Passive vuln scanner built as an mitmproxy addon — flags missing security headers, CORS misconfig, cookie flags, secrets in response bodies, and open redirects as traffic passes through. Started as a Chrome extension first; that fell apart under real load, so I rebuilt it as a proxy addon instead.

Modular scanner for the OAuth/OIDC flows that keep showing up broken in the wild — open redirect via redirect_uri, token leakage, PKCE bypass, implicit flow misuse, state parameter / CSRF.

In progress — extends the auth-tooling line above into JWT and session security specifically: alg confusion, weak signing secrets, missing claim validation, session fixation.

Multithreaded TCP port scanner built on raw sockets — sweeps all 65,535 ports, then layers on service/banner grabbing and basic directory enumeration to flag exposed services in lab environments.

Worked Command Injection and SQLi across DVWA’s Low/Medium/High tiers, bypassing the filters at each step up. Traced each one back through the PHP source and wrote up the actual fix — parameterized queries, input whitelisting — not just the bypass.