Fourteen browser-based games that teach real cyber-security skills — from SQL injection and cross-site scripting to phishing detection and password cracking. Play free, earn XP, climb the ranks. No install, no sign-up to start.
Bypass a login form using real SQL injection. A live evaluator runs your payload — any valid tautology or comment trick works.
play ▸Craft a payload that escapes the page context and pops alert(1) — across body, attribute and URL contexts. Real breakout technique.
play ▸Triage emails and URLs as legit or phishing. Every call teaches the tell — domain spoofs, urgency, gift-card and BEC scams.
play ▸Crack the root password from a memory dump using likeness hints, Fallout-style. Deduce it before lockout.
play ▸Break Caesar-encrypted intercepts against a trace timer. Rotate the dial until the plaintext snaps into focus.
play ▸Run a leaked password hash against a wordlist and find the plaintext before the timer — a dictionary attack in miniature.
play ▸Read an nmap-style scan and identify the service on each open port. Map the attack surface at a glance.
play ▸Memorize and repeat a flashing byte sequence. Every wave adds a byte and speeds up — how deep can your buffer go?
play ▸Spot the prompt injection that jailbreaks an AI assistant — instruction overrides, persona attacks, and prompt leaks. Modern AI-security training.
play ▸Triage wallet messages and offers — flag fake airdrops, seed-phrase phishing and wallet-draining approvals; trust the legit.
play ▸Audit a code snippet and spot the crypto flaw — weak hashes, ECB mode, hardcoded keys, reused IVs. The mistakes that breach real systems.
play ▸Work the SOC alert queue — escalate the real intrusions, dismiss the false positives. Incident-response & threat-detection training.
play ▸Spot the con — pretexting, tailgating, BEC, baiting and vishing. The human side of security that no firewall stops.
play ▸Audit a cloud config and find the misconfiguration — public buckets, open security groups, over-permissive IAM. Least-privilege in practice.
play ▸The zero-friction warm-up: mash any keys and watch exploit code stream out, Matrix rain and all. No sign-up.
launch ▸New to security? Start with PHISH or the hacker typer. Ready to go deeper? Each game has four difficulty tiers and ties into a career track with a certificate of completion.