Amir Sarkhosh

ReconForge

An attack-surface and OSINT platform that runs scoped recon, case investigation and intel projects end to end.

• 80-module deep scan pipeline with resumable scans and wildcard scope enforcement
• Web dashboard, CLI, TUI and MCP server interfaces
• Exports to HTML, PDF, STIX + ATT&CK, MISP and detection-rule formats
• Sanitized export mode that strips secrets, PII, cookies and methodology, then re-verifies the output
• 973 automated tests

CTI Aggregation Platform

Expands the deepdarkCTI source list into a working threat intelligence platform that ingests, enriches and tracks the threat landscape.

• 40+ live-verified sources: C2 and botnet blocklists (Feodo, ThreatView, C2IntelFeeds), phishing feeds, ransomware leak-site trackers
• CVE enrichment with NVD, FIRST EPSS, Exploit-DB, CISA and the GitHub Advisory Database
• MITRE ATT&CK campaign mapping, victim geography, alerting and a dashboard

ScopeTrail

A browser extension for scoped web application testing: it maps a target's attack surface as you browse and drives focused hunts.

• Wildcard scope collector that maps every discovered subdomain
• One-click "Hunt this host" aimed at the real scheme and port
• Human-in-the-loop by design: every hunt is started by the tester
• Automated end-to-end and unit test suites

OVERSEER

A local HTTPS interception proxy for analysing a desktop client's traffic. It's built around how modern clients defend against man-in-the-middle attacks, and it gives way to those defences instead of breaking them.

• Private local CA with per-host certificates generated on demand and signed off the event loop, so the proxy never blocks
• Detects certificate pinning and embedded CA bundles, then switches that client build to passthrough tunnelling. It never tampers with the client.
• Remembers trust per client version and re-tests new builds, resuming interception only when TLS succeeds
• Interception Health panel plus --status / --doctor diagnostics for CA trust, firewall rules and pinning state
• Passive network monitor that keeps working while interception is paused; structured logging
• Packaged Windows release with SHA-256 verification and smoke tests

Multi-Agent Bug Bounty Pipeline

A Claude Code plugin that runs bug bounty research as a staged pipeline of specialised agents, where nothing is reported until it has been independently reproduced and hostilely reviewed.

• Phased workflow: passive intel → attack-surface mapping → hunting → validation → reporting, with an end-to-end autopilot that always stops at a human submit gate
• Agent chain per finding: hunter → skeptic (tries to disprove it) → escalator (proves real impact) → verifier (reproduces from scratch) → triager (hostile severity and scope review), plus chainer, prowler and post-submission monitor agents
• Pre-tool-use guardrail hooks: scope guard (may this call reach this host?), egress guard, and a verify gate that blocks writing anything into a report that wasn't observed
• Program policy and scope transcribed to disk before any traffic; MCP integrations for HackerOne, YesWeHack, Burp, Kali, Nessus and Android tooling

OSINT Arsenal Directory

A curated directory of roughly 39,000 OSINT tools and data sources, built with a wave-based agent orchestration workflow that recovers from its own journal when a run is interrupted.

• Large-scale collection, de-duplication and categorisation of public OSINT resources
• Resumable, journal-backed pipeline for long multi-agent runs

Bot-Network Detection Analysis

An investigation of 12,221 user-uploaded audio records to find content that bypassed normal moderation and curation.

• Found bulk-upload pipelines through filename-as-identity accounts, where the top "artist" was an unrenamed default file
• Flagged duplicate-content farming and templated bot personas
• Separated coordinated rings from low-effort noise

Rooted Android Test Rig

• Built and maintain a rooted Android device (crDroid, KernelSU) for mobile app security testing
• Frida instrumentation, Burp CA in the system trust store, adb and scrcpy, and recovery/fastboot workflows
• Diagnosed a bootloop from dmesg and pstore forensics as a low-battery brownout rather than a software fault

SIEM Implementation & Threat Hunting

• Built an isolated lab of Windows VMs forwarding logs to Splunk to generate and study real attack telemetry
• Wrote custom SPL detections and dashboards, including brute-force logins caught as a spike in failed logons (Event ID 4625) followed by a success (4624), plus malware execution
• Ran each case from alert to closure: enriched IOCs with OSINT, mapped the activity to MITRE ATT&CK and wrote an incident report

Vulnerability Assessment Lab

• Built an isolated VirtualBox lab of Windows VMs for hands-on security testing
• Ran comprehensive Nessus scans and prioritised findings by risk
• Patched and hardened the hosts against CIS Benchmarks, then rescanned to confirm every fix

DeadMansSwitch

A dead man's switch utility that triggers configured actions if the operator stops checking in.

headlessScreenshotBot

Headless-browser screenshot automation, useful for visual recon and change monitoring.

RAM-Management-Utility

A Windows memory management utility that frees memory safely without destabilising the system.

Android App Security

Exported activities, ContentProviders and FileProviders, intent and deep-link handling, network-security-config and certificate trust, and OAuth client secrets shipped in APKs. Static analysis with jadx, dynamic analysis with Frida, Burp and logcat on a rooted device.

Authorization & API Audits

Systematic IDOR/BOLA and mass-assignment testing across two-account setups, including a full audit of a 311-endpoint OpenAPI specification. Also SSRF hunting with Burp Collaborator, stored XSS and postMessage origin validation.

Desktop Client Analysis

Static analysis of a protected Windows game client in scope for a HackerOne program: recovered 184k strings and 33,644 RTTI class records despite an encrypted .text section, mapped its engine stack and API surface, and built a Python harness to fuzz its custom URL-protocol handler.

ADM Blackbox Penetration Test

Led a blackbox penetration test end to end: reconnaissance, vulnerability identification, exploitation and a full findings report with remediation guidance.

Ethical Hacking: HTCS6705

A paper on ethical hacking principles, attacker tactics and hands-on technique, connecting theory to practical exploitation.

Securing Digital Environments

A cybersecurity project report on hardening and protecting digital environments against modern threats.

Risk Assessment: Datacom

From the Datacom cybersecurity job simulation: a structured risk assessment that identifies assets, threats and vulnerabilities, rates likelihood and impact, and maps controls.

Security Awareness: Mastercard

From the Mastercard job simulation: a security awareness programme for HR and Marketing, the teams most exposed to phishing and social engineering.

Data Analysis & Machine Learning

Data analysis and machine learning in Python and Jupyter Notebook: cleaning, exploration, modelling and evaluation.

The Unwatchable Student: Why Client-Side Proctoring Can't Be Trusted

An ethical proof of concept against a real proctoring SDK, supervisor.js. I reverse-engineered its media capture, its telemetry and event-scoring model, and its anti-tamper controls (devtools detection, keyboard lockdown). Then I showed why MV3 extension injection timing and the limits of CSP mean a client the user controls can never be a trust anchor. It ends with defensive recommendations for vendors and institutions, and deliberately leaves out any reproducible bypass. 11 min read.

That Viral "Zoom Hack" Isn't a Hack: It's a Social Engineering Scam

This breaks down the attacker's playbook: posing as a journalist or podcast host, renaming themselves "Zoom", and asking for remote control to drop a RAT or infostealer. It walks through a real case where the "Goopdate" RAT drained more than $100k from crypto wallets in minutes, separates real risks from the BIOS-takeover myth, and ends with a five-step recovery playbook that starts with isolating the machine. 7 min read.

How to Install Arch Linux: A Detailed Guide for Beginners

A beginner's walkthrough of a UEFI install: GPT partitioning with cgdisk, mirror ranking and pacstrap, a locale, user and sudo setup, the systemd-boot loader, NetworkManager, NVIDIA drivers and KDE Plasma. Every step includes the commands. 3 min read.