Security Engineering / SOC & Pentest Track

I build things, then break them,
then document how to catch it happening.

Computer engineering student at École Polytechnique de Lomé, specializing in cybersecurity. I work across the full loop — hardening systems, simulating attacks against them, and increasingly, building the detection layer that catches the attack in the act.

→ github.com/4rthur-Root View projects Get in touch
adrien@4rthur-root — zsh

$ whoami

name Adrien Kpodonou role SOC / Pentest track focus detection engineering, network security status open to opportunities

01

#about

I'm Adrien Kpodonou (KPODONOU Kossigan Gaël God-Love), a computer engineering student aiming for SOC Analyst and pentesting roles. My background is split between offense and defense: I've hardened Samba file servers against real attack tooling (Hydra, CrackMapExec), executed and defended against Layer 2 attacks (ARP spoofing, MITM), and I'm currently building toward detection engineering — SIEM correlation, alerting, and automated response, not just "the attack worked."

I run everything on a Fedora / QEMU-KVM home lab, work comfortably in Linux and Python, and I'm active in CTF competitions (crypto, forensics, steganography). I write up what I build — most of it lives on GitHub with full evidence, not just a description.

02

#skills

Offense

  • ARP spoofing / MITM
  • NTLM hash capture (Responder)
  • SMB / Samba exploitation
  • CTF: crypto, forensics, stego

Defense & Hardening

  • Samba SMB2/3 hardening
  • Fail2ban, log auditing
  • Backup / restore strategy
  • Linux permissions & setgid models

Detection (in progress)

  • Wazuh SIEM
  • Suricata NIDS
  • MITRE ATT&CK mapping
  • SOAR / alert enrichment

Tooling

  • Python, Flask
  • QEMU/KVM, libvirt
  • Docker, Terraform, Ansible
  • Wireshark, tcpdump

03

#projects

NYX

public

SIEM correlation engine with automated SOAR response — stateful multi-source log analysis, YAML detection rules, YARA integration, Grafana dashboard.

PythonSOARYARAGrafana
→ github.com/4rthur-Root/NYX

DevSecOps Web Lab

public

Terraform/Ansible-deployed hardened web stack: ModSecurity WAF (846 OWASP CRS rules) in front of Juice Shop, Grafana/Loki SOC monitoring, full recon→exploit kill-chain with 12 documented root-cause fixes.

TerraformAnsibleModSecurityOWASP Top 10
→ github.com/4rthur-Root/DevSecOps-web-lab

SambaPME

public

Hardened Samba SMB2/3 file server for a simulated SME: per-department access control, Fail2ban, encrypted transport, automated backup/restore, and a Flask admin portal over it. Tested against Hydra, CrackMapExec, and anonymous enumeration.

SambaFlaskFail2banLinux
→ github.com/4rthur-Root/SambaPME

L2 Network Attacks Lab

public

ARP spoofing MITM executed end-to-end with SSH traffic interception, a validated static-ARP countermeasure, and an honestly-documented MAC flooding attempt against virtualization limits.

ARP SpoofingMITMLayer 2
→ github.com/4rthur-Root/l2-network-attacks-lab

Blue Team Fusion Lab

in progress

3-VM KVM/libvirt SOC environment: Windows AD + client + Fedora SIEM. Simulated intrusion chain (LOLBin → persistence → Kerberoasting) mapped to MITRE ATT&CK, detected via custom Wazuh rules, with SOAR-driven OSINT enrichment.

WazuhSuricataMITRE ATT&CKSOAR
→ repository not yet published

Cyber Lab Manager

private / team

Java desktop app managing VirtualBox lab environments for security analysts — groups VMs by lab, drives them via VBoxManage, timestamps analyst notes, exports PDF incident reports. Strategy-pattern design for multi-hypervisor support.

Java 17SQLiteDesign Patterns
→ private repository (team project)

04

#blog

No posts yet — this section will hold write-ups too small for their own repo: CTF solves, detection-engineering notes, things I broke and learned from.

$ ls blog/ → browse the blog index

05

#contact

email kpodonougael@gmail.com
github 4rthur-Root
linkedin add your URL