Haroon Barlas

haroon@lab:~$ ls ~/work

Select an entry to expand it.

• [01]wazuh-siem: Wazuh SIEM and detection rulesA SIEM at home, with detection rules that don't cry wolf.

  I run Wazuh on an isolated network segment, with agents on my Windows and Linux machines. It handles file integrity monitoring, CIS benchmark scans and vulnerability detection.

  The vulnerability scan had been failing silently. Once I fixed it, it reported more than 9,000 findings, most of them kernel package noise. After I separated the noise from real exposure, one item actually needed action. A small dashboard now grades my posture A to F and keeps a CVE watch list ranked by CISA KEV and EPSS.

  I also wrote custom rules for my single sign-on logs: bursts of failed logins, new passkeys being registered, and changes to policies or providers. Before trusting them, I ran them against more than 21,000 real log lines. They raised zero false positives.

  result: 21,000+ log lines tested with zero false positives. 9,000+ findings narrowed to the one that mattered.

  stack: Wazuh, CIS benchmarks, File integrity monitoring, Authentik logs, CISA KEV, EPSS

  cat writing/cvss-epss-kev-what-to-patch-first.md

• [02]domain-hardening: Locking down my own domainsMaking small sites hard to spoof and hard to break, on Cloudflare's free plan.

  Each site I put online goes through the same checklist: TLS set to Full (strict), HTTPS only, HSTS, Cloudflare's free managed WAF and bot protection, and DNSSEC.

  Email records too: SPF, DMARC and CAA, so only the certificate authorities I chose can issue for them. A domain with new mailboxes starts DMARC in monitoring mode (p=none) and moves toward p=reject once its own mail checks out.

  This site follows the same checklist, with DMARC in monitoring mode while its new addresses settle in. It ships no inline scripts and no trackers, which lets it send a strict Content Security Policy.

  result: Signed DNS, strict TLS and headers, and an A+ on securityheaders.com.

  stack: Cloudflare, WAF, DNSSEC, HSTS, CSP, SPF, DMARC, CAA

  cat writing/hardening-a-small-site-on-cloudflare-free.md

• [03]zero-trust-homelab: Self-hosting with zero open portsHome services reachable from anywhere, with nothing on my network listening to the internet.

  I host a few services at home and didn't want to open router ports to do it. Each one goes out through a Cloudflare Tunnel, so there's no inbound port for a scanner to find.

  Cloudflare Access and Authentik passkey sign-in sit in front of every service. Behind them, the origin checks each request's Access token itself: signature, issuer, audience, email, hostname and method. If something ever slipped past Access, the server would still say no.

  The services run with least-privilege file shares, an enforced Content Security Policy, a fail-closed integrity guard, and releases that are hash-verified with a rollback path.

  result: No inbound ports, and identity checked twice on every request.

  stack: Cloudflare Tunnel, Cloudflare Access, Authentik, Passkeys, Docker, Hyper-V, Linux

  cat writing/self-hosting-without-open-ports.md

• [04]media-server: Hardening an internet-facing media serverA public-facing server that isn't an easy target.

  I run an open-source streaming server that has to be reachable from outside. It sits behind a Caddy reverse proxy running as a least-privilege Windows service, with automatic Let's Encrypt certificates, HTTPS-only redirects, HSTS and TOTP two-factor sign-in.

  While reviewing it, I found an ACME challenge endpoint that didn't require authentication. It could have let someone else get certificates issued for my domain. I closed it.

  result: One real certificate-issuance hole found and closed.

  stack: Caddy, Let's Encrypt, HSTS, TOTP, Windows services

• [05]study-app: My own CySA+ study appA study tool built around how I actually learn.

  Off-the-shelf study tools didn't match how I learn, so I built my own for CySA+ and PenTest+. It's built on retrieval practice: flashcards, practice questions and performance-based question drills.

  Questions are drawn in proportion to each exam domain's weight, and answer order is shuffled so I can't memorize positions. It works offline as an installable web app, and an automated test suite runs before every release.

  I built it with AI coding assistants and treated their output like any other code: reviewed and tested before it shipped.

  result: My daily study hub for CySA+ and PenTest+. There's a public demo with sample questions I wrote.

  stack: JavaScript, PWA, service worker, Cloudflare, Automated tests

  ./study-demo: try the sample questions

• [06]gcp-honeypot: A honeypot in Google CloudWhat happens to a fresh server on the open internet.

  I wanted to see what happens to a brand-new server on the public internet, so I deployed a honeynet in Google Cloud Platform and watched.

  Within an hour it had logged more than 3,000 attack attempts, mostly SSH brute-force logins and credential stuffing.

  result: 3,000+ attack attempts in the first hour.

  stack: Google Cloud, VPC firewall rules, Linux, SSH

haroon@lab:~$ cat certs.txt

haroon@lab:~$ cat experience.log

haroon@lab:~$ ls -t writing/

haroon@lab:~$ contact --best