Cesar Vaca

Agentic AI Vulnerability Assessment Tool

Python · Claude Agent SDK

I built a Linux-based autonomous vulnerability-assessment agent with a web GUI that can be pointed at a single host or an entire subnet and left to run a scoped security assessment end to end, auto-generating a findings report when it's done. The agent enforces a strict tool allow-list and validates every target against an authorized IP scope before it's allowed to act, so it can't wander outside the boundaries it was given. Furthermore, scan data and secrets are stored encrypted at rest, and Python code is immutable to the agent. It runs as a managed background service with start-on-boot and auto-restart-on-failure, and has been iterated on and version-controlled across multiple releases. Building the guardrails turned out to be the harder and more interesting problem than building the automation itself.

Active Directory Attack Chain

kerbrute · Impacket · Active Directory

An authorized enterprise pentest where I chained together a full Active Directory attack path. Started with unauthenticated username enumeration via kerbrute's Kerberos pre-authentication timing, then used Impacket to test the recovered accounts for AS-REP roasting, targeting accounts with Kerberos pre-authentication disabled that hand back a crackable ticket to anyone who asks. From there, checked the domain's LDAP signing configuration and confirmed it wasn't enforced, which is a precondition for an NTLM relay attack. Walking one identity from anonymous enumeration to a relay-ready misconfiguration made it obvious why each of these individually "minor" settings compound into a real path to compromise.

WPA2/PMKID Capture & Offline Cracking

Flipper Zero · ESP32 Marauder · Aircrack-ng

Wireless security testing against my own personal network, aimed at going beyond just capturing a handshake and actually recovering the key. Used a Flipper Zero with an ESP32 Marauder board and custom firmware to profile nearby SSIDs, BSSIDs, channels, and encryption types. Then I performed a deauth attack on 2.4GHz-connected devices and captured both the WPA2 4-way handshake and the PMKID to a .pcap file. Ran the capture through Aircrack-ng against a wordlist offline, and recovered the pre-shared key. It's a fast, concrete way to demonstrate why Wi-Fi passwords should be as complex as an online account password, because a weak one can pose a real vulnerability, not just a theoretical one.

RFID/NFC Badge Cloning

Flipper Zero · HID Prox (T5577) · MIFARE Classic · MFKey32

Physical access control testing on two of the most common badge technologies still in wide use, 125kHz fob auth and MIFARE Classic. Reverse engineered the ciphertext and cloned a HID Prox credential onto a writable T5577 tag, then separately captured MIFARE Classic authentication traffic and recovered the per-sector keys with MFKey32. Combined both onto a single emulated fob capable of presenting either credential, using only a handheld reader/writer and no access to the original badge's backend system. The exercise is a reminder that a lot of physical access control still relies on credential technologies that were never designed to resist cloning.

Burp Suite Web/API Testing

Burp Suite · Web/API Security

Web application and API testing against intentionally vulnerable lab targets, focusing on server-side trust boundaries. Used Burp Suite to intercept and modify requests, confirming a server-side request forgery by redirecting a vulnerable parameter to an attacker-controlled callback listener and watching the target make the outbound request itself. Separately tested authorization at the object level by diffing API responses between a low-privilege account and an admin account for the same resource IDs, which surfaced a broken object-level authorization issue letting one account reach another's data. Both findings map directly to entries on the OWASP API Security Top 10.

Secure Self-Hosted Minecraft Server

Ubuntu · AMP (CubeCoders) · Cloudflare Zero Trust · Nginx

I wanted to run a Minecraft server for friends without paying for a hosted Realm and without exposing my home IP address to the internet. So, I decided to self-host a server with CubeCoders AMP on a personally managed Ubuntu box, put the web management panel behind an Nginx reverse proxy with a real TLS certificate on a private subdomain, and tunneled both the web and game traffic outbound so no public port ever has to be opened on the home network. In front of the server admin management panel sits a Cloudflare Zero Trust access gate that only lets pre-approved email addresses in, and only after a one-time passcode. With this defense-in-depth setup, I can have my friends securely manage my Minecraft server remotely.

Uniform Random Apple Shortcuts Password Generator

Apple Shortcuts · iOS/macOS

Apple's native password generator always generates passwords with the same fixed format. It's a set length with exactly one digit, one uppercase letter, two hyphens, and lowercase everywhere else. That fixed structure quietly shrinks the real keyspace, and Apple advertises around 71 bits of entropy, but a known, unchanging format gives an attacker a big head start when brute forcing. My solution was building a password generator in Apple Shortcuts that randomly selects from a 75-character pool of letters, digits, and symbols, with no positional pattern at all. A 17-character password generated from my shortcut works out to roughly 106 bits of entropy, about 7.5×10³¹ possibilities, using nothing but Apple's own visual scripting tool in the Shortcuts app.