Deployments
Things I actually built and shipped. Each runs on its own subdomain, and each is privacy-first by design.
$ dig +short *.0x6a03448f4d.com
Security+ SY0-701 Study Portal
Local-first exam prep engine
A full CompTIA Security+ (SY0-701) training platform I built from scratch. Weighted exam-readiness scoring by official domain percentages, adaptive custom quizzes, performance-based question (PBQ) labs, exam simulations, spaced-repetition flashcards, and a gamified XP / achievement system to keep the grind honest.
vault
Client-side security toolkit
A privacy-preserving password toolkit that runs entirely in the browser. Local strength analysis, CSPRNG passphrase and password generation, a Have I Been Pwned breach check via k-anonymity, plus base64/hex/JWT tooling — the password never leaves the device. No backend, no tracking, nonce-based CSP.
paste
Zero-knowledge pastebin
An encrypted pastebin where the server never sees the plaintext. Text is encrypted in the browser with AES-256-GCM; only ciphertext is stored and the key travels in the link fragment. Burn-after-read, auto-expiry, a creator deletion token, rate limiting, and a nonce-based CSP.
PrivEsc Matrix
GTFOBins + LOLBAS + WADComs, unified
An offline-first privilege-escalation workbench that unifies six sources (GTFOBins, LOLBAS, WADComs, GTFOArgs, HijackLibs, LOLDrivers) into one instant search, with a reverse-shell generator, MSFVenom builder, TTY-upgrade and pivoting cheatsheets, and an enumeration scanner: paste your find -perm -4000 or sudo -l output and it highlights which binaries are exploitable.