Projects: Pentesting, Security, Privacy and CTF/Bug Bounty¶

Project ideas for this topic, ranging from beginner to expert. Projects require synthesizing knowledge from multiple modules and produce real, demonstrable artifacts.

[!IMPORTANT] All projects must be performed in authorized environments: your own systems, intentionally vulnerable VMs (DVWA, Metasploitable, HackTheBox machines), or with explicit written permission. Never test against systems you do not own or have authorization to test.

Beginner Projects¶

Project 1: DVWA Full Walkthrough¶

Difficulty: Beginner Modules: 01, 03, 04, 05 Estimated Time: 6–10 hours

Description: Set up DVWA (Damn Vulnerable Web Application) locally and complete all vulnerability categories at the "Low" security level. Document each vulnerability with a screenshot of the exploit, an explanation of why it works, and the defensive fix.

Deliverables: - A written walkthrough document covering all DVWA categories (Brute Force, Command Injection, CSRF, File Inclusion, File Upload, SQL Injection, XSS reflected, XSS stored) - For each vulnerability: what it is, how you exploited it, what the fix is - Screenshots or terminal output as evidence

Success Criteria: - All categories completed at "Low" security level - Defensive fix explained for each vulnerability - Document is readable by someone who has not done the exercise

Project 2: Personal CTF Writeup Portfolio¶

Difficulty: Beginner to Intermediate Modules: 01, 03, 10 Estimated Time: Ongoing (5+ writeups)

Description: Complete at least 5 CTF challenges from TryHackMe or picoCTF and write a structured writeup for each one. This project teaches you to explain your thinking clearly — a skill essential for both bug bounty reports and job interviews.

Deliverables: - 5 writeups in Markdown format, each covering: challenge description, initial recon, thought process, tools used, solution, and what you learned - One writeup per category (web, crypto, forensics, reversing, misc)

Success Criteria: - Each writeup is understandable by another beginner (no assumed knowledge) - Tools and commands used are documented with explanations - "What I learned" section for each challenge is substantive

Intermediate Projects¶

Project 3: Home Lab Penetration Test¶

Difficulty: Intermediate Modules: 01, 02, 07, 08, 09 Estimated Time: 10–15 hours

Description: Set up a small home lab with at least two VMs (e.g., Kali Linux as attacker + Metasploitable 2 as target), conduct a simulated penetration test, and write a professional penetration test report. The report format mirrors what a real pentest consultant would deliver to a client.

Deliverables: A written penetration test report including: - Executive Summary (1 page, non-technical audience) - Scope and Methodology - Findings table (vulnerability name, severity, CVSS score, affected system) - Detailed finding for each vulnerability (description, evidence, impact, remediation) - Appendix: tools used, testing timeline

Success Criteria: - At least 5 distinct vulnerabilities documented - CVSS scores calculated for each finding - Executive summary is understandable by a non-technical manager - Remediation recommendations are specific and actionable

Project 4: Custom Recon Tool in Python¶

Difficulty: Intermediate Modules: 07, 02 Estimated Time: 8–12 hours

Description: Write a Python tool that automates passive and active reconnaissance for a given target domain (in an authorized context). The tool should: enumerate DNS records, find subdomains via certificate transparency logs, check for common HTTP endpoints, and produce a structured report.

Deliverables: - A Python script with: DNS enumeration, subdomain discovery via crt.sh, HTTP header fingerprinting - JSON or Markdown output report - README with usage instructions

Success Criteria: - Tool runs without errors against a test domain you own - Output is structured and human-readable - Code has comments explaining each function - Error handling for unresponsive targets

Advanced Projects¶

Project 5: Bug Bounty Report Submission¶

Difficulty: Advanced Modules: 01, 03–08, 11 Estimated Time: Variable (40+ hours of practice before first valid submission)

Description: Join a public bug bounty program on HackerOne, Bugcrowd, or Intigriti, find a valid vulnerability within scope, and submit a professional report. This is the most real-world project in the curriculum.

Deliverables: - A submitted bug report (link to the report) - A personal writeup (private, for your portfolio) documenting: how you found the program, how you approached testing, what you found, how you crafted the report, the triage result

Success Criteria: - Report is accepted as valid (even a "Resolved" or "Informational" — any non-duplicate response) - CVSS score included in report - Reproduction steps are exact and reproducible - Impact statement is accurate and specific

[!NOTE] This project may take many weeks or months to yield a valid finding. The process of triaging many non-issues is itself a critical learning experience. Keep a log of every target you test, even when you find nothing.

Project 6: Security Tool: Automated SQLi Detector¶

Difficulty: Advanced Modules: 04, 08 Estimated Time: 12–20 hours

Description: Build a Python tool that, given a URL with parameters, tests for SQL injection vulnerabilities using error-based, boolean-based, and time-based techniques. This is for use against systems you own or have explicit authorization to test.

Deliverables: - Python tool with: error-based detection, boolean-based detection, time-based detection - Test results output in structured format - Unit tests using a local DVWA instance as the target - Documentation explaining the detection logic

Success Criteria: - Correctly identifies SQLi in DVWA at all security levels - False positive rate is low on non-vulnerable endpoints - Code is clean, commented, and follows Python best practices - README includes clear usage instructions and ethical use statement

Expert Projects¶

Project 7: Full Red Team Exercise (Home Lab)¶

Difficulty: Expert Modules: All Estimated Time: 20–40 hours

Description: Design and execute a multi-stage attack simulation against a deliberately vulnerable lab environment you build yourself. The lab should include at least three machines with different vulnerability classes. Document the entire kill chain: initial access → lateral movement → privilege escalation → goal achievement. Write a full red team report and a blue team detection guide for each stage.

Deliverables: - Lab setup documentation (Vagrantfile or Docker Compose file preferred) - Attack timeline log (exact commands, timestamps, findings) - Red team report (attack perspective) - Blue team detection guide (for each attack stage: what log events to look for, what alerts to create)

Success Criteria: - Multi-stage attack chain documented end-to-end - At least 3 different vulnerability classes exploited - Blue team guide provides actionable detection rules (e.g., Suricata/Snort rules or SIEM queries) - Both offensive and defensive perspectives covered for each finding

Project 8: Open Source Security Tool Contribution¶

Difficulty: Expert Modules: All Estimated Time: Variable (20+ hours)

Description: Contribute a meaningful improvement to an open-source security tool (nmap scripts, Metasploit modules, Burp Suite extensions, OWASP ZAP scan rules, etc.). This is the expert-level project because it requires deep technical knowledge, understanding of the tool's architecture, and the ability to contribute clean, well-documented code to a professional codebase.

Deliverables: - An accepted pull request, merged module, or published extension to an open-source security tool - A writeup explaining: what you contributed, why, how it works, what testing you did

Success Criteria: - Contribution is accepted by the project maintainers (or clearly ready for submission) - Code follows the project's style and contribution guidelines - Security implications of the contribution are documented