ForenShield Workshop
The Cyber Workshop
44 tools, 6 simulations and 15 modules in one place. Search by topic, or let us guide you.
- Free, no account
- Real attacks, real tools
- Your progress stays in this browser
Your logbook
- Steps done
- 0/24
- Routes completed
- 0/6
- Simulations completed
- 0/6
- Modules seen
- 0/15
Everything starts at zero: tick a step to unlock your first badge.
Badges
- First step : locked. Tick a step.
- Route completed : locked. Finish a route.
- Three areas : locked. One step done in each area.
- First simulation : locked. Finish a lab simulation.
- Flawless : locked. Score 100% in a simulation.
- Full lab : locked. Finish all six simulations.
Let us guide you
Where to start?
Pick what fits you best: a route of a few steps, to tick off as you go.
All in one place
The catalog
On each topic: understand, practice, then analyze for real.
- UnderstandAwareness15A threat explained in a few minutes, with its demonstration.
- PracticeInteractive lab6Real attacks to replay, risk-free, with a score.
- AnalyzeToolbox44Your own e-mails, URLs and logs, right in the browser.
65 results
E-mails and phishing7
2 modules1 simulation4 tools
- Module≈ 5 minPhishingA fraudulent email step by step, a fake Microsoft page annotated with 6 red flags, and a simulated vishing call with automatic script playback.
- Module≈ 5 minSession Hijacking · AiTM PhishingEven with MFA enabled, an AiTM proxy steals the session cookie after validation. Step-by-step simulation, Twilio/Cloudflare case study and FIDO2 protection.
- Simulation≈ 45 minPhishing LabInvestigate e-mails based on real campaigns: AiTM, device code, ClickFix. Raw headers, SPF, DKIM, DMARC and indicators to collect.
- ToolEmail Analyzer (.eml)Analyze an .eml file for free: SPF, DKIM, DMARC, IOC extraction and phishing detection.
- ToolSafeLinks and Proofpoint DecoderReveal the real destination of a Microsoft SafeLinks or Proofpoint link without visiting it, right in your browser.
- ToolSuspicious URL Analyzer (Sandbox)Analyze a suspicious URL for free: multi User-Agent sandbox, cloaking and malicious redirect detection.
- ToolOffice Document AnalyzerSpot VBA macros, exploits and OLE objects in a Word, Excel, PowerPoint, RTF or PDF document without opening it.
Detection and incident response10
2 modules3 simulations5 tools
- Module≈ 8 minRansomwareIntrusion, spread, wave encryption and ransom note: follow every phase of a ransomware attack and its concrete impact.
- Module≈ 4 minKeyloggerThree keystroke-capture variants - software, a rigged USB cable and a browser extension - with exfiltration to a C2 server.
- Simulation≈ 40 minIncident LabReplay a real LockBit attack: search the logs, contain in the right order, then get your report.
- Simulation≈ 35 minSOC LabHold an analyst seat on a real intrusion: Windows log queries, correlation, false positives and escalation decisions to own.
- Simulation≈ 50 minForensic LabWalk back through a real intrusion, week by week: processes, network, files, Windows artifacts, commands to decode.
- ToolWindows Event ID ReferenceInteractive reference of 358 Windows Event IDs: 4624, 4625, 4688, 4698, 7045 and more for forensics (entries in French).
- ToolXQL Assistant (Cortex XDR and XSIAM)Build, check and reuse your XQL queries for Cortex XDR and XSIAM.
- ToolAlert Closure MemosGenerate structured memos for closing security incidents.
- ToolCompromise DiagramCreate interactive compromise diagrams to visualize attacks.
- TooliOS App Analyzer (.ipa)Static security analysis of iOS applications (.ipa): about fifty OWASP MASVS checks, in your browser.
OSINT and investigation5
1 simulation4 tools
- Simulation≈ 40 minOSINT LabFollow the method of a real investigation into a network of sites: DNS, certificates, shared identifiers, and a graph built evidence by evidence.
- ToolDomain OSINTFree domain OSINT: WHOIS, DNS, email, subdomains, lookalike domains, hosting, security headers and pivots.
- ToolInstagram Profile OSINTView an Instagram profile's public data: bio, counters, recent posts and HD profile picture, with no login.
- ToolPhone Number OSINTCheck a number: country, line type, premium-rate, telemarketing, callback scams and an explained risk score.
- ToolOSINT Investigation MapOrganize your OSINT investigations: an identifier graph linked to an interactive map, running in your browser.
Flaws and threat watch6
1 simulation5 tools
- Simulation≈ 35 minCVE LabReal flaws with their real CVSS, EPSS and KEV data: adjust your context and build a remediation plan you can defend.
- ToolCVE DatabaseSearch a CVE by identifier, product or keyword and prioritize it: CVSS, EPSS, CISA KEV, ransomware, PoCs and fixes.
- ToolContextualized CVSS CalculatorCalculate and contextualize CVSS v3.1 scores to prioritize your patch management.
- ToolDIC(T) Impact AnalysisAssess the impact of a security incident using the 4 DIC(T) criteria: Availability, Integrity, Confidentiality, Traceability.
- ToolPHP Version CheckerFind a website's PHP version and check whether it still gets security fixes.
- ToolCybersecurity Mind MapAn interactive cybersecurity mind map: 11 domains and about 130 concepts to revise or train with.
Web and development13
7 modules6 tools
- Module≈ 4 minSQL InjectionAuthentication bypass via a SQL payload: watch the manipulated query live and apply the fix to block the attack.
- Module≈ 4 minXSS · Cross-Site ScriptingScript injection in a forum comment, real-time session cookie theft and account takeover, illustrated.
- Module≈ 4 minXXE · XML External EntityA booby-trapped XML forces the server to read the internal .env file: database passwords, API secrets and tokens exposed in a single request.
- Module≈ 4 minSSRF · Server-Side Request ForgeryThe attacker supplies an internal URL: the server contacts its own network and returns AWS credentials. Animated step-by-step flow.
- Module≈ 3 minClickjackingAn invisible iframe overlays a legitimate button: one click confirms a €25,000 payment without the user noticing.
- Module≈ 3 minIDOR · Insecure Direct Object ReferenceChanging an identifier in the URL to access another user's confidential data with no privilege escalation at all.
- Module≈ 4 minPath TraversalReading sensitive files (.env, SSH keys, server configuration) via an uncontrolled path parameter in the URL.
- ToolHTTP Headers and TLS Certificate AnalyzerCheck the HTTP headers and SSL/TLS certificate of a website.
- ToolPage SEO AuditAudit a URL's on-page SEO: tags, headings, links, structured data, indexability. Score out of 100 and recommendations.
- ToolREST API TesterTest a REST API without Postman: 7 HTTP methods, headers, authentication, JSON or XML body, cURL export.
- ToolXML Viewer and ValidatorView, format and validate your XML documents with a collapsible tree view and reading aids.
- ToolBase64, URL and Hex DecoderDecode/encode strings in Base64, URL and hexadecimal, with multi-layer auto-decode.
- ToolAI Assistant (Your API Key)Chat with GPT, Claude, Gemini, Mistral or Llama using your own API key: the model runs at the provider.
Network8
1 module7 tools
- Module≈ 3 minCleartext TrafficInteractive Wireshark capture: Telnet, FTP and HTTP expose credentials and passwords in cleartext on the local network.
- ToolNetwork Diagnostics (DNS, TCP Ping, WHOIS)Network diagnostics: IP and ASN resolution, full DNS, propagation, TCP ping and WHOIS (RDAP).
- ToolIP Subnet CalculatorCalculate an IPv4 or IPv6 subnet: CIDR, mask, broadcast, address range and host count.
- ToolRisky Ports and Protocols ReferenceA reference of insecure ports and protocols and their modern alternatives.
- ToolMy IP AddressDisplay your public IP address and connection details.
- ToolWi-Fi QR Code GeneratorCreate your Wi-Fi QR code for free, right in your browser: your SSID and password never leave your device.
- ToolWeb SSH ClientAn SSH terminal in the browser through our WebSocket relay: keep it for test servers and temporary access.
- ToolInternet Speed TestMeasure latency, jitter, download and upload speeds against Cloudflare, with loaded latency (bufferbloat).
Passwords and data6
3 modules3 tools
- Module≈ 4 minPassword sprayingFollow every password attempt in real time, then discover what the attacker sees after the breach: mailbox, HR data and credentials.
- Module≈ 4 minPassword ReuseOne breached site is enough: stolen credentials are automatically tested via credential stuffing. With an interactive Have I Been Pwned check.
- Module≈ 3 minJuice JackingA compromised public USB station or a BadUSB cable: your charging phone can be fully exfiltrated in under 3 minutes, with no alert at all.
- ToolPassword GeneratorGenerate strong passwords with entropy calculated in real time, in your browser, with no transmission.
- ToolEphemeral Text SharingShare text or secrets securely and ephemerally.
- ToolEncrypted Ephemeral ChatCreate temporary, end-to-end encrypted, self-destructing chat rooms.
Everyday tools10
10 tools
- ToolPDF Tools (Including PDF to Word)PDF to Word (.docx), merge, split, compress, sign, watermark: 19 PDF tools running in your browser.
- ToolImage CompressorReduce the size of your images (JPEG, PNG, WEBP, SVG) locally.
- ToolImage to WebP ConverterConvert your JPG, PNG, GIF, BMP and SVG images to WebP locally, with no visible quality loss.
- ToolText ComparerCompare two texts, configs or logs: line, word or character differences, exported as .diff or HTML.
- ToolMarkdown and HTML ConverterConvert Markdown to HTML, HTML to Markdown or plain text to Markdown, with a live preview and sanitized HTML.
- ToolEmoticons and Emojis to Copy and Paste983 Unicode emoticons and emojis to copy in one click, sorted into 11 categories, with search by name and keyword.
- ToolMicrosoft Portals86 verified Microsoft admin portals (Azure, Entra ID, Defender, Intune, Purview): search and favorites.
- ToolCybersecurity Technical Interview GridRun and score a technical cybersecurity interview: 32 questions, sample answers, PDF report (entries in French).
- ToolDay Rate Revenue SimulatorEstimate your revenue from a day rate: working days, absences and billed days month by month, for one or more consultants.
- ToolChess GameFull chess game: a 5-level bot, two-player mode, online duels, a clock and PGN export.
Frequently asked questions
What is the Workshop?
The place that brings together everything you can practice on ForenShield: the toolbox, the lab and the awareness modules, sorted by topic, with a shared search and routes for your profile.
Do I need an account?
No. The routes, the lab and the awareness modules work without an account, like most of the tools.
What is the difference between a tool, a simulation and a module?
A tool analyzes your own data. A simulation has you play a real, reconstructed attack, for about 35 to 50 minutes, and no real data is analyzed. A module explains a threat in a few minutes, with a demonstration.
Is my progress sent anywhere?
No. Your ticked steps, lab scores and seen modules stay in this browser’s storage. The “Clear my steps” button removes the ticked steps.
What should I do if I think I am under attack?
Isolate the affected devices from the network without shutting them down, keep the evidence and do not pay a ransom. Then run the free diagnostic on Cybermalveillance.gouv.fr or ask for help on 17Cyber, the French public online assistance service for victims.