Attack lab

Six real snippets audited live. Modern code must come back clean; each weak pattern must be named.

5 attacks 1 controls live: nothing pre-recorded

Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
Send and read the real reply, or run every preset and watch the scoreboard fill.

What each preset tests

	Preset	Route	Why it matters
control	Modern code: bcrypt, SHA-256, secrets, default TLS	`POST /catalog-demo/taloscrypt-audit/run`	No findings: no false alarm.
attack	Signature check off, TLS check off, key in the code	`POST /catalog-demo/taloscrypt-audit/run`	Three classic mistakes, three findings.
attack	Passwords hashed with MD5	`POST /catalog-demo/taloscrypt-audit/run`	MD5 is broken for passwords.
attack	AES in ECB mode	`POST /catalog-demo/taloscrypt-audit/run`	ECB leaks patterns in the data.
attack	random() used for a security token	`POST /catalog-demo/taloscrypt-audit/run`	random() is predictable; use secrets.
attack	A 1024-bit RSA key	`POST /catalog-demo/taloscrypt-audit/run`	Under 2048 bits is too short.

Each button audits one snippet on the live service. Shared demo; rate limited per address.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.