The Arsenal

Primary tool for web app testing — proxying, repeater, and intruder for manual exploitation.

First step on almost every engagement — service/version detection and initial attack surface mapping.

Exploitation framework for validating known vulnerabilities and post-exploitation modules.

Credential brute-forcing against common services when scope allows.

Packet-level traffic analysis for both offense (recon) and defense (incident investigation).

Log ingestion and correlation for building out detections and triage dashboards.

Entity correlation for OSINT — mapping relationships between people, domains, and infrastructure.

Vulnerability scanning for baseline coverage before manual testing.

This site — and most tool dashboards I build — run on Nuxt.

Automation, custom recon scripts, and the backbone of most tooling I write.

Reproducible environments for both engagements and local dev.

Backend framework of choice when a project needs a real API layer.