite-cookie defenses actually stop it.

Elgg

Network Security

Network

Packet Sniffing & Spoofing

Wrote sniffers, spoofers, and a traceroute from scratch with Scapy.

Scapy
Network

Firewall Internals (iptables/Netfilter)

Built a firewall as a kernel module, then reproduced it with iptables — stateless, stateful, and rate-limited rules.

iptablesLKM
Network

ARP Cache Poisoning & MITM

Poisoned ARP caches three ways, then intercepted and altered live Telnet traffic.

Scapytcpdump
DNS

DNS-over-HTTPS & TLS Analysis

Decrypted DoH sessions with TLS session keys to compare plaintext vs. encrypted DNS visibility.

Wireshark
HTTP

HTTP/1.1 vs. HTTP/2 vs. HTTP/3

Reconstructed HTTP/1.1 conversations, then decrypted TLS 1.3 to compare HTTP/2 and HTTP/3 multiplexing.

TLS 1.3

About

I'm pursuing an M.Tech in Cybersecurity Engineering, building on a background in cybersecurity risk, compliance, and cloud security. My focus is the intersection of cloud infrastructure security, threat detection, and applying machine learning to security problems.

Certifications: Certified Ethical Hacker (CEH), AWS Certified Cloud Practitioner.