CyberCode Academy

CyberCode Academy
  • 0.0 (0)
  • Courses
  • Updated daily

Welcome to CyberCode Academy — your audio classroom for Programming and Cybersecurity. 🎧 Each course is divided into a series of short, focused episodes that take you from beginner to advanced level — one lesson at a time. From Python and web development to ethical hacking and digital defense, our content transforms complex concepts into simple, engaging audio learning. Study anywhere, anytime — and level up your skills with CyberCode Academy. 🚀 Learn. Code. Secure. You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy

  1. Course 36 - Windows Forensics and Tools | Episode 6: From System Hives to Forensic Analysis

    10 hr ago

    Course 36 - Windows Forensics and Tools | Episode 6: From System Hives to Forensic Analysis

    In this lesson, you’ll learn about: Windows Registry structure and forensic analysis1. What is the Windows Registry?A centralized configuration database in WindowsStores system, user, and application settings🔹 Core IdeaThink of it as the brain of Windows configuration2. Registry StructureThe registry is organized in a strict hierarchy:🔹 ComponentsHivesKeysSubkeysValues🔹 AnalogyHive → main database fileKey → folderValue → actual data entry3. Main Root Keys🔹 Key Windows Registry RootsHKEY_LOCAL_MACHINE (HKLM)HKEY_CURRENT_USER (HKCU)🔹 What they representHKLM → system-wide settingsHKCU → settings for the logged-in user4. Physical Storage of Registry HivesStored on disk in:C:\Windows\System32\config 🔹 Why this mattersInvestigators can extract registry data directly from diskEven if Windows is not bootable5. Core HKLM Sub-Hives🔹 SAM (Security Accounts Manager)Stores:User accountsPassword hashes🔹 SECURITY HiveStores:Local security policyLSA secretsAuthentication data🔹 SOFTWARE HiveStores:Installed applicationsConfiguration settings🔹 SYSTEM HiveStores:DriversServicesBoot configuration👉 Key Insight:These hives are critical for system and user reconstruction6. Modern Windows Registry Extensions🔹 Newer HivesBCD (Boot Configuration Data)Controls boot processELAM (Early Launch Anti-Malware)Protects early boot stageBrowser-related application data hives👉 Purpose:Improve security and system initialization7. Forensic Extraction Tools🔹 Common ToolsFTK ImagerUsed to extract registry hives from diskRegistry viewers (offline analysis tools)🔹 Why FTK Imager mattersBypasses OS restrictionsWorks on live or dead systems8. Registry Analysis Workflow🔹 Step-by-step processAcquire disk imageExtract registry hivesLoad into analysis toolExamine keys and values9. What Investigators Look For🔹 Key Evidence TypesUser activityInstalled softwareSystem boot historyMalware persistence mechanismsKey TakeawaysThe registry is a central configuration database for WindowsIt is structured into hives, keys, and valuesCritical hives include SAM, SECURITY, SOFTWARE, SYSTEMRegistry files are physically stored on diskTools like FTK Imager enable offline forensic extractionBig PictureRegistry analysis helps you:👉 Move from system configuration → user and attacker behavior reconstructionMental ModelRegistry = Windows “black box” of system activity You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy

    21 min
  2. Course 36 - Windows Forensics and Tools | Episode 5: Structure and Forensic Significance

    1 day ago

    Course 36 - Windows Forensics and Tools | Episode 5: Structure and Forensic Significance

    In this lesson, you’ll learn about: Windows Security Identifiers (SIDs) and user tracking1. What is a Security Identifier (SID)?A SID (Security Identifier) is a unique value assigned to every:UserGroupSecurity principal (system accounts, services)🔹 Core IdeaIt acts like a permanent digital fingerprint in WindowsUsed internally instead of usernames👉 Key Property:A SID is never reused, even if the account is deleted2. Why SIDs ExistWindows needs a stable way to identify identitiesUsernames can changeSIDs cannot🔹 Example UsePermissions are assigned to SIDs, not namesAccess control checks rely on SID matching3. SID in Access Tokens🔹 What happens at login?Windows creates an access tokenThis token contains:User SIDGroup SIDsPrivileges👉 Key Insight:Every process inherits this tokenThis determines what the user can do4. Structure of a SIDA SID is not random—it has a strict format:🔹 Main ComponentsIdentifier AuthoritySub-authority valuesRelative Identifier (RID)5. SID Breakdown Explained🔹 Identifier AuthorityDefines the system or domain originExample:Local machineDomain controller🔹 Sub-authoritiesRepresent hierarchical security structureProvide organizational uniqueness🔹 Relative Identifier (RID)The most specific partIdentifies the actual account6. Important RID Examples🔹 Common Built-in Accounts500 → Built-in Administrator501 → Guest account512 → Domain Admins group513 → Domain Users group🔹 Special Group“Everyone” group → universal access SID👉 Key Insight:RID tells you exactly what type of account it is7. How SIDs Are Used in Security🔹 Access ControlFile permissions are assigned to SIDsNot usernames🔹 Authentication FlowLogin → SID loaded → permissions applied8. Forensic Importance of SIDs🔹 What investigators can learnWhich user performed an actionWhether an account was deleted or renamedPrivilege escalation attempts🔹 Why it mattersEven if usernames change, SID stays the sameEnables long-term tracking of user behaviorKey TakeawaysSIDs are permanent unique identifiers in WindowsThey are used instead of usernames for security decisionsStored inside access tokens during loginStructured into authority, sub-authority, and RIDEssential for forensic tracking and access controlBig PictureSIDs help you:👉 Move from “who is the user?” → “what identity is truly behind the action?”Mental ModelUsername → Human labelSID → System truth You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy

    21 min
  3. Course 36 - Windows Forensics and Tools | Episode 4: From Acquisition to Volatility Analysis

    2 days ago

    Course 36 - Windows Forensics and Tools | Episode 4: From Acquisition to Volatility Analysis

    In this lesson, you’ll learn about: memory forensics and RAM analysis1. Why Memory Forensics MattersRAM (volatile memory) is one of the most valuable forensic sourcesIt contains data that disappears after shutdown🔹 What RAM can revealRunning processesActive network connectionsCommand historyEncryption keysMalware behavior in real time👉 Key Idea:If disk is “history,” RAM is live truth2. Memory Acquisition (Capturing RAM)🔹 What is memory acquisition?Creating a snapshot of physical RAM for analysis🔹 Common ToolsDumpItSimple one-click RAM dump toolUsed widely in field forensicsNotMyFaultForces system crashGenerates full kernel memory dump👉 Key Tradeoff:DumpIt → fast and simpleCrash dump → deeper but disruptive3. Types of Memory Evidence🔹 What investigators look forProcess objectsSuspicious threadsInjected codeHidden malware artifacts🔹 Why it’s importantMalware often exists only in memoryDisk analysis alone may miss it4. Memory Forensic Techniques🔹 String SearchingLook for:PasswordsURLsCommandsAPI keys🔹 Process InspectionIdentify:Legitimate processesSuspicious or orphaned processes🔹 Thread AnalysisDetect:Code injectionHidden execution paths5. Deep Analysis with Volatility🔹 What is Volatility?A powerful memory forensics framework for analyzing RAM dumps🔹 Key CapabilityExtracts structured evidence from raw memory images6. Core Volatility Commands🔹 pslistShows active processesBased on system process list🔹 psscanFinds hidden or terminated processesScans memory directly🔹 psxviewCross-checks multiple process sourcesDetects rootkits and hidden malware👉 Key Insight:If a process appears in psscan but not pslist, it may be hidden7. OS ProfilingFirst step in analysis is identifying:Operating system versionMemory structure layout👉 Why it matters:Correct profile = accurate results in Volatility8. Malware Detection in Memory🔹 What investigators look forInjected DLLsSuspicious network activityHidden execution threads🔹 Key ConceptMalware often hides better in RAM than on disk9. Reporting Findings🔹 Output processExtract evidenceConvert results into structured reportsDocument every forensic step👉 Goal:Make results repeatable and legally defensibleKey TakeawaysRAM is the most dynamic and valuable forensic sourceMemory acquisition must be done carefully to preserve evidenceTools like DumpIt and crash dumps capture volatile dataVolatility enables deep inspection of memory structuresCross-checking process lists helps detect hidden malwareBig PictureMemory forensics helps you:👉 Move from live system behavior → hidden system truthMental ModelCapture RAM → Identify OS → Analyze processes → Detect anomalies → Report findings You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy

    22 min
  4. Course 36 - Windows Forensics and Tools | Episode 3: Mastering dd.exe for Drives and Memory

    3 days ago

    Course 36 - Windows Forensics and Tools | Episode 3: Mastering dd.exe for Drives and Memory

    In this lesson, you’ll learn about: forensic imaging using the DD utility1. What is DD (Data Dumper)?A low-level command-line tool used for bit-by-bit copyingCommonly used in digital forensics imaging🔹 Core FunctionCopies data from:Input → OutputWithout interpreting or modifying it👉 Key Idea:It creates an exact raw duplicate of data2. Basic DD Syntax🔹 Core Parametersif= → input sourceof= → output destinationbs= → block sizecount= → number of blocks🔹 Example ConceptInput disk → output image file👉 Important Insight:DD does not “understand” filesIt works at raw byte level3. Block Size Optimization🔹 Why it mattersControls how much data is copied per operation🔹 Performance TradeoffLarger block size:Faster imagingToo large:Can exhaust system memory👉 Best Practice:Balance speed vs system stability4. Imaging Storage Devices🔹 Workflow StepsIdentify storage deviceFind volume/drive identifierRun DD imaging commandSave output as forensic image🔹 Supported MediaUSB drivesHard disksOptical media (CD/DVD ISO extraction)👉 Key Technique:Use size limits to avoid reading past device boundaries5. RAM (Memory) Acquisition🔹 What is it?Capturing live system memory (volatile data)🔹 Why it mattersContains:Running processesActive network connectionsEncryption keys🔹 DD AdvantageNo kernel driver required in some casesDirect raw memory capture🔹 LimitationData may be inconsistent ("blurred")Because system is actively changing6. Windows Security Restrictions🔹 Modern Windows BehaviorBlocks direct access to physical memory🔹 Affected SystemsWindows XP 64-bitWindows Server 2003+🔹 RequirementsAdministrator privileges requiredOften requires alternative forensic tools7. Forensic Integrity Principles🔹 Key GoalsBit-for-bit accuracyNo modification of original evidence🔹 Why DD is importantEnsures raw acquisition of evidencePreserves original disk structureKey TakeawaysDD is a powerful low-level forensic imaging toolIt works by copying raw bytes from source to destinationBlock size directly affects performance and stabilityIt can be used for disks, USBs, CDs, and even RAMModern Windows systems restrict physical memory accessBig PictureDD helps you:👉 Move from live system → raw forensic imageMental ModelSelect device → set parameters → raw copy → verify integrity You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy

    23 min
  5. Course 36 - Windows Forensics and Tools | Episode 2: Windows Forensic Imaging and Drive Nomenclature

    4 days ago

    Course 36 - Windows Forensics and Tools | Episode 2: Windows Forensic Imaging and Drive Nomenclature

    In this lesson, you’ll learn about: Windows forensic imaging and data structure fundamentals1. What is Forensic Imaging?A bit-by-bit, sector-by-sector copy of a storage deviceCaptures everything, not just visible files🔹 What it IncludesActive files and foldersDeleted filesUnallocated spaceSlack space👉 Key Difference:Not a backup → it is an exact forensic replica2. Why Forensic Imaging MattersPreserves original evidencePrevents modification of:File timestampsMetadata👉 Legal Importance:Required for court-admissible investigations3. Physical vs Logical Drives (Windows Naming)🔹 Physical DrivesIdentified as:Disk 0Disk 1Represent actual hardware🔹 Logical DrivesRepresent partitions using letters:C:D:E:👉 Analogy:Physical disk → entire cabinetLogical drives → drawers inside the cabinet🔹 Historical NoteA: and B: reserved for floppy disks4. File System Hierarchy🔹 Structure LevelsVolume (highest level)PartitionDirectory (folder)File🔹 File DefinitionA logical grouping of related data👉 Key Insight:Understanding hierarchy helps in locating and analyzing evidence5. Processes and Threads (Execution Basics)Process → running programThread → smallest execution unit within a process👉 Why it matters:Helps track:Program executionMalicious activity6. Data Integrity & Verification🔹 Hashing ConceptGenerate a unique fingerprint for data🔹 Algorithm ExampleMD5 hash🔹 Key PropertiesSame file → same hashRename file → hash unchangedChange 1 bit → completely different hash👉 Use Case:Verify forensic image integrity7. Chain of Trust in ForensicsAcquire image → generate hashAnalyze copy → compare hash again👉 Goal:Ensure no tampering occurredKey TakeawaysForensic imaging captures complete disk data, including hidden contentPhysical and logical drives represent different abstraction layersFile systems follow a structured hierarchyHashing ensures data integrity and authenticityEven a tiny change in data invalidates evidenceBig PictureForensic imaging helps you:👉 Move from raw disk → verified evidence copyMental ModelDisk → Image → Hash → Analyze → Verify You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy

    22 min
  6. Course 36 - Windows Forensics and Tools | Episode 1: Debunking Myths and Mastering Methodology

    5 days ago

    Course 36 - Windows Forensics and Tools | Episode 1: Debunking Myths and Mastering Methodology

    In this lesson, you’ll learn about: digital forensics in Windows environments1. What is Digital Forensics?Also known as computer forensicsThe application of scientific methods to digital investigations🔹 Core ObjectivesIdentify digital evidencePreserve its integrityAnalyze findingsPresent results for legal use👉 Key Idea:Evidence must be accurate, repeatable, and legally admissible2. Why Focus on Windows?Majority of systems run WindowsWidely used in:Personal computingEnterprise environments🔹 ChallengesUndocumented internal featuresLimited low-level accessComplex system structure👉 Result:Windows forensics requires specialized knowledge and tools3. Investigation Methodology (SANS Framework)Developed by the SANS Institute🔹 The 8-Step ProcessStep 1: Initial AssessmentConfirm incidentDefine scopeIdentify affected systems👉 Goal:Understand what happened and whereStep 2: System DescriptionDocument:Hardware specsOS configurationNetwork role👉 Importance:Provides context for analysisStep 3: Evidence Acquisition🔹 Types of DataVolatile Data:RAMRunning processesNetwork connectionsNon-Volatile Data:Hard drivesLogsFiles🔹 Critical ConceptsChain of custodyData integrity verification (hashing)👉 Rule:Never alter original evidenceStep 4: Timeline AnalysisReconstruct system activity over time👉 Helps answer:When did the attack happen?What actions were performed?Step 5: Media AnalysisExamine:File systemsProgram executionDeleted files👉 Insight:Reveals user and attacker behaviorStep 6: String & Byte SearchSearch for:KeywordsSignaturesBinary patterns👉 Use Case:Detect malware traces or hidden dataStep 7: Data RecoveryRecover data from:Unallocated spaceSlack space👉 Importance:Deleted ≠ goneStep 8: ReportingCreate formal report🔹 Must IncludeVerified findingsMethods usedEvidence references👉 Requirement:Must be clear, objective, and defensible in court4. Windows Artifacts (Key Evidence Sources)🔹 Common ArtifactsRegistryPrefetch filesRestore pointsRecycle Bin👉 What they reveal:Program execution historyUser activitySystem changes5. Cybersecurity Use Case🔹 When Digital Forensics is UsedIncident responseMalware analysisLegal investigations👉 Outcome:Understand:Attack methodsImpactResponsible actionsKey TakeawaysDigital forensics applies scientific investigation to digital systemsWindows analysis is complex but essentialSANS methodology ensures structured and reliable investigationsEvidence handling must preserve integrityArtifacts reveal hidden user and attacker activityBig PictureDigital forensics helps you:👉 Move from incident → evidence → truthMental ModelCollect → Preserve → Analyze → Report You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy

    22 min
  7. Course 35 - Footprinting and Reconnaissance | Episode 8: From Target Reconnaissance to Phishing Execution

    6 days ago

    Course 35 - Footprinting and Reconnaissance | Episode 8: From Target Reconnaissance to Phishing Execution

    In this lesson, you’ll learn about: social engineering attacks and spear-phishing execution1. What is Social Engineering?A psychological attack techniqueTargets human behavior instead of systemsExploits trust, urgency, and curiosity👉 Goal:Trick the victim into revealing information or executing malicious actions2. Phase 1: Reconnaissance (Information Gathering)🔹 Target ProfilingCollect Personally Identifiable Information (PII):Job roleRelationship statusDaily habitsInterests (e.g., pets, hobbies)🔹 Data SourcesSocial media platforms (e.g., mock “mybook”)👉 Why it matters:Enables highly targeted (spear-phishing) attacksHelps guess:PasswordsSecurity questions3. Phase 2: Attack Setup🔹 Tools UsedSocial Engineering ToolkitKali Linux🔹 Attack MethodSpear-phishing email with malicious attachment🔹 Payload TechniqueFile disguised as:PCFIX.zip.pdf👉 Deception Strategy:Double extension trick to:Bypass user suspicionAppear as a legitimate document4. Phase 3: Delivery & Execution🔹 Email DeliveryConfigure SMTP serverSend high-priority message🔹 Social Engineering TacticsCreate urgency:“Suspicious internet activity detected”👉 Objective:Force the victim to act without thinking5. System Compromise🔹 Victim InteractionDownloads the fileOpens the attachment🔹 ResultExecution of hidden payloadAttacker gains access via:Metasploit Framework🔹 OutcomeRemote command shell accessFull system control6. Cybersecurity Impact🔹 Attack ChainReconnaissanceWeaponizationDeliveryExploitationAccess👉 Key Insight:A simple phishing email can lead to complete system compromise7. Defense & Awareness🔹 Common Weak PointsHuman trustLack of awarenessPoor email inspection🔹 PreventionSecurity awareness trainingEmail filtering & sandboxingAvoid opening suspicious attachmentsVerify sender authenticityKey TakeawaysSocial engineering targets people, not systemsReconnaissance makes attacks more effectiveFile disguise techniques increase success ratePhishing can lead to full system compromiseAwareness is the strongest defenseBig PictureThis attack demonstrates:👉 How information gathering → targeted phishing → system takeoverMental ModelRecon → “Know the victim”Phishing → “Exploit trust”Payload → “Gain access” You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy

    22 min
  8. Course 35 - Footprinting and Reconnaissance | Episode 7: Information Gathering and Domain Reconnaissance Lab

    28 May

    Course 35 - Footprinting and Reconnaissance | Episode 7: Information Gathering and Domain Reconnaissance Lab

    In this lesson, you’ll learn about: reconnaissance using Recon-ng1. What is Recon-ng?A full-featured web reconnaissance frameworkPre-installed on Kali LinuxDesigned to automate OSINT and domain reconnaissance🔹 Core ConceptWorks like a framework (similar to Metasploit)Uses modules to perform different recon tasks👉 Purpose:Build a structured database of target intelligence2. Tool OverviewRecon-ng🔹 Key CapabilitiesDomain intelligence gatheringContact harvestingSubdomain discoveryFile and directory enumeration👉 Advantage:Organizes results into a workspace database3. Workspace & Domain Setup🔹 Initial StepsCreate a workspaceAdd target domain👉 Why it matters:Keeps recon data organized and reusable4. Contact Harvesting🔹 Module: whois_pocsExtracts:NamesEmail addressesLocations👉 Use Case:Build a target profileUseful for:Social engineeringOSINT correlation5. Host Discovery & Stealth🔹 Module: bing_domain_webFinds:HostsIndexed subdomains🔹 Stealth FeatureRecon-ng introduces delays (sleep) between requests👉 Benefit:Mimics human browsingReduces detection riskAvoids IP blocking6. Subdomain Brute-Forcing🔹 Module: brute_hostsUses wordlists to guess subdomains🔹 OutputHidden subdomainsAssociated IP addresses👉 Importance:Expands the attack surfaceReveals hidden infrastructure7. Sensitive File Discovery🔹 Module: interesting_filesSearches for:robots.txtBackup filesConfig files👉 Why it matters:May expose:Hidden directoriesInternal pathsMisconfigurations8. Analyzing Server Responses🔹 HTTP Status Codes404 → Resource not found (client-side issue)300-series → Redirection👉 Insight:Helps understand:Server behaviorApplication structure9. Cybersecurity Use Case🔹 Reconnaissance PhaseEarly stage of:Penetration testingBug bounty hunting🔹 What You AchieveMap:DomainsSubdomainsContactsInfrastructure👉 Outcome:Clear view of the target environmentKey TakeawaysRecon-ng is a modular recon frameworkUses workspaces to organize intelligenceAutomates multiple OSINT tasksIncludes stealth techniques to avoid detectionProvides structured data for further testingBig PictureRecon-ng helps you:👉 Move from raw data → structured intelligence databaseMental ModelRecon-ng → “Collect + organize recon data”Analysis → “Turn data into actionable insights” You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy

    19 min
See All (258)

About

Welcome to CyberCode Academy — your audio classroom for Programming and Cybersecurity. 🎧 Each course is divided into a series of short, focused episodes that take you from beginner to advanced level — one lesson at a time. From Python and web development to ethical hacking and digital defense, our content transforms complex concepts into simple, engaging audio learning. Study anywhere, anytime — and level up your skills with CyberCode Academy. 🚀 Learn. Code. Secure. You can listen and download our episodes for free on more than 10 different platforms: https://linktr.ee/cybercode_academy

Information

  • Creator
    CyberCode Academy
  • Years Active
    2025 - 2026
  • Episodes
    258
  • Rating
    Clean
  • Copyright
    © Copyright CyberCode Academy
  • Show Website
    CyberCode Academy

You Might Also Like