Disclaimer & Awareness

This is a purely educational simulation designed to demonstrate common password vulnerabilities and cybersecurity principles.

No real hacking is performed, and no personal data is collected.

Note: For the best experience, please use a laptop or desktop computer.

πŸ” Interactive Password Security

See how your password stands up against attacks and how it's protected.

Security Settings & Best Practices

  • Enable Two-Factor Authentication (2FA)
  • - Use 12+ characters & mix character types.
  • - Don't reuse passwords across sites.
  • - Always check the website URL before logging in.
  • Weak passwords are cracked in seconds.
  • - Strong, long passwords with hashing & salting are highly secure.
  • - Phishing attacks trick you into giving away your credentials.

Social Connect

Suspicious activity detected! Please log in to secure your account or reset your credentials.

URL: http://social-connect-login.com

⚠️ Your bank account is temporarily blocked.

You have won β‚Ή10,000 cashback!

[Hacker C2 Panel]

Enter stolen credentials to access system.

[2FA Verification]

A code was sent to your device.

2FA Activated!

[root@kali ~]# ./intercept_sms.sh


        

About the Concepts

This simulation is for educational purposes ONLY to raise security awareness.

1. Brute Force Attack

This attack method involves systematically trying every possible combination of characters until the correct password is found.

How it's calculated:

Combinations = (Charset Size) ^ (Password Length)
  • Charset Size: The number of possible characters (e.g., 26 for lowercase, 52 for mixed case, 62 for alphanumeric, etc.).
  • Password Length: The number of characters in your password.
  • The time to crack is these combinations divided by the number of guesses a computer can make per second (billions).

2. Dictionary Attack

A simpler, faster attack that tries a pre-compiled list of common words, phrases, and passwords instead of every combination. This is why using common words is extremely risky.

3. Phishing Attack

A social engineering attack where a hacker creates a fake, but convincing, login page (e.g., a fake social media or email login) to trick you into entering your real credentials. The hacker captures what you type and can then use it on the real website.

4. Smishing (SMS Phishing)

Similar to phishing, but the attack starts with a text message (SMS). The message creates a sense of urgency (e.g., "your account is locked") or greed ("you won a prize") to persuade you to click a malicious link.

5. RAM-Based Hacks (Keylogging & Clipboard Hijacking)

This demonstrates how malware on your computer can be a threat. Even if your password is secure on a website's server, malware can steal it directly from your computer's memory (RAM) as you type it (keylogging) or copy it to your clipboard.

Defenses Explained

  • Hashing & Salting: A one-way process that scrambles your password into a unique, fixed-length string (the hash). A random "salt" is added before hashing, so even if two users have the same password, their stored hashes will be different. This makes it much harder for hackers to crack passwords even if they steal the database.
  • Two-Factor Authentication (2FA): A critical security layer. Even if a hacker steals your password, they are still blocked because they don't have the second factorβ€”a temporary code from your phone or authenticator app.

User Manual

How to Use This Demo

This tool is designed to help you understand password vulnerabilities and defenses in a hands-on way.

Step 1: Create an Account

Use the "Sign Up" tab. As you type a password, the "Security Analysis" panel on the right will update in real-time, showing you its strength, how long it would take to crack, and how it's stored securely using hashing.

Step 2: Launch Simulated Attacks

Once you create an account, the "Live Hacking Simulation" panel appears. Click the buttons to launch different types of attacks against the password you just created and watch the output.

Step 3: Explore Defenses

In the "Security Settings" panel, you can toggle Two-Factor Authentication (2FA) on or off. Try logging in with it enabled to see the extra verification step. The "Hashing + Salting" section shows you how your password is scrambled for secure storage.

Step 4: See RAM-Based Hacks

While typing in any username or password field, the "RAM-Based Hack Simulation" becomes active on the right. Click "Show/Hide Memory Capture" to see how malware could capture your keystrokes and clipboard data in real-time.

Step 5: Access the Hacker Panel

After a successful "Advanced Hack," a button will appear to "Access Hacker Panel." This simulates what an attacker sees, allowing them to use any stolen credentials to try and log in.