hesi.io — Online Arcade Game with Secure Accounts & Payments⌗

A browser game I built and put into production as a side project, with a security-first backend.

  • Argon2id authentication with rotating refresh tokens and reuse detection
  • CSRF protection and rate limiting
  • Server-authoritative economy with anti-cheat run validation
  • Signature-verified payment webhooks
  • Admin console invisible from the public internet
  • Dockerized (nginx / PostgreSQL / Redis) with CI and 200+ tests

Tech: TypeScript, Node.js, Fastify, PostgreSQL, Prisma, Redis, Docker, nginx, Git

Network System Pentesting Project⌗

Conducted a multi-subnet infrastructure assessment over OpenVPN; engineered exploits for unauthenticated RCE flaws (Elasticsearch/ManageEngine) and bypassed faulty access controls across IPv4/IPv6 architectures to compromise root-level privileges and deliver professional remediation guidelines.

  • Performed reconnaissance and enumeration across multiple subnets over OpenVPN
  • Exploited unauthenticated RCE vulnerabilities in Elasticsearch and ManageEngine
  • Bypassed faulty access controls across IPv4/IPv6 architectures
  • Achieved root-level privilege escalation on target systems
  • Delivered professional remediation guidelines

Tech: OpenVPN, Nmap, Metasploit, NetExec, WPScan, enum4linux-ng, snmpwalk, ftp, adb

ELK + Burp Suite Monitoring System⌗

Built a security monitoring pipeline integrating Burp Suite with the ELK stack.

  • Captured and analyzed HTTP traffic from security testing
  • Centralized logs using Filebeat
  • Visualized attack patterns in Kibana
  • Enabled fast search across historical vulnerability data

Tech: Burp Suite, Elasticsearch, Kibana, Filebeat, Python, SQL

Web Security Honeypot⌗

Designed and deployed a PHP-based honeypot system to detect malicious activity.

  • Created decoy endpoints to attract attackers
  • Logged and analyzed attack patterns
  • Identified common scanning techniques and payloads

Tech: PHP, MySQL, HTML, CSS

Analysis & Development Project (Java)⌗

End-to-end development of a full IT system.

  • Designed data models and use cases
  • Implemented backend logic in Java
  • Built APIs and dashboards
  • Worked in Agile team with full documentation

Tech: Java, Gradle, SQLite, Vue, HTML, CSS, Git

.NET Web Application (Blazor)⌗

Developed a full-stack web app (card shop system).

  • Implemented business logic using C# and LINQ
  • Used Entity Framework for database management
  • Built UI with Blazor
  • Added filtering, search, and session handling

Tech: .NET 8, C#, Blazor, Entity Framework, LINQ

Security & Pentesting⌗

Hands-on work in:

  • Web vulnerability testing (XSS, SQLi)
  • Network scanning with Nmap
  • Linux server hardening
  • API security testing

Tools: Nmap, Burp Suite, Linux, Networking tools