Haitao Zheng EN DE

Projects

Tools, products and accepted upstream work, with source links, validation and the limits of each case.

  1. Cloud investigation cloudtrail-quickscan An explainable first pass over AWS audit logs: IAM changes, logging disruption, public exposure and unusual activity. Local input, readable findings and JSON output; no cloud credentials required. PythonAWS CloudTrailCLIUnit tests
  2. Data inspection jsonl-lens A quick inspection tool for messy event exports: missing fields, type changes, nested paths and noisy identifiers. One report before writing the parser or importing the data. PythonJSON LinesCLI
  3. Linux socket review socket-state-triage A dependency-free utility for reviewing Linux socket state, wildcard listeners and broad privileged-port bindings. Makes host-level exposure questions concrete and testable. CLinuxNo dependencies
  4. Web-log investigation java-web-log-triage A plain-Java CLI that links suspicious paths and scanner-style user agents to the clients that triggered them. Builds with javac and make; reports reviewable counts and findings. JavaApache / NginxNo dependencies
  5. Indicator extraction Sentinel-IOC-Toolkit Extracts and normalizes indicators from investigation text, including defanged URLs, domains, hashes and CVE identifiers. Local extraction works without an enrichment API key. PythonIOCJSON
  6. Full-stack product StudyPulse A study tracker that connects planning, recall checks and spaced review. Built for my own cyber security semester. Key decision: evidence earns progress; elapsed time alone does not. TypeScriptReactWorkersD1
  7. Upstream engineering CloudFormation validation Accepted cfn-lint work on intrinsic functions, SAM outputs, lifecycle policies and schema-aware validation. Eight merged pull requests in cfn-lint as of 3 October 2026. PythonCloudFormationRegression tests
  8. Vulnerability reproduction Heartbleed lab A repeatable lab that reproduces CVE-2014-0160 against a vulnerable and a patched OpenSSL side by side, for a course project at H-BRS. Key decision: the patched server runs next to the vulnerable one as a control, so a leak can be attributed to the bug and nothing else. DockerOpenSSLPythonGitHub Actions
  9. Publishing system tzheng.dev A static engineering portfolio with evidence-linked case studies, technical writing and a shared dark interface. Prebuilt pages and typed content, no public application backend. AstroMarkdownCSSGitHub Pages
  10. Authentication logs authlog-watch A local SSH authentication-log review tool with readable event summaries and summary-only output. Focused Linux log review with unit-tested behavior. PythonLinuxSSH
  11. Detection-rule review sigma-rule-helper A small helper for reviewing Sigma rules with narrow, explainable checks. Keeps rule review local and the checks easy to inspect. PythonSigmaReview checks

Haitao Zheng

EN DE