Cryptographic Identity & Multi-Factor Defense Node
Content-Security-Policy: default-src 'self'; script-src 'self';
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cryptography: Salted SHA-256 with Constant-Time String Comparison (hash_equals)
All-in-One 5-Domain Cyber Security & Network Simulation
VLAN Segmentation, Router-on-a-Stick, Port Security with Sticky MAC, DHCP Snooping & DAI
Click below to simulate Layer 2 attacks in front of professors:
Disabling Insecure Legacy Protocols, Enabling LSA Protection (Anti-Mimikatz) & UAC Enforcement
When Windows cannot find a computer on the network, it broadcasts requests. Attackers use Responder to reply and steal NTLM hashes. Disabling LLMNR stops this attack.
It locks LSASS process memory so hacker tools like Mimikatz cannot scrape plaintext passwords from RAM.
Raw Sockets Packet Inspection (AF_PACKET), SYN Flood Mitigation & Stateful Iptables Firewall
Click below to launch simulated attacks against the Linux engine:
Salted SHA-256 Hashing, 128-Bit CSPRNG Salt & Timing Attack Defense (Constant-Time)
xQv8L3tWqK9yP2mZ1aB8cg==
Computing...
$$\text{Storage Record} = \text{Base64}(\text{Salt}) \parallel \text{Base64}\Big(\text{SHA256}(\text{Salt} + \text{Password})\Big)$$
Why Salt? Prevents Rainbow Table precomputed attacks.
Why Constant-Time? Standard `==` leaks microsecond timing cues. Constant-time processes all bytes unconditionally.
10-Slide Outline, Spoken Presentation Script & Top 5 Tough Defense Questions
DHCP Snooping builds a database of trusted IP-to-MAC bindings. DAI inspects every ARP packet against this table, dropping spoofed ARP packets to prevent Man-In-The-Middle attacks.
Standard `==` terminates on the first wrong character. Attackers measure nanosecond delays to guess each character. Constant-time comparison processes all characters unconditionally.
With Sticky MAC, the switch locks the port to the authorized laptop. If an attacker unplugs it and connects another PC, the port immediately shuts down (err-disabled).
When DNS fails, Windows broadcasts requests locally. Attackers use Responder to spoof responses and steal NTLM hashes. Disabling LLMNR neutralizes this threat.
Cisco blocks rogue physical devices and limits VLAN routing -> Web Portal validates with strict regex -> Backend hashes with Salted SHA-256 in constant time -> Linux telemetry and Windows hardening protect the hosts.