CyberCode Academy

In this lesson, you’ll learn about: Windows Registry artifacts and UserAssist forensics1. Why Registry Artifacts Matter The Windows Registry stores hidden traces of user activity Investigators use it to reconstruct: User behavior Application usage System timelines 🔹 Key Idea Every click and execution leaves a forensic footprint 2. Common Digital Footprints in Windows🔹 Types of artifacts Internet...

In this lesson, you’ll learn about: Windows Registry structure and forensic analysis1. What is the Windows Registry? A centralized configuration database in Windows Stores system, user, and application settings 🔹 Core Idea Think of it as the brain of Windows configuration 2. Registry StructureThe registry is organized in a strict hierarchy:🔹 Components Hives Keys Subkeys Values 🔹 Analogy Hive →...

In this lesson, you’ll learn about: Windows Security Identifiers (SIDs) and user tracking1. What is a Security Identifier (SID)? A SID (Security Identifier) is a unique value assigned to every: User Group Security principal (system accounts, services) 🔹 Core Idea It acts like a permanent digital fingerprint in Windows Used internally instead of usernames 👉 Key Property: A SID is never reused, ev...

In this lesson, you’ll learn about: memory forensics and RAM analysis1. Why Memory Forensics Matters RAM (volatile memory) is one of the most valuable forensic sources It contains data that disappears after shutdown 🔹 What RAM can reveal Running processes Active network connections Command history Encryption keys Malware behavior in real time 👉 Key Idea: If disk is “history,” RAM is live truth 2...

In this lesson, you’ll learn about: forensic imaging using the DD utility1. What is DD (Data Dumper)? A low-level command-line tool used for bit-by-bit copying Commonly used in digital forensics imaging 🔹 Core Function Copies data from: Input → Output Without interpreting or modifying it 👉 Key Idea: It creates an exact raw duplicate of data 2. Basic DD Syntax🔹 Core Parameters if= → input source...

In this lesson, you’ll learn about: Windows forensic imaging and data structure fundamentals1. What is Forensic Imaging? A bit-by-bit, sector-by-sector copy of a storage device Captures everything, not just visible files 🔹 What it Includes Active files and folders Deleted files Unallocated space Slack space 👉 Key Difference: Not a backup → it is an exact forensic replica 2. Why Forensic Imaging...

In this lesson, you’ll learn about: digital forensics in Windows environments1. What is Digital Forensics? Also known as computer forensics The application of scientific methods to digital investigations 🔹 Core Objectives Identify digital evidence Preserve its integrity Analyze findings Present results for legal use 👉 Key Idea: Evidence must be accurate, repeatable, and legally admissible 2. Why...

In this lesson, you’ll learn about: social engineering attacks and spear-phishing execution1. What is Social Engineering? A psychological attack technique Targets human behavior instead of systems Exploits trust, urgency, and curiosity 👉 Goal: Trick the victim into revealing information or executing malicious actions 2. Phase 1: Reconnaissance (Information Gathering)🔹 Target Profiling Collect Pe...

In this lesson, you’ll learn about: reconnaissance using Recon-ng1. What is Recon-ng? A full-featured web reconnaissance framework Pre-installed on Kali Linux Designed to automate OSINT and domain reconnaissance 🔹 Core Concept Works like a framework (similar to Metasploit) Uses modules to perform different recon tasks 👉 Purpose: Build a structured database of target intelligence 2. Tool Overview...

In this lesson, you’ll learn about: information gathering using theHarvester1. What is theHarvester? A reconnaissance tool used for Open Source Intelligence (OSINT) Built into Kali Linux Designed to collect publicly available data about a target 🔹 Core Function Gathers: Email addresses Subdomains IP addresses Hostnames 👉 Purpose: Build a digital footprint of the target before active testing 2. T...

In this lesson, you’ll learn about: website mirroring using HTTrack for footprinting1. What is Website Mirroring? The process of creating a local copy of a website Used for: Footprinting Reconnaissance Offline analysis 👉 Goal: Analyze the target without interacting with the live system repeatedly 2. Tool Overview HTTrack 🔹 What HTTrack Does Downloads: HTML pages Images Scripts (JavaScript, CSS)...

In this lesson, you’ll learn about: Maltego for visual footprinting and OSINT analysis1. What is Maltego? Maltego A tool used for: Information gathering (OSINT) Footprinting Visual link analysis 👉 Key idea: Instead of raw data → Maltego gives you a visual map of relationships 2. Lab Setup (Kali Linux Environment)🔹 Platform Kali Linux 🔹 Setup Steps Install Maltego Community Edition Register an a...

In this lesson, you’ll learn about: Shodan and Google Dorking (GHDB) in footprinting1. Shodan (Internet-Wide Device Discovery)🔹 What is Shodan? Shodan A search engine designed to find: Internet-connected devices Exposed services 🔹 What You Can Discover IP addresses Open ports Operating systems Device types (e.g., routers, cameras, servers) 🔹 Example Use Case Searching for: Cisco routers Filteri...

In this lesson, you’ll learn about: network footprinting using NSlookup and WHOIS1. What is Network Footprinting? The process of gathering technical information about a target domain Focuses on: DNS data IP addresses Domain ownership 👉 Goal: Build a clear profile of the target’s infrastructure 2. Using NSlookup (DNS Intelligence)🔹 Tool Overview NSlookup A command-line tool used to query: DNS (Do...

In this lesson, you’ll learn about: footprinting, OSINT, and setting up a penetration testing lab1. Penetration Testing Methodology🔹 The First Rule: Legal Scope Before any testing: Define scope clearly Get explicit permission 👉 Why it matters: Protects you legally Defines what systems you can test Prevents unauthorized access issues 2. Footprinting & Reconnaissance🔹 Definition The process o...

In this lesson, you’ll learn about: Command & Control (C2), Actions on Objectives, and Defense in Depth1. Command & Control (C2) Phase🔹 Definition The stage where an attacker establishes a communication channel with a compromised system 🔹 Purpose Send commands to the infected machine Receive exfiltrated data Maintain persistent remote access 🔹 Evasion Techniques Attackers disguise commu...

In this lesson, you’ll learn about: Delivery, Exploitation, and Installation in the Cyber Kill Chain1. Delivery Phase (Getting the Payload to the Target)🔹 Definition The process of transferring the malicious payload to the victim 🔹 Common Delivery Methods📡 Technical Methods Using exposed services: FTP uploads Web downloads 💾 Physical Methods Infected USB drives left in: Offices Public places...

In this lesson, you’ll learn about: Active Reconnaissance and Weaponization in the Cyber Kill Chain1. Transition: From Recon to Action After passive recon, attackers move to: Active Reconnaissance → direct interaction Then → Weaponization → building attack tools 👉 This is the shift from: Collecting information → Preparing the attack 2. Active Reconnaissance (Deep Target Profiling)🔹 Definition Di...

In this lesson, you’ll learn about: reconnaissance in the Cyber Kill Chain1. What is Reconnaissance? Reconnaissance is the first phase of the Cyber Kill Chain It focuses on: Gathering information about a target 👉 Why it matters: It forms the foundation of the entire attack Poor recon = weak attack Strong recon = precise targeting 2. Passive Reconnaissance (Footprinting)🔹 Definition Collecting in...

In this lesson, you’ll learn about: cracking 64-bit software and understanding architectural differences1. Transition from 32-bit to 64-bit🔹 Register Naming Changes 32-bit: EAX, EBX, ECX 64-bit: RAX, RBX, RCX 🔹 New Registers Additional registers introduced: R8 → R15 👉 These give you: More space for data handling More efficient execution 2. Key Difference: Parameter Passing🔹 32-bit Systems Argu...

In this lesson, you’ll learn about: applying static analysis and patching to modify software behavior1. Core ConceptThis episode demonstrates how to use x64dbg with the xAnalyzer plugin to: Analyze program logic without constant execution Identify and modify key instructions Alter how a program enforces trial limitations 2. Locating Critical Logic Search for meaningful strings like: "trial period...

In this lesson, you’ll learn about: graphical static analysis and Control Flow Graphs (CFGs)Review AnswerWhen analyzing a Control Flow Graph (CFG) in x64dbg with the xAnalyzer plugin:🔹 What Green and Red Arrows Represent Green arrows Represent the successful condition (TRUE branch) The path taken when a comparison or condition is met Red arrows Represent the failed condition (FALSE branch) The pa...

In this lesson, you’ll learn about: setting up a reverse engineering lab and enhancing x64dbg with plugins1. Essential Tools for Your LabTo build a solid analysis environment, you need:🔹 Core Tools x64dbg Main debugger for static & dynamic analysis Detect It Easy (DIE) Identifies: Packers Compilers File signatures 🔹 Best Practice Organize tools in: Dedicated folders (e.g., C:\RE_Lab\Tools)...

In this lesson, you’ll learn about: static vs dynamic analysis and visual debugging with x64dbg1. Static vs Dynamic Analysis🔹 Static Analysis Analyze program without executing it Focus on: Code structure Assembly instructions Logic flow 🔹 Dynamic Analysis Execute the program Observe: Runtime behavior Memory changes Real-time execution 👉 Both are essential for reverse engineering2. Using x64dbg...

In this lesson, you’ll learn about: Check Point R80 services, WebUI access control, and system backup management1. Core Check Point ProcessesIn Check Point R80, the management server depends on several critical background services.🔹 Key Daemons CPM Main management service Handles SmartConsole operations FWM Manages communication with SmartConsole Directly affects administrator connectivity CPD Ge...