Explore 12 interactive 3D packet-level security simulations across Real-World CVEs, Network Security, Web Application Security, and Cryptography. Toggle any lab between Exploit Mode and Patched Defense Mode.
CWE-62 UNIX Hard Link & CWE-367 TOCTOU Race Condition in APT package manager. MitM HTTP 302 redirect + Acquire::Retries=3 overwrites verified .deb inode before dpkg root execution.
CWE-917 Expression Language & JNDI Injection in Log4j2 message lookup substitution leading to remote Java bytecode execution.
CWE-506 Embedded Malicious Code in XZ Utils 5.6.0/5.6.1 hijacking RSA_public_decrypt in sshd via systemd liblzma linkage.
Layer-2 gratuitous ARP cache poisoning intercepted by switch DHCP Snooping binding database and DAI port enforcement.
Forged UDP 53 bailiwick NS/A glue records vs. cryptographic RRSIG, DNSKEY, and DS validation.
Half-open SYN backlog queue exhaustion mitigated by stateless HMAC-based TCP ISN SYN cookies.
CWE-89 SQL AST tautology injection (' OR 1=1 --) vs. pre-compiled SQL prepared statements with bound parameters.
CWE-918 Server-Side Request Forgery stealing IAM credentials via IMDSv1 vs. IMDSv2 PUT token requirement and IP hop-limit=1.
CWE-79 Stored Cross-Site Scripting session exfiltration blocked by HTML entity encoding, cryptographic Content-Security-Policy nonces, and HttpOnly cookies.
MitM cipher stripping detected by TLS 1.3 ServerHello.random downgrade sentinel and full handshake transcript HMAC.
Stolen authorization code blocked at token endpoint by SHA-256 code_verifier and code_challenge verification.
CWE-347 signature bypass prevented by explicit algorithm allowlisting and asymmetric key type enforcement.