LLM security research
BadToken HYDRA
Automated LLM red-teaming framework built around one scheduler and one evidence format.
PythongarakPyRITvLLM
In development
All projects
Case study / Offensive security
Wirelesslab
Embedded device and RF security testing on an isolated, faculty-supervised hardware bench.
Overview
The hardware half
Applying the offensive methodology behind BadToken to a physical attack surface, producing a device-security findings report as a companion to the LLM work. Being hands-on with techniques I read about in advisories means that when one shows up in an alert, I know what it looks like from the other side.
Techniques
What gets tested
- Rogue AP / evil twin: a captive-portal access point that captures associating client MAC addresses and DHCP-assigned IPs to a live monitor.
- Wi-Fi auditing: scanning, packet capture, deauthentication, and handshake analysis with Marauder, aircrack-ng, and Kismet.
- Sub-GHz RF: capture and replay for access-control and keyfob research.
- RFID / NFC: credential read, clone, and modify workflows across low- and high-frequency tags.
- BadUSB / HID: scripted payloads for physical-access and endpoint-hardening testing.
Evidence
From the bench
# isolated lab AP, self-owned test client
$ clients --watch
CLIENT 1/1
MAC : 0E:74:1D:B4:86:0A
IP : 192.168.4.2
Joined: 21:37:06
Scope
How the work is bounded
Scope and ethics. Every asset is owned by or explicitly authorized for the research group, and all testing happens on an air-gapped bench. My faculty mentor reviews scope before each new exploit class, and any finding with real-world implications goes through coordinated disclosure. No third-party networks, no production systems, no unauthorized targets.