Inspectable software builds, defensive security controls, OSINT utilities, and full-stack tools. Every project is labeled with its exact evidence state.
MultiHAT Academy is a full-stack e-learning platform that turns technical notebooks into premium, verifiable micro-credentials. Built with Next.js 15 and NestJS 11, it features dynamic watermarked e-books, interactive quizzes, public certificates, a built-in Wallet, referral rewards, and native aamarPay integration for seamless local payments.
A premium, high-performance static marketing website for Sydney Wheels & Tyres. Built with Next.js, TypeScript, and Tailwind v4, it features immersive UI animations, 3D tilt cards, automated sitemaps, and rich local business schema. Designed to maximize SEO discoverability, showcase auto services, and drive customer bookings in Campbellfield.
Software, AI & security engineering studio: MultiHAT.dev is a digital agency for custom website and software development, integrations, upgrades, and maintenance. Builds are matched to the right architecture; upgrades are scoped and quoted before work begins; maintenance plans are tiered by support needs. Explore web, desktop, AI, privacy, and cybersecurity projects, demos, and case studies.
Privacy-first static developer and cybersecurity portfolio for Sagar Biswas (MultiHAT). Fast, SEO-friendly GitHub Pages hub showcasing operations, tutorials, and technical write-ups, featuring RSS/Atom feeds, XML sitemaps, responsive design, and automated verification suites.
Passive Attack Surface Toolkit: Module-based passive OSINT recon for web domains. Runs non-destructive subdomain/DNS/WHOIS/SSL/header/wayback/tech discovery, maps depth-1 surface, computes a 0-100 exposure score, and emits presentation-ready HTML, JSON, Markdown and an interactive graph.
A modular, passive reconnaissance CLI that inspects emails, domains, and usernames for leaks and misconfigurations. Generates interactive HTML, JSON and Markdown reports and a visual exposure graph. Includes GitHub secret scans, HIBP/LeakCheck support, Shodan, Google dorks, JS and metadata scanning.
A privacy-first phone-number OSINT toolkit (CLI + minimal GUI). Parses and normalizes numbers (E.164), enriches with deterministic metadata, runs optional async adapters (DuckDuckGo, Google, public datasets), computes explainable risk scores and owner intelligence, and exports JSON/CSV/PDF reports.
A lightweight, offline-capable voice assistant that listens for a wake phrase, converts speech to text, runs local or API-based intent handling, and replies with natural-sounding TTS. Built for quick local deployment, it supports configurable wake words, microphone I/O, and easy integration with custom actions or LLMs.
A local Python desktop assistant (Tkinter) that runs Groq AI queries, maps natural commands to quick web actions (Google, YouTube, GitHub), and persists session history. Lightweight, customizable GUI, easy to extend with new shortcuts and offline session recall for fast personal workflows.
Sagar is a Python-based command-line virtual assistant for CSE students and cybersecurity learners. It supports single-line and multi-line commands to open trusted websites, play curated music links, and answer questions using an AI model; designed for safe automation, learning, and terminal-first exploration.
PoliteWebScanner is a learning-grade web vulnerability scanner plus AI-assisted report viewer. It crawls safely (queue-based, robots-aware, rate-limited), detects common issues (security headers, cookie flags, reflected XSS heuristics, SQL error patterns), and exports human-friendly JSON/HTML reports with optional AI help for triage and remediation
A secure, production-ready Python CLI wrapper for Nmap that makes powerful scans easy and repeatable. Includes 12 built-in profiles (SYN, aggressive, OS detection, vulnerability/NSE checks), interactive and non-interactive modes, strict input validation, Docker support, CI, and script-friendly flags for automation.
Production-grade Linux MAC address manager. Safely randomize, spoof, and restore network interface MACs with automatic hardware backups, RFC-compliant LAA generation, strict validation, and zero-loss instant rollback. Built with typed Python, modern iproute2, and full CI test coverage.
BazaarFlow is a production-ready full-stack e-commerce monorepo with a Next.js storefront and admin panel, NestJS API, product catalog, cart, checkout, orders, coupons, inventory, analytics, reviews, Stripe and bKash payments, Meilisearch search, Supabase storage, Redis caching, and Brevo emails.
Federation AUS, enterprise ASP.NET Core 8 & SQL Server EMR simulation platform built for clinical education. Features 14+ hospital modules: ADDS deterioration alerts, GCS Neurological, Braden & Fall Risk scoring, Regular/PRN MAR, IV & Fluid Balance, Food Intake, Victorian Maternity Record (VMR), RISKMAN OHS incident reports & supervisor lab resets
C++ console application that converts images into detailed ASCII art by mapping pixel brightness and local shapes to characters. Supports gamma correction, filtering, multi-region shape matching, randomness, and multithreading. Designed for Windows terminals with raster fonts (8×12) for best visual results.
Email Harvester; a production-ready CLI that finds publicly visible business emails from category keywords. Pluggable search backends (SerpApi, Bing, DuckDuckGo), robots-aware crawling, contact/link traversal, MX + optional Hunter.io verification, deterministic scoring, CSV outputs, CI-tested and extensible for lead-gen workflows.
WebSource Harvester is an educational web-source harvester that crawls a site (BFS, depth-controlled), downloads browser-visible assets (HTML, CSS, JS, images, fonts, PDFs), and rewrites paths so pages work offline, including nested routes. It enforces same-origin limits and is designed for learning, offline analysis, and safe portfolio demos.
HashAttackDemos; an educational Python toolkit demonstrating secure password hashing (Argon2id, bcrypt, scrypt) and common failure modes (MD5, rainbow tables). Includes reusable library hash_password_cracker, attack demos (dictionary/rainbow/hybrid), CLI tools, and unit tests - for defensive learning on data you own or are authorized to test.
WiFi Dictionary Attack is a compact, Python-based Wi-Fi security testing script. It scans nearby networks, targets a specified SSID, loads a password wordlist from passwords.txt, attempts WPA/WPA2 connections using pywifi, and reports successes or failures. For authorized, educational security audits only.
Lightweight Python keylogger featuring real-time keystroke interception, instant file backup, and automated SMTP email dispatch with 3x retry logic. Includes ESC-key log sanitization and dual OS autostart persistence guides for Linux systemd and Windows.
A Python script demonstrating automated email sending via Gmail SMTP for educational and testing purposes. Supports email format validation, secure password input using getpass, HTML-formatted messages, and controlled loop-based delivery with delays. Intended to teach SMTP authentication and email automation; not for spamming or abuse.
The private, offline-first prompt manager for AI Agent power users. Features AES-256 encrypted local storage, a built-in AI Librarian to evaluate & refine prompts with Gemini & Groq fallback, dynamic {{variable}} templates, Supabase cloud sync, analytics, and instant ⌘K search.
PhishGuard is a fast-paced web game that trains your instincts against email phishing. Powered by a Dual-AI Consensus Engine (OpenRouter & Groq), it generates and verifies highly realistic, unique phishing scenarios in real-time. Can you spot the scam before the 10-second timer runs out?
A local-first Flask web app that analyzes PDF/DOCX resumes using a Groq/OpenAI-compatible LLM. Extracts text, returns structured feedback with ratings, keyword gaps, prioritized fixes, and rewrite examples, and renders results in a clean UI with copy/download tools. Designed for fast, actionable resume improvements.
Automates chat replies for Messenger and WhatsApp using PyAutoGUI for UI actions, Pyperclip for clipboard capture, and Groq for AI responses. Cycles configured chat positions, skips replying to your own messages, supports dry-run and logging, and includes cursor tools and easy config for fast testing and demos. Ideal for portfolio demos & research.
A clean Flask-based URL shortener that converts long links into short, shareable URLs with optional custom aliases, expiration support, and TinyURL mirroring. Uses SQLite for persistence, includes copy helpers, rate limiting, and a simple REST API. Ideal for learning backend fundamentals and deployment.
An educational phishing simulation login page demonstrating how fake UIs capture user credentials. It logs inputs, stores them locally, and emails the captured data for awareness training. Intended strictly for controlled, ethical use to teach URL verification and phishing prevention.
A beginner-friendly Node/Express + Vanilla JS authentication demo that implements a complete sign-up/sign-in lifecycle: email verification (4-digit OTP), optional 2FA (email OTP, TOTP authenticator, backup codes), password reset, account settings, session handling, and deploy-ready email fallback (Brevo → SMTP → debug).
Local PHP/MySQL e-wallet application combined with a hands-on cybersecurity demo lab. Implements user/admin auth, balances, transfers, CSRF protection, session timeouts, login lockout, and hashing. Includes a toggleable Vulnerable/Secure lab to demonstrate XSS and session hijacking with real code and mitigations.
A polished, accessible client-side password strength checker that estimates entropy, detects weak patterns, and provides actionable suggestions. Includes a built-in password generator, works fully offline with no network calls, and uses ARIA live updates for accessibility. Ideal for demos, portfolios, or frontend components.
Behavioral Fingerprinting-Augmented Embedded IDS on Raspberry Pi 4 + ESP32. Detects zero-day attacks by learning per-device traffic profiles using Isolation Forest; no signatures needed. Features distributed MQTT nodes, real-time Flask dashboard, iptables auto-blocking, and GPIO alerts.
TCP-Playground; A simple multi-client TCP, compact, cross-platform Python multi-client chat toolkit for learning and LAN testing. Includes host.py (server), clint.py (client), and net_utils.py utilities; supports optional TLS with password-protected message encryption, CLI flags for scripted use, and unit tests for core validation.
A production-quality C++17 command-line tool that captures customer details, computes discounts and totals, prints a clean receipt, and atomically persists records to CSV and JSONL. Cross-platform CMake build, unit tests, and export utilities make it durable, scriptable, and POS-friendly.
Photo PDF Bidirectional Converter is a lightweight Windows converter that turns photos into high-quality PDFs and extracts PDF pages to images. It preserves EXIF rotation, supports multi-page or per-photo PDFs, offers DPI/format/embedding controls (jpeg_high, keep_original, lossless_png), and prefers img2pdf for best fidelity. Runs locally.
Library Management System is a compact desktop library-management app built with Python and Tkinter. It supports admin and member workflows, two-step sign-in (password + TOTP), book lending/returns, overdue tracking, CSV/JSON import-export, and simple analytics. Data is saved locally and designed for learning, small libraries, and safe offline use.
PyTextEditor; a modern, cross-platform Tkinter text editor focused on safety and productivity. Atomic Save/Save As, BOM-aware encoding detection with explicit encoding choice, autosave with on-launch recovery, regex Find & Replace, undo/redo, recent files, light/dark themes, font & autosave preferences, and a CLI/packaging entrypoint.
SafeTodoManager; an offline-first, production-ready Python To-Do manager with a polished Tkinter UI, keyboard shortcuts, and flexible storage backends (filesystem, SQLite, optional encrypted files). Provides atomic saves, rotating backups/logs, headless CLI for export/backup, packaging (wheel/PyInstaller), and complete dev/test tooling.
Production-grade C11 contact manager: a single portable binary with SQLite storage, Argon2id password hashing, interactive keyboard menu and full non-interactive CLI. Features CSV import/export with transactional dry-run, JSON output for scripting, backups, and unit/integration tests for reliable automation.
PyCalculator; A secure, beginner-friendly Python scientific calculator with a modern Tkinter GUI and an AST-based evaluator (no raw eval). Supports arithmetic, %, ^ → **, sqrt, log, and degree-based trig (sin/cos/tan). Keyboard-friendly, unit-tested with pytest and CI-ready.
Beginner-friendly, notebook-style guide to installing WSL2, Kali Linux, and Win-KeX GUI on Windows. Covers prerequisites, GPU support, command walkthroughs, installer prompt decisions, and real-world error recovery for a stable Kali-on-WSL setup.
Open-source research hub featuring data-backed social timing analytics (BST), a 5-phase SWE & cybersecurity career roadmap (2026-2030), and the PRISM study system for CSE students. Covers web security, bug bounty, AI engineering, system design, and daily focus protocols.
infosec-vocabulary is a bilingual (English ↔ Bangla) cybersecurity glossary with concise definitions, synonyms, real-world examples, and short educational notes for each term. Alphabetized and workshop-friendly, it's ideal for learners, translators, SOC trainees, and security educators; docs-ready and GitHub Pages compatible.
Educational security research notes documenting USB HID (BadUSB/Rubber Ducky) concepts from a defensive perspective. The repository preserves historical filenames while emphasizing detection, prevention, user awareness, and ethical lab use. No payloads, automation scripts, or actionable exploits are provided.
A safe, browser-based brute-force simulator for defensive learning. Configure PIN length and charset, set rate limits, captcha penalties, lockout thresholds, and jitter; then watch live attempts/sec, ETA, entropy, and a visual chart. Export JSON reports or test a local API. Pure front-end demo for teaching infosec and defenses.
BruteforceLab2 is a self-contained, hands-on web security lab that demonstrates credential brute-force attacks and basic defenses. It includes a Flask login app, a CLI attacker simulator, optional in-memory rate limiting and lockout, automated tests and CI, and configuration knobs (rate window/max, enforce regex). Run locally to observe attacks, to
TextBombing-Toolkit; a small, cross-platform Python utility for responsibly automating repeated keystrokes or clipboard pastes. Supports interactive and CLI modes, dry-run verification, clipboard paste for long messages, confirm + countdown, robust input validation, and PyAutoGUI failsafe (move mouse to top-left to abort).
virusNewFolder; A safe, cross-platform CLI that creates predictable, persistent directories inside your OS temporary folder for demos, tests, and automation. Supports create/detect/cleanup, --dry-run, --overwrite/--yes, customizable prefixes/instances, startup automation helpers, clear logging, and unit tests.
WinTempCleaner is a lightweight batch utility that instantly clears common temp locations %TEMP%, %WINDIR%\Temp, %USERPROFILE%\AppData\Local\Temp, Prefetch. Interactive confirmation, forces read-only deletions, suppresses noisy errors and shows a visual progress color. Run as Administrator to clean system folders; files only, directories preserved.
Recover saved Windows Wi-Fi profiles safely and locally. This admin-focused CLI enumerates saved profiles, requests typed explicit consent before revealing keys, supports masked display, encrypted exports, dry-run and locale-aware parsing of netsh output. No telemetry; local-only, audit-friendly, and safe-by-default.
Generate Wi-Fi QR codes instantly in your browser, no backend required. Supports WPA/WPA2, WEP, and open networks; hidden SSIDs; adjustable size and error correction; export PNG or SVG; copy raw Wi-Fi payload; offline-friendly (local QR lib). Privacy-first: nothing leaves your device.
Minimal PHP MVC learning project demonstrating the Model–View–Controller pattern end-to-end. Uses plain PHP with PDO, a front controller, simple routing, and CRUD student management. Designed to teach separation of concerns, prepared statements, and typical MVC structure without frameworks.
Resolve domains, URLs, and IP literals to IPv4/IPv6 addresses with a production-ready CLI and library-safe API. Supports IDNs, URL inputs, concurrent lookups, JSON output, optional dnspython timeouts, and file/bulk mode; ideal for network tooling, automation, and reproducible tests.
PyAlarmClock; a focused, testable Python CLI alarm that accepts HH:MM:SS AM/PM input, displays a live time table while waiting, and plays a sound (default alarm.mp3). Windows uses MCI/wave playback; other platforms fall back to a console beep. Supports one-shot or repeating rings and includes pytest tests.
SecureBankingSystem - is a desktop bankAccount manager built with Python and Tkinter, using SQLite for persistence and Argon2id for secure password/PIN hashing. It supports admin/customer workflows, account creation, deposits/withdrawals, PIN changes, and transaction history-designed for learning secure app patterns and prototyping fintech features
SecureBank-CLI; A compact C++17 command-line banking simulator demonstrating secure credential handling, atomic JSON/JSONL persistence, audited transactions, and safe defaults (no overdrafts). Includes CMake builds, unit tests, sanitizers, admin tools, and Docker support - ideal for learning secure systems design and test-driven C++ workflows.
This project is a Python-based port scanner designed for educational purposes. It allows users to scan open TCP ports on a target machine. The tool can be used via a command-line interface or a web-based GUI built with Flask.
A client-side web security tool that sanitizes potentially malicious HTML and JavaScript input by stripping unsafe tags and event attributes. Designed to demonstrate XSS prevention concepts, safe input handling, and frontend security practices using pure HTML, CSS, and JavaScript in a beginner-friendly interface.
Python Selenium project that launches Firefox, opens Google, submits a search query, and displays results. Great for learning browser automation end-to-end, with clear setup/run steps and an ethical roadmap to migrate toward Google Custom Search JSON API for legal, CAPTCHA-safe, production-friendly search workflows.
All code repositories are intended solely for educational research, security testing, and defensive learning.
Visit GitHub Profile (@SagarBiswas-MultiHAT) →