Adversarial Simulations Grid: Rakib Nadir
Full Archive of 11 Offensive Audits & Threat Intelligence Research
AI / LLM Security
ACTIVE RESEARCH
Adversarial LLM Security Assessment
Built and pentested a local multi-model AI environment using Ollama, evaluating Mistral, Qwen, Gemma, Granite, and LLaMA against real-world adversarial techniques. Conducted automated prompt injection testing using Garak v0.14 across 768 attack attempts. Mistral:7b rated DC-2 (Very High Risk). Fingerprinted a live RAG-powered chatbot backend using LLMap. Built and open-sourced garak-report-to-excel for structured vulnerability reporting.
APPARATUS STACK USED
Garak v0.14
Ollama
LLMap
Python
OWASP LLM 10
Open Source Tool / Python
AUTOMATION
garak-report-to-excel
A Python utility that parses raw Garak LLM vulnerability scanner .jsonl report files into structured Excel spreadsheets. Built to solve the problem of unreadable Garak output during adversarial LLM security research.
APPARATUS STACK USED
Python
Garak .jsonl
OpenPyXL
Pandas
[ Image coming soon ]
Open Source Tool / Python
RECONNAISSANCE
Passive Subdomain Parser
An open-source asynchronous subdomain enumeration and alive-checking tool for security assessments, bug bounty hunting, and VDP reconnaissance. Integrates multiple passive intelligence sources including crt.sh, AlienVault OTX, RapidDNS, HackerTarget, urlscan.io, ThreatCrowd, and SecurityTrails. Features concurrent alive-host validation using AsyncIO and AIOHTTP, optional subfinder integration, JSON/CSV export, and a Rich-powered terminal interface.
APPARATUS STACK USED
Python AsyncIO
AIOHTTP
OSINT APIs
Crt.sh
Rich UI
Infrastructure
AD LAB AUDITING
Multi-Forest Active Directory Lab
Built a fully isolated enterprise-grade AD environment across four network segments — enterprise.dc (Primary Forest), corp.enterprise.dc (Child Domain), and manufacturing.local (Secondary Forest). Simulates real-world attack paths including network pivoting, trust relationship attacks, privilege escalation across domain boundaries, and cross-forest compromise via bidirectional forest trust.
APPARATUS STACK USED
Active Directory
Domain Trusts
Double Pivots
Kerberos
BloodHound
Web Pentest
VAPT REPORT
Web App Security Assessment (Grey Box)
Conducted a Grey Box penetration test on a self-hosted web application. Identified critical vulnerabilities including weak JWT implementation leading to account takeover, XSS enabling session hijacking, authentication flaws, and insecure transport mechanisms. Findings manually validated with actionable remediation aligned to OWASP and PTES.
APPARATUS STACK USED
Burp Suite Pro
OWASP Top 10
JWT Audits
XSS Injection
PTES
SOC / Forensics
ANALYSIS CASE
Phishing Email Analysis
Conducted structured forensic analysis of a phishing email impersonating a major brand. Performed full email header inspection, sender infrastructure tracing, and SPF/DKIM/DMARC verification. Analyzed embedded URL using VirusTotal, URLVoid, and PhishTool, confirming an active credential harvesting portal. Documented findings in a structured SOC report with IOC summary and containment recommendations.
APPARATUS STACK USED
Email Headers
SPF/DMARC
VirusTotal
PhishTool
[ Image coming soon ]
Endpoint Security / Blue Team
HOST DIAGNOSTICS
Detecting Persistence After simulated Compromise
Simulated a full compromise-and-detection scenario on a Windows endpoint using Metasploit. Established a Meterpreter reverse TCP session, deployed malicious.exe as an auto-start Windows service (BackupService), and added a registry run key for logon persistence. Detection phase included process tracing via WMIC, service analysis with Get-CimInstance, network analysis confirming the Meterpreter session on port 5555, registry forensics via PowerShell, and autorun baselining with PSAutoRun to diff pre/post-compromise snapshots. VirusTotal flagged the hash 58/71 as trojan.metasploit/rozena.
APPARATUS STACK USED
Metasploit SAM
WMIC Forensic
PSAutoRun
VirusTotal Hash
Self-Contained Offline Simulation Case Study
[ Image coming soon ]
SIEM / Blue Team
TELEMETRY MONITOR
SIEM Deployment & Blue Team Detection — Splunk Enterprise
Deployed and configured Splunk Enterprise on Ubuntu to understand how defenders detect offensive techniques at the log level. Ingested real HTTP web server logs and used SPL to investigate traffic patterns — identifying a single IP generating 2,920 out of 3,086 total requests. Surfaced a Hydra brute-force tool signature making POST requests to /login.php. Built a multi-panel security dashboard covering top user agents, URI path frequency, geographic IP distribution, and HTTP volume over time. Configured a real-time alert for Local File Inclusion (LFI) detection.
APPARATUS STACK USED
Splunk SIEM
SPL Queries
Ubuntu Server
LFI Alert Rules
Self-Contained Local SIEM Pipeline case study
Infrastructure
ACTIVE AD EXPLOIT
Remote & Local Credential Harvesting in AD
Demonstrated credential harvesting in Active Directory using Mimikatz, SAM dumps, LSASS extraction, DCSync attacks, and Overpass-the-Hash / Pass-the-Ticket techniques. Highlights precise execution to avoid triggering service loops, with lateral movement simulation across AD environments.
APPARATUS STACK USED
Mimikatz
DCSync Attacks
LSASS forensic
Pass-the-Ticket
Infrastructure
DELEGATION EXPLOIT
Kerberos Unconstrained Delegation Abuse
Full exploitation of Kerberos unconstrained delegation misconfigurations to achieve domain-level compromise through TGT extraction and impersonation.
APPARATUS STACK USED
Kerberos TGT
Delegation Abuse
Domain takeover
Mimikatz dump
Infrastructure
PERSISTENCE LOOP
AdminSDHolder Persistence & ACL Abuse
Demonstrated persistence through AdminSDHolder ACL abuse, maintaining backdoor access to privileged AD groups through SDProp propagation.
APPARATUS STACK USED
AdminSDHolder
ACL backdoor
SDProp cycle
PowerView
