Skip to content
View mandoof1's full-sized avatar

Block or report mandoof1

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
mandoof1/README.md
Hadi Abdulrahman — I build systems that investigate. Cybersecurity engineering student working on honeypots, security models, and AI infrastructure.

Flagship work   /   Research   /   Get in touch

I'm Hadi, a cybersecurity engineering student working where security, machine learning, and systems engineering meet. I build the full path: capture attacker behavior, analyze the evidence, and give an investigator something useful to work with.

Open to cybersecurity internships and entry-level roles. My projects are open source, designed for research and authorized testing, and built to run on infrastructure I control.

Flagship work

HoneySentinel AI. Five-protocol honeypot platform: capture interactions, analyze them with local classifiers and models, then investigate transcripts, ATT&CK techniques, and indicators. Open repository.

HoneySentinel AI captures attacker interactions across SSH, Telnet, FTP, HTTP, and HTTPS and turns them into encrypted evidence. Its investigation workspace brings together session transcripts, ATT&CK mappings, indicators, and exports for downstream tools.

The self-hosted deployment blocks outbound traffic from the honeypot engine and separates ingestion from the API. Wolfram enriches captured transcripts through local inference.

Explore the system →   ·   Architecture & deployment   ·   Evaluation & measurements


Wolfram — the final evolution of Chimera. A MiMo 9B based security model, fine-tuned with QLoRA and deployed locally through llama.cpp. Transforms honeypot transcripts into structured intent, ATT&CK techniques, and indicators. Open repository.

Wolfram is the final evolution of my Chimera project. Built on MiMo-V2.6-Distill-Qwen-9B, it is fine-tuned for security analysis: what an attacker intended, which objectives and ATT&CK techniques the commands support, and which indicators appear in the transcript.

The project covers fine-tuning, evaluation, GGUF deployment, and local integration with HoneySentinel. The application validates technique IDs and checks extracted indicators against captured transcripts.

Explore Wolfram →   ·   See the integration

Research and infrastructure

Amnis — persistent memory for AI agents. Hybrid semantic and keyword retrieval, wiki compilation, a knowledge graph, and an MCP server. Open repository. Aegis — prompt-injection and tool-abuse benchmarking for agents. Measures attack success and useful task completion across defense layers, with an offline simulation and real-model adapter. Open repository. Abliteration — model internals research for hybrid-attention architectures. Extracts response-region directions, applies training-free weight edits, and evaluates behavior and capability. Open repository.

Across the stack

Systems & security — Python · Go · C/C++ · Linux · Docker · Protocol emulation · MITRE ATT&CK
Models & agents — PyTorch · Transformers · QLoRA · llama.cpp · Hybrid RAG · MCP
Applications & data — TypeScript · React · FastAPI · PostgreSQL · Redis · SQLite


Let's build something worth investigating. Email haadii2005@gmail.com. Open to internships and entry-level roles.

Pinned Loading

  1. honeypot-ui honeypot-ui Public

    AI-assisted honeypot and investigation workspace: SSH/Telnet/FTP/HTTP(S) emulation, encrypted session evidence, ATT&CK mapping, a decoy-website diversion, and a fully local analysis pipeline — Rand…

    Python 1

  2. amnis amnis Public

    ☀️ Persistent Memory + RAG + Wiki Compilation for AI Agents — MCP server + Web UI with interactive knowledge graph

    Python 1

  3. chimera-14b-v2 chimera-14b-v2 Public

    Chimera-14B-v2 — cybersecurity reasoning LoRA for Ministral 3 14B (blue-team analysis, ATT&CK-aware). Companion repo to Flexingmeow/Chimera-14B-v2 on Hugging Face.

    2

  4. abliteration abliteration Public

    Post-hoc refusal ablation ("abliteration") for qwen3_5 hybrid-attention models — the architecture TransformerLens-based tools cannot load. Training-free weight edit: refusal 78.1% -> 9.4%, capabili…

    Python 1

  5. agent-chat agent-chat Public

    Local multi-agent chat harness for OpenAI-compatible servers (llama.cpp, Ollama, ...): agents that delegate to and question each other, a shared memory, email + calendar + browser agents, scheduled…

    Python 1

  6. wolfram wolfram Public

    Wolfram — a local 9B cyber-SME analysis model for the HoneySentinel honeypot. MiMo-9B cyber QLoRA + abliteration, quantized to GGUF for CPU. ATT&CK technique F1 0.15→0.90, refusals→0%. Weights on H…

    1