[ 001 ] Security Tool Developer • Python • Network Security • Security Automation
I build tools that make defenders faster.
Veera Bhadhra Rao — Building practical security tooling in Python with a focus on network analysis, offensive security, and automation.
[ 002 ]
Operator Status
Flagship Deployment
Cyber-Recon-Toolkit
9 modules · Python Rich CLI · Unified recon pipeline
View repositoryDeployments
0
1 flagship CLI · 2 desktop tools · 1 prototype
Lab Audits
0+
Conducted in controlled testing environments
GitHub Repos
0
Public repositories
Technologies
0+
Python · PyQt6 · Linux · React · Nmap
[ 003 ]
Deployments
Deployment 01 / 05
Security AutomationCyber-Recon-Toolkit📦 Published on PyPIFlagship Project
A modular, terminal-based network intelligence and reconnaissance platform published on PyPI.
pip install cyber-recon-toolkitPyPI ↗Solo Developer · 2025
Developed a secure CLI-based assessment platform published on PyPI combining DNS enumeration, port scanning, WHOIS lookups, and log forensics into verified reports.
A modular, terminal-based network intelligence and reconnaissance platform published on PyPI.
Threat Context
Traditional network reconnaissance tools generate uncollated outputs, forcing security analysts to manually assemble evidence. This leads to reporting delays, data fragmentation, and unauthenticated forensic audit trails.
The Problem
Integrating multiple disconnected command-line scanning tools into a single workflow, handling multithreaded network requests safely, and generating clean, watermarked PDF reports directly from Python.
The Deployment
An integrated Python CLI framework distributed as a PyPI package installable via pip. Executes asynchronous port scanning, DNS resolution, banner grabbing, threat checks, and log analyzer queries. Outputs automated reports in PDF, JSON, and CSV formats.
System Architecture & Execution Path
WHOIS LOOKUP
Collects registrar intelligence, domain status, nameservers, creation and expiration dates.
Core Capabilities
- Modular CLI design utilizing the Rich terminal interface.
- Asynchronous multithreaded host scans and port banner extraction.
- Watermarked PDF report generation with cryptographic hashes.
- Forensic log analysis and signature-based phishing URL verification.
/projects/recon/port_scanner.png
Console Output Telemetry · Cyber-Recon-Toolkit
toolkit > 4 [+] Port Scanner initialized. [*] Scanning target: 127.0.0.1 [*] Scanning ports 1 to 1024... [+] Port 22/tcp [OPEN] (ssh) - Banner: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3 [+] Port 80/tcp [OPEN] (http) - Banner: nginx/1.18.0 [+] Port 443/tcp [OPEN] (https) - Banner: nginx/1.18.0 [+] Scan complete. Writing reports/port_scan_report.json...
Lessons Learned
Learned to manage socket timeouts and thread pools in Python to prevent network resource starvation. Gained experience using ReportLab for layout calculation and programmatic PDF compilation.
Deployment 02 / 05
Mobile Security ResearchAndroid Credential Leakage Detector
Static and dynamic analysis scanner to identify exposed credentials and storage risks in APK files.
Solo Developer · 2026
Engineered a modular Python security tool decompiling APK files, extracting string configurations, and correlating runtime logs to generate comprehensive APK risk assessments.
Static and dynamic analysis scanner to identify exposed credentials and storage risks in APK files.
Threat Context
Mobile applications frequently leak API keys, access tokens, and credentials in client-side smali bytecode or local SharedPreferences storage, creating immediate vectors for unauthorized backend API access.
The Problem
Automating the extraction of static configuration variables and decompiled resources, parsing Android logs dynamically, and matching findings to calculate a unified risk score.
The Deployment
A Python-based framework automating static APK decompilation, strings XML parsing, regex pattern matching, and dynamic runtime logcat/network packet evidence parsing. Features a correlation engine that flags escalated application risk based on combined static and runtime findings.
System Architecture & Execution Path
APK DECOMPILE
Invokes Apktool CLI in a subprocess to decompile target APKs into readable assets and Smali bytecode.
Core Capabilities
- Decompilation of Android resources and Smali code via Apktool.
- Regex-driven scan for 30+ service credentials and sensitive keys.
- Dynamic logcat and HTTP text capture parsing for credentials in transit.
- Risk correlation rules that escalate application vulnerability severity.
/projects/android/analysis_output.png
Console Output Telemetry · Android Credential Leakage Detector
python main.py samples/vulnerable.apk runtime_data/ ================ APK SECURITY REPORT ================ +--------------------------+----------+ | Metric | Value | +--------------------------+----------+ | Overall Risk | HIGH | | Static Findings | 2 | | Dynamic Log Findings | 0 | | Dynamic Network Findings | 0 | +--------------------------+----------+ ================ FINDING SUMMARY ================ +-----------------------+---------+ | Category | Count | +-----------------------+---------+ | Hardcoded Credentials | 2 | +-----------------------+---------+
Lessons Learned
Acquired deep familiarity with APK structures, Android manifest rules, and Smali syntax. Discovered limits of static heuristics and resolved them by implementing a dual-mode correlation pipeline.
Deployment 03 / 05
AI-assisted SOC OperationsAI SOC Copilot
An intelligent SOC investigation assistant coordinating Gemini-powered agents for automated threat analysis.
Solo Developer · 2026
Engineered a multi-agent framework utilizing FastAPI and React to coordinate 7 specialized security analyst agents, reducing threat validation cycles.
An intelligent SOC investigation assistant coordinating Gemini-powered agents for automated threat analysis.
Threat Context
Security operations centers suffer from extreme alert fatigue, often taking hours to correlate raw syslog telemetry with threat intelligence databases and MITRE Attack matrix tactics.
The Problem
Designing a clean system to orchestrate sequential Gemini LLM agents without structured JSON output format breaks, and ensuring persistent threat tracking.
The Deployment
A local FastAPI + SQLite container orchestrating 7 specialized AI roles (Alert classification, Geo-IP lookup, command script parsing, timeline correlation, MITRE mapper, IOC indexing, containment recommendations). Outputs automatic markdown summaries.
System Architecture & Execution Path
ALERT AGENT
Classifies incoming alerts and computes initial severity risk scores.
Core Capabilities
- Multi-agent collaborative triaging pipeline powered by Google Gemini.
- Interactive cyber-defense dashboard showcasing Recharts statistics.
- Automated Executive Incident Report generator compiling Markdown.
- SQLite session history tracking utilizing SQLAlchemy ORM models.
COMING SOON
Real-time interface captures are coming soon.
Console Output Telemetry · AI SOC Copilot
POST /investigate HTTP/1.1 Host: localhost:8000 Content-Type: application/json [Alert Agent] Classifying alert: Brute-Force SSH Attempt [Threat Agent] Resolving Geo-IP for 185.220.101.9 (Region: Germany) [Log Agent] Scanning logs. Found 14 failed logins for user 'admin' [Correlation Agent] Chronology compiled. Attack duration: 42s [MITRE Agent] Mapped to T1110 (Brute Force) [Response Agent] containment playbook generated. Output: reports/report_20260708.md
Lessons Learned
Discovered how to coordinate agent schemas to prevent structured data format breaks in JSON outputs, and handled Debian PEP 668 externally-managed-environment errors on Kali Linux.
Future Roadmap
Persistent PostgreSQL DB transition, live webhook support for real-time SIEM alerts, and customizable correlation playbook rules.
Deployment 04 / 05
Desktop EngineeringPingBro
Cross-platform desktop notification client and operator workspace wellness assistant.
Solo Developer · 2026
Developed a zero-dependency desktop notification utility in Python featuring global hotkeys, single-instance locks, and fullscreen detection.
Cross-platform desktop notification client and operator workspace wellness assistant.
Threat Context
Security operators face fatigue and cognitive overload during long monitoring shifts, while system alerts can cause visual disruptions. A lightweight, cross-platform notifier is needed to manage scheduled reminders and wellness pauses safely.
The Problem
Preventing multiple app instances, capturing keyboard hotkeys system-wide in background threads without hanging the Qt loop, and dynamically detecting if a fullscreen application is currently in focus.
The Deployment
A desktop notification assistant built in Python. Features Click-to-Edit schedules, a unified reminder manager, native Windows toast notifications, fullscreen-app suppression checks, and a global keyboard panic hook (CTRL + SHIFT + X) to instantly terminate the GUI and background threads.
System Architecture & Execution Path
SINGLETON LOCK
Binds port 58585 and creates system-level mutexes (Windows Mutex / Linux fcntl) to restrict running processes to a single instance.
Core Capabilities
- Single-instance process locking using platform Mutex and socket binding.
- Global shortcut instant shutdown hook (Ctrl+Shift+X) for emergency compliance.
- In-focus fullscreen window detection using native user32.dll APIs.
- Click-to-edit alarms dashboard, system tray, and hydration analytics.
/projects/pingbro/Dashboard.png
Console Output Telemetry · PingBro
[Lock] Mutex acquired. Port 58585 bound. First instance active. [Scheduler] Thread started. Loaded 5 alarms. [Tray] Initializing system tray loop... [Hotkey] Global hotkey registered: Ctrl+Shift+X [Safety] Active window handle: 65538 (Fullscreen check: True - alarm suppressed)
Lessons Learned
Understood how to link Qt UI events with multithreaded Python tasks. Learned to integrate Windows DLL libraries natively using ctypes and manage background system tray behaviors.
Deployment 05 / 05
Hackathon ProjectEcoSnap
Waste tracking and management system designed for municipal reporting workflows.
Team Lead · 2025
Developed a waste tracking web portal and mobile app connecting citizens with municipal authorities, selected in the Top 45 of Vadodara Hackathon 6.0.
Waste tracking and management system designed for municipal reporting workflows.
Threat Context
Municipal waste workflows suffer from lack of digitized verification, leaving citizen reports unlogged and unresolved. An accessible client portal is required to prototype user registration, dashboard reports, and administrative management.
The Problem
Designing a clean administrative interface, validating citizen reports on the client, and structuring local data stores to model real-world reporting cycles.
The Deployment
A React-based citizen reporting dashboard. Features interactive forms, user login screens, routing logic, and simulated administration logs. Since this is an academic prototype, real-time database endpoints and geolocation maps are marked as pending assets.
System Architecture & Execution Path
PROTOTYPE AUTH
Simulates logins for Citizens, Managers, and Admins to show role-based layouts.
Core Capabilities
- Role-Based User Interface Mockups.
- Form validation & client-side inputs.
- Audit Log Timeline View (Pending live backend connection).
COMING SOON
Real-time interface captures are coming soon.
Console Output Telemetry · EcoSnap
// EcoSnap Client Instance [Auth] Session started: Role = Citizen (Mocked) [Form] Submitted Report: Waste Category = Electronic, Location = Vadodara [Database] [Live Database Offline - Data saved in Local Session Cache] [System] Status: Active Prototype
Lessons Learned
Created wireframes and coordinated workflows in a team of 4. Selected among the Top 45 finalist teams out of hundreds of entries in Vadodara Hackathon 6.0.
[ 004 ]
Capabilities
Depth over breadth — contextual expertise, not skill percentages.
[ 005 ]
Operator Log
Incident-style timeline of key operational milestones.
Started Bachelor of Engineering
Began formal studies in Cyber Security at Parul University, Vadodara.
Released Cyber-Recon-Toolkit
Built and published a modular Python-based reconnaissance toolkit for passive and active network intelligence gathering.
Published on PyPI
Published the reconnaissance toolkit as an installable Python package, making it available for direct installation via pip.
Vadodara Hackathon 6.0
Participated in Vadodara Hackathon 6.0 at Parul University, coding solutions with teammate peers.
Released PingBro Notifier
Engineered a PyQt6-based desktop wellness utility featuring Windows system mutexes and global keyboard panic listeners.
Android Secret Leakage Research
Built the static and dynamic Android Credential Leakage Detector as a major final-year research project.
Registered Cyber Volunteer
Enrolled in the national Cyber Crime Volunteers program under the NTR Commissionerate.
Seeking Internship Opportunities
Ready for SOC operations or penetration testing roles.
NEXT
Deploying into SOC operations. Ready for mission assignment.
[ 006 ]
Verified Events
Third-party validated milestones and output evidence.
Palo Alto Networks Cybersecurity Foundation
Student Certificate
Completed foundational security studies under the Palo Alto Networks Cybersecurity Academy.
Network Security Fundamentals
Student Certificate
Validated knowledge of network security components, threats, and mitigation strategies under Palo Alto Academy.
Vadodara Hackathon 6.0
Hackathon Participant
Participated in the team hackathon held at Parul Institute of Engineering & Technology, focusing on building environmental tech solutions.
Cyber Crime Volunteer
Cyber Expert & Unlawful Content Reporter
Registered Cyber Volunteer under NTR Commissionerate, assisting in cyber safety awareness and identifying/reporting malicious content.
[ 007 ]
Establish Connection
Typically responds within 24 hours
Let's build something secure.
Open to internship opportunities in SOC operations, penetration testing, and security engineering.