/ cyber security & development
Cybersecurity student & developer building secure systems and exploring new technologies.
I'm a fourth-year Information Security student passionate about cybersecurity, system administration and backend development. I like building things that are reliable, secure and useful.
— unicorn
More about meQuick facts
Education
4th year, Information Security
Focus
Security & Development
Location
Chelyabinsk, Russia
Availability
Open to internship
What I work with
Security
Development
Infrastructure
Networks
I got into computers early and never really stopped — first taking them apart and fixing them, then writing software, then learning how both of those break. Today I'm a fourth-year Information Security student in Chelyabinsk, and most of my time goes to two things I genuinely run myself.
One half is building. I keep two products in production — an AI platform and a licensed security product — and I own the whole technical side, from the backend and the servers to the desktop client and the release pipeline. The other half is breaking: I audit my own systems, work out how they'd be attacked, and keep the edge sharp on pentest labs and vulnerable machines. I don't think you've really secured something until you've tried to break it yourself.
Along the way I started a small web studio, led a dev team and worked the floor as a club administrator — so I know infrastructure from the terminal and from the moment a real person in front of me just needs it to work. I like making things that are reliable, clear and a little bit hand-made. This whole site — and this portrait — were put together by hand.
He knows everything on this site: projects, experience, badges and encyclopedia articles. Ask in your own words — the dotted face will show how he took it.
What I actually use, grouped the way I think about it. Everything here has been through a real project — a product in production, a test stand or a machine taken apart.
127.0.0.1:443def main():root@kali:~#systemctl statusgit log --onelineru · enThe tools I reach for, by stage of the work. Five sets, switched like tabs in a terminal — official project marks throughout.
nmap
masscan
Maltego
SpiderFoot
enum4linux
Burp Suite
sqlmap
ffuf
gobuster
nikto
dirb
wpscan
hashcat
John the Ripper
hydra
impacket
responder
Wireshark
tcpdump
netcat
aircrack-ng
Metasploit
exploitdb
SET
radare2
binwalkTwo products run in production for real users. The rest are stands and write-ups, built to check solutions by hand rather than by description.
AI platform
Co-owner, lead developer and cybersecurity specialist
The first officially registered AI aggregator in Russia. Access to neural networks without a VPN: chat, image and video generation, AI agents, card payments.
React
TypeScript
FastAPI
Cloudflare$ curl -sI https://asterio-ai.com | head -1
HTTP/2 200
# bundle 977 KB → 276 KB after code splitting
Network protection for gaming clubs
Co-owner. Client and server development, security, legal perimeter
The guest presses one button and a tunnel to the game node comes up. The venue's own local networks are never touched.
Rust
TauriAmneziaWGWindows$ vantage status
tunnel up 82 ms 0.0% loss
routes split club network untouched
# a club machine is always treated as untrusted
Open-source plugin for Claude Code
A senior cybersecurity specialist that lives inside Claude Code — authorization-gated, grounded in real CVE/ATT&CK data, teaches from zero. 29 skills, 6 expert personas, MIT.
MarkdownYAML
Python
Open-source plugin for Claude Code
A senior DevOps / SRE / platform engineer inside Claude Code — CI/CD, Kubernetes, IaC, delivery, observability and incident response. Gated before any change, grounded in official docs. 28 skills, 5 expert personas, MIT.
MarkdownJSONPython
Open-source plugin for Claude Code
A senior designer inside Claude Code — colour, type, layout, UI, motion, 3D and brand. Distinctive by default instead of AI templates, grounded in real references, ships real front-end. 24 skills, 6 expert personas, MIT.
MarkdownJSONPython
A pocket router nothing leaks past
A pocket router hides all traffic from the attached device in an obfuscated tunnel and lets nothing leak past it. The uplink is a phone over USB; there is deliberately no SIM in the router.
OpenWrtAmneziaWGnftablesCudy TR3000
A hardened, isolated Windows 10 in VirtualBox
All DNS is forced through Cloudflare DoH, plain DNS is blocked, host-to-guest channels are closed. Threat model, deployment scripts, isolation checks.
VirtualBoxPowerShellcloudflaredWindows
The expensive hypothesis was wrong; the cheap check was right
A local model running as an agent in opencode produced 1 token per second. Trying different quantisations changed nothing: the system had no NVIDIA driver and the GPU was computing through Vulkan. After the driver — 16 tokens per second and working tool-calling.
OllamaopencodeCUDAPython
Web pentest training stand
A deliberately vulnerable login form and, in the same folder, the fixed version next to it. You see both the SQL injection itself and what cures it.
Python
Flask
SQLite
Password strength analysis
A scoring model, a check against a dictionary of common passwords, and a generator built on secrets. Web interface, computed on the server.
PythonFlask
Write-ups from reconnaissance to root
Vulnerable machines taken apart end to end: Mr Robot, Kevgir, Empire LupinOne. Full attack chains with the commands. The stand is nested QEMU/KVM virtualisation on an isolated network.
nmapffufMetasploitJohn
This site, built from scratch
The portfolio you're reading. English by default with an instant switch to Russian and no reload, a pre-entry sequence, a hand-cut mascot, one flowing story on Next.js 16.
Next.jsReactTypeScript
Tailwind
MotionGSAPLenisReact Three Fiber2026 — present
One of two developers behind the AI platform: I lead the site, the REST API and the server side — FastAPI under Uvicorn in Docker, PostgreSQL behind a connection pool, Redis, Nginx with Let's Encrypt, a three-contour production topology, zero-downtime deploy with rollback. In active development.
2025 — present
Client and server side of a network-protection product for gaming clubs. It runs in the Colizeum club network — that's where the collaboration with Colizeum is now: three clubs, 127 machines, nodes in Frankfurt.
2025 — 2026
My own startup: a small website studio built on one principle — a direct line to the developer, service and unusual projects, run by a close and trusted team. The foundation was ready, but as students with no funding I couldn't carry it then. Good experience and an honest conclusion.
2025 — 2026
Ran the club and its machines at a high service bar: client support, diagnostics and repair, workstation setup and optimization. Now in the staff reserve, covering shifts when needed. This is where the trust that turned into the VANTAGE collaboration was earned.
2025
Ran the floor of a gaming club: guests and bookings, the till and attendance, workstation setup and first-line troubleshooting.
2023 — 2025
Led web development for about two years: site architecture and client solutions, requirements gathering, coordinating the team and setting standards, a knowledge base and onboarding.
2023 — 2027
Comprehensive information security of automated systems. Fourth year now, graduating 2027 — I try to take not only the curriculum but the practice too: solving machines, building stands, reading other people's write-ups.
2025 — 2026
Penetration testing, system administration, information-security basics, Python and C# development, GameDev — the college's hands-on courses alongside the main track.
2025 — present
TryHackMe and Hack The Box, red team and blue team. Pentesting pulls me in the most: you see straight away whether the reasoning holds.
2021
Web and app development, Python, C++ and C#, service testing, information security, GameDev and UX/UI design — where the breadth started.
Verified courses and certifications. Click any one to see the certificate itself.
badges and certificates
each links to its source
what matters to an employer
Candidate status with ISC2 — the body behind CISSP and CC. It's a membership, not an exam.
Verify ↗
Cisco Networking Academy foundation course, verified on Credly.
Verify ↗
Google Cloud Skill Badge, Intermediate — hands-on in a live cloud.
Verify ↗all badges and certificates
1–8 of 32 · p. 1/4
Practise, explore, break, learn. Machines taken apart from reconnaissance to root, on my own stand.
Reconnaissance, SSH brute force with Hydra, cracking an encrypted RSA key in John, privilege escalation through a careless sudo rule (vim from GTFOBins).
Exploiting CVE-2007-2447 in Samba 3.0.20: command injection through username map script gives a root shell straight away, with no escalation step.
Brute-forcing the WordPress admin password, a PHP reverse shell through the theme editor, root through SUID on nmap in --interactive mode.
Joomla with CVE-2008-3681, a meterpreter session, escalation through SUID on cp: it is used to overwrite /etc/passwd. The path is www-data to root.
Hidden paths through ffuf, Base58, cracking an SSH key, overwriting webbrowser.py and sudo pip. The path is icex64 to arsene to root.
TryHackMeLearning offensive security on TryHackMe as @unicorn224. Below are the rooms I've completed and the badges they earned — the theory behind them lives in the encyclopedia.
Completed rooms
The OSI and TCP/IP models, encapsulation, and the first recon commands — ping, traceroute, whois, dig.
TheoryDomain hierarchy, the main record types (A, MX, NS, TXT…) and the full path of a DNS query.
TheoryRequests and responses, methods, status codes, headers, and how cookies keep a session.
TheoryThe terminal: moving around, reading files, searching, and chaining commands with operators.
TheoryHow Windows is built inside: NTFS and ACLs, System32, account types and SYSTEM, UAC.
TheoryA first taste of offensive security — content discovery and directory brute-forcing on a target.
TheoryBadges earned
Webbed31.8% rarity
3 Day Streak15.4% rarity
Mr. Robot5% rarity
Hash Cracker8.5% rarity
Ice3.1% rarity
7 Day Streak26.1% rarity
First Mobile Quiz2.2% rarity
Logging Legend1.6% rarity
Terminated!0.7% rarityrarestThe theory behind these rooms — networking, Linux, Windows, tools.
Open the encyclopedia
AnthropicAcademyThe other side of my learning — courses from Anthropic, the makers of Claude, on how generative models really behave. Where TryHackMe is hands-on hacking, this track is understanding the machine. Every course earns a verified badge.
14courses142lessons~41hours14verifiable badges
Click the top badge or use the arrows to flip through the deck.
13 lessons·≈ 3.5 h·badge issued Sep 12, 2026
A working mental model of how generative AI behaves and why — so an unexpected answer reads as a known kind of error with a precise fix, not a mystery.
The mental model it gives you
Google CloudSkills BoostA third learning track — a Google Cloud skill badge earned hands-on in a live cloud environment. Where TryHackMe is offensive and Anthropic Academy is the machine, this one is defending real infrastructure.
Issued September 14, 2026
Hands-on in a live environment: using Security Command Center to find, prioritise and fix misconfigurations, vulnerabilities and active threats across cloud assets.
Verify badgePlaces where I gained experience and made an impact.
2025 — 2026A chain of gaming clubs
Administrator, now in the staff reserve; and the network-protection client (VANTAGE) runs in their venues.
2025 — 2026A website development startup
Development and markup, SEO, working with clients.
2025A gaming club
Running the floor, maintaining machines and consoles.
2023 — 2025A small web studio
Markup and website development, animation, SEO.
2022 — 2023A large internet provider
Call centre: selling the company's services from a cold list.
13 public repos · ★ 6 · 1 followers
Test stands and write-ups with the sources. Some work is closed — for that, see the projects above.
Open the profileA fourth-year information-security student already running two products in production. I want a place where I can apply what I know, be useful to a team and grow under people stronger than me. Areas that interest me most:
Cybersecurity
Pentesting, network security, threat modelling, hardening and isolation — checked by hand on my own stands and machines.
AI & backend
Working with LLMs and agents, and the server side around them: FastAPI, PostgreSQL, Redis, queues, payment and legal perimeters — the way Asterio is built.
Infrastructure & DevOps
Linux, Docker, Nginx, Cloudflare, CI, zero-downtime deploy, monitoring and incident response. Servers that stay up under load.
Networks & VPN
Tunnels and obfuscation (WireGuard, AmneziaWG), split routing, DNS, firewalls — from the VANTAGE client and the TR3000 stand.
Verified ranks, course badges and certifications, my résumé on Habr Career and Setka — and direct ways to reach me. Every account, one click away.
Open to offers in information security and development. Reach me whichever way suits you — I answer within the day.
