CyberCode Academy

In this lesson, you’ll learn about managing identity and access in Microsoft Azure, aligned with the AZ-500 certification, with a strong focus on security and privileged access control:Azure Active Directory Identity Protection Detecting and responding to risky sign-ins and accounts, such as: Logins from anonymous IPs (e.g., via Tor) Unusual behavior or leaked credentials Identifying vulnerabiliti...

In this lesson, you’ll learn about securing and managing hybrid identities using Azure Active Directory, bridging on-premises infrastructure with cloud services:Identity Security and Access Control Conditional Access & MFA: Define access policies based on conditions like location, device state, or risk level Enforce Multi-Factor Authentication (MFA) or block suspicious logins Azure AD Password...

In this lesson, you’ll learn about: Azure Active Directory (Azure AD) fundamentals, including its role as a centralized identity and access management platform for users, groups, and applications. Architecture and licensing tiers, understanding the differences between: Free Basic Premium P1 Premium P2 (advanced security capabilities) Identity management in Azure AD: Managing users (internal, Micro...

In this lesson, you’ll learn about a defense-in-depth approach against Elevation of Privilege (EoP) attacks, highlighting strategies to make systems resilient even when some components are compromised:Core Philosophy Only immutable, compiled strings are fully trustworthy. All other input—environment variables, network data, DNS responses, user input—must be treated as potentially hostile. Multi-La...

In this lesson, you’ll learn about: Elevation of Privilege (EoP), where attackers gain unauthorized access—ranging from executing limited commands to achieving full administrative or root control. The role of untrusted input: How attackers manipulate input to trick systems into treating data as executable code. Why input validation failures are a primary cause of privilege escalation. How parsers...

In this lesson, you’ll learn about: Building resilient systems, focusing on availability, stability, and the ability to withstand failures and high load conditions. Load and stress testing: Ensuring systems can handle traffic spikes and node failures. Simulating real-world scenarios to validate system behavior under pressure. Resilience as a system property: Understanding usage patterns (e.g., per...

In this lesson, you’ll learn about: Modern Denial of Service (DoS) challenges across emerging technologies, including mobile networks, IoT devices, and cloud infrastructure. Mobile and IoT DoS scenarios: How outages can occur accidentally in high-density situations (e.g., large events or disasters). How these disruptions may appear like attacks from both user and server perspectives. Physical limi...

In this lesson, you’ll learn about: Core dimensions of Denial of Service (DoS) attacks, including how attacks differ in duration, sophistication, and resource usage. Persistent vs. transient attacks: Persistent attacks cause long-lasting damage that requires manual intervention (e.g., disk exhaustion, battery drain). Transient attacks only impact the system while the attack is active (e.g., networ...

In this lesson, you’ll learn about: Denial of Service (DoS) attacks, and how they target the availability pillar of the CIA triad by exhausting critical system resources. Network bandwidth exhaustion, where attackers flood infrastructure with massive traffic volumes (large or high-frequency packets) to overwhelm connectivity and block legitimate access. CPU and memory exhaustion, including: Fork b...

In this lesson, you’ll learn about mastering Burp Suite for professional web application security testing: Burp Suite Editions: Community Edition Professional Edition Enterprise Edition Installation steps, Java setup, browser proxy configuration, and installing the Burp SSL certificate for HTTPS interception Core Components and Manual Testing Tools: Proxy & Dashboard: Intercepting, modifying,...

In this lesson, you’ll learn about key Firefox extensions that enhance productivity, privacy, and browsing customization: Open Multiple URLs: Quickly launch a list of websites at once, saving time during research or testing. Proxy SwitchyOmega: Simplifies managing multiple proxy profiles, allowing fast switching between networks. User Agent Switcher and Manager: Spoofs browser user-agent strings t...

In this lesson, you’ll learn about: Common network “low-hanging fruit” vulnerabilities, including: Anonymous FTP access Guest SMB shares Default credentials across services like SSH, RDP, and databases such as MySQL, PostgreSQL, and Microsoft SQL Server The risks of credential reuse across multiple systems Clear-text traffic risks, understanding how tools like Wireshark can reveal sensitive creden...

In this lesson, you’ll learn about: Core web technologies and protocols, and how they directly impact web application security and penetration testing methodologies. Hypertext Transfer Protocol (HTTP) fundamentals, including: Its stateless, request–response architecture The evolution from HTTP/1.0 to HTTP/3 Common request methods such as GET and POST Status code classes (1xx–5xx) and what they rev...

In this lesson, you’ll learn about: Metasploitable 2, an intentionally vulnerable Ubuntu-based virtual machine designed for safely practicing penetration testing techniques in a controlled lab. Structured reconnaissance and enumeration, using tools like Nmap to identify open ports, detect service versions, and map the attack surface before attempting exploitation. Service version detection and exp...

This episode explores the fundamental web files and extensions that are critical for both web development and security enumeration. It provides a detailed breakdown of how automated programs, such as search engine crawlers, interact with web servers and how these interactions can reveal sensitive information. Key topics include: Instructional Web Files: The episode covers robots.txt, which provide...

In this lesson, you’ll learn about: Web application penetration testing workflows, focusing on discovering hidden resources, identifying vulnerabilities, and validating security weaknesses in authorized testing environments. Content discovery tools, including: DirBuster for dictionary-based directory and file enumeration. Dirb (often referenced similarly in labs) for brute-forcing hidden paths. Vu...

In this lesson, you’ll learn about: Banner grabbing (service fingerprinting), a technique used to identify open ports, running services, and version information exposed by a target system. How service banners work, understanding that many network services return text-based responses revealing software type, version numbers, and sometimes operating system details. Active vs. passive banner grabbing...

In this lesson, you’ll learn about: The early phases of a penetration test, focusing on intelligence gathering, infrastructure mapping, and active scanning techniques. Open Source Intelligence (OSINT), collecting actionable data from publicly available sources without directly interacting with the target system. Google hacking (dorking), using advanced search operators like site:, filetype:, and i...

In this lesson, you’ll learn about: Open Web Application Security Project (OWASP), an open community focused on improving software security through standards, tools, and best practices. The OWASP Top 10, a widely recognized awareness document outlining the most critical web application security risks. Common web application vulnerabilities, including: Injection flaws (e.g., SQL injection) Broken a...

In this lesson, you’ll learn about: Steganography fundamentals, the practice of concealing information inside other media files such as images, audio, or video without visibly altering the carrier file. Manual hiding techniques, including simple visual tricks like matching font color to background color and appending hidden data to files using command-line utilities. Least Significant Bit (LSB) st...

In this lesson, you’ll learn about: Data Representation and Encoding: ASCII: Uses 128 unique values to represent text characters in computing. Base64: Encodes binary data into text form for safe transfer across text-only channels like email or HTML. Numerical Systems in Computing: Binary (Base 2): Uses 0 and 1, fundamental to machine operations. Decimal (Base 10): Standard human-readable numbering...

In this lesson, you’ll learn about: Tradecraft Fundamentals: The structured set of tools, techniques, and methods used in modern intelligence gathering and espionage. Key Categories of Tradecraft: Agent Handling: Managing human assets for intelligence collection. Analytic Tradecraft: Techniques for correlating, validating, and interpreting collected intelligence. Black Bag Operations: Covert entri...

In this lesson, you’ll learn about: The structured penetration testing lifecycle, a professional methodology that simulates real-world attacks while delivering measurable value to an organization. Pre-engagement interactions, including: Defining scope and boundaries Establishing timelines Securing written authorization Formalizing the Rules of Engagement (ROE) and Statement of Work (SOW) to ensure...

In this lesson, you’ll learn about: Core penetration testing terminology, including the difference between a vulnerability (a weakness in a system) and an exploit (the method used to leverage that weakness). Payload concepts, understanding how attackers deliver custom code to a target system after successful exploitation. Shellcode fundamentals, the low-level assembly instructions often embedded w...

In this lesson, you’ll learn about: Red vs. Blue Team operations, where Red Teams simulate adversarial attacks to uncover weaknesses, and Blue Teams defend, detect, and validate the effectiveness of security controls. The progression from vulnerability scanning to assessments, understanding how automated scans identify weaknesses, while vulnerability assessments prioritize and analyze risk without...