Rules-based fraud detection in SQL
Seven SQL rules for account takeover, scams, card testing and money mules, scored against 585,000 labelled transactions. They catch 224 of 230 fraud cases at 41 alerts a day.
// projects
Projects
Detection, security and data work, each with its method and results written up.
Cyber Technician lab portfolio
All 22 EC-Council CCT lab modules completed. Ten exercises documented step by step and turned into a security and disaster recovery strategy for a research-vessel network.
Hacker101 CTF
Extracted admin credentials by hand with blind SQL injection, exploited stored XSS and IDOR flaws, and built an AES-CBC padding-oracle attack to crack the Encrypted Pastebin challenge. Earned private-program eligibility in September 2026.
Knowing exactly how these attacks work is what makes the defensive work above useful. A detection rule is only as good as your picture of what the attacker does next.
NZ business data toolkit
A Python toolkit that pulls NZBN and Companies Office data, from the API and bulk files, into a local database with scheduled jobs. I designed the loaders so a thinner source file can never overwrite a richer existing record, which fixed a data-integrity bug found during the build.
The same discipline applies to fraud data: a pipeline that silently drops fields produces rules that silently miss fraud.