CAIN-42 CAIN StudioAttack lab
Six real snippets audited live. Modern code must come back clean; each weak pattern must be named.
5 attacks 1 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Modern code: bcrypt, SHA-256, secrets, default TLS | POST /catalog-demo/taloscrypt-audit/run | No findings: no false alarm. |
| attack | Signature check off, TLS check off, key in the code | POST /catalog-demo/taloscrypt-audit/run | Three classic mistakes, three findings. |
| attack | Passwords hashed with MD5 | POST /catalog-demo/taloscrypt-audit/run | MD5 is broken for passwords. |
| attack | AES in ECB mode | POST /catalog-demo/taloscrypt-audit/run | ECB leaks patterns in the data. |
| attack | random() used for a security token | POST /catalog-demo/taloscrypt-audit/run | random() is predictable; use secrets. |
| attack | A 1024-bit RSA key | POST /catalog-demo/taloscrypt-audit/run | Under 2048 bits is too short. |
Each button audits one snippet on the live service. Shared demo; rate limited per address.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.