A curated repository of 70 graded security projects, certification roadmaps, and learning resources that teaches professionals to build real defensive and offensive tooling in Python, Go, C++, and Ruby.
| Tool | CarterPerez-dev/Cybersecurity-Projects — 70 graded cybersecurity projects with source code, certification roadmaps, and learning resources |
| Category | Security education / project-based learning repository |
| Primary Use | Building practical skills by constructing tools like a hash-identifier, http-headers-scanner, password-manager, and canary-token-generator in a lab context |
| Safe Use | Educational use in personal labs, home labs, and authorized training environments; explicitly designed as a teaching aid with ethics notes built into projects like the keylogger exercise |
| Telemetry Note | As a learning repository rather than operational tooling, it leaves no network footprint by itself; individual projects such as scanners should only be pointed at systems you own or are authorized to test |
CarterPerez-dev/Cybersecurity-Projects is not a single tool but a structured curriculum delivered as code: 70 security projects with full source, ten certification roadmaps, and a resources directory, all under an AGPL-3.0 license. With 7,325 stars and a primary language tag of Go, the repository has clearly resonated with the self-taught security community, and the README shows an unusually deliberate pedagogical architecture rather than a loose pile of scripts. The projects are split into four tiers — Foundations, Beginner, Intermediate, and Advanced — with a badge system tracking difficulty, estimated build time, and language. At the time of writing, the author notes that 42 of the 70 projects have full source published, with a DDoS Mitigation Tool currently in progress, which tells you this is an actively maintained work-in-progress rather than a finished archive.
The Foundations tier is the most interesting design decision. The README describes it as explicitly pre-beginner: single-file Python projects, heavily commented source, Numpy-style docstrings on every function, and a learn/ folder that explains both the language features and the security concepts from zero. The stated philosophy is "senior-level code, beginner-level explanations," meaning learners read production-quality patterns rather than toy code. The three Foundations projects listed are a Hash Identifier (recognizing MD5, SHA, bcrypt, and Argon2 families by prefix, length, and charset, including the PHC string format), an HTTP Headers Scanner that audits response headers for missing controls like CSP, HSTS, and X-Frame-Options, and a Password Manager built on Argon2id key derivation with AES-GCM authenticated encryption. That is a genuinely coherent on-ramp: pattern matching, HTTP fundamentals, and modern cryptography, in order.
The Beginner tier widens the language mix. A Simple Port Scanner written in C++ teaches TCP socket programming and async I/O patterns, contributed by an external collaborator. A DNS Lookup CLI Tool covers DNS record queries, WHOIS, and reverse lookups. A Simple Vulnerability Scanner in Go checks software versions against CVE databases, introducing dependency scanning — a directly defensive skill that maps onto real SOC and AppSec workflows. The Network Traffic Analyzer ships in both Python and C++ variants with parallel documentation trees, which is a nice touch for learners comparing high-level versus low-level packet capture implementations.
Some projects in the Beginner tier touch on offensive concepts, and it is worth being precise about how the repository handles them. The Keylogger exercise is framed around event handling, file I/O, and what the README explicitly calls "ethical considerations" — it is a two-hour exercise in input APIs, not a deployment-ready implant, and the accompanying learn/ docs are the point. Similarly, the Hash Cracker teaches hash algorithms and dictionary attacks as a way to understand password security, and the Caesar Cipher project uses brute force against classical encryption to make attack complexity tangible. These are standard pedagogical constructs found in university security courses; the emphasis throughout is comprehension of why weak constructions fail, not operational capability against third-party systems.
Two Beginner projects stand out as more sophisticated than their tier suggests. The Steganography Multi-Tool, written in Go, hides data across images, audio, QR codes, PDFs, and text using techniques including audio LSB embedding, zero-width Unicode characters, and QR Reed-Solomon injection, wrapped in an encrypted AEAD envelope. The Canary Token Generator is a defensive deception project: self-hosted honeytokens implemented in Go and React, with Docker deployment, MySQL wire protocol emulation, PDF and DOCX patching, and alerting via webhooks and Telegram. Building a honeytoken platform from scratch is one of the better blue-team learning exercises available, because it forces the builder to think about how attackers enumerate documents and credentials, and how defenders instrument the tripwire.
The Deserialization Gadget Lab is the most technically dense item documented in the README. Written in Ruby with Docker, it teaches how untrusted Marshal and YAML data can be inspected without being revived — reading the binary format safely before deliberately breaking it. The learning goals include gadget chains, gated versus ungated dispatch, TracePoint veto mechanisms, and a referenced CVE. The project publishes a companion marshalsea gem on rubygems.org, suggesting the lab material has been distilled into a reusable library. For defenders, understanding deserialization internals is directly relevant to reviewing Ruby application code and writing detection logic for unsafe Marshal.load patterns.
Beyond the code, the repository's ROADMAPS/ directory offers ten structured career paths with certification guides covering roles like SOC Analyst, Pentester, and Security Engineer, while RESOURCES/ aggregates tools, courses, communities, and frameworks. This positioning matters for authorized professionals: the repository is oriented toward certification candidates and career changers building portfolio evidence, with topics like grc, cybersecurity-certifications, and cybersecurity-portfolio in its topic list. Anyone hiring junior analysts can reasonably treat completed projects from this repo as demonstrable evidence of applied fundamentals.
Operationally, everything here belongs in a lab. The scanners, the traffic analyzer, and the vulnerability checker should be pointed at localhost, deliberately vulnerable VMs, or systems you own — the usual CTF-and-home-lab envelope. The README's own structure supports this: heavy documentation, Docker-based isolation for the more complex projects, and explicit ethics notes on the dual-use items. There is no operational tooling here designed for use against third-party infrastructure; the offensive-adjacent projects are teaching skeletons, not weaponized frameworks.
Caveats are the usual ones for community education repositories. With 42 of 70 projects published, anyone following the curriculum should expect gaps and ongoing churn; the badge system and the "currently building" note are honest about that. The README also promotes a linked commercial offering, CertGames, which provides guided versions of the same projects — worth knowing so you can distinguish the open AGPL-3.0 repository from the paid companion. As a free, graded, well-documented path from "never written Python" to building honeytoken platforms and deserialization labs, it is one of the stronger resources of its kind, and senior engineers may find the Foundations and Beginner tiers useful as onboarding material for new team members who need security fundamentals fast.
CarterPerez-dev/Cybersecurity-Projects.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.