CRYPTO LAB — Cybersecurity Operations & Learning Lab

INTERACTIVE CYBERSECURITY OPERATIONS LAB

Master Modern Cryptography & Network Security

Explore interactive visual simulations of digital fingerprints, encryption algorithms, public key infrastructure (PKI), TLS handshakes, and encrypted VPN tunnels.

01 One-Way

Hashing

Creating one-way digital fingerprints of data. Test MD5, SHA-256, SHA-512, SHA-3, BLAKE2b, and see the Avalanche Effect in action.

Launch Hash Lab

02 Reversible

Encryption

Transforming readable plaintext into protected ciphertext using secret keys. Try AES-256, ChaCha20, RSA, and 3DES.

Launch Encryption Lab

03 Shared vs Keypair

Symmetric vs. Asymmetric

Compare shared secret keys vs public/private keypairs. Understand why real-world protocols combine both.

Compare Cryptography

04 Web Security

PKI & TLS

Simulate HTTPS certificate validation, step-by-step TLS handshakes, attacker eavesdropping, and invalid cert warnings.

Launch TLS Handshake

05 Encrypted Tunnel

VPN Security

Protect traffic over untrusted networks. Explore Remote Access vs Site-to-Site VPNs, WireGuard, and packet inspection.

Inspect VPN Tunnels

06 Passing Certificate

Master Challenge & Certificate

Full end-to-end interactive lifecycle playback and gamified scenario challenges to earn a verified completion certificate.

Earn Certificate

Module 01

HASHING — Digital Fingerprints

"Creating a one-way digital fingerprint of data."

Visual Hashing Pipeline

PLAINTEXT

"Welcome to Kable Academy"

Variable length input data

HASH FUNCTION (SHA-256)

INPUT → HASH FUNCTION → FIXED-LENGTH HASH

HASH VALUE (64 HEX CHARS)

0f5139a0444ee00b5220c3a2bc0d80c3e66a3d93964177d6749ec37a898444a7

Fixed-size 256-bit output

Interactive Hash Generator

Enter Data to Hash:

Select Hash Algorithm:

Live Updating

RESULTING HASH ( SHA-256 ) 256 Bits (64 Hex Characters)

Calculating...

Avalanche Effect Demonstration

Observe how changing a single character ("123" vs "124") causes a completely chaotic, unpredictable change across the entire hash output.

MESSAGE A Standard Password

SHA-256 Hash A:

MESSAGE B (1 Character Changed) Modified Password

SHA-256 Hash B:

NO MATCH — DATA MODIFIED

Hash Difference: 98.4% of hex characters changed

Module 02

ENCRYPTION — Protected Data

"Transforming readable data into protected ciphertext using a key."

Interactive Encryption & Decryption Lab

1. Enter Plaintext:

2. Select Encryption Algorithm:

AES-256 (Advanced Encryption Standard): Industry standard symmetric bulk encryption used worldwide.

3. Encryption Key:

GENERATED CIPHERTEXT WebCrypto Native

Click "ENCRYPT MESSAGE" to run algorithm...

DECRYPTION RECOVERY

Decrypted message will appear here...

Module 03

SYMMETRIC VS. ASYMMETRIC ENCRYPTION

Comparing shared secret keys with public/private keypairs.

SYMMETRIC ENCRYPTION

SAME SECRET KEY

Both Alice and Bob must possess the exact same pre-shared secret key to encrypt and decrypt messages.

Best For:

High-speed bulk data transfer (e.g. AES-256, ChaCha20) across established secure sessions.

The Key Distribution Problem:

How do Alice and Bob safely share the initial secret key across an untrusted internet without an attacker intercepting it?

ASYMMETRIC ENCRYPTION

PUBLIC / PRIVATE KEYPAIR

Uses a mathematically linked keypair. The Public Key 🔓 is shared with everyone; the Private Key 🔑 must remain strictly secret.

Solves Key Distribution:

Alice encrypts using Bob's Public Key. ONLY Bob's Private Key can decrypt it!

Interactive RSA-2048 Key Pair Generator

Generate a live WebCrypto 2048-bit RSA Key Pair and simulate asymmetric key exchange.

BOB'S PUBLIC KEY (SHARED WORLDWIDE) X.509 SPKI PEM

Click "Generate RSA Keypair" to initialize...

BOB'S PRIVATE KEY (KEPT SECRET) PKCS#8 PEM

Click "Generate RSA Keypair" to initialize...

Alice Sends Encrypted Message to Bob:

Alice's Plaintext Message:

Ciphertext / Decrypted Result:

Click Encrypt to test asymmetric cipher flow...

Module 04

PKI & TLS HANDSHAKE

Public Key Infrastructure, Digital Certificates, and HTTPS Security.

X.509 Digital Certificate Inspector

Digital Certificates bind a server's Domain Name to its Public Key via a trusted Certificate Authority (CA).

https://bank.kableacademy.com SECURE HTTPS (TLS 1.3)

Verified by DigiCert Trusted Root CA

SUBJECT COMMON NAME bank.kableacademy.com SAN: *.kableacademy.com

ISSUER CA Kable Certificate Authority CA-1 Root CA Trusted in OS Store

PUBLIC KEY ALGORITHM RSA 2048-Bit (e=65537) Valid: 2026-01-01 to 2027-01-01

CA DIGITAL SIGNATURE sha256WithRSAEncryption [VALID] Tamper-Proof Checksum

Interactive TLS 1.3 Handshake Simulator

Watch step-by-step how HTTPS establishes a secure session key between client and server.

Step 1 / 4

CLIENT BROWSER

User Client (Chrome / Firefox)

Initiating TLS ClientHello...

STEP 1: CLIENT HELLO

Client sends supported cipher suites (TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305), supported TLS versions (TLS 1.3), and a Random Nonce to the server.

WEB SERVER

HTTPS Web Server (nginx / apache)

Listening on Port 443...

MAN-IN-THE-MIDDLE WIRESHARK NETWORK SNIFFER VIEW

[TLS 1.3 ENCRYPTED TRAFFIC] Content-Type: Application Data (23) | Payload: 0x8f4a219c0b11e2f3a970e4c198b3f2... (Plaintext hidden from eavesdroppers!)

Module 05

VPN SECURITY & ENCRYPTED TUNNELS

Protecting network communications across untrusted public infrastructure.

Virtual Private Network (VPN) Simulator

Encapsulates and encrypts network traffic inside a secure tunnel across untrusted networks (e.g. Coffee Shop Wi-Fi, Public Internet).

TUNNEL DISCONNECTED (UNPROTECTED)

Select Network Topology:

Select Tunnel Protocol:

TOPOLOGY: REMOTE ACCESS WORKER OVER PUBLIC WI-FI Protocol: WireGuard UDP/51820

Remote Worker Laptop

Local IP: 192.168.1.105

UNPROTECTED PUBLIC INTERNET

Packets exposed to Wi-Fi Eavesdroppers & ISP

Corporate VPN Gateway

Subnet: 10.1.0.0/16

LIVE PACKET ENCAPSULATION & INSPECTION SNIFFER Outer IP Header vs Encrypted ESP Payload

[UNENCAPSULATED PACKET CAPTURED BY ISP]

SRC IP: 192.168.1.105 | DST IP: 142.250.190.46 | PROTO: TCP/80 (HTTP)

PAYLOAD: GET /confidential_payroll.pdf HTTP/1.1 (Visible to Eavesdropper!)

Module 06

PUTTING IT ALL TOGETHER & FINAL CHALLENGE

Master end-to-end lifecycle playback & earn your passing grade completion certificate.

FINAL CHALLENGE: SECURE THE CONNECTION

Solve the 6 security scenarios to earn your official course Certificate of Completion.

CHALLENGE SCORE

0 / 6

Student Name for Certificate:

SCENARIO 1: SOFTWARE INTEGRITY CHECK

A user is downloading a critical security software update over the internet. How should the administrator allow users to verify that the file was not corrupted or modified by a hacker?

Select Best Security Approach: