CyberCode Academy

In this lesson, you’ll learn about: how the web actually works under the hood, how data travels via HTTP, and how to programmatically capture it using Python1. Prerequisites for Web Scraping🔹 What You Need to KnowBefore scraping, you should be comfortable with: Python 3 HTML structure CSS basics 👉 Why it matters Scraping is not guessing—it’s reading and navigating structured documents2. How the...

In this lesson, you’ll learn about: why JavaScript breaks traditional scrapers, how to detect dynamic content issues, and the tools used to scrape modern interactive websites1. Why Traditional Scraping Fails on Modern Websites🔹 The Core ProblemLibraries like Requests and Scrapy: Only download initial HTML Do NOT execute JavaScript 👉 Result: Missing data Empty elements Incomplete pages 🔹 What Ac...

In this lesson, you’ll learn about: building scalable scraping systems with Scrapy, mastering selectors in real time, and designing efficient, production-ready spiders1. What is Scrapy (and Why It Matters)?🔹 The Framework ApproachUse Scrapy Not just a library → a full scraping engine Handles: Requests scheduling Data pipelines Middleware Concurrency 👉 Key Insight Scrapy follows the Hollywood Pri...

In this lesson, you’ll learn about: setting up a professional Python scraping environment, extracting web data step-by-step, and transforming raw HTML into structured datasets1. Setting Up Your Development Environment🔹 Python Version ManagementUse pyenv Install and switch between Python versions بسهولة Avoid compatibility issues across projects 🔹 Virtual Environments & DependenciesUse pipenv...

In this lesson, you’ll learn about: the legality and ethics of web scraping, the difference between scraping and hacking, and how to stay safe while collecting data1. What is Web Scraping (Revisited)?🔹 Definition: Web scraping is automated web browsing—using code to collect data just like a human would, but at scale👉 Key Insight If a human can view and copy it, a script can usually extract it fa...

In this lesson, you’ll learn about: how to extract precise data from web pages using selectors, how CSS and XPath differ, and how to apply them effectively with real browser tools1. What is Data Extraction (“SQL for the Web”)🔹 Core IdeaData extraction is about selecting exactly what you want from a web page—just like SQL queries select rows from a database. Using tools like Beautiful Soup, you ca...

In this lesson, you’ll learn about: how automated data collection works, the fundamentals of HTTP, and how to build dynamic scraping workflows1. Human vs. Automated Browsing🔹 Human browsing: Click links Scroll pages View images Manually extract information 🔹 Automated browsing (web scraping): Send requests to servers Download raw HTML Parse structured data Store results automatically 👉 Key Insi...

In this lesson, you’ll learn about: how web scraping unlocks hidden web data, real-world applications, and the essential tools used to build scraping systems1. What is Web Scraping?🔹 Definition: Web scraping is the process of automatically extracting data from websites👉 Key idea It turns the internet into a massive, queryable database, even when no API exists2. Why Web Scraping Matters🔹 Problem...

In this lesson, you’ll learn about: auditing Node.js applications using manual code review techniques and automated static analysis tools to identify security vulnerabilities1. What is Node.js Application Auditing?🔹 Purpose: Systematically review a Node.js codebase to find security weaknesses before attackers do🔹 Two main approaches: Manual code review Automated static analysis 👉 Key idea Real...

In this lesson, you’ll learn about: securing Node.js applications through safe coding practices, HTTP security headers, ReDoS protection, and preventing information disclosure1. Secure Coding in Node.js🔹 Key idea: Secure Node.js applications require strict control over execution context and defaults.🔹 Strict Mode Enables safer JavaScript execution Prevents accidental global variables Forces expl...

In this lesson, you’ll learn about: critical Node.js vulnerabilities caused by unsafe user input handling, including RCE, command injection, XSS, and directory traversal1. Core Security Principle🔹 Key idea: Never trust user input👉 Any data from users must be treated as hostile by default Without validation, it can become a direct execution path into the system.2. Remote Code Execution (RCE) via...

In this lesson, you’ll learn about: Node.js runtime architecture, single-threaded execution risks, global scope vulnerabilities, and HTTP Parameter Pollution (HPP)1. What is Node.js?🔹 Definition: A JavaScript runtime built on: Node.js Chrome V8 engine 🔹 Purpose: Run JavaScript outside the browser Build scalable server-side applications 👉 Key Insight Node.js is not a framework—it’s a runtime env...

In this lesson, you’ll learn about: Same Origin Policy (SOP), its controlled exceptions, and how attackers exploit it using SOME via Flash callbacks1. What is the Same Origin Policy (SOP)🔹 Definition: A core browser security rule that restricts how documents interact 🔹 Enforced in: Web Browsers 🔹 Rule: Two URLs can interact only if all match: Protocol (HTTP / HTTPS) Host (domain) Port 👉 Key In...

In this lesson, you’ll learn about: window.opener risks, phishing via tab manipulation, and Same Origin Method Execution (SOME)1. What is window.openerUsing JavaScript:🔹 Definition: A property that gives a newly opened tab access to its parent tab 🔹 When it exists: When a link uses target="_blank" 👉 Key Insight A child tab can control or modify the parent tab2. Why window.opener is Dangerous🔹...

In this lesson, you’ll learn about: Reflected File Download (RFD), Mutation XSS (mXSS), and Relative Path Overwrite (RPO) XSS1. Reflected File Download (RFD)🔹 Definition: A vulnerability where user input is reflected into a response that the browser treats as a downloadable file 🔹 How it works (high-level): Attacker crafts a URL Server reflects input into response Browser downloads it as a file...

In this lesson, you’ll learn about: bypassing weak RCE filters and understanding JSON hijacking (legacy browser vulnerability)1. Why RCE Filters Fail🔹 Common mistake: Developers block specific characters (like ;) 🔹 Problem: Attack surface is much larger than one delimiter 👉 Key Insight Blacklisting single characters is not real security2. Alternative Command Operators🔹 Even if ; is blocked, ot...

In this lesson, you’ll learn about: Remote Command Execution (RCE), blind exploitation techniques, and defensive strategies against command injection1. What is Remote Command Execution (RCE)🔹 Definition: A vulnerability where user input is executed as an OS command 🔹 Common in: Python → os.system Node.js → exec PHP → shell_exec 👉 Key Insight RCE = user controls what the server executes2. Root C...

In this lesson, you’ll learn about: REST limitations, GraphQL fundamentals, and the hybrid approach with Graphiti1. The Problem with REST APIsUsing REST:🔹 Key limitations: Overfetching Client receives more data than needed Underfetching Requires multiple requests to get all data No strict typing Errors happen at runtime Heavy reliance on documentation 👉 Key Insight REST is simple and scalable—bu...

In this lesson, you’ll learn about: API pagination, versioning strategies, and building scalable Rails APIs1. Why Pagination Is EssentialUsing Ruby on Rails APIs:🔹 Problem: Returning large datasets (thousands of records) Slow responses + heavy database load 🔹 Solution: Break data into pages (chunks) 👉 Key Insight Pagination improves performance, speed, and user experience2. How Pagination Works...

In this lesson, you’ll learn about: modular JSON generation, JBuilder templates, and reusable API response structures1. The Problem with as_jsonUsing Ruby on Rails default serialization:🔹 Issue: Models become bloated with formatting logic Business logic + presentation logic get mixed 🔹 Example problem:def as_json super.merge(custom_data: ...) end 👉 Key Insight Models should handle data, not how...

In this lesson, you’ll learn about: multi-format responses, JSON serialization, and building clean, reusable Rails API controllers1. Multi-Format Controller ResponsesUsing Ruby on Rails:🔹 Problem: Different clients need different formats Browser → HTML Mobile app → JSON External systems → XML 🔹 Solution: Use respond_to def show @user = User.find(params[:id]) respond_to do |format| format.html fo...

In this lesson, you’ll learn about: securing APIs in Rails, authentication strategies, and building a stateless authorization system1. Why API Security MattersUsing Ruby on Rails APIs:🔹 Problem: APIs are publicly exposed endpoints Without protection → anyone can access or manipulate data 🔹 Goal: Ensure only authorized users can interact with resources 👉 Key Insight An unsecured API is essential...

In this lesson, you’ll learn about: system (end-to-end) testing in Ruby on Rails, simulating real browser interactions and validating full user experience1. What Is System (End-to-End) Testing? Using Ruby on Rails:🔹 Definition: Tests the application through a real browser 🔹 Difference: Unit → single component Integration → backend flow System → full user experience (UI + backend) 👉 Key Insight...

In this lesson, you’ll learn about: transitioning from unit tests to full integration testing in Ruby on Rails, simulating real user workflows and validating complete application behavior1. What Is Integration Testing? Using Ruby on Rails:🔹 Definition: Tests how multiple components work together 🔹 Difference from unit tests: Unit → test isolated parts Integration → test full workflows 👉 Key Ins...

In this lesson, you’ll learn about: building a robust unit testing suite in Ruby on Rails, including methodology, debugging, and test optimization1. The 3-Step Testing MethodologyUsing Ruby on Rails:🔹 Step 1: Identify what to test Function Model Controller 🔹 Step 2: Choose inputs Realistic, production-like data 🔹 Step 3: Verify output Compare expected vs actual results 👉 Key Insight Every test...