lab
Small, contained sandboxes for the concepts security engineers deal with daily -- the kind you use constantly but rarely see animated. Pick a mode, run it, watch what actually changes. Everything here is entirely client-side and simulated unless a lab says otherwise on its own page -- one of the labs below has a small, clearly-labeled live component, and it says so up front.
Policy Console Sandbox
Eight generic policy modules — forwarding, URL filtering, DNS, cloud app control, and more — one core skill practiced in each: trace which rule fires in a table, read top-down, first match wins.
Forward Proxy vs. Reverse Proxy
Watch the same request animate hop by hop through a forward proxy and then a reverse proxy, and see exactly what each hop knows: destination visibility, where TLS terminates, what headers get added. The vocabulary you use daily, finally drawn out.
What a DNS Query Leaks
Build a real DNS query byte by byte, send it over plaintext, DNS-over-TLS, or DNS-over-HTTPS, and see which observers stop being able to read the hostname -- and which one never does, no matter which transport you pick.
What TLS Inspection Actually Sees
Toggle inspection on and off against a simulated HTTPS connection. SNI, certificate, and body -- see exactly which one changes when a proxy terminates and re-signs the connection, and which one was never hidden in the first place.
How Cloudflare Sees Your Request
Part one is real: see the actual headers Cloudflare's edge just added to the request that loaded this page. Part two is a labeled simulation of how you'd stop someone from bypassing that edge and hitting your origin directly.
be first to know
One email when a new lab or tool ships -- and the one-page PAC troubleshooting cheat sheet lands in your inbox the moment you confirm.
ack — check your inbox for a confirmation link.
One confirmation email, then you're in. Unsubscribe anytime.