github mail
~/hamza workspace 1
Hyderabad, India · UTC+5:30

Hamza Jeelani

I take things apart to see why they work.

Security student in Hyderabad. Lately that means benchmarking whether LLM agents can find attack paths a human would, teaching a camera to aim a turret, and reading my own brainwaves off an Arduino. Every one of them started as a question I couldn't look up.

email me github ↗ download cv
[2]

Things I built to answer a question

Ariadne ★ 9
// flagship — research

Ariadne

Can an LLM agent trace an Active Directory attack path to Domain Admin on its own — and how does it compare to BloodHound? I built the benchmark to find out. Synthetic domains generated straight into the BloodHound Neo4j schema, a ReAct agent hunting paths, and a scorer that checks every claim against ground truth.

It finds paths BloodHound structurally can't — kerberoasting, delegation flaws, credentials sitting in a description field — because those live in node properties, not graph edges.

83.8% correctness 0 hallucinated edges 1/17th cost on mini
pythonneo4jllm agentsbloodhound
source ↗
DART ★ 4

DART

An autonomous pan-tilt turret. YOLOv8 finds people, ByteTrack keeps their identity, InsightFace decides who's authorised — and only unauthorised targets get a lock. PID servo control streams to an Arduino at 30 Hz.

opencvyolov8arduino
source ↗
flowstate ★ 3

FlowState

Real-time focus tracking off an EEG sensor on your forehead. A BioAmp pill into an Arduino at 500 Hz, my own NumPy logistic regression trained on my brain, and a buzzer that catches me zoning out.

eegnumpyflask
source ↗
Argus ★ 1

Argus

A defensive OSINT auditor: it shows you exactly what an attacker could find about an identity you can prove you own. GitHub OAuth and DNS challenges gate every scan; nothing is ever persisted.

fastapireactosint
source ↗
esp_chatroom ★ 5

ESP32 Chatroom

An entire offline chat room living on one ESP32 — access point, DNS, web server and ring-buffer storage in a single sketch. Connect and the captive portal drops you straight into the room. No internet involved.

esp32c++captive portal
source ↗
scanix-food ★ 2

Scanix

Point a camera at a packaged-food label and it reads it the way an inspector, a lab and a nutritionist would — OCR, ingredient risk profiling, FSSAI compliance and counterfeit checks into one verdict.

fastapiocrnext.js
source ↗
spotify-playlist-download ★ 12

Playlist Downloader

My most-starred repo, and it started as pure selfishness: I wanted my playlists offline. Pulls whole playlists with metadata intact and survives rate limiting with retry and backoff.

pythonweb apis
source ↗

# six more live at github.com/Crepco — steganography, a local password vault, a vocal isolator.

[3]

The short version

about.md

I started with Python because I was lazy in the right way — automating anything I didn't want to do twice. Somewhere along the line I realised breaking software teaches you more about it than building it, and that detour became the whole road.

Most of what I make starts as a personal itch: playlists I wanted offline, credentials I didn't want in someone's cloud, a desktop that had to look exactly right. The itches got bigger. Now they look like "nobody has actually measured whether an LLM can do this", and I spend a month building the benchmark to find out.

"Read the source. Understand the system. Own your stack."
right now
  • LLM agents + security — can they reason about attack graphs?
  • Active Directory — BloodHound, kerberoasting, delegation
  • Computer vision — detection, tracking, embeddings on live video
  • Web exploitation — OWASP Top 10, Burp workflows
  • CTFs — grinding boxes on TryHackMe & HackTheBox
  • Embedded systems — Arduino, ESP32, UART/I2C, a soldering iron
[4]

Daily drivers

pacman -Qs lang
local/python3.13# daily driver
local/javascriptes2024
local/bash5.2
local/sqlmysql
local/html-csshandwritten
pacman -Qs sec
local/burpsuite# web
local/bloodhound# ad graphs
local/nmap7.95
local/wireshark# packets
local/metasploit
local/sqlmap · gobuster
pacman -Qs env
local/archrolling# btw
local/neo4j5.x# graphs
local/opencv · ultralytics
local/fastapi · react
local/hyprland · neovim
local/git · mysql · node

# honesty clause: python and linux are daily use — everything else depends on the box in front of me.

[5]

Now breaking hardware too

scope — ch1 1V/div · 2ms/div
ƒ 1.00kHz · 3.30Vpp · TRIG'D
i2cdetect -y 1
0x3c ssd1306 oled · 0x68 mpu6050 imu
pacman -Qs embedded
local/arduino-cli1.3# uno + nano
local/esp-idf# wifi goes brr
local/platformio
local/kicad9.0# traces
local/avrdude · minicom
learning.md
  • GPIO + interrupts — buttons that don't bounce (eventually)
  • UART · I2C · SPI — making chips talk to each other
  • Soldering — joints improving, burns healing
  • Datasheets — reading them like novels now

# status: one board bricked so far, then resurrected. the magic smoke stays inside *most* days.

[6]

Say hello

~/inbox workspace 6

Mail is fastest. Always reading.

Open to security research, anything involving agents and attack graphs, collaborating on tools, or arguing about window managers. If you've read this far — or found the flag — we probably have something to talk about.

hamza0jeelani@gmail.com github.com/Crepco ↗ download cv