Simran Khirbat

Engineered a segmented Purple Team environment to simulate OWASP Top 10 attack scenarios and validate defensive telemetry across isolated VLAN networks.
The lab bridges offensive exploitation with detection engineering, demonstrating how real attack techniques translate into IDS alerts, log correlation, and actionable security visibility.
This project showcases end-to-end attack → detection → investigation lifecycle across a controlled, enterprise-style network topology.

Segmented network using pfSense with attacker, target, and monitoring zones:

• VLAN 10: Red Team (Kali Attacker)
• VLAN 20: Target Application (OWASP Juice Shop)
• VLAN 30: Blue Team Monitoring (Suricata IDS + ELK)

            Kali (Attacker VM - VLAN 10: 192.168.10.x)
                │
                ▼
          pfSense (Firewall + VLAN Segmentation + Traffic Control)
                │
                ├──▶ Ubuntu App (OWASP Juice Shop - VLAN 20: 192.168.20.x)
                │
                └──▶ Ubuntu IDS (Suricata - Traffic Mirror/SPAN)
                               │
                               ▼
                        EVE JSON Logs
                               │
                               ▼
                      Logstash (Parsing & Enrichment)
                               │
                               ▼
                     Elasticsearch (Indexed Security Telemetry)
                               │
                               ▼
                        Kibana (Dashboards & Alert Analysis)
          

Suricata alerts exported via EVE JSON and ingested into ELK for structured analysis, categorization, and investigation.

• Executed OWASP Top 10 attack scenarios (SQLi, XSS, Command Injection, Brute Force).
• Demonstrated authentication bypass and payload injection exploitation.
• Validated exploit execution across segmented VLAN boundaries.
• Mapped attack techniques to observable IDS telemetry.

• Integrated Emerging Threats ruleset into Suricata.
• Developed custom OWASP-focused detection rules.
• Tuned alert thresholds to reduce noise and improve signal quality.
• Correlated IDS alerts with executed payloads to validate rule accuracy.
• Classified events by severity and attack category for structured visibility.

• Validated control effectiveness through attacker-driven testing.
• Demonstrated bidirectional learning between attack patterns and detection refinement.
• Showcased full attack → detection → analysis workflow for portfolio demonstrations.

• Successfully executed OWASP Top 10 exploitation scenarios.
• Validated vulnerable endpoints within segmented environment.
• Demonstrated real-world attack behavior under controlled firewall policies.

• Captured 50+ validated security alerts across attack categories.
• Achieved real-time threat visibility via ELK dashboards.
• Reduced false positives through rule tuning and severity classification.
• Enabled rapid pivot from alert to contextual log analysis.

Demonstrated cohesive offensive and defensive security workflow, validating how exploitation techniques inform detection engineering and security control tuning.

To eliminate repetitive manual testing workflows, this platform orchestrates Nmap, SQLmap, and Nessus API scans within a unified Flask-based controller, centralizing findings into structured dashboards and automated PDF reports.
The automation reduces manual assessment effort by 60% while improving consistency and reporting quality.

            Input (Targets)
                │
                ▼
          Flask Controller (Scan Orchestration Layer)
                ├──▶ Nmap (Port Discovery + NSE Vulnerability Scripts)
                ├──▶ SQLmap (Automated SQL Injection Testing)
                └──▶ Nessus API (Enterprise Vulnerability Scans + CVE Mapping)
        
          Results Aggregation Layer
                │
                ├──▶ Web Dashboard (Real-Time Scan Status & Findings)
                └──▶ PDF Report Generator (Structured Executive + Technical Output)
          

• Automated port and service enumeration using Nmap with NSE-based vulnerability scripts.
• Integrated SQL injection testing pipeline leveraging SQLmap automation.
• API-driven Nessus orchestration for scan execution, status monitoring, and CVE correlation.
• Consolidated findings into structured PDF reports with severity classification and remediation guidance.

• Validated scanner effectiveness against intentionally vulnerable environments (DVWA, OWASP Juice Shop).
• Detected high-severity vulnerabilities including SQL injection, XSS, weak SSL/TLS configurations, and exposed services.
• Identified 20+ open ports and mapped associated CVEs via Nessus API integration.
• Generated automated PDF deliverables aligned with professional penetration testing report standards.

This project implements an adaptive LLM-driven security co-pilot that autonomously coordinates web security tools within a structured Observe-Decide-Act loop .
Instead of executing a fixed scan sequence, the system evaluates current findings, scope constraints, and stored agent state to determine the next testing action. This enables dynamic vulnerability discovery, structured CVSS v4.0 triage, and automated OWASP Top 10-mapped reporting.
The system reduced web assessment effort by 45% by eliminating static workflows and introducing state-aware decision logic.

The copilot runs as a controlled Observe-Decide-Act loop. Instead of a fixed scan sequence, the LLM selects the next action based on current findings and persisted state. All tool execution flows through a Secure Tool Gateway that enforces scope boundaries and execution budgets, while results are stored for structured triage and reporting.

          Target URL(s) + Scope/Budget
                │
                ▼
        Agentic AI PenTest Copilot (FastAPI Controller)
                │
                ▼
      Observe (collect context)  [http_fetch + WhatWeb]
                │
                ▼
  Decide (LLM Decision Engine - Gemini)  [select next action based on state + findings]
                │
                ▼
  Validate (Secure Tool Gateway)  [scope allowlist • time/depth/rate budgets • tool allowlist]
                │
                ▼
     Execute Tools (as chosen)
          ├──▶ OWASP ZAP        [crawl + active scan]
          ├──▶ testssl.sh       [TLS/SSL checks]
          ├──▶ CVE Enrichment   [tech → CVE context]
          └──▶ Nmap             [ports/services if in-scope]
                │
                ▼
    Analyze + Triage  [normalize findings • dedupe • CVSS v4.0 scoring]
                │
                ▼
     Store State + Evidence (SQLite + artifacts)  [decisions • outputs • traceability]
                │
                ▼
      Report Generator  [OWASP Top 10-mapped executive + technical report]
                │
                └──────────────▶ Repeat Loop  [next action chosen from updated state]
          

• State-driven decision loop: Observe-Decide-Act execution model with no fixed scan sequence; next actions determined from persisted findings and contextual state.
• Structured decision schema: LLM outputs constrained to tool + parameters + rationale format to ensure deterministic execution and auditability.
• Secure tool gateway: Centralized execution layer enforcing scope boundaries, execution budgets (time/depth/rate), and strict tool allowlists.
• Multi-layer agent memory: Working, semantic, and episodic memory layers used to avoid redundant actions and refine decisions across iterations.
• Normalized findings pipeline: Consolidates raw tool outputs into structured findings with deduplication and standardized severity classification.
• CVSS v4.0 triage integration: Applies structured scoring to prioritize vulnerabilities and reduce false positives.
• Automated OWASP Top 10 reporting: Generates consistent executive + technical reports with remediation guidance and reproducible evidence.
• Persistent execution trace (SQLite): Stores state transitions, tool invocations, and artifacts for reproducibility and audit traceability.

• Improved assessment efficiency by 45% by replacing static scan sequences with a state-aware Observe-Decide-Act execution loop.
• Reduced false positives and duplicate findings through normalized output handling and structured CVSS v4.0 triage across tools.
• Increased consistency of reporting by auto-generating OWASP Top 10-mapped executive + technical deliverables with remediation guidance.
• Strengthened control and safety via a secure tool gateway enforcing scope boundaries, execution budgets, and tool allowlists.
• Enabled auditability and reproducibility by persisting decisions, tool outputs, and evidence artifacts in SQLite for end-to-end traceability.

BotBuddy is a production-ready generative AI chat platform built on a modular multi-agent architecture. The system integrates Hugging Face LLMs to deliver real-time, token-by-token streaming responses over WebSocket connections.
Designed with a security-first mindset, the platform implements enterprise-grade authentication, OWASP-aligned hardening, rate limiting, and resilient state replication to support secure, scalable deployment.
The result is a secure, multi-agent generative AI system capable of handling persistent sessions and real-time inference in a production SaaS environment.

FastAPI backend with WebSocket support, AI adapter pattern for multiple providers, and persistent database with cloud replication.

            Users (Browser)
                │
                ▼
        Frontend (Angular SPA)
                │
                ├──▶ HTTPS REST (Auth, Sessions, History)
                └──▶ WSS Websocket(Real-Time Chat Streaming)
                │
                ▼
        Backend Service (FastAPI - Dockerized)
           ├──▶ Security Layer
           │    • JWT Auth + Argon2
           │    • CSRF + CAPTCHA + Rate Limits
           │    • OWASP Headers + CORS
           │
           ├──▶ Multi-Agent Router
           │    ├─ General Assistant
           │    ├─ Code Expert
           │    ├─ Creative Writer
           │    └─ Data Analyst
           │
           │    (Agent-specific system prompts + temperature + configs)
           │
           ├──▶ AI Adapter Layer
           │    • Hugging Face Inference
           │    • Streaming response handler
           │
           └──▶ Persistence Layer
                • SQLite (sessions + messages)
                • Litestream → Cloudflare R2
          
              

• Role-based multi-agent design: Implemented four specialized agents (General Assistant, Code Expert, Creative Writer, Data Analyst) using isolated system prompts and per-agent generation settings (e.g., temperature / max tokens) for consistent task behavior.
• Real-time token streaming: Built a WebSocket streaming pipeline to deliver token-by-token responses with connection lifecycle handling (auth handshake, reconnect-safe session flow, timeouts).
• Hugging Face inference integration: Integrated Hugging Face LLM inference behind an adapter layer so models/providers can be swapped without changing core chat logic.
• Secure session + auth model: Implemented JWT access/refresh tokens with secure password storage (Argon2) and session management for persistent chat history.
• Abuse & request controls: Added CSRF protection, CAPTCHA on login, and IP-based rate limiting to reduce automated abuse and protect authentication endpoints.
• OWASP-aligned hardening: Enforced security headers (CSP, HSTS, X-Frame-Options), strict CORS allowlisting, and input validation/sanitization to mitigate XSS and injection risks.
• Production-grade persistence: Persisted users/sessions/messages in SQLite and implemented Litestream replication to Cloudflare R2 for durability, backup, and recovery.
• Deployment readiness: Containerized the application with Docker and added environment-based configuration patterns to support consistent production deployment.

• Successfully deployed a production-ready generative AI platform with multi-agent routing and secure real-time streaming.
• Implemented enterprise-grade authentication & authorization using JWT (access/refresh), Argon2 password hashing, and secure session isolation.
• Built a token-by-token WebSocket streaming engine, delivering responsive real-time LLM output to the client.
• Designed a role-based multi-agent architecture supporting 4 specialized AI agents with isolated prompts and configurable inference settings.
• Achieved OWASP-aligned security posture, mitigating common web risks (XSS, CSRF, injection, abuse) through layered controls.
• Ensured durable data persistence via SQLite with Litestream replication to Cloudflare R2 for backup and recovery.