Skip to content

60 cybersecurity project ideas with detailed guides, certification roadmaps for 10 security roles, and 2 fully built projects. Everything you need to build your security portfolio and land your first job. * Building all 60 projects with complete implementations as the repo grows.*

License

Notifications You must be signed in to change notification settings

CarterPerez-dev/Cybersecurity-Projects

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

72 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

60 Cybersecurity Projects & 10 Certification Roadmaps by Role 🧙‍♂️

2 of these projects I've fully built for you, with full source code and documentation so you can clone, learn, and customize!


View complete projects: Projects/

As time goes on I will fully build each and every one of these projects so all 60 are available with full source code and documentation.


Table of Contents


Projects (Each Links To Their Brief Instructions)

Beginner Projects

Build a Python script using the socket library to test common ports (22, 80, 443, 3306, etc.) on a target IP. Implement threading or asyncio to scan multiple ports concurrently for speed. Add service detection by analyzing banner responses from open ports.

SOURCE CODE: /Keylogger

Use Python's pynput library to capture keyboard events and log them to a local file with timestamps. Include a toggle key (like F12) to start/stop logging. Important: Add clear disclaimers and only test on systems you own.

Create a CLI tool that shifts characters by a specified number (the "key") to encrypt/decrypt text. Implement both encryption and brute-force decryption (try all 26 possible shifts). Bonus: Add support for preserving spaces and punctuation.

Use Python's dnspython library to query different DNS record types (A, AAAA, MX, TXT, NS, CNAME). Display results in a clean table format with color coding. Add reverse DNS lookup functionality.

Build a script that checks installed software versions against a CVE database or uses pip-audit for Python packages. Parse system package managers (apt, yum, brew) to list installed software. Flag packages with known vulnerabilities and suggest updates.

Build a tool that removes metadata from files (images, PDFs, Office docs) to protect privacy. Extract and display EXIF data, GPS coordinates, author info, and edit history. Support batch processing and create sanitized copies. Add detection for hidden data in file headers and warn users about information leakage risks.

Use scapy to capture packets on local network and display protocol distribution, top talkers, and bandwidth usage. Filter by protocol (HTTP, DNS, TCP, UDP) and visualize data with simple bar charts. Add export to CSV functionality.

Build a basic hash cracking tool that attempts to match MD5/SHA1/SHA256 hashes against wordlists. Implement both dictionary and brute-force modes. Add salted hash support and performance metrics (hashes per second).

Hide secret messages inside image files using LSB (Least Significant Bit) steganography. Support PNG and BMP formats. Include both encoding and decoding functionality with password protection option.

Create a script to change network interface MAC addresses on Linux/Windows. Include validation, backup of original MAC, and automatic restoration. Add vendor lookup to generate realistic MAC addresses.

Monitor specified directories for file changes using checksums (MD5/SHA256). Log all modifications, additions, and deletions with timestamps. Send alerts when critical system files are modified.

Scrape cybersecurity news from sites like Krebs on Security, The Hacker News, and Bleeping Computer. Parse articles, extract CVEs, and store in a database. Create a simple dashboard to view latest threats.

Analyze URLs for common phishing indicators (suspicious TLDs, typosquatting, URL shorteners). Check against safe browsing APIs (Google Safe Browsing). Display risk score with detailed analysis.

Monitor auth.log or secure log files for failed SSH login attempts. Detect brute force patterns and automatically add offending IPs to firewall rules. Send email alerts when attacks detected.

Scan for nearby wireless networks and display SSIDs, signal strength, encryption types, and connected clients. Identify potentially rogue access points and weak encryption (WEP, WPA).

Create a tool that encodes/decodes Base64, Base32, and hex. Automatically detect encoding type. Add support for URL encoding and HTML entity encoding.

Parse firewall logs (iptables, UFW, pfSense) and generate reports on blocked connections. Identify top attacking IPs, most targeted ports, and attack patterns. Visualize with graphs.

Monitor network for ARP spoofing attacks by tracking MAC-to-IP mappings. Alert when duplicate IP addresses or MAC address changes detected. Log all ARP traffic for analysis.

Track changes to Windows registry keys and values. Focus on common persistence locations (Run keys, Services, Scheduled Tasks). Alert on suspicious modifications.

Educational tool that demonstrates file encryption without actual harm. Encrypt test files in isolated directory with strong encryption. Include decryption capability and educational warnings.


Intermediate Projects

Create a server that listens for incoming reverse shell connections using Python sockets. Implement command execution, file upload/download, and session management for multiple clients. Use cmd2 or similar library for a clean CLI interface.

Build a Flask/FastAPI backend that ingests logs via syslog or file parsing, then visualize with a React frontend using Chart.js or Recharts. Store events in SQLite/PostgreSQL and implement basic correlation rules (e.g., "5 failed logins in 1 minute"). Add filtering by severity, source IP, and time range.

Use APIs from threat feeds (AbuseIPDB, VirusTotal, AlienVault OTX) to collect IOCs (IPs, domains, file hashes). Store in a database with deduplication and enrich with WHOIS/geolocation data. Create a simple UI to search IOCs and view threat scores.

Build a tool that decodes JWT tokens, validates signatures, and checks for common vulnerabilities (weak secrets, algorithm confusion, expired claims). Use PyJWT or similar library and add support for multiple signature algorithms (HS256, RS256). Display token payload in formatted JSON with security warnings.

Create an async Python scanner using httpx that crawls a target website and tests for XSS (reflected/stored), SQLi (error-based), and CSRF (missing tokens). Implement a plugin architecture so tests are modular and easy to add. Generate HTML reports with vulnerability details and remediation advice.

Build a peer-to-peer chat using WebSockets with end-to-end encryption via the cryptography library (Fernet or RSA+AES). Implement key exchange using Diffie-Hellman. Add a simple React frontend with message history and user authentication.

Create a network monitor that detects traffic spikes using packet sniffing (Scapy) and implements rate limiting with iptables or similar. Add anomaly detection by establishing baseline traffic patterns. Include alerts via email/webhook when attacks detected.

Scan Docker images by parsing Dockerfiles for insecure practices (running as root, hardcoded secrets) and checking base image versions against vulnerability databases. Use Docker API to inspect running containers for exposed ports and mounted volumes. Output findings in JSON with severity ratings.

Build middleware that implements token bucket or sliding window rate limiting for APIs. Support per-user, per-IP, and global limits. Include Redis backend for distributed rate limiting across multiple servers.

Monitor WiFi networks for deauthentication attacks using packet sniffing. Alert when abnormal deauth frames detected. Track affected clients and potential attacker locations.

Enumerate AD users, groups, computers, and permissions using LDAP queries. Identify privileged accounts, stale accounts, and misconfigurations. Generate visual diagrams of AD structure.

Disassemble executables and analyze for suspicious patterns. Extract strings, identify imported functions, and detect packing/obfuscation. Support PE, ELF, and Mach-O formats.

Real-time packet inspection using Snort rules or custom signatures. Automatically block malicious traffic using firewall integration. Dashboard for viewing blocked threats and rule management.

Audit Active Directory or local password policies against security best practices. Test for weak passwords using common patterns. Generate compliance reports and recommendations.

Automatically discover and catalog all resources across AWS, Azure, and GCP. Track changes over time, identify untagged resources, and calculate costs. Export to CSV/JSON.

Aggregate data from public sources (WHOIS, DNS, social media, breached databases). Automate information gathering for penetration testing. Generate comprehensive target profiles.

Scan domains for SSL/TLS misconfigurations (expired certs, weak ciphers, missing HSTS). Check against best practices (Mozilla SSL Config). Alert on vulnerabilities like Heartbleed.

Decompile Android APKs and iOS IPAs to analyze security. Detect hardcoded secrets, insecure data storage, and vulnerable libraries. Generate OWASP Mobile Top 10 compliance reports.

Verify backup files aren't corrupted using checksums. Test restoration process automatically. Alert if backups fail validation or haven't run recently.

Build a reverse proxy that filters HTTP requests for malicious patterns. Block SQL injection, XSS, and path traversal attempts. Include whitelist/blacklist rules and logging.

Analyze Linux/Windows systems for potential privilege escalation vectors. Check for SUID binaries, weak permissions, and kernel exploits. Generate attack path diagrams.

Establish normal network behavior patterns (traffic volume, protocol distribution, top talkers). Alert on deviations that could indicate compromises or attacks.

Scan Docker environments for security issues (privileged containers, exposed ports, outdated images). Check against CIS Docker Benchmark. Generate remediation reports.


Advanced Projects

Build an enterprise-grade automated API security scanner that performs deep vulnerability assessment across REST, GraphQL, and SOAP endpoints, detecting OWASP API Top 10 flaws through intelligent fuzzing, authentication bypass testing, broken object level authorization, mass assignment exploitation, and rate limiting analysis with ML-enhanced payload generation and comprehensive reporting dashboards. (FastAPI - React-Typescript - Vite - Nginx - Docker - CSS)

Build a modular framework in Python where exploits are plugins (one file per vulnerability). Include payload generators, shellcode encoders, and target validation. Implement a Metasploit-like interface with search, configure, and execute commands.

Train a machine learning model (Random Forest or LSTM) on network traffic data (CICIDS2017 dataset) to classify normal vs. malicious behavior. Use feature engineering on packet metadata (packet size, timing, protocols). Deploy model with FastAPI for real-time inference on live traffic.

Create a web app with user roles (researchers, companies), vulnerability submission workflow, and reward management. Implement severity scoring (CVSS), status tracking, and encrypted communications. Use React frontend, FastAPI/Django backend, PostgreSQL database, and S3 for file uploads.

Build a tool using boto3 (AWS), Azure SDK, and Google Cloud SDK to scan for misconfigurations (public S3 buckets, overly permissive IAM roles, unencrypted storage). Implement compliance checks against CIS benchmarks. Generate executive dashboards showing risk scores and remediation priorities.

Create a sandbox using Docker or VMs where suspicious files are executed in isolation while monitoring API calls, network traffic, and file system changes. Implement static analysis (strings, PE headers, YARA rules) and dynamic analysis (behavior tracking). Generate detailed reports with IOCs extracted.

Implement post-quantum algorithms like Kyber (key exchange) or Dilithium (digital signatures) using existing libraries (liboqs-python). Build a file encryption tool that uses hybrid encryption (classical + quantum-resistant). Benchmark performance against traditional RSA/AES and document the security rationale.

Fuzzing framework that automatically discovers bugs in applications. Implement coverage-guided fuzzing using AFL or LibFuzzer. Triage crashes and generate proof-of-concept exploits.

Coordinate password cracking across multiple machines using GPU acceleration. Support distributed workloads with job queuing. Dashboard for monitoring progress and performance.

Detect kernel-level rootkits by comparing system calls, loaded modules, and memory structures. Use volatility framework for memory analysis. Alert on hidden processes or drivers.

Static analysis tool for Solidity smart contracts detecting vulnerabilities (reentrancy, integer overflow, access control). Integrate with Mythril and Slither. Generate security reports.

Generate adversarial examples to fool ML-based security systems. Implement attacks like FGSM, DeepFool, and C&W. Test robustness of image classifiers and malware detectors.

Simulate multi-stage APT attacks with C2 infrastructure, lateral movement, and data exfiltration. Support various persistence mechanisms and evasion techniques. Generate attack reports.

Software emulation of HSM for cryptographic operations. Implement secure key storage, signing, and encryption. Support PKCS#11 interface for application integration.

Exfiltrate data using DNS queries, ICMP packets, or HTTP headers. Implement encoding schemes to hide data in legitimate traffic. Measure detection rates against common DLP solutions.

Orchestrate full penetration tests including reconnaissance, vulnerability scanning, exploitation, and post-exploitation. Generate executive and technical reports. Support multiple target types.

Analyze software dependencies for vulnerabilities and malicious packages. Detect typosquatting, dependency confusion, and compromised packages. Monitor for suspicious updates in CI/CD pipelines.


Certification Roadmap by Role

Certification Roadmaps By Role

1. SOC Analyst

Role

Level Certification Organization Link
Entry Security+ CompTIA Website
Core CySA+ CompTIA Website
Intermediate GCIH (Certified Incident Handler) GIAC Website
Intermediate CEH (Certified Ethical Hacker) EC-Council Website
Advanced GCIA (Certified Intrusion Analyst) GIAC Website
Senior/Management CISSP (ISC)² Website

2. Penetration Tester

Role

Level Certification Organization Link
Foundation Security+ CompTIA Website
Entry-Level Pentest PenTest+ CompTIA Website
Intermediate CEH (Certified Ethical Hacker) EC-Council Website
Advanced OSCP (Gold Standard) Offensive Security Website
Expert OSEP Offensive Security Website
Expert GXPN (Exploit Researcher) GIAC Website

3. Security Engineer

Role

Level Certification Organization Link
Foundation Security+ CompTIA Website
Intermediate CySA+ CompTIA Website
Advanced SecurityX (formerly CASP+) CompTIA Website
Advanced/Expert CISSP (ISC)² Website
Expert (Cloud-focused) CCSP (ISC)² Website

4. Incident Responder

Role

Level Certification Organization Link
Entry Security+ CompTIA Website
Core CySA+ CompTIA Website
Core IR Cert GCIH (Certified Incident Handler) GIAC Website
Forensics/Advanced GCFA (Certified Forensic Analyst) GIAC Website
Malware Analysis/Expert GREM (Reverse Engineering Malware) GIAC Website

5. Security Architect

Role

Level Certification Organization Link
Foundation Security+ CompTIA Website
Advanced SecurityX (formerly CASP+) CompTIA Website
Architect/Management CISSP (Required) (ISC)² Website
Cloud Architecture CCSP (ISC)² Website
Security Architecture Framework SABSA SABSA Institute Website
Enterprise Architecture TOGAF The Open Group Website

6. Cloud Security Engineer

Role

Level Certification Organization Link
Foundation Security+ CompTIA Website
AWS Cloud Security AWS Security Specialty AWS Website
Azure Cloud Security Azure Security Engineer Microsoft Website
Vendor-Neutral CCSK Cloud Security Alliance Website
Advanced CCSP (ISC)² Website
Advanced Practice SecurityX (formerly CASP+) CompTIA Website
Expert/Management CISSP (ISC)² Website

7. GRC Analyst/Consultant

Role

Level Certification Organization Link
Foundation Security+ CompTIA Website
Audit Focused CISA (Certified Information Systems Auditor) ISACA Website
Risk Management CRISC (Risk and Information Systems Control) ISACA Website
Advanced CISSP (ISC)² Website
Compliance-Heavy ISO 27001 Lead Auditor PECB (and others) Website

8. Threat Intelligence Analyst

Role

Level Certification Organization Link
Foundation Security+ CompTIA Website
Core CySA+ CompTIA Website
Cyber Threat Intelligence GCTI GIAC Website
Intrusion Analysis GCIA GIAC Website
OSINT (Optional) GOSI GIAC Website
OSINT (Optional) C|OSINT McAfee Institute Website

9. Application Security

Role

Level Certification Organization Link
Foundation Security+ CompTIA Website
Foundation/Core CEH (Certified Ethical Hacker) EC-Council Website
Foundation/Core CySA+ CompTIA Website
Secure Software Lifecycle CSSLP (ISC)² Website
Web App Exploitation OSWE Offensive Security Website
Web App Pentest GWAPT GIAC Website

10. Network Engineer (Security-Focused)

Role

Level Certification Organization Link
Foundation Network+ CompTIA Website
Foundation Security+ CompTIA Website
Associate CCNA (Cisco Certified Network Associate) Cisco Website
Advanced CCNP Security Cisco Website
Architect/Management CISSP (ISC)² Website

Cybersecurity Learning Resources

A collection of tools, courses, frameworks, and educational resources for cybersecurity professionals and learners at all levels.


Table of Contents


Cybersecurity Tools

Reconnaissance & Scanning

Web Application Testing

Network & Wireless

Exploitation & Post-Exploitation

Cryptography & Analysis

Forensics & Malware Analysis

Monitoring & Defense

Code Security

Intelligence & Recon


Study Platforms & Courses

Udemy CompTIA Courses

Udemy Other Security Courses

Free Learning Platforms

Premium Platforms


Certifications & Exam Prep

CompTIA Exam Objectives

Practice Test Resources

Exam Vouchers & Official Resources

Study Guides & Books


YouTube Channels & Videos

Top Cybersecurity Channels

Featured Video Playlists & Courses

Learning Science & Study Techniques

Practice Exam Videos


Reddit Communities

Main Subreddits

Certification-Specific Communities

Popular Reddit Posts


Security Frameworks

NIST Framework Suite

ISO/IEC Standards

Industry Frameworks

Compliance & Regulatory

Analysis & Modeling


Industry Resources

Security News & Blogs

Training & Education Organizations

Professional Organizations

Development & Tools


Cloud Certifications

AWS Cloud

Microsoft Azure

Google Cloud

Other Cloud Platforms


CISSP Resources

Official Materials

Practice Tests & Prep

YouTube Courses

Study Resources


LinkedIn Professionals to Follow

Industry Leaders

Organizations


Additional Learning Resources

Specialized Platforms

Cheat Sheets & References


Last Updated: November 2025

Tips for Success:

  • Start with free resources to test your interest
  • Combine video courses with hands-on labs
  • Use practice exams to measure progress
  • Join communities for support and networking
  • Stay current with security news and trends

About

60 cybersecurity project ideas with detailed guides, certification roadmaps for 10 security roles, and 2 fully built projects. Everything you need to build your security portfolio and land your first job. * Building all 60 projects with complete implementations as the repo grows.*

Topics

Resources

License

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published