Custom Protocol Exploitation · Hacking Project

Reverse-engineer an undocumented network protocol and develop tooling to discover, exploit, and mitigate its vulnerabilities.

**The problem**
Proprietary and industrial binary protocols (IoT, OT/ICS, gaming, fintech messaging) rarely receive the scrutiny that HTTP does, yet they often lack authentication, encryption, and input validation. Attackers reverse-engineer these protocols to inject commands, replay messages, or crash services, and defenders lack tooling to fuzz and validate them. Few engineers can analyze an undocumented wire format from raw captures.

**What you'll build**
Reverse-engineer a custom or proprietary network protocol from packet captures and binary analysis, then build a protocol dissector, a stateful fuzzer, and proof-of-concept exploits for discovered flaws (auth bypass, replay, buffer overflow, command injection). Deliver mitigations including message authentication, sequence validation, and a hardened protocol spec.

**Objective** — Reverse-engineer an undocumented network protocol and develop tooling to discover, exploit, and mitigate its vulnerabilities.

**Expected outcome** — A protocol dissector, a stateful fuzzing harness, documented PoC exploits, and a hardening specification with authentication and integrity controls.

**Difficulty** — Expert — demands binary reverse engineering, protocol state modeling, fuzzer construction, and low-level exploit development.

**Primary category** — Penetration Testing; Secondary = Reverse Engineering, Vulnerability Research, ICS/OT Security

**Security domains** — Primary = Security Research; Secondary = Red Team, Malware Analysis, Cloud Security

**Technical focus** — Packet capture analysis, protocol reverse engineering, binary analysis, stateful fuzzing, memory-corruption exploitation, replay attacks, protocol dissector development, ICS/OT protocol security

**Core technologies** — Languages: Python, C, Rust; Frameworks/Libraries: Scapy, boofuzz, Kaitai Struct, construct; Security Tools: Wireshark, Ghidra, radare2/rizin, gdb+pwndbg, AFL++/libFuzzer; Cloud/Infra: isolated lab, QEMU for firmware; AI/Data: crash triage analytics; Databases: SQLite (crash corpus)

**Where it's valued** — ICS/OT, IoT manufacturers, defense, telecom, gaming, fintech messaging, embedded/product security

**Careers it builds toward** — Vulnerability Researcher, Exploit Developer, Reverse Engineer, Product Security Engineer, ICS/OT Security Researcher

**Framework alignment**
• MITRE ATT&CK: Exploitation of Remote Services (T1210), Network Sniffing (T1040), Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095); ICS: Unauthorized Command Message (T0855), Replay (T0856)
• NIST CSF 2.0: Identify (ID.RA, ID.AM), Protect (PR.DS, PR.PS), Detect (DE.CM)
• OWASP: N/A (non-web binary protocol); relates to input-validation principles
• CIS Controls v8: 4 Secure Configuration, 13 Network Monitoring, 16 Application Software Security