Kurt Sooknanan Open to internships and co-ops

Projects, 2025 to 2026

Selectedwork

Research frameworks, security tooling, hardware testing, and the infrastructure I run at home. Each one links to a full case study with the architecture, the method, and what actually came out of it.

7 projects
01 / Flagship research
BadToken HYDRA architecture The HYDRA engine schedules attacks through three modules (garak, PyRIT and WebRedTeam, with X-Ray planned) against locally served models and LLM-backed web apps. Every module writes into one shared evidence record that produces a single findings report. engine HYDRA Scheduler module, attack, target Evidence format one record per finding attack modules garakProbe library (NVIDIA) PyRITMulti-turn orchestration (Microsoft) WebRedTeamBrowser-based web testing X-RayPlanned module targets Locally served LLMs vLLM on A100 nodes, Slurm LLM-backed web apps Lab-hosted test instances Shared evidence record every module writes here, so one campaign produces one comparable findings report
In active development

BadToken HYDRA

Automated LLM red-teaming framework

BadToken is a Python toolkit for adversarial testing of language models. HYDRA is its engine: a scheduler and a shared evidence format that let garak, PyRIT, and a browser-based web module run as one campaign, with every finding landing in one comparable record.

PythongarakPyRITvLLMPyTorchSlurm / A100
Read the case study
untrusted page content model output rendered as HTML

Illustration of the vulnerability class, not a WebRedTeam screenshot

02 / Web and LLM security

WebRedTeam

In progress

When an LLM-backed web app renders model output, prompt injection can turn into script execution. I'm extending the WebRedTeam black-box framework into a HYDRA module that tests for exactly that, through a real browser.

Browser automationPrompt injectionXSSHYDRA module
Read the case study

Sweep based on the README example: ports 20 to 100 on scanme.nmap.org

03 / Security tooling

CyberToolkit

Public on GitHub

Five command-line network security utilities in Python, standard library only: a threaded port scanner, banner grabber, chunked SHA-256 hashing, DNS lookup, and a password generator built on secrets.

PythonThreadPoolExecutorSocketspytestMIT license
Case study Repository (opens in a new tab)

More projects

sub-GHz

04 / Offensive security

Embedded device and wireless lab

The hardware half of the BadToken research: rogue access points, Wi-Fi auditing, Sub-GHz, RFID/NFC, and BadUSB, all on group-owned equipment on an air-gapped bench.

Flipper ZeroMarauderaircrack-ngKismet
Ongoing
TrueNAS / ZFS local LLM container Pi-hole + Unbound Nextcloud, Jellyfin

05 / Infrastructure

Security homelab

TrueNAS and ZFS hosting an offline LLM red-team target, Pi-hole with Unbound, and a Python monitoring tool built on SQLite and Trivy.

TrueNAS / ZFSDocker ComposeTrivy
Running
REC

06 / Team project

Ghostclick

A privacy-first Chrome extension that records a website task once and replays it on request, using an on-device model through WebLLM so nothing is sent to a server.

JavaScriptChrome extensionWebLLM
Team project

07 / Web engineering

This portfolio

Hand-written HTML, CSS, and JavaScript with no frameworks: custom canvas scenes, a keyboard command palette, and browser tests that run against every page.

HTMLCSSCanvasjQueryPlaywright
LiveSource (opens in a new tab)

Everything else is on GitHub

Commit history included, so you can see how each project came together rather than just the finished version.

Browse repositories (opens in a new tab)