Oxpar — learning cybersecurity & infra

I'm working through cybersecurity fundamentals and IT infrastructure, and building small tools along the way to make it stick. The best way I've found to actually understand a system is to try to build or break one myself. This site is where I log that progress: projects, notes, and the things I get wrong on the way there.

./progress-log ./about-me

01 — about

System info

I'm learning cybersecurity and IT infrastructure, and building small tools along the way. Partly because they're useful, mostly because writing something forces me to actually understand it instead of just reading about it.

Right now that looks like working through hands-on labs, rebuilding parts of my home network to learn how they really work, and writing small scripts and tools that replicate what bigger security tools do under the hood. I'm keeping notes on all of it here as I go.

Got into security the boring way: by getting curious about things I was already running. Configured a firewall and wanted to know if it actually worked. Ran nmap and wanted to know what it was really doing behind the flag I typed. Each question led to another project, and eventually to a CompTIA Security+ cert and this site. Not sure where it ends yet, but I'm enjoying the direction.

Oxpar, Netherlands
CompTIA Security+ certified

neofetch

status: Learning
focus: Cybersecurity, IT infra, tooling
uptime: ~3 yrs
certs: - CompTIA Security+
- Cisco Endpoint Security
- Cisco Ethical Hacker
- Cisco Introduction to Cybersecurity
- Cisco Networking Devices and Initial Configuration
- Cisco Networking Basics
currently: AI & Go fundamentals
stack: Linux, C/C++, Python, JavaScript, ESP32
based in: Netherlands
next up: GO

02 — progress

Build & learning log

2026-08built

WordPress HoneyPot (PHP, Python)

Built a low-interaction WordPress honeypot that runs alongside a static site on a public domain. It serves believable WordPress endpoints (wp-login.php, xmlrpc.php, wp-json user enumeration, wp-config.php.bak, .git/HEAD) to capture credential-stuffing attempts, XML-RPC abuse, and reconnaissance probes. Each hit is published as a JSON event over MQTT to a local Mosquitto broker, picked up by a Python subscriber that enriches it with country and ASN data from MaxMind GeoLite2, and written to MySQL. A PHP dashboard with auto-refresh shows attacker origin, credentials tried, sparkline cards, and a live attack map rendered on a pre-generated SVG world map. Chart.js is vendored locally and everything is locked down with a strict Content-Security-Policy.

github.com/oxpar-cyber/WPHoneyPot

honeypotwordpressmqttgeoip

2026-08built

WiFi probe request scanner (ESP32)

Built a full pipeline around an ESP32 DevKit that puts its radio into promiscuous mode and hops channels to passively capture 802.11 probe request frames, the packets phones send out looking for networks they already know. Sightings get published over MQTT, stored in MySQL, and shown on a small PHP dashboard with vendor lookup and history charts. A good excuse to learn MQTT, systemd services, and the messier parts of the 802.11 frame format at once.

github.com/oxpar-cyber/esp32-wifi-probe-logger

wifiesp32mqtt

2026-06built

ICMP ping utility (Python)

Built a ping implementation from scratch using raw sockets. No subprocess wrapping the system binary. Constructs ICMP Echo Request packets manually with struct, sends them out and parses replies to extract round-trip times and packet loss. Output is color-coded by latency for quick visual feedback. Supports count mode, continuous mode, and a --no-color flag for piping. Catches Ctrl+C to print final stats before exiting. Requires root/admin for raw socket access, same as the system ping binary.

github.com/oxpar-cyber/oping

infrastructurepfsensehands-on

2026-05passed

CompTIA Security+ (SY0-701)

Passed the CompTIA Security+ exam on May 27, 2026. Studied across several months covering attacks and threats, architecture and design, implementation, operations and incident response, and governance/risk/compliance. Mix of self-study material, practice exams, and hands-on work on my own network, because reading about attack vectors only goes so far when you haven't seen one in the wild. First proper certification, and a useful forcing function to fill gaps in areas I was already somewhat familiar with.

credly.com — verified badge

certificationsecurity+comptia

2026-03built

Simple port scanner (Python)

Wrote a multithreaded TCP port scanner from scratch, using only the standard library, to understand how tools like nmap actually work under the hood rather than only using them. Takes either an IP or a domain name, handles IPv4 and IPv6 (with a preference toggle when a host resolves to both), and does basic service-name lookups on open ports so results read as more than just numbers.

github.com/oxpar-cyber/port_scanner

toolingpythonnetworking