Iván Santiago Lastra
Cybersecurity Portfolio | Red & Blue Team Labs and Projects
Systems Engineering student specializing in Offensive security, Penetration testing, and Security automation. Focus areas include web application security (OWASP Top 10), Linux and Windows hardening, and hands-on security labs in controlled environments. I document my methodology, findings, and mitigation strategies as technical write-ups.
Featured Projects
Hybrid Home Lab
Multi-Platform Security Environment
Advanced segmented network with VirtualBox, VMware, and Docker. Simulating enterprise infrastructure with Windows Server, vulnerable Ubuntu hosts, and containerized OWASP applications for realistic red/blue team exercises.
Web Application Pentesting
OWASP Top 10 Exploitation
Comprehensive penetration testing methodology using Burp Suite, Nikto, and OWASP ZAP. Full workflow from reconnaissance and enumeration to exploitation and remediation documentation.
Network Security Monitoring
Detection & Response Lab
Building a SIEM environment with log aggregation, alert rules, and threat detection. Analyzing attack patterns and creating custom detection signatures.
Security Automation Scripts
Python & Bash Tools
Custom security tools for vulnerability scanning, enumeration automation, and report generation. Focus on efficiency and reproducibility in security assessments.
Labs & Write-ups
Detailed technical documentation of security assessments: methodologies, findings, exploitation techniques, and defensive countermeasures for real-world scenarios.
Apache Server Hardening
2024Complete security audit of Apache web server. Identifying and fixing information disclosure vulnerabilities, implementing security headers, and validating configurations.
Secure DNS & Deployment
2024End-to-end secure deployment pipeline using Cloudflare for DNS management and DDoS protection, with automated HTTPS provisioning and security best practices.
SQL Injection Deep Dive
2024Exploring various SQL injection techniques from basic union-based to blind and time-based attacks. Includes both exploitation and secure coding practices.
Active Directory Attacks
2024Understanding common AD attack vectors: Kerberoasting, Pass-the-Hash, Golden Tickets. Lab setup, exploitation, and detection mechanisms.
Technical Arsenal
Penetration Testing
- ▸Burp Suite
- ▸Metasploit
- ▸Nmap
- ▸Nikto
- ▸SQLMap
- ▸Hydra
Operating Systems
- ▸Kali Linux
- ▸Parrot OS
- ▸Ubuntu Server
- ▸Windows Server
Scripting & Automation
- ▸Python
- ▸Bash
- ▸PowerShell
- ▸Git
Web Technologies
- ▸OWASP Top 10
- ▸REST APIs
- ▸Docker
- ▸Nginx/Apache
Network Security
- ▸Wireshark
- ▸VPN
- ▸Firewalls
- ▸IDS/IPS
Cloud & DevSecOps
- ▸Cloudflare
- ▸Vercel
- ▸CI/CD
- ▸Infrastructure as Code