Harvester ZeroGPU runner — full upload

app.py

@@ -52,6 +52,7 @@ TASK_BANKS = {
     "maslow_hierarchy_tasks.json":    "Maslow's Hierarchy & Human Motivation (15 tasks) → Qwen Coder",
     "family_dynamics_tasks.json":     "Family Dynamics & Human Bonds (15 tasks) → Qwen Coder",
     "cognitive_architecture_tasks.json": "Cognitive Architecture & HCI (15 tasks) → Qwen Coder",
+    "cybersecurity_defense_tasks.json": "Cybersecurity Defense & Self-Protection (15 tasks) → Qwen Coder",
 }
 
 

cybersecurity_defense_tasks.json

@@ -0,0 +1,141 @@
+{
+  "bank_name": "cybersecurity_defense",
+  "description": "Defensive cybersecurity — understanding attacker tools and methodology for self-protection. Based on Kali Linux toolkit categories. Every task is framed as defense, detection, or analysis — never offensive exploitation.",
+  "tasks": [
+    {
+      "id": "cyber_defense_01",
+      "title": "Port Scan Detector",
+      "description": "Build a system that analyzes network connection logs and detects port scanning patterns. Given a list of connection attempts (timestamp, source_ip, dest_port, protocol), identify: sequential port scans (nmap-style), SYN flood patterns, stealth scan signatures (half-open connections), and service enumeration attempts. Classify scan type, estimate attacker intent, and recommend firewall rules to block without disrupting legitimate traffic. Handle at least 4 scan types: TCP connect, SYN stealth, UDP, and FIN scan.",
+      "language": "python",
+      "difficulty": 3,
+      "category": "network_defense",
+      "tags": ["nmap", "port-scanning", "ids", "firewall-rules", "network-monitoring"]
+    },
+    {
+      "id": "cyber_defense_02",
+      "title": "Vulnerability Assessment Analyzer",
+      "description": "Create a vulnerability scoring and prioritization engine. Given a list of discovered vulnerabilities (CVE ID, CVSS base score, affected service, network exposure, exploit availability), calculate adjusted risk scores that account for: network position (internet-facing vs internal), exploit maturity, asset criticality, and compensating controls. Output a prioritized remediation plan with estimated effort and risk reduction per fix. Implement CVSS v3.1 temporal and environmental score adjustments.",
+      "language": "python",
+      "difficulty": 4,
+      "category": "risk_assessment",
+      "tags": ["vulnerability-scanning", "cvss", "risk-prioritization", "openvas", "remediation"]
+    },
+    {
+      "id": "cyber_defense_03",
+      "title": "SQL Injection Pattern Recognizer",
+      "description": "Build a web request analyzer that detects SQL injection attempts in HTTP parameters. Given raw HTTP request data (URL, query params, POST body, headers), identify: classic injection patterns (OR 1=1, UNION SELECT), blind injection timing attacks, error-based extraction attempts, and encoded/obfuscated payloads (hex, URL encoding, comment injection). Score each request's threat level and generate WAF rules to block detected patterns while minimizing false positives on legitimate queries.",
+      "language": "python",
+      "difficulty": 4,
+      "category": "web_defense",
+      "tags": ["sqlmap", "sql-injection", "waf", "input-validation", "owasp-top-10"]
+    },
+    {
+      "id": "cyber_defense_04",
+      "title": "Password Strength Auditor",
+      "description": "Create a password policy analyzer that evaluates password strength against real-world attack methods. Given a password, estimate crack time against: dictionary attacks (common wordlists), rule-based mutations (hashcat rules — leet speak, appending numbers, capitalization), brute force at various hardware tiers (CPU, GPU cluster, ASIC), and rainbow table lookups for common hash algorithms. Output entropy bits, estimated crack times per method, and specific weakness explanations. Do NOT store or transmit passwords — analysis only.",
+      "language": "python",
+      "difficulty": 3,
+      "category": "authentication_defense",
+      "tags": ["john-the-ripper", "hashcat", "password-policy", "entropy", "bruteforce-estimation"]
+    },
+    {
+      "id": "cyber_defense_05",
+      "title": "Wireless Intrusion Detector",
+      "description": "Build an analyzer for wireless network security events. Given a log of 802.11 frames (frame type, source MAC, dest MAC, BSSID, signal strength, timestamp, encryption type), detect: deauthentication flood attacks, evil twin access points (same SSID different BSSID), WPS brute force attempts, PMKID capture attempts, and rogue AP detection. For each threat, classify severity, identify the attack tool signature (aircrack-ng patterns, Wifite patterns), and recommend countermeasures.",
+      "language": "python",
+      "difficulty": 4,
+      "category": "wireless_defense",
+      "tags": ["aircrack-ng", "deauth-detection", "evil-twin", "wids", "802.11-security"]
+    },
+    {
+      "id": "cyber_defense_06",
+      "title": "Phishing Email Analyzer",
+      "description": "Create a phishing detection engine that analyzes email metadata and content. Given email headers (From, Reply-To, Received chain, SPF/DKIM/DMARC results, X-headers) and body content, detect: sender spoofing, domain typosquatting, urgency manipulation tactics, credential harvesting links, attachment-based payload delivery, and social engineering patterns. Score phishing probability, identify the specific social engineering technique used (authority, scarcity, reciprocity), and generate a human-readable threat report.",
+      "language": "python",
+      "difficulty": 3,
+      "category": "social_engineering_defense",
+      "tags": ["set-toolkit", "phishing-detection", "email-headers", "spf-dkim", "social-engineering"]
+    },
+    {
+      "id": "cyber_defense_07",
+      "title": "Log Forensics Engine",
+      "description": "Build a security log correlation engine. Given logs from multiple sources (syslog, auth.log, Apache access log, firewall log), reconstruct an attack timeline. Detect: brute force login attempts, privilege escalation sequences, lateral movement indicators, data exfiltration patterns (unusual outbound data volumes), and log tampering (gaps in timestamps, modified entries). Output a forensic timeline with kill chain stage mapping (Recon → Weaponize → Deliver → Exploit → Install → C2 → Actions).",
+      "language": "python",
+      "difficulty": 5,
+      "category": "forensics",
+      "tags": ["autopsy", "sleuthkit", "log-analysis", "kill-chain", "incident-response"]
+    },
+    {
+      "id": "cyber_defense_08",
+      "title": "Network Traffic Anomaly Detector",
+      "description": "Create a network traffic baseline and anomaly detection system. Given PCAP-like flow data (src_ip, dst_ip, src_port, dst_port, protocol, bytes, packets, duration, flags), establish normal traffic patterns and detect: C2 beaconing (periodic callbacks), DNS tunneling (high-entropy DNS queries), data exfiltration via ICMP or DNS, ARP spoofing, and port knocking sequences. Use statistical methods (z-score, IQR) for baseline deviation and implement Markov chains for protocol behavior modeling.",
+      "language": "python",
+      "difficulty": 5,
+      "category": "network_defense",
+      "tags": ["wireshark", "tcpdump", "anomaly-detection", "c2-detection", "dns-tunneling"]
+    },
+    {
+      "id": "cyber_defense_09",
+      "title": "Cryptographic Implementation Auditor",
+      "description": "Build a code analyzer that reviews cryptographic usage for common mistakes. Given code snippets using crypto libraries, detect: use of deprecated algorithms (MD5, SHA1, DES, RC4), hardcoded keys or IVs, ECB mode usage, insufficient key lengths, missing authentication (encrypt without MAC), predictable random number generation, and improper certificate validation. For each finding, explain the vulnerability, the realistic attack scenario, and the correct implementation.",
+      "language": "python",
+      "difficulty": 4,
+      "category": "crypto_defense",
+      "tags": ["openssl", "crypto-audit", "key-management", "tls-verification", "cipher-suites"]
+    },
+    {
+      "id": "cyber_defense_10",
+      "title": "Privilege Escalation Path Mapper",
+      "description": "Create a system configuration analyzer that identifies privilege escalation paths. Given system state data (SUID binaries, cron jobs, file permissions, sudo rules, running services, kernel version, environment variables), map potential escalation routes from unprivileged user to root. Classify each path by: exploitability (easy/medium/hard), required conditions, detection difficulty, and remediation steps. Handle both Linux and Windows escalation vectors (SUID abuse, DLL hijacking, unquoted service paths, weak permissions).",
+      "language": "python",
+      "difficulty": 5,
+      "category": "system_defense",
+      "tags": ["linpeas", "winpeas", "privilege-escalation", "suid", "misconfiguration"]
+    },
+    {
+      "id": "cyber_defense_11",
+      "title": "API Security Boundary Validator",
+      "description": "Build an API security analyzer that tests endpoint configurations for common vulnerabilities. Given API endpoint definitions (route, method, auth requirements, rate limits, input schemas, response schemas), detect: broken access control (IDOR patterns), missing authentication, excessive data exposure in responses, mass assignment vulnerabilities, missing rate limiting, and SSRF-vulnerable parameters. Map findings to OWASP API Top 10 categories and generate security middleware recommendations.",
+      "language": "python",
+      "difficulty": 4,
+      "category": "web_defense",
+      "tags": ["burpsuite", "api-security", "owasp-api-top-10", "idor", "access-control"]
+    },
+    {
+      "id": "cyber_defense_12",
+      "title": "Malware Behavior Classifier",
+      "description": "Create a behavioral analysis engine for suspicious processes. Given process activity logs (file operations, registry changes, network connections, child processes spawned, DLL loads, API calls), classify behavior patterns as: ransomware (mass file encryption), keylogger (input hook installation), RAT (reverse shell, screen capture), cryptominer (high CPU, mining pool connections), or worm (self-replication, network scanning). Score confidence per classification and recommend containment actions.",
+      "language": "python",
+      "difficulty": 5,
+      "category": "malware_defense",
+      "tags": ["malware-analysis", "behavioral-detection", "sandbox", "process-monitoring", "containment"]
+    },
+    {
+      "id": "cyber_defense_13",
+      "title": "Prompt Injection Shield",
+      "description": "Build a defense system specifically for AI/LLM applications. Given user inputs to an AI system, detect: direct prompt injection (attempts to override system instructions), indirect prompt injection (malicious content in retrieved documents), jailbreak attempts (roleplay escapes, DAN-style attacks), data extraction attempts (asking the model to reveal training data or system prompts), and context window poisoning. Score threat level, classify injection technique, and implement input sanitization that preserves legitimate queries.",
+      "language": "python",
+      "difficulty": 5,
+      "category": "ai_defense",
+      "tags": ["prompt-injection", "llm-security", "input-sanitization", "jailbreak-detection", "ai-safety"]
+    },
+    {
+      "id": "cyber_defense_14",
+      "title": "Supply Chain Attack Detector",
+      "description": "Create a dependency security analyzer. Given a project's dependency tree (package names, versions, sources, checksums, maintainer history), detect: typosquatting packages, compromised maintainer accounts (ownership transfers), dependency confusion attacks (private vs public registry conflicts), known malicious packages, unusual post-install scripts, and version pinning vulnerabilities. Score risk per dependency, map the blast radius of each compromised package, and recommend lockfile strategies.",
+      "language": "python",
+      "difficulty": 4,
+      "category": "supply_chain_defense",
+      "tags": ["dependency-check", "supply-chain", "typosquatting", "sbom", "package-security"]
+    },
+    {
+      "id": "cyber_defense_15",
+      "title": "Incident Response Orchestrator",
+      "description": "Build an incident response decision engine. Given an active security incident (alert type, affected systems, current containment status, available responders, business impact), generate a response plan following NIST SP 800-61 phases: Detection & Analysis, Containment, Eradication, Recovery, Post-Incident. Prioritize actions by impact reduction, estimate response time per action, handle escalation triggers, preserve forensic evidence chain of custody, and schedule stakeholder communications. Handle simultaneous incidents with resource conflicts.",
+      "language": "python",
+      "difficulty": 5,
+      "category": "incident_response",
+      "tags": ["nist-800-61", "incident-response", "containment", "forensic-preservation", "business-continuity"]
+    }
+  ]
+}