All Games49 games
Score-based security games. Timer, points, high scores — learn by competing, not just reading.
Permission Panic
BeginnerRead the scenario — only owner should write, group can read. Pick the correct chmod value before the clock runs out.
Header Inspector
IntermediateHTTP response headers appear. One is misconfigured — missing HttpOnly, CSP wildcard, public cache on private data. Click it.
Cert Check
BeginnerRead the TLS certificate — subject, SAN, issuer, dates. Is it valid, expired, wrong hostname, self-signed, or untrusted CA?
Log Hunter
AdvancedA wall of server logs appears. One line hides an attack — SQL injection, XSS probe, brute force, path traversal, recon. Find it.
Crypto Sorter
BeginnerMD5, AES-256, RC4, SHA-3, DES — Secure, Deprecated, or Broken? 10 algorithms, no timer. Learn your cryptography.
Incident Response
AdvancedA breach alert fires. Triage the indicators, identify the attack vector, contain the threat, and write the post-mortem — against the clock.
CVE Timeline
IntermediateMatch famous vulnerabilities to their year and CVSS score — Heartbleed, Log4Shell, Shellshock, EternalBlue, and more.
Spot the Phish
BeginnerReal email or phishing attack? Read the message, click suspicious elements for bonus points, then decide before time runs out.
Cipher Challenge
Beginner5 levels of encoded messages — ROT13, Caesar cipher, Atbash, reversed words, Base64. Decode each one with fewer attempts for more points.
Code Audit
IntermediateReal code snippets with real vulnerabilities. Click the vulnerable line — SQL injection, XSS, hardcoded secrets, path traversal, and more.
JWT Heist
Intermediate5 rounds. Each JWT has a different vulnerability — alg:none, weak secret, expired claim. Identify and exploit them before time runs out.
Crypto Escape Room
AdvancedDecode Base64 clues, crack a hash, decrypt AES ciphertext, forge a JWT, and read the final secret. Escape as fast as you can.
Bug Bounty Rush
IntermediateFind vulnerabilities in code snippets before time runs out — XSS, SQL injection, hardcoded secrets, and more.
Firewall Rules
BeginnerAllow legitimate traffic, block attacks. Identify port scans, SQL injection payloads, and brute force attempts in real-time.
Crypto Breaker
AdvancedBreak increasingly harder ciphers — ROT13, Caesar, substitution, XOR, and RSA with tiny primes.
Social Engineer
IntermediateSocial engineer a helpdesk to extract sensitive info. Learn attack techniques by playing the attacker — then study the defenses.
Incident Timeline
IntermediateReconstruct attack timelines — arrange security events in chronological order across phishing, ransomware, and insider threat scenarios.
Malware Classifier
IntermediateClassify file samples as trojan, ransomware, worm, adware, or clean based on behavior and network indicators.
Privilege Escalation
AdvancedEscalate from low-privilege user to root. Exploit SUID binaries, cron jobs, sudo misconfigs, and kernel vulns.
Network Mapper
BeginnerRead nmap scan results, identify services, and spot vulnerabilities — exposed databases, open SMB, Redis without auth.
Security Trivia
BeginnerRapid-fire security questions — ports, protocols, CVEs, encryption types, OWASP categories. 15 seconds per question.
Decode the Payload
IntermediateDecode Base64, URL-encoded, hex, and double-encoded attack payloads. Identify the attack type hiding inside.
Attack or Defense
BeginnerSecurity tools flash on screen — Metasploit, Wireshark, Burp, Snort. Classify each as offensive or defensive. Fast.
Port Scanner
BeginnerPort number appears — identify the service. SSH, HTTP, MySQL, PostgreSQL, Redis, MongoDB, and more.
HTTP Status Codes
BeginnerStatus code flashes — pick the meaning. 200, 301, 403, 404, 418, 429, 500, 503. How many can you get?
Regex Defender
AdvancedWrite regex patterns to block SQL injection, XSS, and path traversal — without blocking legitimate input.
Security Acronyms
BeginnerXSS, CSRF, SAST, DAST, RBAC, MFA, WAF, IDS, SIEM, SOC — expand them all before time runs out.
Encryption Match
BeginnerAES, RSA, SHA-256, HMAC, ECC, bcrypt — classify each as symmetric, asymmetric, hashing, or MAC.
Password Cracker
IntermediateCrack hashes from MD5 to Argon2. See why MD5 falls instantly while bcrypt takes years. Pick the right password.
CVE Severity
IntermediateRate vulnerabilities by CVSS severity — Low, Medium, High, or Critical.
Log Analyzer
IntermediateParse server logs, click the attack line, identify the technique.
Packet Inspector
IntermediateClassify network packets — normal traffic, recon, exploit, exfiltration, or C2.
Security Policy Builder
AdvancedBuild correct CSP and CORS headers for each scenario before time runs out.
Threat Model
IntermediateIdentify real threats in architecture diagrams — STRIDE methodology.
Hash Identifier
BeginnerA hash appears — is it MD5, SHA-1, SHA-256, bcrypt, or Argon2? Identify fast.
Vulnerability Match
IntermediateMatch famous CVEs to affected software — Heartbleed, Log4Shell, EternalBlue.
Secure Code Fixer
IntermediateVulnerable code appears — pick the correct fix from 3 options.
OWASP Category
BeginnerClassify vulnerabilities into OWASP Top 10 categories as fast as you can.
Encoding Chain
AdvancedDecode multi-layered encodings — Base64 inside URL-encode inside hex. Peel the layers.
Network Defense
IntermediateAttacks come in — pick the right mitigation: rate limit, WAF rule, SYN cookies, fail2ban.
Compliance Quiz
BeginnerGDPR, SOC2, PCI-DSS, HIPAA — rapid-fire compliance questions.
Cipher Identifier
IntermediateCiphertext sample appears — identify: AES-CBC, ChaCha20, RSA, DES, or ROT13.
Phishing Detector
IntermediateAdvanced phishing emails — spear phishing, whaling, BEC. Spot them all.
Linux Commands
IntermediateSecurity scenario appears — type or select the right Linux command to handle it.
API Security
IntermediateFind vulnerabilities in API request/response pairs — IDOR, auth bypass, data exposure.
Memory Forensics
AdvancedAnalyze process lists — find the malware hiding among legitimate processes.
DNS Detective
IntermediateAnalyze DNS records — find missing SPF, dangling CNAMEs, and open resolvers.
Token Spotter
BeginnerCode files flash on screen — find leaked API keys, tokens, and secrets fast.