Web Application Pentesting
├── OWASP Top 10+ (SQLi, XSS, SSTI, XXE, IDOR, SSRF)
├── JWT Manipulation & Auth Bypass
├── Insecure Deserialization
├── API Security Testing (REST/GraphQL)
└── Custom Exploit Development

Network & Infrastructure
├── External / Internal Network Assessments
├── Active Directory — Kerberoasting, NTLM Relay, Golden Ticket
├── Lateral Movement & Privilege Escalation
└── Post-Exploitation Frameworks (Metasploit, Empire)

Bug Bounty Research
├── HackerOne Active Hunter
├── CVE Validation & PoC Development
└── Responsible Disclosure

Incident Response
├── IR Lifecycle — Preparation → Detection → Containment → Eradication → Recovery
├── Threat Hunting & Anomaly Detection
├── Root Cause Analysis (RCA)
└── Post-Incident Reporting

SIEM & Log Analysis
├── Splunk — SPL queries, dashboards, alerts
├── Wazuh — Agent deployment, custom rules, FIM
├── ELK Stack — Elasticsearch, Logstash, Kibana
└── Log correlation, IOC hunting, threat detection

Digital Forensics
├── Memory Forensics — Volatility Framework
├── Disk Forensics — Autopsy, FTK
├── Network Forensics — Wireshark, Zeek, NetworkMiner
└── Timeline Analysis & Evidence Preservation

Threat Intelligence & Detection
├── MITRE ATT&CK Mapping
├── IOC Collection & Enrichment
├── YARA Rule Development
└── Sigma Rule Writing

Case Management
├── TheHive — Case creation, alert triage, task workflow
├── Cortex — Automated analyzer integrations
└── MISP — Threat sharing & IOC platform

LLM Security Research
├── Prompt Injection & Jailbreak Analysis
├── AI-Powered Threat Detection
└── LLM-Assisted Penetration Testing

Projects
├── NullSight    — Security Intelligence Platform (Node.js + AI)
└── DeepSec-L2   — AI-driven Pentest Framework (Python async, BitNet.cpp)

RED  ──►  Recon → Enum → Exploit → Post-Exploit → Report
                                        │
BLUE ◄──  Detect → Triage → Contain → Eradicate → Recover → Lessons Learned