Visual walk‑through: left pane - protocol sequence diagram with the vulnerable state transition highlighted; right pane - offline NLP assistant answering a detection query; bottom bar - quick IOC summary (malicious verify_status byte, targeted ports, anomalous log patterns).

Code

How I Built It

The Spark

Cisco’s disclosure of CVE‑2026‑20127 - an unauthenticated DTLS handshake bypass in the vSmart controller’s vdaemon service - immediately ignited my passion. A single missing state‑machine check in the vbond_proc_challenge_ack_ack() function allowed an attacker to forge an authenticated session without ever presenting a valid certificate. The original exploit repository laid bare the raw mechanics; I wanted to turn that knowledge into a defensive force multiplier that would outlive the patch cycle.

This challenge provided the perfect forcing function. In one weekend, I built an extension that doesn’t just describe the vulnerability - it teaches the protocol weakness, arms defenders with live detection rules, and does so in a completely offline package that respects the operational security of the most sensitive environments.

Architecture: Isolated Intelligence, Maximum Impact

The extension adheres to the strict separation enforced by Manifest V3, while delivering a reactive, near‑instant experience.

Data Layer (src/knowledge)

The raw exploit research was parsed into 17 domain‑specific JSON objects covering everything from the DTLS state machine (message types 8,9,10) to IOC fingerprints in vsyslog and auth.log. This structured intelligence is the foundation of the offline engine.

Offline NLP Engine (src/services)

A custom, zero‑latency pipeline runs entirely in the browser:

1. 
   Tokenization & stop‑word removal on the user’s natural‑language query.


2. 
   Heuristic intent detection - mapping phrases like “how to detect” to the Detection knowledge domain.


3. 
   Semantic retrieval against the pre‑built inverted index (a Set<string> intersection over tokens).


4. 
   Template‑driven synthesis that assembles the matched JSON fragments into human‑readable Markdown, complete with memory addresses, log signatures, and ACL recommendations.

All indexing happens synchronously at side‑panel load, keeping query response times sub‑millisecond.

Presentation Layer (React 19 + Vite + Tailwind)

The UI is built as a single‑page application mounted in the sidePanel. Key design choices:

• 
  Lazy‑loaded components ensure instant first paint; the Protocol Explorer and Packet Viewer are loaded only when their tabs are activated.


• 
  Framer Motion hardware‑accelerates the DTLS sequence animations, making the state‑transition attack path intuitively visible.


• 
  Lucide React provides a professional icon set that scales across Chrome’s light/dark modes.

Browser Integration

• A service worker (background.ts) acts as the central event bus, routing messages between the popup, side panel, and storage layers with mandatory return true for async chrome.runtime.onMessage listeners.


• 
  chrome.storage.local persists user preferences and the most recent report snapshot.


• The manifest requests only activeTab, sidePanel, and storage - no webRequest, no declarativeNetRequest. All intelligence is self‑contained; the tool makes zero network requests, guaranteeing that no sensitive investigation data leaks.

Technical Deep Dive: Why the Vulnerability Exists

The extension’s Protocol Explorer visualises the core flaw. In the legitimate flow:

1. Client sends DTLS ClientHello with X.509 cert.


2. Server issues CHALLENGE (msg_type=8).


3. Client responds CHALLENGE_ACK (msg_type=9) with cryptographic proof.


4. Server validates proof, sends CHALLENGE_ACK_ACK (msg_type=10), and sets *(BYTE*)(peer_state+70) = 1.

The exploit skips step 3 entirely. The attacker intercepts the CHALLENGE and immediately crafts a CHALLENGE_ACK_ACK with a non‑zero verify_status byte. Because vbond_proc_msg() exempts msg_type=10 from authentication checks, the packet reaches the vulnerable handler, which blindly trusts the client‑supplied status and marks the peer as authenticated.

The extension renders these two flows side‑by‑side, highlighting the missing validation gate, and overlays the exact binary patch (upgrade to v20.12.6.1) that introduces the state‑machine enforcement.

Detection & Mitigation Built In

Beyond visualisation, the Knowledge Engine codifies actionable detection guidance directly from the exploit research:

• 
  vsyslog anomaly: Alert on control-connection-state-change with peer-vmanage-system-ip of 0.0.0.0 followed by immediate down state.


• 
  auth.log anomaly: Unexpected SSH key acceptance for vmanage-admin on port 830 immediately after DTLS instability.


• 
  Network ACLs: Strictly restrict inbound DTLS ports (12346, 52521) to known edge routers.


• 
  Patch imperative: Upgrade to v20.12.6.1+, which adds the missing verify_status validation.

Every answer is synthesized from the local JSON store; the assistant is not a generative AI that hallucinates. It’s a deterministic retrieval engine that guarantees factual accuracy.

Passion in Every Component

This wasn’t a casual build. The extension reflects a deep obsession with protocol‑level security research. I manually disassembled the vdaemon logic, traced the memory writes, and translated the binary analysis into interactive UI elements. The NLP engine itself was hand‑crafted - no TensorFlow, no external models - because I wanted the intellectual satisfaction of building a pure, dependency‑free reasoning core that respects the air‑gap.

The project is a love letter to the art of defense: taking an attacker’s blueprint and forging a shield that educates and protects simultaneously. The World Cup of cybersecurity is happening every day in data centers and SOCs, and this tool is my seat in the stands, cheering for the blue team.