For IT and security teams
Version 2026.10.28 · built 2026-10-28
Hacket Tracer is a free, browser-based teaching tool. It simulates attacks on example networks (IT, OT and cloud) and shows what a defender's sensors would and would not see. It is one static page. This page gives you what you need to approve it.
What it does and does not do
- Runs entirely in the visitor's browser. After the page loads it makes no network requests: no scripts, fonts, images, analytics or APIs are fetched from anywhere.
- No accounts, no cookies, no tracking. Settings, hints dismissed and Learn progress are kept in the browser's local storage on that device only.
- The scenarios are models. They contain no exploit code, payloads or working attack tooling. Addresses are example or documentation addresses unless a scenario says it uses a published indicator.
- The only links that leave the site are plain links to public security write-ups, opened only if a user clicks them.
What to allow
| Item | Value |
|---|---|
| Hostname | hackettracer.com (port 443 only) |
| Other hostnames needed | None |
| Suggested category | Education, or Computer and Internet Information |
| Method | GET only. There is no upload, form or API. |
How the page is protected
The server sends these headers. They also lock the page down so it cannot load or send anything it should not:
Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'none'; font-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none' Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Referrer-Policy: no-referrer Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()
'unsafe-inline' is present only because the page is a single file with its script and styles inline.
Host it yourself
If your policy is to run tools internally, or the network is air-gapped, you do not need our server. Download the single file, check it, and put it on any static web server or open it from disk.
- hacket-tracer-2026.10.28.html (one file, no dependencies)
- SHA256SUMS and signature (see the next section)
- Software bill of materials (CycloneDX). There are no third-party components.
Verify the download
sha256sum -c SHA256SUMS # This release is not signed; rely on the checksum published on this page.
Compare the checksum above with the one published on this page over HTTPS. A mismatch means the file changed; do not run it.
Accessibility, privacy and reporting
- Privacy: the page collects nothing. There is nothing to export or delete on our side.
- Accessibility: controls have keyboard shortcuts and there are light and dark themes, but the network map itself is drawn on a canvas and has known gaps for screen-reader users. A formal VPAT is not yet available; ask us and we will share the known gaps.
- Report a security issue or a wrong fact: terrysmith@praeviamail.com. Our security.txt has the details.