CyberCode Academy

CyberCode Academy

By CyberCode AcademyTechnologyEducationCourses
Download on the App Store

CyberCode Academy episodes

  • Course 14 - Wi-Fi Pentesting | Episode 7: WPA/WPA2 Cracking via WPS: Reaver Exploitation, Error Bypassing, and WPS Unlocking
    In this lesson, you’ll learn about:
    • How WPS weaknesses can undermine WPA and WPA2 security
    • Why WPS PIN brute forcing is theoretically possible
    • The conceptual role of tools used in WPS security testing
    • Why router association failures occur during security assessments
    • The purpose of debugging during security testing
    • How WPS lockout mechanisms are designed to stop abuse
    • Why denial-of-service conditions can interfere with authentication systems
    • The defensive importance of disabling WPS entirely
    Conceptual Overview of WPS Vulnerabilities WPS (Wi-Fi Protected Setup) was originally created to simplify wireless connections by allowing devices to authenticate using an 8-digit PIN instead of the actual WPA or WPA2 password. From a security perspective, this creates a secondary authentication path that becomes a potential weakness. Even though WPA and WPA2 use strong cryptographic protection, WPS operates separately from the encryption itself. This means:
    • The attacker does not need to break WPA or WPA2
    • The attacker only needs to compromise the WPS authentication process
    • Once WPS is compromised, the real network key can be derived
    Concept of WPS Network Discovery Before a WPS weakness can be assessed, a reconnaissance phase is required to identify which surrounding networks have WPS enabled. From a defensive viewpoint, this highlights why:
    • Broadcasting WPS availability increases attack exposure
    • Leaving WPS enabled unnecessarily increases risk
    • Security administrators should regularly audit WPS status on access points
    Theoretical WPS PIN Brute-Force Process The WPS PIN system appears to offer 8-digit security, but it is vulnerable because:
    • The PIN is validated in two separate halves
    • This drastically reduces the real number of verification attempts needed
    • Automated testing systems can exploit this mathematical weakness
    Once the correct PIN is identified:
    • The access point reveals the real WPA/WPA2 password
    • The encryption itself is never broken directly
    • The attack succeeds purely due to authentication design flaws
    Association Failures and Authentication Reliability In wireless security assessments, tools may sometimes fail to:
    • Properly associate with the access point
    • Maintain reliable authentication states
    • Sustain consistent communication under heavy testing conditions
    These failures demonstrate that:
    • Wireless authentication systems are sensitive to timing and congestion
    • Security tools must handle unstable communication carefully
    • Defensive systems that drop unstable associations can slow down attacks
    Debugging and Transaction Failures In theoretical WPS testing scenarios:
    • Security tools may enter repeated error states during authentication exchanges
    • These failures usually result from packet synchronization errors
    • Debugging output is used to identify where authentication handshakes are failing
    From a defensive standpoint, this reinforces:
    • The importance of strict protocol handling
    • The value of malformed-packet rejection
    • The need for intelligent traffic inspection at the access point level
    WPS Lockout Protection Mechanisms Many modern routers include WPS lock mechanisms, which:
    • Temporarily disable WPS after several failed PIN attempts
    • Protect against continuous brute-force authentication
    • Force attackers to wait extended periods before retrying
    This demonstrates an important defensive concept:
    • Rate limiting and lockout policies are critical protections
    • Without them, even weak authentication methods become catastrophic
    • With them, attack feasibility is dramatically reduced
    Denial-of-Service Effects on Authentication Systems High volumes of authentication requests can:
    • Overload access points
    • Force temporary service failures
    • Cause unexpected system resets
    While this can disrupt WPS lock enforcement in poorly designed routers, from a defensive perspective this highlights:
    • The need for traffic throttling
    • The necessity of intrusion detection at the wireless layer
    • The importance of firmware stability under authentication floods
    Security Best Practices (Defensive Focus)
    • Always disable WPS entirely unless absolutely required
    • Use WPA2-Enterprise or WPA3 where possible
    • Enable authentication rate limiting
    • Apply firmware updates regularly
    • Audit wireless configurations during every security assessment
    Core Security Takeaway WPA and WPA2 can be cryptographically strong, but a single weak convenience feature like WPS can completely bypass that strength. This lesson demonstrates how security is only as strong as its weakest authentication mechanism, not its strongest encryption algorithm.

    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    11 min
  • Course 14 - Wi-Fi Pentesting | Episode 6: WPA/WPA2 Cracking Introduction: Exploiting the WPS Vulnerability
    In this lesson, you’ll learn about:
    • The fundamental difference between WEP and WPA/WPA2 security
    • Why WPA and WPA2 are significantly harder to crack than WEP
    • The role of TKIP and CCMP in protecting data integrity
    • What WPS (Wi-Fi Protected Setup) is and why it introduces risk
    • How the WPS PIN design weakens WPA/WPA2 security
    • Why push-button authentication (PBC) blocks WPS PIN attacks
    • Why testing for WPS vulnerabilities is the first step in WPA/WPA2 assessments
    Transition from WEP to WPA/WPA2 Security After cracking WEP, the course transitions to the more advanced protection mechanisms used by WPA and WPA2. Unlike WEP, which is fundamentally broken at a cryptographic level, WPA and WPA2 were specifically designed to eliminate WEP’s weaknesses. Although WPA and WPA2 share the same core structure, they differ in how message integrity is protected:
    • WPA uses TKIP (Temporal Key Integrity Protocol)
    • WPA2 uses CCMP, which is based on the AES encryption standard
    This improvement makes WPA and WPA2 far more resistant to direct cryptographic attacks than WEP. Why WPA/WPA2 Are More Difficult to Break Unlike WEP:
    • WPA/WPA2 do not reuse small IV spaces in a predictable way
    • Keys change dynamically
    • Packet replay attacks do not expose keystream weaknesses
    As a result:
    • Traditional WEP cracking techniques completely fail
    • Attackers must rely on indirect weaknesses, not on breaking the encryption algorithm itself
    The Role of WPS (Wi-Fi Protected Setup) Because WPA and WPA2 are difficult to attack directly, one of the first weaknesses assessed is WPS (Wi-Fi Protected Setup). Purpose of WPS
    • Designed to simplify device connection to routers
    • Allows authentication using:
      • A push button
      • Or an 8-digit PIN code
    Why the WPS PIN Is a Security Weakness Although an 8-digit PIN seems strong, it actually creates a small brute-force space due to how the PIN is validated in two halves. This makes it possible for:
    • The PIN to be systematically guessed
    • The process to complete within a relatively short time
    Once the correct WPS PIN is discovered:
    • The actual WPA or WPA2 network password can be retrieved
    • Full access to the network becomes possible
    When the WPS Attack Works — and When It Fails This method only works if:
    • WPS is enabled
    • The router is using PIN-based authentication
    This method fails completely if:
    • The router is configured for Push Button Configuration (PBC)
    • WPS is fully disabled
    Why WPS Testing Is Always the First Step Because:
    • Direct WPA/WPA2 cryptographic attacks are extremely complex
    • WPS dramatically reduces the difficulty of network compromise
    Security assessments always begin by testing for WPS exposure before attempting any deeper attack strategy. Key Educational Takeaways
    • WPA and WPA2 are cryptographically secure when properly configured
    • The primary weakness often lies in router convenience features, not encryption
    • WPS was built for usability, not maximum security
    • Disabling WPS is one of the most important wireless security hardening steps


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    11 min
  • Course 14 - Wi-Fi Pentesting | Episode 5: WEP Cracking: Packet Injection and Replay Attacks (ARP, Chopchop, Fragmentation, and SKA)
    In this lesson, you’ll learn about:
    • Why WEP cracking depends on Initialization Vectors (IVs)
    • How packet injection accelerates WEP cracking
    • The most reliable WEP injection technique (ARP Replay)
    • Alternative injection methods for idle networks
    • The conceptual difference between Chopchop and Fragmentation attacks
    • Why Shared Key Authentication (SKA) changes the attack strategy
    • How attackers adapt when fake authentication is blocked
    Forcing IV Generation on WEP Networks Cracking WEP depends on collecting a large number of Initialization Vectors (IVs). On busy networks, IVs are generated naturally through traffic. However, on idle networks, attackers must force the access point to generate new packets, which in turn generates new IVs. This episode explains three primary packet injection methods, followed by a special technique for Shared Key Authentication (SKA) networks. 1. ARP Request Replay Attack (Most Reliable Method) This is considered the most effective and dependable method for accelerating IV collection. Conceptual Overview
    • The attacker monitors the network.
    • A special ARP request packet is captured.
    • This ARP packet is:
      • Replayed repeatedly back into the network.
    • Each replay forces the access point to:
      • Respond with a new encrypted packet
      • Generate a new IV
    This results in:
    • A rapid increase in the IV count
    • Enough data to crack:
      • 64-bit WEP keys
      • 128-bit WEP keys
    Key Requirement
    • The attacker must first associate with the target network
    • Without association:
      • The access point will ignore injected packets
    2. Chopchop Attack (For Low-Traffic Networks) This method is useful when:
    • The network has no connected clients
    • There is very little traffic
    • No ARP packets are naturally available
    How the Chopchop Attack Works (Conceptually)
    • A single encrypted packet is captured.
    • The attacker attempts to:
      • Recover part of the keystream
    • Even a partial keystream (around 80–90%) can be sufficient.
    • Using this partial keystream:
      • A new forged ARP packet is created.
    • This forged packet is then:
      • Injected into the network
      • Forces the access point to generate new encrypted packets
      • Rapidly increases the IV count
    This method:
    • Does not rely on existing ARP traffic
    • Works even when the network is almost completely idle
    3. Fragmentation Attack This attack is similar in concept to Chopchop, but with an important difference. Key Characteristics
    • Instead of recovering a partial keystream:
      • The attacker recovers the entire 1,500-byte PRGA
    • Once the full PRGA is obtained:
      • A forged packet is created
      • The packet is injected into the network
      • IV generation increases rapidly
    Comparison with Chopchop
    • Requires:
      • Better signal quality
      • Being physically closer to the access point
    • Advantages:
      • Much faster than Chopchop
      • More reliable once PRGA is fully obtained
    4. Cracking WEP Networks Using Shared Key Authentication (SKA) Most WEP networks use:
    • Open Authentication
    However, some rare networks use:
    • Shared Key Authentication (SKA)
    Why SKA Is Different
    • In SKA:
      • The router refuses association
      • Unless the correct WEP key is already known
    • This means:
      • The standard fake authentication technique fails
      • Traditional ARP replay cannot be initiated normally
    Modified ARP Replay Attack for SKA Networks To bypass SKA restrictions:
    • The attacker must rely on:
      • An already connected legitimate client
    How the Bypass Works (Conceptually)
    • The attacker:
      • Observes a connected client
      • Takes note of that client’s MAC address
    • The ARP replay attack is then:
      • Performed using the victim’s MAC address
    • The access point believes:
      • The traffic is coming from the authorized client
    • This allows:
      • Rapid packet generation
      • IV collection without fake authentication
      • Successful WEP key recovery
    This method works for:
    • SKA-based WEP networks
    • Standard WEP networks as well
    Key Educational Takeaways
    • WEP security fails because:
      • IVs are too small
      • Keystreams get reused
    • Packet injection exists purely to:
      • Speed up IV generation
    • ARP Replay is:
      • The most reliable injection method
    • Chopchop and Fragmentation are:
      • Backup techniques for idle networks
    • Shared Key Authentication:
      • Does not fix WEP’s cryptographic weakness
      • Only changes the attack strategy


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    12 min
  • Course 14 - Wi-Fi Pentesting | Episode 4: Cracking WEP Encryption: Gaining Network Access
    In this lesson, you’ll learn about:
    • What WEP encryption is and why it is weak
    • How the RC4 algorithm is used (and broken) in WEP
    • How Initialization Vectors (IVs) cause WEP to fail
    • Capturing WEP traffic using Airodump-ng
    • Cracking WEP keys using Aircrack-ng
    • Speeding up WEP cracking on idle networks
    • Using fake authentication and packet injection
    • Preparing for post-connection attacks after cracking WEP
    Cracking WEP Encryption Why WEP Is Weak WEP (Wired Equivalent Privacy) is an old Wi-Fi encryption method that uses:
    • RC4 encryption algorithm
    • A shared secret key for encryption and decryption
    How WEP works:
    • The access point generates a 24-bit Initialization Vector (IV)
    • The IV is combined with the network password
    • Together they generate a keystream
    • This keystream encrypts the packets
    • The IV is sent in plain text with every encrypted packet
    Why this is dangerous:
    • A 24-bit IV is very small
    • On busy networks:
      • IVs repeat very quickly
    • Repeated IVs allow:
      • Statistical attacks
      • Tools like Aircrack-ng to recover the keystream
      • The WEP password to be cracked
    Cracking WEP in Practice The attack process consists of two main stages: 1. Capturing Data (IV Collection)
    • Use Airodump-ng to capture packets
    • Packets are saved into a capture file
    • The “data” counter represents:
      • The number of unique IVs collected
    • The higher the data count:
      • The higher the success rate
    • On busy networks:
      • IVs increase very fast
      • Cracking can take only minutes
    2. Cracking the Key
    • Use Aircrack-ng on the captured file
    • Aircrack-ng performs:
      • Statistical analysis
      • RC4 weaknesses exploitation
    • Once the key is recovered:
      • You can connect to the network
      • You gain full network access
    Handling Idle Networks If the network is not busy:
    • IV collection becomes extremely slow
    • Cracking may take many hours or longer
    To solve this, attackers force packet generation 1. Fake Authentication (Association) Before injecting packets, the attacker must:
    • Associate with the target network
    • Association means:
      • The access point accepts your device
      • Even though you are not fully connected
    This is done using:
    • aireplay-ng fake authentication attack
    • This tells the access point:
      • “I am a valid client”
    Association is required so:
    • The access point does not ignore injected packets
    2. Packet Injection After successful association:
    • The attacker injects packets into the network
    • This forces the access point to:
      • Generate large numbers of new packets
      • Create new IVs very quickly
    • The IV count rises:
      • From a few hundred
      • To tens of thousands in minutes
    • This allows:
      • Very fast WEP cracking
      • Even on a completely idle network
    After Cracking the Key Once the WEP key is recovered:
    • You can:
      • Connect to the Wi-Fi network normally
      • Intercept traffic
      • Gather sensitive information
      • Perform man-in-the-middle attacks
      • Modify data in transit
    • This prepares you for:
      • All post-connection attacks
      • Covered in later lessons


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    12 min
  • Course 14 - Wi-Fi Pentesting | Episode 3: Targeted Wireless Network Discovery and Pre-Connection Bypasses
    In this lesson, you’ll learn about:
    • Sniffing wireless networks on both 2.4 GHz and 5 GHz bands
    • Performing targeted packet capture on a specific access point
    • Saving and analyzing captured wireless traffic
    • Executing deauthentication attacks without knowing the password
    • Discovering the names of hidden wireless networks
    • Reconnecting to hidden networks after revealing their SSIDs
    • How MAC filtering works and how it is bypassed
    Targeted Wireless Discovery & Pre-Connection Access Wireless Band Sniffing (2.4 GHz & 5 GHz) Wireless networks broadcast on two main frequency bands:
    • 2.4 GHz
    • 5 GHz
    Key points:
    • By default, airodump-ng only sniffs the 2.4 GHz band
    • To sniff 5 GHz, you must use:
      • --band A
    • To sniff both at once:
      • --band ABG
    • Sniffing both bands:
      • Requires a powerful wireless adapter
      • Is usually slower
    • The adapter must support 5 GHz, otherwise no data will be captured from that band
    Targeted Sniffing & Data Capture Instead of capturing all networks, you can focus on:
    • One specific target network
    This is done by specifying:
    • BSSID: Target network MAC address
    • Channel: Operating channel
    Targeted capture allows you to:
    • View only:
      • The target access point
      • Connected clients (stations)
    • Save captured packets to files:
      • .cap files
    • Even though all packets are captured:
      • If the network uses WPA/WPA2
      • The data appears encrypted and unreadable
      • Wireshark will display it as gibberish without the key
    The Deauthentication Attack A deauthentication attack allows you to:
    • Disconnect any connected device
    • Without:
      • Knowing the Wi-Fi password
      • Being connected to the network
    How it works:
    • The attacker pretends to be:
      • The router when talking to the client
      • The client when talking to the router
    • This forces the device to disconnect
    Tool used:
    • aireplay-ng
    Discovering Hidden Networks Hidden networks:
    • Do not broadcast their SSID (name)
    • Still broadcast:
      • MAC address
      • Channel
      • Encryption type
    Steps to reveal a hidden SSID:
    1. Run airodump-ng against the hidden network only
    2. If a client is connected:
      • Launch a deauthentication attack
      • Send a small number of packets (e.g., 4)
    3. When the client reconnects:
      • It sends the network name in the air
    4. Airodump-ng captures:
      • The previously hidden SSID
    Connecting to Hidden Networks After discovering the SSID:
    • The wireless card must return to:
      • Managed mode
    This can be done by:
    • airmon-ng stop
    • Or by:
      • Disconnecting and reconnecting the wireless adapter
    If the network manager service is stopped:
    • Restart it using:
      • service network-manager start
    Once restored:
    • Manually enter:
      • The discovered SSID
      • The correct security type
    • Then connect normally
    Bypassing MAC Filtering MAC filtering controls which devices can connect using:
    • Their MAC address
    Two types: Blacklist
    • Blocks specific MAC addresses
    • Easily bypassed by:
      • Changing your MAC address to a random one
    Whitelist
    • Only allows specific MAC addresses
    • Harder to bypass, but still possible
    Bypassing a whitelist:
    1. Use airodump-ng to detect:
      • A client already connected to the target network
    2. That client’s MAC must be:
      • On the whitelist
    3. Use macchanger with:
      • -m to clone that MAC address
    4. Return to managed mode
    5. Connect to the network successfully using the spoofed MAC


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    11 min
  • Course 14 - Wi-Fi Pentesting | Episode 2: Network Fundamentals, Wireless Adapter Setup, and Packet Sniffing Basics
    In this lesson, you’ll learn about:
    • How wireless networks operate and transmit data
    • Why packet sniffing is possible in Wi-Fi environments
    • The role of external USB wireless adapters in security testing
    • What MAC addresses are and how they function in networks
    • The difference between managed mode and monitor mode
    • Enabling monitor mode using airmon-ng and iwconfig
    • Discovering nearby networks using Airodump-ng
    Wireless Networking & Packet Sniffing Fundamentals Basic Network Operation A wireless network consists of:
    • Clients (devices such as laptops and phones)
    • An access point (router or server)
    The access point acts as:
    • The only gateway to shared resources
    • The connection point to the internet
    Communication happens through:
    • Requests and responses
    • Sent in the form of data packets
    In Wi-Fi networks:
    • Packets travel through the air
    • Any device within range can potentially:
      • Capture usernames
      • Capture passwords
      • Capture visited URLs
    • This is what makes wireless packet sniffing possible
    External USB Wireless Adapter Built-in wireless cards:
    • Usually do NOT support:
      • Monitor mode
      • Packet injection
    For security testing, you must use:
    • A specialized external USB wireless adapter
    Setup inside Kali Linux (VirtualBox):
    • Plug in the adapter
    • Attach it using:
      • VirtualBox → Devices → USB
    • Kali will recognize it as an interface such as:
      • wlan0
    Understanding the MAC Address The MAC Address (Media Access Control) is:
    • A unique physical address
    • Permanently assigned to each network interface
    Key roles:
    • Used inside the local network
    • Directs traffic between devices
    Packet structure includes:
    • Source MAC
    • Destination MAC
    Uses of MAC spoofing:
    • Increasing anonymity
    • Bypassing MAC filtering
    • Avoiding device tracking
    Wireless Operating Modes Managed Mode (Default)
    • The wireless card only:
      • Receives packets sent to its own MAC address
    • Normal internet usage mode
    Monitor Mode
    • The wireless card:
      • Captures ALL packets in the air
      • Regardless of destination
    • Required for:
      • Packet sniffing
      • Network attacks
      • Security analysis
    Enabling Monitor Mode Steps used:
    1. Stop conflicting processes:
      • airmon-ng check kill
    2. Enable monitor mode:
      • Use iwconfig or airmon-ng start wlan0
    After activation:
    • The interface switches to monitor mode
    • It can now capture every wireless packet in range
    Packet Sniffing with Airodump-ng Airodump-ng allows you to:
    • Discover all nearby Wi-Fi networks
    • Monitor traffic without connecting
    Displayed network information includes:
    • ESSID: Network name
    • BSSID: Router MAC address
    • PWR: Signal strength
    • Channel: Wireless channel used
    • Encryption: WPA, WPA2, WEP
    • Cipher: Encryption algorithm
    • Authentication: Access method
    Successful Airodump-ng output confirms:
    • The adapter is working correctly
    • Monitor mode is functioning properly
    • The system is ready for wireless security auditing


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    15 min
  • Course 14 - Wi-Fi Pentesting | Episode 1: Setting Up the Virtual Hacking Lab: VirtualBox and Kali Linux
    In this lesson, you’ll learn about:
    • How to set up a complete virtual hacking lab
    • The role of VirtualBox in safe security testing
    • Installing and configuring Kali Linux as a virtual machine
    • Understanding NAT networking in virtual environments
    • Navigating the Kali Linux desktop and workspace system
    Building a Virtual Hacking Lab with VirtualBox & Kali Linux Installing VirtualBox VirtualBox is a virtualization platform that allows you to run multiple operating systems on a single physical machine (host), including Windows, macOS, and Linux. Key benefits:
    • Runs multiple virtual machines (VMs) inside your main system
    • Provides complete isolation between the host and the lab
    • Prevents damage to the real system if a VM is compromised
    • Supports snapshots for quick restore after experiments
    After installation:
    • The VirtualBox Extension Pack must be installed
    • Enables:
      • USB device support
      • Wireless adapters
      • Mouse and keyboard integration
    Installing Kali Linux as the Hacking Machine Kali Linux is a Debian-based operating system designed specifically for:
    • Penetration testing
    • Digital forensics
    • Security research
    It comes:
    • Pre-installed with hacking tools
    • Fully pre-configured for security testing
    Installation Method
    • Download the Kali Linux VirtualBox OVA image
    • Import the OVA file directly into VirtualBox
    • No manual OS installation is required
    Recommended Virtual Machine Settings
    • RAM: 1 GB minimum
    • CPU: 1 processor
    • Network Mode: NAT
    Understanding NAT Network Configuration
    • NAT creates a virtual private network for all VMs
    • The host system acts as the router
    • All VMs can:
      • Access the internet
      • Communicate with each other
    • No direct exposure to the real external network
    Kali Linux Login Credentials
    • Username: root
    • Password: toor
    Kali Linux Desktop Overview Key interface components include:
    • Applications Menu
      • Contains all hacking tools grouped by category
    • Places Menu
      • Quick access to important directories such as:
        • /root home directory
    • System Tray
      • Network control
      • Audio
      • Display settings
    Workspaces in Kali Linux
    • Kali uses multiple virtual desktops by default
    • Allows separation of:
      • Scanning tasks
      • Exploitation tasks
      • Reporting tools
    Internet & Wireless Considerations
    • Internet access works automatically via NAT
    • Connecting directly to Wi-Fi from Kali:
      • Requires an external USB wireless adapter
      • Internal laptop Wi-Fi cannot be directly controlled by Kali inside a VM
    Learning Environment Readiness
    • Users are encouraged to:
      • Explore menus
      • Practice navigation
      • Get comfortable with terminal usage
    • This environment will be used throughout the entire course


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    10 min
  • Course 13 - Network Forensics | Episode 8: Email Analysis and Forensic Investigation
    In this lesson, you’ll learn about:
    • How email systems work from a forensic perspective
    • Where and how email evidence can be recovered
    • How headers, protocols, and timestamps help analysts trace message origins
    • Legal considerations affecting email investigations
    • Tools used in forensic email analysis
    Email Analysis & Forensic Investigation Forensic Locations and Evidence Recovery Email evidence can reside in multiple places, so investigators must consider:
    • Client/Suspect Machine: Local email clients, temporary files, swap space, browser cache, slack space.
    • Mail Server: Messages stored during transit or retained copies.
    • Recipient’s System: Evidence often found in the receiver’s mailbox or client.
    • Intermediate Entities: ISPs may also hold relevant artifacts.
    Effective investigation requires understanding email systems, storage behaviors, and how different clients manage local vs. server-side data. Email Structure & Protocols Email messages consist of two main components: Header
    • Contains trace information, routing data, and metadata.
    • Fields are generated by the sender, their client, and each server the message passes through.
    • Crucial for tracking the message back to its true point of origin.
    Body
    • The actual message content, which may include attachments.
    Protocols
    • SMTP (port 25) – responsible for sending mail.
    • POP3 (port 110) – retrieves email, often removing it from the server.
    • IMAP – keeps messages stored server-side for synchronization.
    • Ports may be customized, so correct port filtering is essential.
    Encoding
    • MIME – standard encoding for transmitting messages and attachments across networks.
    • S/MIME & PGP – used for secure, encrypted email communications.
    Message Storage & Client Forensics Email storage varies depending on configuration:
    • Stored only on the server
    • Stored on both client and server
    • Deleted from the server after retrieval by client settings
    Important points:
    • Client settings (like in Outlook) may be overridden by the server.
    • Browser-based clients store less structured email data but may leave:
      • Cached message views
      • Temporary HTML copies
      • Thumbnails
    Outlook & PST Files
    • Outlook stores email data in PST files, which are typically the largest and most valuable evidence sources.
    Email Tracing & Header Analysis Technical headers provide the primary means to trace an email’s path. How to Trace an Email
    • Analyze the Received: header fields.
    • Begin from the bottom entry (earliest hop).
    • Move upward to reconstruct the route.
    • Evaluate timestamps and time zone offsets carefully to avoid misinterpreting the message flow.
    Key Considerations
    • Some header fields can be spoofed, but not all.
    • Tools for verification include:
      • Sam Spade
      • DNS lookup tools
      • WHOIS
    BCC Field
    • If the BCC field appears in a header, it simply confirms a blind copy was sent, though the recipient remains hidden.
    Legal & Investigative Factors The level of legal protection depends on message age and state:
    • Unopened emails (< 90 days) → Highly protected, often requiring a warrant.
    • Opened emails → Lower level of protection.
    • Unopened emails (> 90 days) → Reduced protection.
    • Emails (> 180 days) → Minimal protection regardless of status.
    Legal guidance is critical, especially during investigations involving phishing or other malicious email-based attacks. Tools & Monitoring Techniques Investigators rely on several forensic tools: Forensic Suites
    • FTK (AccessData)
    • EnCase (Guidance Software)
      • Both support PST extraction and email analysis.
    Network Monitoring Tools Used to examine raw email traffic, especially SMTP:
    • Wireshark
    • Microsoft Network Monitor
    • TCPdump
    • TShark
    Typical filtering involves isolating traffic on port 25 (SMTP) or any non-standard port used by the mail service.

    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    12 min
  • Course 13 - Network Forensics | Episode 7: Web Traffic Analysis and Browser Forensics: Handshakes, DNSSEC, and Cookies
    In this lesson, you’ll learn about:
    • How to identify and analyze web traffic using network forensics techniques
    • The role of DNSSEC in securing DNS infrastructure
    • Browser forensics across IE, Firefox, Chrome, Edge, and Safari
    • How history files, caches, and artifacts differ between browsers
    • The forensic value of cookies and how they are stored and analyzed
    1. Network Traffic Analysis Fundamentals A core skill in network forensics is the ability to recognize and interpret the TCP three-way handshake.
    This handshake—SYN → SYN/ACK → ACK—is the best indicator of:
    • A new connection forming
    • Impending data transfer
    • The type of communication taking place
    Identifying Web Traffic
    • Port 80 typically indicates HTTP web traffic
      • A GET request usually confirms this
    • Port 23 indicates Telnet, which sends data in plaintext
    Older packet captures may reveal metadata about the remote system:
    • Example: Seeing IIS5 suggests the server was running Windows 2000
    Being able to identify OS fingerprints and protocol behavior is critical for traffic analysis. 2. Enhancing Security with DNSSEC DNSSEC (DNS Security Extensions) is recommended to strengthen DNS infrastructure. Key Benefits of DNSSEC
    • Cryptographic signing of records prevents unauthorized changes
    • Makes DNS poisoning or zone file tampering extremely difficult
    • If a compromise occurs, DNSSEC provides detailed forensic evidence
      • Signatures
      • Validation failures
      • Tampered data traces
    DNSSEC does not fix DNS’s entire design, but it dramatically increases integrity and trust. 3. Browser and Client-Side Forensics Different browsers store history, cache, and session data in different formats and file locations. These paths also vary across operating systems. Understanding these artifacts is essential for analyzing user activity. Internet Explorer (IE) Key artifact: index.dat
    • A binary file that logs significant browsing activity
    • Cannot be opened with Notepad or standard editors
    • Requires specialized tools or index.dat viewers
    • Older systems stored IE artifacts under:
      Local Settings\Temporary Internet Files
    IE’s structure makes it rich in recoverable artifacts even after attempted deletion. Firefox Key artifact: history.dat
    • Stored in ASCII format, viewable in plain text
    • Easier to read than IE’s binary format
    • However, it does not directly link visited sites with cached pages
      • Reconstruction of user view is harder
    • Stored under the user profile in Application Data > Firefox folders
    Firefox’s structured but separated data can make page reconstruction challenging. 4. The Forensic Significance of Cookies A cookie is a small text file saved by websites to store:
    • Language preferences
    • Activity
    • Session identifiers
    • Visit frequency
    Cookies are critical in forensics because they persist even when:
    • History is deleted
    • Cache is wiped
    • Private browsing was used
    Why Cookies Matter
    • Show repeated visits vs. “accidental” single access
    • Reveal behavior and browsing patterns
    • Tie activity to specific sessions or visits
    • Help reconstruct long-term user engagement
    Cookie Characteristics
    • Minimum expected size: 4 KB
    • Contain six components (e.g., name, value, expiration date, domain, path, flags)
    • Session cookies: deleted when browser closes
    • Persistent cookies: stored long-term and replayed on revisit
    • Often used for access control and session management
    Tampering and Manipulation Cookies can be intercepted or modified using tools such as:
    • Burp Suite
    • Browser developer tools
    Examples include:
    • Modifying session cookies
    • Changing identifiers
    • Influencing e-commerce machine-learning systems that adjust prices based on user interest/visit frequency
    Storage Locations Each browser (IE, Edge, Chrome, Firefox, Safari) stores cookies in different folders and formats, often encoded or indexed. Precise knowledge of these locations is required during forensic acquisition or investigation.

    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    13 min
  • Course 13 - Network Forensics | Episode 6: Wireless Network Analysis, Standards, and Security Forensics
    In this lesson, you’ll learn about:
    • Wireless networking fundamentals, standards, and modulation techniques
    • Key 802.11 amendments and operating modes
    • The evolution of Wi-Fi security from WEP to WPA2 Enterprise
    • Common wireless threats and attack techniques
    • Forensic considerations when investigating compromised wireless devices
    1. Wireless Fundamentals and Standards Wireless LANs rely on several core components:
    • Access Points (APs)
    • Wireless NICs
    • Antennas, such as Yagi, parabolic, and omnidirectional models
    Wi-Fi operates mainly in unlicensed frequency bands, typically 2.4 GHz and 5.8 GHz. Spread Spectrum Techniques These methods reduce interference and support reliable wireless communication:
    • Frequency Hopping Spread Spectrum (FHSS)
      • Used in early 802.11
      • Continuously hops frequencies to resist narrowband interference from devices like Bluetooth or microwaves
    • Direct Sequence Spread Spectrum (DSSS)
      • Used in 802.11b/g
      • Works best on the non-overlapping channels (1, 6, 11) in 2.4 GHz
      • Limited channel spacing drove the move to 5.8 GHz (802.11a/ac), enabling more adjacent APs with less interference
    Key 802.11 Amendments
    • 802.11c – Enabled MAC bridging to connect facilities
    • 802.11e – Introduced QoS for reliable audio/video transmission
    • 802.11f – Developed roaming capabilities between APs
    • 802.11i – Major security upgrade and foundation of WPA2 Enterprise
      • Enabled port-level authentication with RADIUS and smart cards
    Operational Modes
    • Infrastructure Mode (BSS) – Uses an AP
    • Ad Hoc Mode (IBSS) – Peer-to-peer without an AP
    Wireless Application Protocol (WAP)
    • Used older mobile devices
    • Pages structured using WML, based on XML, divided into decks and cards
    2. Evolution of Wireless Security Protocols WEP (Wired Equivalent Privacy)
    • Early Wi-Fi security but fundamentally flawed
    • Claimed “64-bit encryption,” but truly offered 40-bit key strength
    • Used a 24-bit IV, transmitted in clear text
      • IV space exhausted quickly → collisions → RC4 encryption breaks
    • Relied on static keys and manual distribution
    WPA (Wi-Fi Protected Access) Created as a temporary fix to WEP’s failures:
    • Increased IV space from 24 to 48 bits
    • Used 128-bit keys
    • Introduced TKIP for dynamic key generation
    • Initially used RC4, later transitioned to AES + TKIP
    WPA2 Enterprise Introduced via 802.11i:
    • Uses AES encryption (later with ECC)
    • Implements port-level authentication through RADIUS
    • Supports enterprise credentials and smart cards
    • Considered the standard for strong Wi-Fi security
    3. Wireless Threats and Attack Techniques Misconceptions and Weak Protections
    • SSID Hiding
      • Ineffective—SSID appears in clear text in management frames
    • MAC Filtering
      • Easily bypassed via MAC spoofing
    Common Wireless Attacks
    • Eavesdropping (passive sniffing)
    • War Driving (locating WLANs while moving)
    • DoS Attacks
      • Flooding deauthentication frames
      • Spoofing AP messages
    • DNS Poisoning
    • Rogue Access Points
      • Attackers create a fake AP with the same SSID
      • Tools like the WiFi Pineapple attract clients using a stronger signal
    Bluetooth Threats
    • Bluejacking – Sending unsolicited messages
    • Bluesnarfing – Stealing data via unauthorized Bluetooth access
    Link Encryption Concerns
    • Wi-Fi uses link-layer encryption, meaning:
      • Data is decrypted and re-encrypted at every hop
      • Each hop creates an additional point of vulnerability
    4. Wireless Forensics and Investigation To investigate compromised wireless devices, analysts must understand:
    • How authentication and association occur
    • That Wi-Fi uses symmetric, shared-key encryption
      • The same key encrypts data on the client and decrypts it on the AP
    • How to detect abnormal wireless activity
    Key Forensic Techniques
    • Conduct wireless site surveys
    • Use tools such as:
      • NetStumbler (network discovery)
      • Wireshark (packet capture and analysis)
    • Examine management frames, signal strength patterns, and authentication logs


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    📚 The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    15 min

About CyberCode Academy

From the publisher's feed

Welcome to CyberCode Academy — your audio classroom for Programming and Cybersecurity.
🎧 Each course is divided into a series of short, focused episodes that take you from beginner to…