网安（黑客）学习这座宝藏库，最近被我挖到了，而且清一色免费开源。

一个 GitHub 仓库里硬是塞进了 70 个网络安全实战项目，从一行代码都没碰过的小白，一路拽到高阶老鸟，梯度铺得清清楚楚。

想学的东西基本都能找到： 1️⃣ 哈希识别、端口扫描这类入门操作 2️⃣ JWT/OAuth 漏洞靶场、TLS 指纹识别 3️⃣ 供应链攻击模拟这类进阶玩法 Python、Go、C++ 多种语言全都覆盖，每个项目都配齐完整源码加学习文档，不是扔一堆代码让你自己死磕。想入行网安又不知从哪儿下手的，别再收藏吃灰了，直接照着做就完事。 🔗 http://github.com/CarterPerez-dev/Cybersecurity-Projects…

CarterPerez-dev/Cybersecurity-Projects

Source: https://github.com/CarterPerez-dev/Cybersecurity-Projects

Cybersecurity Projects 🐉

70 Cybersecurity Projects, Certification Roadmaps & Resources

View Complete Projects:

_{Currently building: DDoS Mitigation Tool}

Quick Navigation

Projects

Hands-on cybersecurity projects with full source code, organized in four tiers — Foundations (pre-beginner, first-time programmers), Beginner, Intermediate, and Advanced.

Certification Roadmaps

10 structured career paths with certification guides for SOC Analyst, Pentester, Security Engineer, and more.

Learning Resources

Tools, courses, certifications, communities, and frameworks for cybersecurity professionals.

Projects

Want to be walked through building these instead of reading finished source? CertGames has guided project courses that build real security tools from scratch, step by step, with the concepts explained as you go. Same projects, less getting stuck. FREE

Foundations Projects

Start here if this is your first time coding. The Foundations tier is pre-beginner — built for someone who has never written Python, has barely used a terminal, and is new to cybersecurity. Source files are heavily commented as a teaching aid, and every learn/ folder explains concepts from zero. Once you’re comfortable here, the Beginner projects assume you already know the language and move faster.

What makes Foundations different:

• Single-file projects — the entire tool lives in one readable Python file. No file-hopping.
• Heavy teaching comments — every line that introduces a new concept is annotated inline.
• Numpy-style docstrings on every function — what it does, why it exists, every parameter.
• Extra-deep learn/ folders — Python features and security concepts both explained from zero.
• Senior-level code, beginner-level explanations — the code itself is still production-quality.

Project	Info	What You’ll Learn
Hash Identifier Identify hash types by prefix, length, and charset		Hash families (MD5, SHA, bcrypt, Argon2) • PHC string format • Pattern matching • Pure-function design Source Code | Docs
HTTP Headers Scanner Audit a URL’s response headers for missing or weak security controls		HTTP fundamentals • Security headers (CSP, HSTS, X-Frame-Options) • httpx requests • Scored audits Source Code | Docs
Password Manager Encrypted local vault with master password unlock		Argon2id key derivation • AES-GCM authenticated encryption • Secure on-disk vaults • Master-password workflows Source Code | Docs

Beginner Projects

Project	Info	What You’ll Learn
Simple Port Scanner Async TCP port scanner in C++ @deniskhud		TCP socket programming • Async I/O patterns • Service detection Source Code | Docs
Keylogger Capture keyboard events with timestamps		Event handling • File I/O • Ethical considerations Source Code | Docs
Caesar Cipher CLI encryption/decryption tool		Classical cryptography • Brute force attacks • CLI design Source Code | Docs
DNS Lookup CLI Tool Query DNS records with WHOIS		DNS protocols • WHOIS queries • Reverse DNS lookup Source Code | Docs
Simple Vulnerability Scanner Check software against CVE databases		CVE databases • Dependency scanning • Vulnerability assessment Source Code | Docs
Network Traffic Analyzer Capture and analyze packets		Packet capture • Protocol analysis • Traffic visualization Source (C++) | Docs (C++) | Source (Python) | Docs (Python)
Hash Cracker Dictionary and brute-force cracking		Hash algorithms • Dictionary attacks • Password security Source Code | Docs
Steganography Multi-Tool Hide data in images, audio, QR, PDFs, text		Multi-format steganography • Encrypted AEAD envelope • Zero-width Unicode • Audio LSB • QR Reed-Solomon injection Source Code | Docs
Deserialization Gadget Lab Read untrusted Marshal and YAML without ever reviving it, then break it		Gadget chains • Marshal binary format • Gated vs ungated dispatch • TracePoint veto • CVE-2026-41316 Source Code | Docs
Canary Token Generator Self-hosted honeytokens that alert on access		Deception defense • Honeytokens • MySQL wire protocol • PDF/DOCX patching • Webhook + Telegram alerting Source Code | Docs
Phishing Domain Generator & Quishing Scanner Typosquat generation + QR phishing detection		Homoglyph attacks • Typosquatting • QR code analysis • Domain intelligence Learn More
SSH Brute Force Detector Monitor and block SSH attacks		Log parsing • Attack detection • Firewall automation Learn More
Simple C2 Beacon Command and Control beacon/server		C2 architecture • MITRE ATT&CK • WebSocket protocol • XOR encoding Source Code | Docs
Base64 Encoder/Decoder Multi-format encoding tool		Base64/32 encoding • URL encoding • Auto-detection Source Code | Docs
Linux CIS Hardening Auditor CIS benchmark compliance checker		CIS benchmarks • System hardening • Compliance scoring • Shell scripting Source Code | Docs
Systemd Persistence Scanner Hunt Linux persistence mechanisms		Persistence techniques • Systemd internals • Cron analysis • Threat hunting Source Code | Docs
Linux eBPF Security Tracer Real-time syscall tracing with eBPF		eBPF programs • Syscall tracing • BCC framework • Security observability Source Code | Docs
Trojan Application Builder Educational malware lifecycle demo		Trojan anatomy • Data exfiltration • File encryption • Attack lifecycle Learn More
DNS Sinkhole Pi-hole-style malware domain blocker		DNS protocol • Blocklist management • Query logging • Network defense Learn More
Firewall Rule Engine Parse and validate iptables/nftables rules		Firewall internals • Rule parsing • iptables/nftables • V language Source Code | Docs
LLM Prompt Injection Firewall Sandbox the effects, not the prompt: fence untrusted text, authorize the tool calls, match the secret on the way out		Provenance fencing • Taint propagation • Unicode tag-block smuggling • Encoding closure • OWASP LLM01:2025 Source Code | Docs

Intermediate Projects

Project	Info	What You’ll Learn
Security News Scraper Aggregate cybersecurity news		Web scraping • CVE parsing • Database storage Source Code | Docs
Payload Obfuscation Engine Multi-layer payload obfuscation toolkit		Obfuscation techniques • Polymorphism • AV evasion • Signature detection Learn More
SIEM Dashboard Log aggregation with correlation		SIEM concepts • Log correlation • Full-stack development Source Code | Docs
Token Abuse Playground 15+ token vulnerabilities to exploit and fix		JWT exploitation • OAuth attacks • Session security • Token forensics Learn More
Supply Chain Attack Simulator Fake PyPI package dependency confusion demo		Supply chain attacks • Dependency confusion • Package security • PyPI internals Learn More
DDoS Mitigation Tool Detect traffic spikes		DDoS detection • Rate limiting • Anomaly detection Learn More
Secrets Scanner Scan codebases and git history for leaked secrets		Secret detection • Shannon entropy • HIBP k-anonymity • SARIF output Source Code | Docs
API Security Scanner Enterprise API vulnerability scanner		OWASP API Top 10 • ML fuzzing • GraphQL/SOAP testing Source Code | Docs
Wireless Deauth Detector Monitor WiFi deauth attacks		Wireless security • Packet sniffing • Attack detection Learn More
Credential Enumeration Post-exploitation credential collection		Credential extraction • Browser forensics • Red team tooling • Nim language Source Code | Docs
Binary Analysis Tool Disassemble and analyze executables		Binary analysis • String extraction • Malware detection Source Code | Docs
Chaos Engineering Security Tool Inject security failures to test resilience		Chaos engineering • Security resilience • Credential spraying • Auth testing Learn More
Credential Rotation Enforcer Track and enforce credential rotation policies		Credential hygiene • Secret rotation • Compliance dashboards • API integration Source Code | Docs
Race Condition Exploiter TOCTOU race condition attack & defense lab		TOCTOU attacks • Double-spend bugs • Concurrent exploitation • Race visualization Learn More
JA3/JA4 TLS Fingerprinting Tool Fingerprint TLS clients by handshake		TLS handshake analysis • JA3/JA4 hashing • Bot detection • Malware C2 identification Source Code | Docs
Mobile App Security Analyzer Decompile and analyze mobile apps		APK/IPA analysis • Reverse engineering • OWASP Mobile Learn More
DLP Scanner Data Loss Prevention for files, DBs, and traffic		PII detection • GDPR/HIPAA compliance • Pattern matching • Data classification Source Code | Docs
Lua/Nginx Edge Backend Full CRUD backend via Lua in Nginx		Edge computing • OpenResty • Lua scripting • WAF • JWT at the edge Learn More
Privesc Playground 20+ privilege escalation paths to exploit		SUID exploitation • Sudo abuse • Cron hijacking • GTFOBins • Capability abuse Learn More
SBOM Generator & Vulnerability Matcher Software Bill of Materials with CVE matching		SPDX/CycloneDX formats • Dependency analysis • CVE databases • EO 14028 compliance Source Code | Docs
Subdomain Takeover Scanner Detect dangling DNS records		DNS enumeration • CNAME analysis • Cloud resource claiming • Bug bounty Learn More
GraphQL Security Tester Automated GraphQL vulnerability testing		Introspection attacks • Query depth DoS • Authorization bypass • Batching abuse Learn More
Docker Security Audit CIS Docker Benchmark scanner		CIS benchmarks • Container security • Multiple output formats Source Code | Docs

Advanced Projects

Project	Info	What You’ll Learn
API Rate Limiter Distributed rate limiting middleware		Token bucket algorithm • Distributed systems • Redis backend Source Code | Docs
Encrypted Chat Application Real-time E2EE messaging		Signal Protocol • Double Ratchet • WebAuthn • WebSockets Source Code | Docs
Exploit Development Framework Modular exploitation framework		Exploit development • Payload generation • Plugin architecture Learn More
AI Threat Detection ML-powered nginx threat detection		ML ensemble (AE + RF + IF) • ONNX inference • Real-time detection Source Code | Docs
Zingela Stateless Scanner Line-rate stateless mass TCP/UDP port scanner		Stateless SYN scanning • SipHash cookies • Cyclic-group permutation • AF_PACKET / AF_XDP Source Code | Docs
Bug Bounty Platform Full vulnerability disclosure platform		Full-stack development • CVSS scoring • Workflow automation Source Code | Docs
Cloud Security Compliance Dashboard Multi-cloud compliance with CIS, SOC2, HIPAA		CIS benchmarks • SOC2/HIPAA compliance • Cost-security optimization • Drift detection Learn More
Malware Analysis Platform Automated sandbox analysis		Malware analysis • Sandboxing • YARA rules • IOC extraction Learn More
Quantum Resistant Encryption Post-quantum cryptography		Post-quantum algorithms • Hybrid encryption • Kyber/Dilithium Learn More
Zero Day Vulnerability Scanner Coverage-guided fuzzing		Keyless harness synthesis • Auto-build under ASAN • AFL++ campaigns • Stack-hash dedup • Magma-validated triage • Disclosure bundles Source Code | Docs
Distributed Password Cracker GPU-accelerated cracking		Distributed systems • GPU computing • Hash cracking Learn More
Kernel Rootkit Detection Detect kernel-level rootkits		Kernel internals • Memory forensics • Rootkit detection Learn More
Blockchain Smart Contract Auditor Solidity vulnerability analysis		Smart contracts • Static analysis • Solidity security Learn More
Adversarial ML Attacker Generate adversarial examples		Adversarial ML • FGSM/DeepFool • Model robustness Learn More
Reverse-Engineering Reverse-engineering learning platform.		Reverse Engineering • Disassembly • Dynamic & Static Analysis Source Code | Docs
Hardware Security Module Emulator Software HSM that compiles to a real PKCS#11 .so		PKCS#11/Cryptoki C ABI (machine-checked vs OASIS headers) • AES-GCM/CBC • RSA/ECDSA/ECDH • Argon2id + encrypted-at-rest • driven by pkcs11-tool Source Code | Docs
Network Covert Channel Data exfiltration techniques		Covert channels • Data exfiltration • Steganography Learn More
Automated Penetration Testing Full pentest automation		Pentest automation • Recon to exploitation • Report generation Learn More
Haskell Reverse Proxy Functional reverse proxy with security middleware		Functional programming • Reverse proxy design • Security middleware • Haskell Source Code
“Monitor the Situation” Dashboard Real-time cyber threat situational awareness		Threat intel feeds • EPSS/KEV/CVE velocity • BGP hijacks • WebSocket fan-out • 3D globe SOC view Source Code | Docs
Honeypot Network Multi-service honeypot deployment & analysis		Honeypot deployment • Attacker behavior analysis • IOC extraction • MITRE mapping Source Code | Docs
Supply Chain Security Analyzer Dependency vulnerability analysis		Supply chain security • Dependency analysis • Malicious packages Learn More

Big Thanks to all the sponsors! 🩵

• @CoolCat-108

Learn More

Certification Roadmaps - Career paths for SOC Analyst, Pentester, Security Engineer, GRC Analyst, and 6 more tracks

Learning Resources - Tools, courses, certifications, YouTube channels, Reddit communities, and security frameworks

CertGames - The platform I built to do all of this in one place: practice questions, Learn lessons, guided projects, and these roadmaps with progress tracking. FREE

License

AGPL 3.0.