▶ MSc Cybersecurity — Coventry University

Segun Akinsoyinu Cybersecurity Portfolio

Penetration testing. Incident response. Network security design.
Three disciplines. Real lab environments. Zero generic filler.

🚩 User: 5038{B1UF_...} 💀 Root: 5038{B1RF_...} 🚩 User: CUEH{P@ssW0rd_...} 💀 Root: CUEH{Tr@gic_...} 🚩 User: 5038{Xss_...} 💀 Root: 5038{Unit_Tests_...}
3
Targets Compromised
6
Flags Captured
16
Vulns Identified
4
CVEs Exploited
13
VLANs Designed
5
Modules Covered
// Boot-to-Root Engagements
Attack Chains
▶ View on GitHub →
Target 01
Target 01
Docker / PHP / Apache
Blind SQL injection via sqlmap extracted MD5-hashed credentials from SQLite login form
MD5 hash cracked to plaintext via CrackStation rainbow table lookup
GIF89a magic-byte webshell bypassed MIME validation; Burp Suite intercepted Content-Type header
Reverse shell returned as www-data via netcat listener
SUID tee binary injected attacker SSH key to dev's authorized_keys
GTFOBins sudo ftp !/bin/bash escape escalated to root
SQLi 9.8 RCE 9.0 sudo 8.8 SUID 7.8
USER: 5038{B1UF_...} — Captured
ROOT: 5038{B1RF_...} — Captured
Target 02
Target 02
Docker / PHP / ImageMagick
robots.txt disclosed .sqlite extension; public Coventry GitHub revealed real database filename
SQLite database downloaded; MD5 hash cracked to plaintext via CrackStation
UNION-based SQL injection bypassed login authentication entirely
Password reused across web app and SSH port 22 yielding user flag
GitHub source review exposed profile.php running sudo convert as root
CVE-2016-3714 MVG pipe injection payload bypassed extension-only file validation; root command executed via ImageMagick
SQLi 9.8 CVE-2016-3714 8.4 Upload 8.8 Reuse 6.5
USER: CUEH{P@ssW0rd_...} — Captured
ROOT: CUEH{Tr@gic_...} — Captured
Target 03
Target 03
Docker / Roundcube / FastAPI / Gitea
IMAP credentials disclosed on public website; webmaster address identified as social engineering target
CVE-2024-42009 stored XSS in Roundcube 1.6.6 delivered via unauthenticated SMTP; 19 emails exfiltrated silently
SSH credentials recovered from stolen admin email; user flag captured
CI pipeline source reviewed; malicious conftest.py placed in world-writable /tmp escalated to admin via pytest discovery
Attacker SSH key injected into admin authorized_keys via CI re-trigger
sudo git commit core.editor misconfiguration exploited via GTFOBins; root SUID bash created
CVE-2024-42009 8.8 CI RCE 8.1 sudo 7.8 Disclosure 5.3
USER: 5038{Xss_...} — Captured
ROOT: 5038{Unit_Tests_...} — Captured
▶ CVE-2024-42009 PoC →
// Proof of Concept
Sample Exploit Trace
kali@attacker:~$ nmap -sC -sV -p- -T4 [target] -oN box3_nmap.txt
PORT STATE SERVICE VERSION
25/tcp open smtp Postfix smtpd
80/tcp open http Apache 2.4.65
1222/tcp open ssh OpenSSH 10.0p2 Debian
8000/tcp open http Uvicorn (FastAPI)
 
kali@attacker:~$ python3 deliver_xss.py
[*] Sending CVE-2024-42009 payload to webmaster@hacking.local ...
[+] Email delivered via unauthenticated SMTP port 25
[+] OPTIONS preflight received -- XSS handler fired
[+] POST received -- 19 emails exfiltrated (238 KB)
 
kali@attacker:~$ ssh webmaster@[target] -p 1222
webmaster@7b16d12ebfcb:~$ cat user.txt
5038{Xss_...} — Captured
 
kali@attacker:~$ sudo /usr/bin/git commit
[master (root-commit)] pwn
kali@attacker:~$ /tmp/rootbash -p
rootbash-5.2# whoami
root
rootbash-5.2# cat /root/root.txt
5038{Unit_Tests_...} — Captured
// Vulnerability Findings
All 16 Findings Across Three Targets
B1-001
SQL Injection — Blind SQLite Login FormTarget 01 | sqlmap boolean-based and time-based blind | OWASP A03
CRITICAL
9.8
B1-002
Insecure File Upload — MIME Bypass RCETarget 01 | GIF89a magic bytes + Burp Content-Type intercept | OWASP A05
CRITICAL
9.0
B1-003
Sudo Misconfiguration — ftp NOPASSWD EscapeTarget 01 | GTFOBins !/bin/bash shell escape | OWASP A05
HIGH
8.8
B1-004
SUID Binary Abuse — tee owned by devTarget 01 | SSH key injection via SUID write primitive | OWASP A05
HIGH
7.8
B1-005
Weak Password Hashing — Unsalted MD5Target 01 | CrackStation rainbow table lookup | OWASP A02
HIGH
7.5
B1-006
Information Disclosure — Source Code CommentsTarget 01 | Plaintext password exposed in connect.php | OWASP A05
MEDIUM
5.3
B2-001
Source Code & Database Exposure via Public GitHubTarget 02 | Real SQLite DB filename disclosed in conn.php | OWASP A05
HIGH
7.5
B2-002
SQL Injection — UNION-Based Login BypassTarget 02 | UNION SELECT injected matching row into auth query | OWASP A03
CRITICAL
9.8
B2-003
Remote Code Execution — CVE-2016-3714 ImageTragickTarget 02 | MVG pipe injection; sudo convert executing as root | OWASP A06
HIGH
8.4
B2-004
File Upload — Extension-Only Validation BypassTarget 02 | .jpg extension accepted without magic byte validation | OWASP A05
HIGH
8.8
B2-005
Password Reuse Across SSH and Web ApplicationTarget 02 | Cracked hash 'goodforyou' valid on SSH port 22 | OWASP A07
MEDIUM
6.5
B3-001
Credentials Disclosed in Public Website ContentTarget 03 | IMAP/SMTP credentials on /email.html | OWASP A05
MEDIUM
5.3
B3-002
Stored XSS — CVE-2024-42009 Roundcube 1.6.6Target 03 | CSS animation handler; full inbox silently exfiltrated | OWASP A03
HIGH
8.8
B3-003
CI Pipeline RCE — World-Writable /tmpTarget 03 | conftest.py parent-dir discovery executed as admin | OWASP A05
HIGH
8.1
B3-004
SSH Key Injection via CI PipelineTarget 03 | Persistent admin access via CI-executed key write | OWASP A05
HIGH
7.5
B3-005
Sudo git commit Privilege EscalationTarget 03 | core.editor set to root SUID bash creation command | OWASP A05
HIGH
7.8
// Tooling
Tools & Frameworks Applied
nmap 7.98
Full TCP port scanning, service version detection, NSE scripting
ffuf v2.1.0
Web directory fuzzing and virtual host enumeration
sqlmap 1.10.3
Automated SQL injection exploitation and database dumping
Burp Suite 2026.2.3
HTTP proxy; MIME type bypass via request interception
netcat / curl
Reverse shell delivery, listener, HTTP interaction, IMAP probing
CrackStation
MD5 hash cracking via rainbow table lookup
GTFOBins
Sudo and SUID privilege escalation reference (ftp, git commit)
searchsploit
CVE identification against discovered service versions
Python 3 smtplib
Authenticated SMTP delivery of XSS email payload
Python 3 http.server
CORS-capable HTTP listener for email exfiltration receipt
sqlite3
Local interrogation of downloaded database files
SecLists
Wordlists for directory fuzzing and virtual host enumeration
// Demonstrated Competencies
Technical Skill Areas

Reconnaissance & Enumeration

Port Scanning Service Fingerprinting Virtual Host Fuzzing Web Directory Fuzzing IMAP / SMTP Interaction Source Code Review robots.txt Analysis GitHub OSINT

Web Application Exploitation

SQL Injection (Blind) SQL Injection (UNION) Stored XSS File Upload Bypass MIME Type Manipulation Magic Byte Injection Auth Bypass Session Exfiltration

CVE Exploitation

CVE-2024-42009 (Roundcube XSS) CVE-2016-3714 (ImageTragick) CVSS v3.1 Scoring searchsploit Workflow Exploit Adaptation Negative Finding Documentation

Privilege Escalation

Sudo Misconfiguration SUID Binary Abuse GTFOBins Techniques CI Pipeline Abuse conftest.py Injection SSH Key Injection git core.editor Escape

Reporting & Methodology

PTES Framework Cyber Kill Chain OWASP Top 10 2021 Executive Summaries Remediation Roadmaps Threat Modelling Computer Misuse Act 1990 UK GDPR Compliance

Infrastructure & Tooling

Kali Linux VMware / Docker Python Scripting Bash Automation FastAPI Analysis Gitea / Git SMTP / IMAP Protocols Reverse Shell Delivery
// Academic Projects
Other Coursework
Security Research — CVE PoC
Public PoC Released
CVE-2024-42009 — Roundcube Webmail 1.6.6 Stored XSS
Zero-click inbox exfiltration via CSS animation event handler · CVSS 8.8 (High) · Patched in 1.6.8
8.8
CVSS Score
19
Emails Exfiltrated
0
Clicks Required
▶Roundcube ≤ 1.6.6 fails to strip JavaScript event handlers from CSS animation keyframes inside malformed body tag attributes. The payload fires the moment the victim opens the email — no link click required.
▶Delivered via unauthenticated SMTP relay (port 25). The injected JavaScript iterates all inbox UIDs through Roundcube's internal mail API and exfiltrates every message as JSON to the attacker's listener.
▶Exploited during an authorised lab engagement — 19 emails silently exfiltrated, SSH credentials recovered from the first message, user flag captured. Full PoC published for security research and CTF use.
■exploit.py — SMTP delivery, base64 payload injection
■listener.py — CORS server, saves stolen_emails.json
■payload.html — Annotated injection string breakdown
■README.md — CVE writeup, usage guide, remediation
CVE-2024-42009 Stored XSS CSS Animation Injection SMTP Delivery Email Exfiltration Roundcube 1.6.6 Python PoC CVSS 8.8 OWASP A03 Zero-Click Zero Dependencies
▶ View PoC on GitHub →
Incident Response — Coursework 2
Threat Monitoring & Insider Threat IR Framework
Coventry University — Segun Akinsoyinu
▶Designed a layered monitoring architecture across a multi-gateway enterprise network using NetFlow/sFlow collectors on routing nodes 1, 2, 6, and 7 and IPFIX monitoring at gateways 0, 3-5, and 8-13 to detect insider reconnaissance.
▶Deployed Zeek with custom protocol and behaviour analysis scripts alongside Suricata IDS/IPS at network chokepoints to flag Nmap scanning patterns, DNS enumeration, and service query anomalies.
▶Produced a forensic evidence collection plan covering memory capture (DumpIt / FTK Imager), registry hive extraction, USB device logging, full packet capture, and database transaction log analysis across affected gateways 5, 9, and 10.
▶Addressed forensic soundness requirements: hardware write-blockers, SHA-256 hashing, chain-of-custody documentation, and system clock synchronisation for legal admissibility.
▶Proposed APT testing methodology combining monthly penetration tests, red-team simulations using living-off-the-land TTPs, and purple-team sessions aligned to MITRE ATT&CK.
■Question 1 — Detecting Insider Reconnaissance (523 words)
■Question 2 — Incident Response Evidence Collection (666 words)
■Question 3 — APT Testing Methodology (328 words)
▶ View on GitHub →
Zeek Suricata NetFlow / sFlow IPFIX Splunk SIEM MITRE ATT&CK FTK Imager DumpIt SHA-256 Hashing Chain of Custody Purple Team APT Detection OSCP / GPEN
Network Security — Coursework 1
Megadodo Publications Network Redesign
Coventry University — Segun Akinsoyinu
▶Redesigned a flat Layer 2 campus network into a hierarchical IEEE 802.1Q VLAN architecture across two buildings (Alpha and Beta), eliminating broadcast flooding and segmenting 13 departments into dedicated /24 subnets.
▶Specified Layer 3 core switch deployment for hardware-accelerated inter-VLAN routing and QoS policy enforcement, prioritising VoIP and server backup traffic.
▶Replaced single copper inter-building link with redundant OM4 multimode fibre running as a dual-port LACP bundle (2 x 1 Gbps SFP+) for full fault tolerance.
▶Deployed FortiGate NGFW at the perimeter with stateful inspection, IPS, WAF, and a DMZ for the server environment. Implemented 802.1X RADIUS authentication and NAC for endpoint compliance enforcement.
▶Authored policy amendments covering RBAC with least privilege, MFA enforcement for management and finance, ISO/IEC 27001:2022 aligned BYOD/AUP, incident response with RTO/RPO objectives, and third-party SaaS risk assessments.
▶Delivered full budget allocation (£8,000 total) with device-level costing and a future Zero Trust roadmap using FortiGate policy enforcement.
DepartmentSubnet
Server10.3.70.0/24
Finance10.2.30.0/24
IT10.8.100.0/24
Software Dev10.2.40.0/24
Guest Wi-Fi (Beta)10.4.100.0/24
+ 8 more VLANs—
■Cisco Packet Tracer topology file (.pkt) submitted
■Full report with budget table — 1,471 words
▶ View on GitHub →
IEEE 802.1Q VLANs Layer 3 Switching LACP / SFP+ FortiGate NGFW 802.1X / RADIUS NAC Splunk SIEM QoS Wi-Fi 6 OM4 Fibre ISO/IEC 27001:2022 Zero Trust Cisco Packet Tracer
Security of Connected Systems
Hill Valley Power Systems Ltd — IoT Security Strategy
CMI Units 704 & 705 — Coventry University · Segun Akinsoyinu
▶Conducted full strategic analysis of a 47-person IoT energy management company using PESTLE, Porter's Five Forces, VRIO, McKinsey 7S, and Balanced Scorecard, identifying security as an active commercial weakness blocking ISO 27001 investor requirements and German BSI market entry.
▶Evaluated three strategic options against SAFe criteria and selected a phased 18-month programme: Cyber Essentials Plus by month 6, ISO 27001 or SOC 2 by month 18, and BSI TR-03148 certification for German market entry by month 24.
▶Recommended Microsoft SDL with STRIDE threat modelling embedded into two-week agile sprints, justified against OWASP SAMM and PASTA. Designed a Security Champions programme scaling security capacity with headcount growth rather than requiring dedicated security hires.
▶Designed PTES methodology augmented with IoT-specific tooling (Binwalk, EMBA, UART/JTAG, Zigbee, MQTT) for the Flux-88, Flux-121, Flux-Sense device range and Flux Capacitor REST API. Modelled distributed architecture implications for a 10,900-installation installed base.
▶Produced a case study on Johnson Controls Metasys CVE-2025-26385 (CVSS 10.0, command injection) and CVE-2021-36204 (CVSS 7.8, plaintext credential exposure via API), mapping both failure patterns directly to HVPS's Flux Capacitor platform as equivalent unmitigated risks.
▶Applied Kotter's 8-step model, ADKAR individual adoption, Lewin's Force Field Analysis, and Balogun and Hope Hailey's Reconstruction typology to manage developer resistance and embed security-as-literacy across the engineering team.
■Section 2 — Org Change Strategy (PESTLE, 7S, SAFe)
■Section 3 — Secure Design: SDL + STRIDE vs SAMM vs PASTA
■Section 4 — Audit: PTES + IoT vs OWASP vs NIST 800-115
■Section 5 — Case Study: CVE-2025-26385 & CVE-2021-36204
■Appendix A — Full 7S, VRIO, Kotter, ADKAR, Lewin tables
■Appendix B — STRIDE model, PTES IoT scope, checklist, compliance map
Microsoft SDL STRIDE PTES + IoT OWASP IoT ETSI TS 103 701 ISO 27001 SOC 2 BSI TR-03148 Cyber Essentials Plus PSTI Act 2022 EU Cyber Resilience Act CVE-2025-26385 CVSS 10.0 Binwalk / EMBA MQTT / Zigbee McKinsey 7S Balanced Scorecard Kotter / ADKAR Lewin Force Field CMI 704 & 705
▶ View on GitHub →
Cloud Infrastructure and Operations
Grade: 85%
Docker Container Security Hardening & Cloud Infrastructure
MSc Cybersecurity · Coventry University · Segun Akinsoyinu
Part A — Security Analysis
▶Identified six critical vulnerabilities in a prototype Docker environment: EOL CentOS 7 base images, privileged execution, root UID processes, excessive port exposure (SSH 22 + daemon 2375), hard-coded credentials in Makefiles, and zero resource limits.
▶Hardened web container: migrated from CentOS 7 (~600MB) to Alpine Linux 3.19 (~50MB), 92% image size reduction via multi-stage build, non-root webuser (UID 1001), read-only root filesystem with tmpfs mounts.
▶Applied runtime controls: no-new-privileges, AppArmor custom profile, custom seccomp policy, ALL capabilities dropped with selective NET_BIND_SERVICE re-add, CPU and memory limits enforced.
Part B — Implementation
▶Migrated Makefile-driven workflow to declarative Docker Compose Infrastructure as Code with auditable controls, health-check-driven dependency management, and network segmentation isolating front-end and back-end traffic.
▶Integrated Trivy and Snyk into a four-stage scanning pipeline: pre-commit local scans, build-time automated scans with pipeline failure on HIGH/CRITICAL findings, Dockerfile config scans, and runtime registry re-scans on CVE database updates.
▶Designed multi-layer logging: Nginx access/error, PHP error, Docker JSON driver, daemon events, and security audit logs. ELK Stack (Elasticsearch, Logstash, Kibana) with Prometheus and Grafana for metrics, OOM events, seccomp violations, and SIEM integration path.
Part C — AWS EKS Cloud Strategy
▶Evaluated IaaS, PaaS, and CaaS deployment models; selected AWS EKS for managed Kubernetes control plane, IRSA, CloudWatch/ECR/KMS/VPC integration, and native HPA and Cluster Autoscaler support.
▶Designed multi-AZ high-availability architecture across three us-west-2 availability zones: worker nodes in private subnets, ALB in public subnets, pod anti-affinity rules, RDS MariaDB Multi-AZ with ~60-second automatic failover, and Kubernetes network policies enforcing zero-trust inter-service communication.
▶Designed CI/CD pipeline: Code Commit, multi-stage build, Trivy scan gate, Syft SBOM generation, Cosign image signing, OPA/Conftest manifest validation, ECR push, EKS rollout. Estimated baseline cost £270-£315/month with 40-60% saving via Reserved Instances.
Security MetricBeforeAfter
Base Image Size~600MB (CentOS 7 EOL)~50MB (Alpine 3.19)
User Execution ContextRoot (UID 0)Non-root dedicated users
Container Privileges--privileged=trueALL capabilities dropped
Credential HandlingHard-coded in MakefilesDocker secrets (file-based)
Root FilesystemFully writableRead-only + tmpfs
Vulnerability StatusMultiple HIGH/CRITICAL CVEsZero known critical vulns
■SECURITY_ANALYSIS_REPORT.md — 2,500+ word threat analysis
■SECURITY_IMPLEMENTATION_GUIDE.md — Full hardening walkthrough
■docker-compose.hardened.yml — IaC orchestration file
■manage-secure.sh — Automated security management script
■Hardened Dockerfiles: webserver (Nginx/PHP-FPM) + dbserver (MariaDB)
■README-CLOUD-DEPLOYMENT.md — AWS EKS production strategy
Docker Docker Compose Alpine Linux Nginx / PHP-FPM MariaDB Trivy Snyk AppArmor Seccomp Docker Secrets AWS EKS AWS RDS AWS ECR Kubernetes GitHub Actions Prometheus Grafana ELK Stack Cosign Syft SBOM OPA / Conftest CIS Docker Benchmark NIST SP 800-190 Infrastructure as Code
▶ View on GitHub →
// About
Background

I am Segun Akinsoyinu, a cybersecurity practitioner pursuing an MSc in Cybersecurity at Coventry University. This portfolio covers practical work across five modules: ethical hacking and penetration testing, incident response, network security design, security of connected systems, and cloud infrastructure security.

Across three isolated VMware lab environments I executed complete attack chains from unauthenticated access to root shell. In parallel coursework I designed enterprise monitoring frameworks for insider threat detection, architected a full campus network redesign, produced a board-level IoT security strategy applying CMI Units 704 and 705 frameworks, and delivered a full Docker hardening and AWS EKS cloud deployment project graded at 85%.

My background also spans AI evaluation and content quality assessment and compliance-adjacent analysis, giving me the communication skills to translate complex technical findings into clear, actionable language for non-technical stakeholders.

Institution Coventry University
Programme MSc Cybersecurity
Module 1 Ethical Hacking
Module 2 Incident Response CW2
Module 3 Network Security CW1
Module 4 Connected Systems
Module 5 Cloud Infrastructure (85%)
Methodology PTES + Kill Chain + MITRE
Location Coventry, United Kingdom