Vulnerability Research & Experiments (From JMak-Security)
Welcome to my security research repository. This space serves as an ongoing technical journal and portfolio where I design, build, and analyze self-contained laboratories to evaluate cryptographic implementations, software logic flaws, and advanced red-team exploit vectors.
The objective of this repository is to demonstrate practical cybersecurity concepts, moving past theoretical definitions into fully functional proof-of-concept (PoC) code.
📂 Laboratory Directory
🧪 01. Post-Quantum Cryptography (PQC) Side-Channel Bypass (2026-06-02)
- Directory Location:
/PQC-SideChannel-Bypass
- Primary Concepts:
ML-KEM-768, AES-GCM-256, CWE-532 (Insecure Logging), Cryptographic Bypass.
- Core Vulnerability: A hybrid post-quantum data pipeline is completely neutralized due to an administrative logging flaw that leaks ephemeral symmetric key material to a plaintext file.
- Key Takeaway: Algorithmic strength (even NIST-standardized quantum defenses) cannot compensate for insecure implementation logic.
🧪 02. Semantic Logic Hijacking & Multi-File Context Manipulation (2026-06-26)
- Directory Location:
/2026-06-26 - Semantic Hijacking IPI Lab for PISA
- Primary Concepts: Indirect Prompt Injection (IPI), Context Window Unification, Compliance Bias, Fragmented Exfiltration.
- Core Vulnerability: An LLM agent reconstructs functional exfiltration strings from fragmented inputs across separate files, bypassing static signature filters.
- Key Takeaway: Structural instruction adherence can override data safety parameters when context is unified across disparate sources.
🧪 03. Multi-Stage AI & Traditional Infrastructure Homelab (2026-07-03)
- Directory Location:
/2026-07-03 - AI & Infra-Homelab
- Primary Concepts:
CWE-78 (Command Injection), CWE-918 (SSRF), CWE-502 (Insecure Deserialization), Docker Socket Breakout, Network Segmentation.
- Core Vulnerability: A three-tier AI microservice stack with isolated Docker networks is fully compromised through chained traditional attacks—from perimeter injection to host escape via a mounted Docker daemon socket.
- Key Takeaway: AI-adjacent infrastructure inherits classical web and container flaws; network segmentation alone cannot stop dual-homed SSRF pivoting.
🧪 04. IMDSv2 SSRF & AI Training Data Poisoning Lab (2026-07-09)
- Directory Location:
/2026-07-09 - IMDSv2 SSRF & AI Training Data Poisoning Lab
- Primary Concepts: Cloud storage IAM misconfiguration, IMDSv2 credential theft (
CWE-918 + CWE-532), AI training-data poisoning via leaked session tokens.
- Core Vulnerability: A dual-homed FastAPI AI gateway trusts attacker-controlled
storage_path values with an over-privileged role, leaks temporary IAM credentials through an SSRF→IMDS diagnostics probe, and enables a secondary cloud pivot that overwrites secure fine-tuning corpora.
- Key Takeaway: AI data planes fail the same way cloud control planes do — over-privileged roles, metadata exposure, and unauthenticated object writes compound into full pipeline compromise without a single classical RCE.
More laboratory experiments added continuously as research progresses…
🛡️ Responsible Disclosure & Usage Policy
The labs and source code provided across this repository are created strictly for educational, research, and defensive compilation purposes.
- All target systems and architectural flaws are simulated locally in controlled environments.
- The techniques illustrated are designed to help security engineers, developers, and researchers understand implementation vulnerabilities to build more resilient software development lifecycles (SDLC).
Maintained by: JMak-Security
Continuous learning through breaking, fixing, and securing.