CyberCode Academy

In this lesson, you’ll learn about: The complete toolkit and techniques for analyzing network traffic using Connection Analysis, Statistical Analysis, and Event-Based (signature-focused) Analysis. 1. Data Analysis Toolkit General-Purpose Tools These are foundational command-line utilities used to search, filter, and reshape data: grep → pattern searching awk → field extraction and manipulation cut...

In this lesson, you’ll learn about: Advanced Malware Traffic Analysis — how to detect, decode, and investigate RATs, fileless exploits, worms, and multi-stage infections using real network captures. 1. Remote Access Trojans (RATs) WSH RAT Uses plaintext beaconing for C2 → very easy to identify. Key data exfiltrated in HTTP requests: Unique device ID Computer name Username (“admin”) RAT version (of...

In this lesson, you’ll learn about: Network Threat Analysis — understanding how common attacks and advanced malware appear in real traffic captures, and how to extract intelligence from them. Part 1 — Analysis of Common Network Threats 1. Network Scanning Techniques Attackers scan networks to discover targets, services, and vulnerabilities. Demonstrations cover several scanning styles: SYN / Half-...

In this lesson, you’ll learn about: Intelligence Collection from Network Traffic Captures — focusing on anomalies, attacker behavior, and extracting actionable intelligence. 1. Network Mapping & Visualization Humans struggle with long lists → visualizing traffic helps you feel the environment. Tools like pcap viz generate maps at different OSI layers: Layer 3 (IP Addresses) Shows which machine...

In this lesson, you’ll learn about: Three powerful alternatives to Wireshark that expand your capabilities in network traffic analysis. How to use Network Miner for passive intelligence, T-shark for automation, and CloudShark for collaborative, web-based analysis. When and why each tool is more effective than Wireshark in specific scenarios. Network Miner — Passive Data Collection & File Extra...

In this lesson, you’ll learn about: Transitioning from theoretical networking concepts to hands-on traffic analysis. Using Wireshark to capture, dissect, filter, and understand live network traffic. Identifying how common protocols appear in real packet captures, including their structure and behavior. Recognizing how different protocols handle communication, reliability, and security. Wireshark:...

In this lesson, you’ll learn about: The core networking concepts required before beginning any network traffic analysis. The relationship between the OSI model, low-level protocols, and application-level protocols, and how they shape the behaviour of traffic you’ll examine in a tool like Wireshark. How to recognize common protocol behaviours at a high level so you can later understand patterns, an...

In this lesson, you’ll learn about: Goal — verifying if an Android device is compromised (conceptual): How investigators look for Indicators of Compromise (IoCs) on a device by inspecting network activity and running processes; emphasis on performing all checks only with explicit authorization and on isolated lab devices. Network‑level indicators: Look for unexpected outbound or long‑lived connect...

In this lesson, you’ll learn about: Remote desktop from Android to Windows — legitimate use & risks (conceptual): What remote desktop access enables: control a Windows desktop from an Android device for administration, support, or productivity (launch apps, browse files). Legitimate configuration concerns: who should be allowed remote access, least‑privilege user selection, and the importance...

In this lesson, you’ll learn about: Threat overview — device command‑and‑control via debug interfaces (conceptual): What attacker frameworks that target device debug services aim to achieve (remote control, data exfiltration, persistence). Why debugging interfaces (like Android’s debug bridge) are attractive: powerful access surface, rich device APIs, and potential for high impact if misused. High...

In this lesson, you’ll learn about: Access control flaws & exposed debug interfaces: how application components and debug/logging channels can unintentionally reveal sensitive functionality or credentials when accessible from outside the normal UI (e.g., via dev/debug interfaces), and why minimizing exposed surfaces is critical. Log‑based information leakage: why verbose runtime logs (debug lo...

In this lesson, you’ll learn about: ADB & SCRCPY — purpose & components (conceptual): What the Android Debug Bridge (ADB) is (a client/daemon/server communication layer) and its role for device management, debugging, and automation in development and incident response. What SCRCPY (screen‑mirror tool) does: mirror and control an Android device screen from a desktop for testing and demonstr...

In this lesson, you’ll learn about: Threat model — mobile remote‑control malware (conceptual): What attackers seek from a malicious Android app: persistent remote access, stealth (hide presence), broad permissions (contacts, SMS, storage, mic, camera, location), data exfiltration, and remote command/control. Why mobile malware is impactful: rich sensor/data access, always‑on networks, user trust i...

In this lesson, you’ll learn about: iPhone Simulator on macOS — purpose & use: running a full iOS simulator via Xcode to test, debug, and perform mobile app analysis without physical hardware. Prerequisites: a Mac running macOS and a working installation of Xcode (installed from the App Store; note: large download). Launching the Simulator: open Xcode, load or create a project, then use Xcode...

In this lesson, you’ll learn about: Setting up Android Studio on Windows: Launching Android Studio (built on IntelliJ) for developing, testing, and examining APKs. Verifying proper installation of the Android SDK to ensure access to essential developer tools. Creating and managing Android Virtual Devices (AVDs): Using the AVD Manager to configure emulators by selecting: Platform type (e.g., Phone)...

In this lesson, you’ll learn about: Process and signal management: Understanding Linux processes and gathering details using ps, top (for CPU-intensive tasks), and pgrep (to find PIDs). Analyzing process attributes such as PID, user, memory usage, and CPU time, and learning to filter and format outputs. Managing processes through signals — terminating with kill (default SIGTERM) or force-stopping...

In this lesson, you’ll learn about: Resource monitoring & optimization: Using df and du to calculate disk usage and free space, display results in human-readable form (-H), summarize totals, exclude directories, and locate the largest files with du | sort. Tracking disk I/O activity with iotop in both interactive and script modes. Checking filesystem integrity using fsck, with options to simul...

In this lesson, you’ll learn about: Network connectivity & diagnostics: using ping to verify reachability and measure RTT (use -c to limit packets, check exit status), and traceroute to map hops. Techniques for discovering live hosts via parallel ping scripts or fping for fast network sweeps. Secure remote access & automation (SSH): running remote commands securely, enabling compression (-...

In this lesson, you’ll learn about: The Backup Plan — Data Management, Archiving, and Backup Automation This section provides a deep dive into data management strategies, focusing on archiving, compression, specialized file systems, and automated backup solutions. It builds upon the previous lesson, where web interaction through shell scripting was introduced. 🗃️ Archiving Fundamentals • tar (Tape...

In this lesson, you’ll learn about: Tangled Web — Automating Web Interaction with Shell Scripting This section focuses on how shell scripting and command-line tools can be used to interact with and automate web-related tasks. It explains how to retrieve, parse, send, and monitor web data using the HTTP protocol through utilities like wget, curl, and links. 🌐 Core Command-Line Utilities for Web In...

In this lesson, you’ll learn about: 🧠 Core Concept: Text Processing in Unix/Linux This section, titled “Texting and Driving,” focuses on the art and science of text manipulation—a cornerstone of shell scripting. You’ll explore powerful utilities like grep, sed, awk (or ORC), and cut, all built around Regular Expressions (REs)—a miniature programming language for pattern matching across characters...

In this lesson, you’ll learn about: 📁 File Creation, Size, and Storage Management • Generating Files of Any Size: Learn to use the low-level dd command to create files of specific sizes using block size (BS) and count parameters—ideal for test data or loopback file systems. • Loopback File Systems: Understand how to create virtual disk images that can be mounted like physical drives using mount -...

In this lesson, you’ll learn about: Text & File Management Basics Using cat to read, display, and concatenate files, including combining stdin and file input. Cleaning up file output (removing blank lines, showing tabs as ^I). Splitting files with split (by size or line count) and csplit (by context or text match). Creating temporary files/directories using mktemp, stored securely in /tmp. Man...

In this lesson, you’ll learn about: Shell I/O & printing: echo (flags like -n), printf for formatted output, colored text via escape sequences, and printing alignment/rounding. File descriptors & redirection: stdin/stdout/stderr (0/1/2), >, >>, 2>, &>, piping |, tee, /dev/null, and creating custom FDs with exec. Reading input & command output: read (including fixed-c...

In this lesson, you’ll learn about: Nuclei file-based templates — purpose: extending Nuclei beyond HTTP to scan local files and codebases for sensitive content (hard‑coded secrets, API keys, credentials, tokens). File block basics: replace requests with a file: block in the template to target files instead of sending network requests. Targeting options: extensions: specify file types to scan (e.g....