CyberCode Academy

In this lesson, you’ll learn about: how web scraping unlocks hidden web data, real-world applications, and the essential tools used to build scraping systems1. What is Web Scraping?🔹 Definition: Web scraping is the process of automatically extracting data from websites👉 Key idea It turns the internet into a massive, queryable database, even when no API exists2. Why Web Scraping Matters🔹 Problem...

In this lesson, you’ll learn about: auditing Node.js applications using manual code review techniques and automated static analysis tools to identify security vulnerabilities1. What is Node.js Application Auditing?🔹 Purpose: Systematically review a Node.js codebase to find security weaknesses before attackers do🔹 Two main approaches: Manual code review Automated static analysis 👉 Key idea Real...

In this lesson, you’ll learn about: securing Node.js applications through safe coding practices, HTTP security headers, ReDoS protection, and preventing information disclosure1. Secure Coding in Node.js🔹 Key idea: Secure Node.js applications require strict control over execution context and defaults.🔹 Strict Mode Enables safer JavaScript execution Prevents accidental global variables Forces expl...

In this lesson, you’ll learn about: critical Node.js vulnerabilities caused by unsafe user input handling, including RCE, command injection, XSS, and directory traversal1. Core Security Principle🔹 Key idea: Never trust user input👉 Any data from users must be treated as hostile by default Without validation, it can become a direct execution path into the system.2. Remote Code Execution (RCE) via...

In this lesson, you’ll learn about: Node.js runtime architecture, single-threaded execution risks, global scope vulnerabilities, and HTTP Parameter Pollution (HPP)1. What is Node.js?🔹 Definition: A JavaScript runtime built on: Node.js Chrome V8 engine 🔹 Purpose: Run JavaScript outside the browser Build scalable server-side applications 👉 Key Insight Node.js is not a framework—it’s a runtime env...

In this lesson, you’ll learn about: Same Origin Policy (SOP), its controlled exceptions, and how attackers exploit it using SOME via Flash callbacks1. What is the Same Origin Policy (SOP)🔹 Definition: A core browser security rule that restricts how documents interact 🔹 Enforced in: Web Browsers 🔹 Rule: Two URLs can interact only if all match: Protocol (HTTP / HTTPS) Host (domain) Port 👉 Key In...

In this lesson, you’ll learn about: window.opener risks, phishing via tab manipulation, and Same Origin Method Execution (SOME)1. What is window.openerUsing JavaScript:🔹 Definition: A property that gives a newly opened tab access to its parent tab 🔹 When it exists: When a link uses target="_blank" 👉 Key Insight A child tab can control or modify the parent tab2. Why window.opener is Dangerous🔹...

In this lesson, you’ll learn about: Reflected File Download (RFD), Mutation XSS (mXSS), and Relative Path Overwrite (RPO) XSS1. Reflected File Download (RFD)🔹 Definition: A vulnerability where user input is reflected into a response that the browser treats as a downloadable file 🔹 How it works (high-level): Attacker crafts a URL Server reflects input into response Browser downloads it as a file...

In this lesson, you’ll learn about: bypassing weak RCE filters and understanding JSON hijacking (legacy browser vulnerability)1. Why RCE Filters Fail🔹 Common mistake: Developers block specific characters (like ;) 🔹 Problem: Attack surface is much larger than one delimiter 👉 Key Insight Blacklisting single characters is not real security2. Alternative Command Operators🔹 Even if ; is blocked, ot...

In this lesson, you’ll learn about: Remote Command Execution (RCE), blind exploitation techniques, and defensive strategies against command injection1. What is Remote Command Execution (RCE)🔹 Definition: A vulnerability where user input is executed as an OS command 🔹 Common in: Python → os.system Node.js → exec PHP → shell_exec 👉 Key Insight RCE = user controls what the server executes2. Root C...

In this lesson, you’ll learn about: REST limitations, GraphQL fundamentals, and the hybrid approach with Graphiti1. The Problem with REST APIsUsing REST:🔹 Key limitations: Overfetching Client receives more data than needed Underfetching Requires multiple requests to get all data No strict typing Errors happen at runtime Heavy reliance on documentation 👉 Key Insight REST is simple and scalable—bu...

In this lesson, you’ll learn about: API pagination, versioning strategies, and building scalable Rails APIs1. Why Pagination Is EssentialUsing Ruby on Rails APIs:🔹 Problem: Returning large datasets (thousands of records) Slow responses + heavy database load 🔹 Solution: Break data into pages (chunks) 👉 Key Insight Pagination improves performance, speed, and user experience2. How Pagination Works...

In this lesson, you’ll learn about: modular JSON generation, JBuilder templates, and reusable API response structures1. The Problem with as_jsonUsing Ruby on Rails default serialization:🔹 Issue: Models become bloated with formatting logic Business logic + presentation logic get mixed 🔹 Example problem:def as_json super.merge(custom_data: ...) end 👉 Key Insight Models should handle data, not how...

In this lesson, you’ll learn about: multi-format responses, JSON serialization, and building clean, reusable Rails API controllers1. Multi-Format Controller ResponsesUsing Ruby on Rails:🔹 Problem: Different clients need different formats Browser → HTML Mobile app → JSON External systems → XML 🔹 Solution: Use respond_to def show @user = User.find(params[:id]) respond_to do |format| format.html fo...

In this lesson, you’ll learn about: securing APIs in Rails, authentication strategies, and building a stateless authorization system1. Why API Security MattersUsing Ruby on Rails APIs:🔹 Problem: APIs are publicly exposed endpoints Without protection → anyone can access or manipulate data 🔹 Goal: Ensure only authorized users can interact with resources 👉 Key Insight An unsecured API is essential...

In this lesson, you’ll learn about: system (end-to-end) testing in Ruby on Rails, simulating real browser interactions and validating full user experience1. What Is System (End-to-End) Testing? Using Ruby on Rails:🔹 Definition: Tests the application through a real browser 🔹 Difference: Unit → single component Integration → backend flow System → full user experience (UI + backend) 👉 Key Insight...

In this lesson, you’ll learn about: transitioning from unit tests to full integration testing in Ruby on Rails, simulating real user workflows and validating complete application behavior1. What Is Integration Testing? Using Ruby on Rails:🔹 Definition: Tests how multiple components work together 🔹 Difference from unit tests: Unit → test isolated parts Integration → test full workflows 👉 Key Ins...

In this lesson, you’ll learn about: building a robust unit testing suite in Ruby on Rails, including methodology, debugging, and test optimization1. The 3-Step Testing MethodologyUsing Ruby on Rails:🔹 Step 1: Identify what to test Function Model Controller 🔹 Step 2: Choose inputs Realistic, production-like data 🔹 Step 3: Verify output Compare expected vs actual results 👉 Key Insight Every test...

In this lesson, you’ll learn about: setting up a robust testing environment in Ruby on Rails using isolated databases, parallel execution, and dynamic test data generation1. Project Overview (Testing Context)Using Ruby on Rails:🔹 Application features: User profiles Swipe functionality Mobile-first design 🔹 Frontend: Powered by Vue.js 👉 Key Insight Testing must reflect real-world usage, especial...

In this lesson, you’ll learn about: implementing user feedback systems in Ruby on Rails using flash messages, validation errors, and UI styling1. The Problem: Lost Feedback After Redirects🔹 Common issue: Messages like “Login Failed” disappear after page reload 🔹 Cause: Standard variables don’t persist across redirects 👉 Key Insight User feedback must survive redirects to be effective2. Flash St...

In this lesson, you’ll learn about: session management, secure data storage, and protection against CSRF attacks in Ruby on Rails1. Understanding SessionsUsing Ruby on Rails:🔹 Definition: Sessions allow the app to remember users across requests 🔹 Example: User logs in once → stays logged in while navigating 👉 Key Insight HTTP is stateless, so sessions provide continuity for user identity2. Mana...

In this lesson, you’ll learn about: building a secure, membership-based Ruby on Rails application with authentication, encryption, and password recovery1. Building the News Feed FoundationUsing Ruby on Rails:🔹 Core idea: Create a news feed app that fetches live data 🔹 Technology: RSS integration (e.g., Google News feeds) 👉 Key Insight Start with a functional app, then layer security on top2. Re...

In this lesson, you’ll learn about: rapid resource building in Ruby on Rails using scaffolding and manual prototyping, and how to balance speed with control1. Understanding CRUD Operations🔹 Core actions: Create → add new data Read → retrieve data Update → modify data Delete → remove data 👉 Key Insight CRUD operations are the foundation of every web application2. The Power of ScaffoldingUsing Rub...

In this lesson, you’ll learn about: enforcing low-level business rules in Ruby on Rails using validations, database constraints, and lifecycle hooks to ensure strong data integrity1. Understanding Business Rules🔹 Definition: Business rules = constraints that define how data should behave 🔹 Focus: Low-level rules → apply directly to model attributes 🔹 Examples: A name must exist A ticker symbol...

In this lesson, you’ll learn about: data modeling and resource management in Ruby on Rails, from conceptual design to real-world implementation and testing1. Conceptual Data Modeling🔹 Core concepts: Entities → represent real-world objects (e.g., Company, Stock) Attributes → properties of entities (name, price, symbol) Data types → string, integer, decimal, etc. 🔹 Key elements: Primary Key (ID) →...