CyberCode Academy

In this lesson, you’ll learn about: How to convert a standard Raspberry Pi into a portable penetration testing device The required hardware components, including a touchscreen display, portable power source, and external wireless adapter Why a specialized Wi‑Fi adapter with packet injection support is essential for advanced network attacks The step-by-step assembly process for building a compact,...

In this lesson, you’ll learn about: The purpose of this segment as a preparation and logistics guide for working with single-board computers Where to acquire Raspberry Pi hardware, with emphasis on the official Raspberry Pi website The advantages of purchasing bundled kits that include SD cards, power adapters, and essential peripherals The Raspberry Pi 3 as the minimum recommended model for follo...

In this lesson, you’ll learn about: What a Raspberry Pi is and why it’s described as a low-cost, credit-card-sized single-board computer How installing an operating system on a micro SD card turns the device into a fully functional computer The types of operating systems supported, including Linux and Windows Common use cases such as DIY projects, robotics, and embedded systems Why the Raspberry P...

In this lesson, you’ll learn about: The forensic purpose of Inception for accessing live, locked systems without powering them down Why volatile memory preservation makes Inception valuable during on-scene triage How the DMA exploit works via FireWire and Thunderbolt interfaces The concept of planting a temporary RAM-based authentication bypass that disappears after reboot How Inception is integra...

In this lesson, you’ll learn about: A technical overview of memory acquisition using Magnet RAM Capture and FTK Imager How RAM footprint size affects evidence integrity during live memory collection The key features of Magnet RAM Capture, including custom output paths and memory image splitting Why file segmentation is operationally important when handling large RAM captures The role of FTK Imager...

In this lesson, you’ll learn about: The role of RAM acquisition in digital forensics and why volatile memory is critical evidence How benchmarking RAM extraction tools helps investigators make defensible tactical decisions A technical comparison between Belkasoft RAM Capturer and Magnet RAM Capture The trade-offs between system footprint and extraction speed during live memory capture How both too...

In this lesson, you’ll learn about: Why Benchmarking RAM Extraction Tools Matters How benchmarking supports defensible tool selection in forensic investigations. Using measurable metrics to justify decisions during reports or court testimony. Understanding that different systems and environments can affect tool behavior. Key Benchmarking Criteria RAM Footprint: Measuring how much memory the tool c...

In this lesson, you’ll learn about: Why RAM Is Critical Forensic Evidence How volatile memory captures data that never touches disk and is lost on shutdown. Recovering private browsing sessions, chat data, webmail content, and remnants of failed wiping attempts. Identifying in-memory malware, including rootkits, injected code, and hidden processes that evade disk-based scanners. Extracting encrypt...

In this lesson, you’ll learn about: Validating Network Drive Activity with Shellbags How Windows Shellbags act as a silent witness for user interaction with network shares and mapped drives. Why UsrClass.dat is a critical artifact for proving access to remote resources, even when permissions are restricted. Recording Remote Folder Access How accessing a mapped network drive (e.g., Z:) generates Sh...

In this lesson, you’ll learn about: USB Forensics Using Shellbag Artifacts How Windows Shellbags can be leveraged to reconstruct user interaction with removable media. Why Shellbags are valuable for determining whether files were copied to or from USB devices, even when the media is no longer connected. Initial Evidence Generation and Collection Creating controlled forensic artifacts by moving tes...

In this lesson, you’ll learn about: Practical ShellBag Forensics Workflow How ShellBags function as registry-based artifacts that record user folder interaction and view preferences. The full investigative cycle: evidence creation, acquisition, analysis, and validation. Registry Hive Acquisition Creating controlled user activity (e.g., test folders) to deliberately generate ShellBag evidence. Expo...

In this lesson, you’ll learn about: Preparing a Forensic Workstation The purpose of using a controlled forensic setup to safely extract and analyze system artifacts. Why working from an acquired drive or image is critical for maintaining evidentiary integrity. Essential Tools for Shellbag and Registry Analysis Shellbags Explorer: Used to parse and analyze shellbag artifacts associated with user fo...

In this lesson, you’ll learn about: What Windows Shellbags Are and Why They Matter How shellbags are registry-based artifacts created by Windows Explorer to store folder view preferences. Why they are a powerful source of user activity evidence, even when files or folders no longer exist. How Shellbags Are Created and Updated The specific user actions that trigger shellbag updates, such as resizin...

In this lesson, you’ll learn about: Why Malware Uses Cryptography and Encoding How encryption and encoding are used to conceal payloads, configuration data, and command-and-control traffic. The difference between encoding (obfuscation for transport) and encryption (confidentiality and anti-analysis). Why cryptographic protections are often the final barrier hiding a malware sample’s true behavior....

In this lesson, you’ll learn about: Why Malware Builds Its Own Import Tables How bypassing static, dynamic, and runtime linking hides API usage from analysis tools. Why this technique is especially valuable for shellcode, which executes without a normal Windows loader. How custom API resolution breaks automated inspection and signature-based detection. Locating System Libraries via the PEB Accessi...

In this lesson, you’ll learn about: String Obfuscation in Native Malware: Why string analysis is significantly harder in native code compared to interpreted languages. How compiled binaries store logic as machine instructions inside formats like the Portable Executable (PE), requiring reverse engineering rather than simple string extraction. Core Native String-Hiding Techniques: Stack Strings: Con...

In this lesson, you’ll learn about: Obfuscation in Interpreted Code: Why interpreted languages like VBA and PowerShell are still heavily obfuscated despite being easier to access than native binaries. Common tactics such as junk instructions, string and object obfuscation, and nonsensical naming designed to slow analysis rather than prevent it. Analyzing Malicious VBA Macros: Extracting macro code...

In this lesson, you’ll learn about: The Purpose of Code Obfuscation: Defining obfuscation as the practice of intentionally making software difficult to read or analyze. How malware authors use obfuscation to hide strings, functions, payloads, and command-and-control communication. The concept of “raising the bar” for analysts by increasing the time and effort required to understand malicious inten...

In this lesson, you’ll learn about: Functional Programming with Closures: Defining closures as anonymous functions that capture values from their surrounding scope. Using closures with iterator methods like map, filter, and fold to transform data. The difference between borrowing closures and move closures, and why move semantics are required for safe multi-threaded execution. Multi-threaded Execu...

In this lesson, you’ll learn about: Data Organization with Structs and Traits: Using structs to group data fields, methods, and associated functions. Defining shared behavior with traits instead of inheritance. Writing generic functions that operate on any type implementing a required trait. Using default trait implementations to share common behavior without repetitive code. Managing Data with St...

In this lesson, you’ll learn about: Ownership and Memory Management in Rust: How Rust guarantees memory safety without a garbage collector. The difference between stack and heap memory and how data lifecycles are managed. The Mechanics of Ownership: Rust’s three core ownership rules: Every value has a single owner. Only one owner exists at a time. Values are dropped immediately when the owner goes...

In this lesson, you’ll learn about: Core Data Representations in Rust: Scalar types: integers (signed i and unsigned u), floating-point types (f32, f64), booleans, and Unicode char values. Compound types: tuples (accessed via indexing or destructuring) and fixed-size arrays stored on the stack, along with their practical limits. Project Organization and Reusability: Moving logic into a library fil...

In this lesson, you’ll learn about: The Rust Ecosystem and Tooling: Using Cargo as Rust’s package manager, build system, and documentation tool. Creating projects with cargo new, managing dependencies in Cargo.toml, and running code with cargo run. Understanding the difference between debug builds and optimized release builds. Variables and Constants: Declaring variables with let in a strongly typ...

In this lesson, you’ll learn about: Evading Initial Detection: Payload Obfuscation: Encoding payloads multiple times to cloak them from IDS detection. Benign Carrier Injection: Hiding malicious code inside legitimate scripts (e.g., Python Base64 payloads). Custom Packaging: Using packers to compress or encrypt malware, creating unique fingerprints that bypass signature-based detection. Post-Penetr...

In this lesson, you’ll learn about: Foundations of Intrusion Defense: Multi-layered defense-in-depth strategies using models like SAPSA. Difference between Intrusion Detection Systems (IDS), which alert operators, and Intrusion Prevention Systems (IPS), which can actively block threats. The challenge of balancing false positives vs. false negatives in threat detection. Detection Methodologies: Sig...