Your toys and checklist progress stay in this browser.
Welcome to catsec's lair!
Hello there, and welcome to the softest corner of infosec!
I made this site because security doesn't have to be gray dashboards and scary hoodies. Here you'll find pocket-sized threat profiles, browser toys for poking at passwords and ciphers, and a tiny capture-the-flag you can solve right on this page. ฅ^•ﻌ•^ฅ
Everything here is made for learning, and the tools I link to are for systems you own or have permission to test. New to all this? Start with the Safety Checklist, then visit the Threat Zoo.
whoami
House rules
Only test systems you own or have written permission to test. Report bugs kindly and privately. Share what you learn, and be patient with beginners, because everyone was one once.
What makes kitty happy
Kitty lives in this browser, so nothing is sent anywhere. Clearing your site data resets everything.
Your deposit
Browse catsec from the command line. Press ` anywhere to come back here.
Nothing matches that yet. Try a shorter word.
Personal security checklist
Times assume 10 billion guesses per second against a fast hash and 10 thousand per second against a slow one. This is a rough estimate, and attackers try common patterns first. A long random passphrase from a password manager beats clever substitutions.
None of these keep a secret. Base64, hex and URL encoding are reversible by anyone, and a Caesar shift has only 25 keys. For real secrecy, use vetted encryption such as AES-GCM or ChaCha20-Poly1305.
Change a single letter and the whole hash changes. That is the avalanche effect, and it is why hashes are good at detecting tampering.
SHA-1 is shown for comparison only, since practical collisions exist. General-purpose hashes are too fast for storing passwords: use Argon2id, scrypt or bcrypt with a unique salt.
Header
Payload
This tool reads a token but doesn't check its signature. Anyone can read a JWT, so never store secrets in one.
Forge a token
The secret is known now, so you can mint a token the server will trust. Edit the payload (try changing the role) and re-sign it with the cracked secret.
Only HS* tokens use a shared secret. RS, ES and PS tokens are signed with a private key you can't guess, and an algorithm of none means the token isn't signed at all.
This is a best guess from the hash's shape and length. Different algorithms can look identical, and only test hashes you're allowed to test.
Adult and dating sites. Searching for someone's profiles here can expose them to real harm, so use this only for scams, impersonation or your own accounts.
This page builds links but never checks them, so a link may lead to a missing profile or someone else with the same name. Site list from WhatsMyName by Micah Hoffman, CC BY-SA 4.0 (license).
All brands, names and addresses here are made up for practice. .example is a reserved domain, so these links could never go anywhere.
Find all four flags
Each flag looks like flag{some_words}. Poke around the shell below, then submit what you find. Nothing leaves this page, and nothing you type here touches a real system.
Hints
- Pages often say more in their source than on screen.
- Hidden files start with a dot. Encoding isn't encryption, and the Cipher Box can help.
- Browser developer tools have a console, and the shell has
dmesg. A shift of 13 might come in handy. - Web crawlers are told where not to look. Attackers read those files too.
Hard mode
Solve these offline with your own tools. Answers are checked on the server, so the page can't give them away. Everything you need is right here, so please don't attack the site or its database.
Layers (100)
Peel it back. The usual suspects are all here.
Follow the Mail (150)
Which IP address actually sent this email? Answer as flag{ip}.
Return-Path: <billing@kittybank-alerts.example>
Received: from relay2.mailhost.example (relay2.mailhost.example [198.51.100.24])
by mx.yourcompany.example; Thu, 05 Nov 2026 09:14:22 +0000
Received: from kittybank-alerts.example (unknown [203.0.113.77])
by relay2.mailhost.example; Thu, 05 Nov 2026 09:14:19 +0000
Authentication-Results: mx.yourcompany.example;
spf=fail smtp.mailfrom=kittybank.example;
dkim=none; dmarc=fail
From: KittyBank Security <security@kittybank.example>
Reply-To: billing@kittybank-alerts.example
Subject: URGENT: verify your accountWeak Hash (200)
An unsalted password hash leaked. Answer as flag{password}. The Hash Identifier is a good start.
Repeating Key (300)
XOR with a short repeating key, in hex. You already know how every flag starts.
Signed, Not Secure (300)
Recover the secret that signed this token. The JWT Decoder will show you what's inside.
This season
All time
Connecting to the forum…
Sign in to post
Reading needs no account. Your handle is shown on the forum instead of your GitHub name. Supabase, the forum's database provider, keeps the basic GitHub profile details it receives, including your email address.
Privacy
catsec has no ads, trackers or analytics of its own. This is what happens to your data when you use it.
Reading the site
- Neocities hosts the site and may log visits, like most web hosts.
- On forum and CTF pages, your browser also contacts Supabase for the data.
- Your checklist ticks, CTF progress and toys stay in your browser and aren't sent to me. Anything you type into the toys stays there too.
Signing in
- Sign-in uses GitHub. Supabase, the database provider, stores the basic profile details GitHub shares, including your email address, and may log your IP address.
- Your email and GitHub name aren't shown on the forum. Only your handle is.
- Your browser keeps a sign-in session until you sign out.
What you post
- Posts, handles and leaderboard scores are public, and search engines or other people could copy them.
- If you report a post, moderators see the report but it isn't shown publicly.
- Moderators can hide posts and ban accounts.
Your choices
You can delete your own posts at any time. To delete your account or ask a question, email w0xera@waifu.club. See security.txt for reporting vulnerabilities.
Practice
Reference
Read and listen
Neighbors on Neocities
Other cybersecurity sites living on Neocities, from malware notes to CTF writeups. Each one is run by its own owner, so what you find there is theirs.
Link back to catsec
Copy this to add the button to your site:
Found a bug on a site?
Look for /.well-known/security.txt. It's the standard file (RFC 9116) where a site lists how to report vulnerabilities. Report privately, give the owner time to fix it, and stay within any published policy.