Each case file pairs an attack technique with its defense — try the vulnerable version, then the hardened one, and watch what changes. Built for classroom demonstration; nothing here touches a live network or system.
SQL Injection
OffenseA login form builds a database query by pasting user input directly into a string. Type ' OR '1'='1 into the password field on the left and compare it with the parameterised version on the right.
Vulnerable query
Simulated only — no real database is queried.
Parameterised query
Input is bound as a value, never as SQL syntax.
Cross-Site Scripting (XSS)
OffenseA comment box echoes whatever you type back onto the page. Try posting <img src=x onerror="alert(1)"> on the left, then the same text on the right where it's escaped before display.
Unsanitised render
We display — never execute — the payload here, so it's safe to try.
Escaped render
HTML special characters are encoded, so tags show as text.
Password Strength & Guessing Speed
DefenseType a password below. We estimate how long an offline guessing attack would take at 10 billion guesses/second — a realistic rate for a modern GPU rig against a weakly-hashed password.
Try a password
Phishing Triage
DefenseOne of these three emails is genuine. Click the one you'd trust — then see the tells that separate it from the fakes.
Firewall Rule Matching
DefenseA tiny rule set decides which packets pass. Add or edit a rule, then run traffic through it.
Rule set (checked top-to-bottom)
Rules are illustrative — first match wins, like most real packet filters.
Encryption, Conceptually
DefenseA Caesar shift shows why substitution ciphers are trivially breakable, and how modern encryption (AES, RSA) differs in kind, not just degree.
Caesar cipher (shift 3)
Only 25 possible shifts — brute-forced instantly by hand.
Why AES-256 is different
Not a bigger alphabet shift — a different category of problem. AES mixes data through multiple rounds of substitution and permutation keyed by a 256-bit key: 2²⁵⁶ possibilities. RSA instead relies on the difficulty of factoring huge numbers. Both are designed so guessing is computationally infeasible, not merely inconvenient.
This panel is explanatory — no live encryption is performed here.
Knowledge Check
QuizScore: 0 / 0