Training_range
Play the attack. Learn the defense.
Three short games on fictional targets. They run in your browser, and nothing you type is sent anywhere.
1 · Spot the phish
Eight emails. Decide: legitimate or phishing?
2 · How long to crack it?
Estimates an offline attack at 10 billion guesses per second. This is a brute-force estimate; real attackers also try wordlists and common patterns, so famous phrases fall faster. Do not type a real password.
—
3 · Capture the flag
A tiny Linux shell with three levels. Find each flag and submit it.
Real systems fight back less politely.
We test web applications the way attackers do, with written authorization, and prove every finding by hand.