Understanding cyber threats is the first line of defense. Explore attacks, test your knowledge, and learn how to stay safe in the digital age.
Covering all OWASP Top 10 risks and major real-world attack types. Click any card to learn how each attack works, how to spot it, and how to defend against it.
The OWASP Top 10 is the globally recognized standard for the most critical web application security risks, updated in 2021. Prevalence scores are based on real-world CVE data and industry testing.
Simple but powerful steps everyone should follow to stay safe online.
Create unique passwords with 12+ characters using a mix of letters, numbers, and symbols. Use a password manager to keep track.
Add a second layer of security to all accounts. Even if your password is stolen, attackers can't access your account without the second factor.
Enable automatic updates for your OS, apps, and antivirus. Most attacks exploit known vulnerabilities with available patches.
Follow the 3-2-1 rule: 3 copies, 2 different media types, 1 offsite. Ransomware becomes powerless when you have clean backups.
Verify email senders, hover over links before clicking, and never open unexpected attachments — even from known contacts.
Public networks are hunting grounds for hackers. A VPN encrypts your traffic, protecting you from eavesdropping and MitM attacks.
Six hands-on tools to analyze passwords, scan headers, check ports, detect phishing, search CVEs, and verify URL reputation — all for educational purposes.
Evaluate password strength in real-time. Your password never leaves your browser — all analysis is done locally.
Check which HTTP security headers a website implements. Uses securityheaders.com API data to grade header coverage.
Simulates a port scan on common service ports and explains what each open port means for security. Use only on systems you own or have permission to test.
Analyzes a URL for phishing indicators, suspicious patterns, lookalike domains, and known threat intelligence signals.
Search the NVD (National Vulnerability Database) for known CVEs by keyword, software name, or CVE ID. Powered by NVD public API.
Paste a suspicious URL or email snippet. The module scores it against 20+ phishing indicators including lookalike domains, urgency keywords, deceptive patterns, and malformed URLs.