SERGRDZSERGIO RODRIGUEZ
Skip to workbench

REVERSE ENGINEERING / ADVERSARIAL TESTING

Attack workbench

A wrapped integer. A reused grant. An event wearing the wrong identity. Follow the failure in motion, then open the code and the recorded experiment behind it.

SR / 02

11 projects / SOURCE & EVIDENCE

PROJECT EXPLORER ATTACK STORIES & SOURCE

01 / VISUAL ATTACK STORIES

Attack Atlas

Three attack mechanics drawn as moving systems: an integer wraps past a range check, a grant returns for a second use, and a convincing event arrives from the wrong emitter.

Attack questionAdversarial reasoning: control the input, locate the trust boundary, and trace exactly where the decision changes.

Inspect the exact trace →Read the attack models →
labs/attack-atlas/
Three separate specimen plates: a fractured integer ring, a split approval seal, and an identity mask.
ENTER THE ATTACK STORYAttack Atlas

Load the scene, change the input, follow the failure.

Open full page ↗

Preview not loaded. The full page is always available.

WHAT TO INSPECT
Run each visual story, change its input, and compare the vulnerable assumption with the corrected check. Follow the linked source experiment for native runs and recorded evidence.
PROJECT SCOPE
Interactive models of three controlled experiments. The animations explain the mechanics; source fixtures and recorded results carry the supporting evidence.

FOLLOW THE REASONING

Read the investigation.

VISUAL STORIES / THREE TRUST BOUNDARIESSee the failure take shape.Overflow, grant replay, and event identity — connected to their source experiments05 OCT / CVE-2026-97689A streaming read still needs a bound.Pinned releases, 32 bounded cases, line reads and body controls27 SEP / CVE-2026-44431A redirect crosses the header boundary.Exact urllib3 releases, captured calls, and twelve passing case expectations27 SEP / TOOL AUTHORIZATIONAvailable is not approved.Signed calls, exact arguments, expiry, and one-use grantsGHIDRA / NATIVE TESTSOne check. Two machine forms.Recovered graphs, compiler transformations and native counterexamplesBINARY STRUCTURE / SEPTEMBER 2026Beyond the section table.Original PE inspector, measured report & 59 synthetic testsSERIALIZATION / SOURCE REVIEWA saved index should stay data.PolicyScout, JSONL persistence & the remaining validation boundarySOURCE REVIEW / SEPTEMBER 2026Claims & constraintsExact probability checks & independent review↗CASE STUDY / 01Event trustBoolean decoding & event attribution↗CASE STUDY / 02Execution gapsWhen an assumed fill skips the gap↗METHODS NOTETurn an assumption into a test.Attack hypotheses, boundary tracing, minimal reproducers, and regression evidence↗

PUBLIC DATA / RESEARCH VIEWS

Keep the source
in the picture.

Expand a view to request its public-data snapshot.
Methods and limitations stay beside the numbers.

01Threat indicatorsCISA KEV · Feodo Tracker · ThreatFoxOn demand

Public indicators returned by the existing feed service: CISA KEV, Feodo Tracker, and ThreatFox. Check the source timestamp and coverage before interpreting the sample.

Open this panel to load its public data.

Recently added to KEV

CISA KEV

Waiting for the CISA snapshot.

Reported botnet C2

Feodo Tracker

Waiting for the Feodo snapshot.

Returned indicators

ThreatFox

Waiting for the ThreatFox snapshot.

Public-source snapshot · no automatic polling
02Emerging vulnerabilitiesNVD · FIRST EPSS · CISAOn demand

Recent NVD entries ranked by FIRST EPSS, with CVSS context and KEV membership. EPSS estimates exploitation probability over the next 30 days. A score or a missing catalog entry does not establish whether a particular system is safe.

Open this panel to load its public data.

Open this view to request the ranked snapshot.

Ranking = EPSS probability first, then CVSS severity, then recency. EPSS via FIRST.org; scores shift daily as exploitation signal accrues. This is public-data analysis, not a claim of private discovery.

Public-source snapshot · no automatic polling
03Disclosure to the KEV catalogPublication dates · catalog inclusion · limitsOn demand

This board compares a vulnerability's NVD publication date with the date CISA added it to the Known Exploited Vulnerabilities catalog: max(0, KEV dateAdded − NVD published). The interval describes time to catalog inclusion. It does not date the first exploit or measure how long a system was safe to leave unpatched. Only entries matched across the two sources are included.

Open this panel to load its public data.

Catalog interval by year

median days, by KEV addition year

Open this view to request its snapshot.

Catalog interval by vendor

2023+, shortest first

Open this view to request its snapshot.

METHOD & LIMITS

Headlines use matched entries added to KEV from 2023 onward; the yearly chart also includes earlier additions. Historical backfills and delays in publication or cataloging affect this interval in every year. dateAdded is the catalog addition date, not the first exploitation date. Intervals at or below zero are displayed as zero; they do not establish a zero-day exploit. KEV is a selected catalog, and missing source records can reduce coverage. These figures describe catalog history and do not establish a safe patching window.

Public-source snapshot · no automatic polling
04Extortion activityAggregate counts · ransomware.liveOn demand

Posting counts, group activity, and sector summaries from ransomware.live. These are aggregate observations of a selected public feed, not a census of incidents or independently verified victim claims.

Open this panel to load its public data.

Postings by group

postings per crew

Open this view to request its snapshot.

Sector selection

reported sector

Open this view to request its snapshot.

Geography

reported country

Open this view to request its snapshot.

COLLECTION ETHICS

This view presents aggregate counts. Victim names and hidden-service addresses are not displayed. The counts describe source postings and do not establish the number of confirmed breaches.

Public-source snapshot · no automatic polling
Read the threat-intelligence research ↗

ARCHIVE / JULY–AUGUST 2026

Earlier tools.

Earlier Python projects, kept here for context.
Original repositories and methods remain available.

03 AUG 2026 / EXPOSURE

RangeCheck

Concurrent discovery, service fingerprinting, and explainable finding rules. An exposed service is an observation to investigate.

PythonAsyncReports
Inspect source ↗Read methodology ↗
31 JUL 2026 / DETECTION

Detect Lab

ATT&CK-mapped detection rules and time-window correlation. Published fixtures and critiques make the logic reviewable.

PythonRulesRegression tests
Inspect source ↗Read critique ↗
31 JUL 2026 / RETRIEVAL

PolicyScout

Hybrid retrieval and cited answers with a sample evaluation corpus. The critique documents decisions, corrections, and limits.

PythonRetrievalEvidence
Inspect source ↗Read critique ↗

These repositories precede the current studies above. The September engineering review records later local patches separately. Read that review ↗

THE PERSON BEHIND THE WORK

Serious about
the details.

I’m Sergio Rodriguez, an Iona University undergraduate from New York’s Hudson Valley. I’m seeking Summer 2027 internships in security research, reverse engineering, and adversarial testing. These projects show how I form an attack hypothesis, build the smallest reproducer, and test the result against a control.

More about me ↗

CONTINUE THE CONVERSATION

Discuss an internship.

sergio.w.rdz@gmail.com ↗

Review internship fit ↗Request résumé ↗GitHub ↗LinkedIn ↗

Project preview