CyberCode Academy

CyberCode Academy

By CyberCode AcademyTechnologyEducationCourses
Download on the App Store

CyberCode Academy episodes

  • Course 3 - Mastering Nuclei for Bug Bounty | Episode 6: Nuclei Fuzzing Techniques: Cluster Bomb, Pitchfork, and Battering Ram
    In this lesson, you’ll learn about:
    • Fuzzing with Nuclei — purpose: using custom YAML templates to brute-force or enumerate inputs (usernames, passwords, endpoints, parameters) to find misconfigurations, default creds, or hidden functionality.
    • Template components for fuzzing: define raw request, payloads (wordlists), payload positions, attack type, and matchers (e.g., word: success + status: 200) that mark a successful hit.
    • Cluster‑Bomb (combinatorial) fuzzing:
      • Mechanism: one position is fixed while another iterates through its entire list; repeats for each fixed value (good for username Ă— password lists).
      • Use case: test many passwords per given username.
      • Template note: set attack: clusterbomb, map Parameter A → usernames.txt, Parameter B → passwords.txt.
    • Pitchfork (parallel) fuzzing:
      • Mechanism: iterate multiple lists in lock‑step (1st of list A with 1st of list B, 2nd with 2nd, …).
      • Use case: paired credential lists or aligned parameter sets.
      • Template note: set attack: pitchfork and ensure lists are same length or intended pairing.
    • Battering‑Ram (single payload) fuzzing:
      • Mechanism: use a single wordlist for all fuzz positions or a single targeted parameter.
      • Use case: known username + fuzz many passwords, or reuse same payload across several params.
      • Template note: set attack: batteringram with one payload source.
    • Success detection: combine response checks (e.g., word: "success") with status codes (status: 200) or other fingerprints to reduce false positives. Use extractors to capture useful response data.
    • Practical workflow: validate template YAML, test against staging or safe targets, proxy via Burp for live inspection, run with -debug/-v to see requests/responses.
    • Operational safety & ethics: never run aggressive fuzzing against production/unauthorized targets; throttle requests (rate-limit), respect scope, and document findings (time, payload, matched response) for reproducible PoCs.
    • Tips to improve success rate: tune content-type and headers, handle cookies/session reuse if needed, rotate/parallelize carefully (bulk-size / concurrency), and pre‑filter targets to avoid wasting wordlist attempts on unreachable endpoints.


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    đź“š The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    10 min
  • Course 3 - Mastering Nuclei for Bug Bounty | Episode 5: Matching Conditions in the Body and Header
    In this lesson, you’ll learn about:
    • POST-based matchers in Nuclei — overview: moving from simple GET checks to POST requests that include payloads; used when the vulnerable endpoint expects body data.
    • Matching in the body:
      • Set request method: post and provide body: (key=value pairs, e.g., search=apple or YAML-style search: apple).
      • Create matchers that look for a word (e.g., apple) in the response body and typically assert a status code (e.g., status: 200) for a confident hit.
    • Matching in response headers:
      • Use part: header in the matcher to check for values that appear in response headers (e.g., a custom header containing apple).
      • Combine header matching with status checks for precision.
    • Template authoring workflow:
      • Build the requests block with method: POST, path, and body:.
      • Add matchers specifying type: word or type: regex, part: body or part: header, and optional status conditions.
    • Validation & debugging:
      • Validate YAML syntax with a linter (YAML Lint) before running.
      • Use -debug and -v to print exact HTTP requests/responses Nuclei sends/receives.
      • Proxy through Burp Suite to capture the POST request, inspect the response, and confirm the matcher logic works as intended.
    • Practical tips:
      • Ensure correct Content-Type headers (e.g., application/x-www-form-urlencoded or application/json) in the template if the endpoint requires it.
      • When matching JSON responses, prefer type: regex to safely extract values (e.g., \"key\"\s*:\s*\"apple\").
      • Test locally on a safe target or staging environment before broad runs.
      • Combine body and header matchers when possible to reduce false positives.


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    đź“š The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    11 min
  • Course 3 - Mastering Nuclei for Bug Bounty | Episode 4: Headers, Body, Raw Requests, and Response Matching
    In this lesson, you’ll learn about:
    • Custom headers in templates: define headers: as key–value pairs (e.g., User-Agent, X-Forwarded-Host, or custom headers like X-Test: hello world) to tag or alter requests.
    • Request bodies: use the body: block to send POST/PUT payloads (e.g., search=apple) required by many vulnerable endpoints.
    • Cookie reuse / session handling: enable cookie reuse: true to persist cookies across requests when the target requires session continuity.
    • Raw requests: use the raw: block to supply an exact HTTP request (as copied from Burp) supporting methods like GET, POST, PUT, DELETE for full-fidelity testing.
    • Unsafe raw requests: set unsafe: true to allow malformed or protocol-abusing requests (useful for finding CRLF injection, HTTP request smuggling, or other edge-case bugs) — use with extreme caution and only in-scope.
    • Matchers / response logic: create matchers that check status codes (e.g., status: 200), response body words (e.g., match apple), or custom response headers (e.g., new-header) to confirm findings.
    • Combining matchers & extractors: pair precise matchers with extractors to capture version strings or identifiers from responses for clearer output.
    • Practical tips: test templates locally with -debug and via a proxy (e.g., Burp) to inspect exact requests/responses; validate YAML with a linter before wide runs; respect scope and avoid unsafe:true on production targets.












    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    đź“š The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    13 min
  • Course 3 - Mastering Nuclei for Bug Bounty | Episode 3: Scanning Lists, Metrics, Template Writing, and Proxying
    In this lesson, you’ll learn about:
    • Feeding targets to Nuclei: enumerating subdomains (e.g., Subfinder), validating live hosts with HTTPX, and supplying host lists to Nuclei via STDIN or the -l flag; importance of prepending http:// / https:// when needed.
    • Tool maintenance: updating Nuclei from the terminal using nuclei -update to get the latest templates and fixes.
    • Real-time monitoring: enabling -metrics to view live scan stats (duration, errors, matches, total requests) in your browser (e.g., localhost:9092/metrics).
    • Custom template authoring — structure & blocks: building id and info blocks (name, author, severity, tags, description, references) and crafting requests with dynamic path variables (base-url, root-url, hostname, host, port) for flexible templates.
    • Request methods & dynamics: using various HTTP methods (GET, POST, etc.) and leveraging dynamic variables to make templates reusable across many hosts.
    • Using a proxy with Nuclei: configuring a proxy (e.g., Burp Suite) so Nuclei’s requests can be intercepted, examined, and modified for deeper testing.
    • Operational tips: validate custom templates locally with -debug before wide runs, keep Nuclei updated, monitor metrics during large scans, and always respect scope and rate limits to avoid harming targets.












    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    đź“š The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    14 min
  • Course 3 - Mastering Nuclei for Bug Bounty | Episode 2: Controlling Scans, Traffic Tuning, and Custom Template Development
    In this lesson, you’ll learn about:
    • Controlling Nuclei template selection — include templates by tags (e.g., xss, tech, enginex), severity (info, low, medium, high, critical), or author; and exclude specific templates/tags/severity with exclusion flags to avoid noisy results.
    • Performance tuning & safe scanning — tune rate-limit (requests/sec), bulk-size (parallel hosts per batch), and -C (concurrency for templates) to avoid overwhelming targets or triggering WAFs; prefer conservative defaults for bug‑bounty targets.
    • Request identification & tracking — add custom HTTP headers with -H / --header to tag traffic (useful for program owners and triage).
    • Persistent configuration — use config.yaml to store default flags (targets, template lists, exclusions, headers) so runs are consistent and reproducible.
    • Debugging & visibility — use -debug and -v to print the exact HTTP requests and responses Nuclei sends/receives; essential to understand why a match fired (status codes, regexes, extractors).
    • Template structure & components — YAML template building blocks: id, info (name, severity, author, tags), requests (method, path, payload), matchers (status code, regex, words), and extractors (capture and display matched data).
    • Filtering & extraction rules — craft matchers for precise detection (e.g., status: 200, regex capture); use extractors to pull versions or identifiers into the output.
    • Custom template development — how to modify/create templates (example: PHP version detection), validate YAML with linters (YAML Lint), and test locally with -debug before wide runs.
    • Operational best practices — limit templates to relevant categories, exclude info severity when noisy, validate custom templates, document headers/flags used for each engagement, and always respect scope/authorization.


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    đź“š The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    14 min
  • Course 3 - Mastering Nuclei for Bug Bounty | Episode 1: Nuclei: Installation, Template Setup, and First Scan
    In this lesson, you’ll learn about:
    • Nuclei — definition & purpose: a template‑based automated vulnerability scanner written in Go, designed for fast, customizable scanning, mass hunting, and CI/CD integration.
    • Claims & note: community descriptions sometimes state very low false‑positive rates; always validate findings in-scope before reporting.
    • Supported template types: HTTP, DNS, TCP, and file‑based templates (organized by categories like CVEs, misconfiguration, takeovers, fuzzing).
    • Templates are the core: templates are YAML files that define checks; most are community‑maintained in the official GitHub repo and can be auto‑downloaded or installed manually (git clone / ZIP).
    • Installation methods: primary method uses Go (requires Go ≥ 1.18); alternatives include Homebrew (Mac) or Docker. Verify install by running nuclei -h.
    • First run / basic CLI usage: scans require a template (-t) and a target URL (-u with protocol). Omitting -t runs all templates — avoid this on live targets to prevent excessive requests.
    • Practical example: running the technologies template category can reveal informational details such as PHP and Nginx (EngineX) versions on a target.
    • Operational best practices: always limit templates to relevant checks, respect target scope/authorization, throttle requests when needed, and validate any automated findings manually.
    • Integration: Nuclei works well in automation pipelines for continuous scanning, and users can write custom templates to match unique testing needs.
    • Analogy (teaching aid): Nuclei = the locksmith’s toolkit (binary) and templates = custom lockpicks — pick the right template (-t) for the target lock (-u) instead of trying the whole box.


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    đź“š The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    12 min
  • Course 2 - API Security Offence and Defense | Episode 4: Aggressive Attacks, Traditional Vulnerabilities and Exploitation of Staging APIs
    In this lesson, you’ll learn about:
    • Aggressive Attacks on APIs
      • Denial of Service (DoS): Flooding servers to disrupt service; Layer 7 attacks mimic normal users.
      • Brute Force: Guessing secrets like passwords, JWTs, tokens, or 2FA codes.
      • Mitigation: Rate limiting, authentication for heavy processes, short expiration for secrets, complex codes, caching, load balancing, restricting direct IP access.
    • Targeting Non-Production APIs
      • Development, staging, and deprecated APIs often lack proper security.
      • Risks include exposed debugging info, weaker policies, and connection to production databases.
      • Mitigation: Delete deprecated APIs, restrict access (passwords/IP), enforce production-level security policies, include in penetration testing scope.
    • Traditional Web Vulnerabilities in APIs
      • IDOR: Manipulate object IDs in URLs to access unauthorized data.
      • XSS: Only exploitable if content type allows JavaScript execution.
      • SQL Injection: Unexpected results indicate query manipulation.
      • Remote Code Execution (RCE): 500 errors from unusual input may signal server or OS-level vulnerabilities.
    • Key Takeaway:
      APIs must be protected from both API-specific threats and classic web vulnerabilities, with consistent security policies across all environments.












    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    đź“š The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    19 min
  • Course 2 - API Security Offence and Defense | Episode 3: OAuth Protocol: Standards, Authorization Flows, Attacks, and Real-World Case Study
    In this lesson, you’ll learn about:
    • OAuth — purpose & distinction: an authorization protocol that grants third-party apps scoped access to user resources without sharing user credentials; it’s about authorization, not authentication.
    • OAuth 1.0a — core concepts & flows:
      • Concepts: Consumer Key/Secret, Nonce, Signed requests (HMAC‑SHA1).
      • Flows: one‑legged (trusted apps), two‑legged (token exchange), and three‑legged (adds user approval and a verifier; e.g., Twitter sign‑in).
    • OAuth 2.0 — concepts & common flows:
      • Concepts: Client ID/Secret, Scope (permissions), Response Type, State (CSRF defense).
      • Flows: two‑legged (machine‑to‑machine) and three‑legged Authorization Code Grant (most common; auth code exchanged for access token after user consent).
    • Primary attacker goal: steal an access token — the token’s scope defines the attacker’s effective privileges.
    • Common OAuth vulnerabilities & attacks:
      • Auth code leakage via redirect_uri: weak redirect validation lets codes be sent to attacker servers.
      • CSRF in the OAuth flow: missing/invalid state allows attacker-forced authorization flows (account linking, CSRF).
      • Open redirect: poor redirect checks enable phishing or token exfiltration vectors.
      • CSRF via XSS / iframe chaining: use XSS to inject frames or scripts that bypass protections and extract codes/tokens.
      • Implicit flow abuse: switching response_type=token causes tokens to be returned in URL fragments — easily exfiltrated by XSS.
    • Hardening & best practices:
      • Always use HTTPS to prevent MITM.
      • Require and validate the state parameter to stop CSRF.
      • Disable implicit flow unless strictly necessary; prefer Authorization Code with PKCE for public clients.
      • Strictly validate redirect_uri (exact-match, not prefix).
      • Sanitize and remove XSS vulnerabilities that could be chained into OAuth attacks.
      • Minimize token lifetime and use scopes with least privilege.
    • Real-world lessons: small, low-severity bugs can be chained (redirect issues, missing validation, XSS) to fully compromise accounts — careful end‑to‑end validation and layered defenses are essential.


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    đź“š The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    11 min
  • Course 2 - API Security Offence and Defense | Episode 2: Authentication Methods and Security: Basic, Digest, and JSON Web Tokens (JWT)
    In this lesson, you’ll learn about:
    • Authentication & Authorization Fundamentals:
      • Authentication: Identifying the user.
      • Authorization: Defining what actions an authenticated user can perform.
      • Stateful vs. Stateless:
        • Stateful: Session cookies store session data on the server.
        • Stateless: Tokens are validated without server-side session storage.
    • Basic and Digest Authentication:
      • Basic Auth: HTTP-based, sends Base64-encoded credentials; vulnerable because Base64 is easily decoded.
      • Digest Auth: Adds MD5 hashing with a nonce to protect credentials; less common.
    • Attacks on Traditional Methods:
      1. MITM Attacks: Stealing credentials if HTTPS is not used.
      2. Brute Force: No retry limits enable guessing credentials.
      3. Logic Attacks (Wrong HTTP Methods): Unprotected HTTP methods allow bypassing auth.
      4. Configuration File Exploitation: Accessing .htpasswd or .htdigest and cracking hashes.
    • Mitigation: Use HTTPS, enforce strong passwords, limit login retries, and protect all HTTP methods.
    • Tokens, Cookies, and JWT:
      • Cookies: Stateful; risks include XSS (if not HTTP Only), CSRF, and scalability issues.
      • Tokens: Stateless; risks include XSS (if in local storage), CSRF (if in cookies), and non-revocable compromised tokens.
      • JWT (JSON Web Token):
        • Structure: Header (algorithm), Payload/Claim (user data, exp, issuer), Signature (verification).
        • Generation: Signed using a secret key and chosen algorithm.
        • Usage: Stateless API authentication, self-contained.
    • JWT Attacks & Mitigation:
      1. Algorithm Bypass (None Attack): Modifying header to none can bypass verification.
      2. Algorithm Confusion (RS256 → HS256): Signing with public key due to server misconfiguration.
      3. Cracking Weak Secrets: Brute force or dictionary attacks on weak signing keys.
    • Mitigation for JWT: Enforce strong random keys, backend-enforced algorithm validation, short token expiration, and HTTPS.
    • Core takeaway: Modern web authentication requires careful design of state handling (cookies vs tokens), secure credentials, and robust JWT management to prevent bypasses, tampering, and data leaks.






























    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    đź“š The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    13 min
  • Course 2 - API Security Offence and Defense | Episode 1: API Fundamentals: Standards, Versioning, and Investigative Techniques
    In this lesson, you’ll learn about:
    • APIs — Definition & Evolution:
      • API (Application Programming Interface): A mechanism originally designed to allow software to access operating system libraries; now primarily used for data exchange between servers, web apps, mobile apps, and frontend frameworks like React or Vue.
      • Evolution of API standards:
        • XML-RPC: Early XML-based method, complex and insecure.
        • SOAP (Simple Object Access Protocol): Standardized XML-based protocol, widely adopted but rigid.
        • REST (Representational State Transfer): Modern standard, relies on HTTP methods (GET, POST, PUT, DELETE) and commonly uses JSON or XML.
    • REST API Structure & Versioning:
      • HTTP Methods & CRUD mapping:
        • GET / HEAD: Read
        • POST: Create
        • PUT / PATCH: Update
        • DELETE: Delete
      • Request Components:
        • Headers: Authentication (Authorization: Bearer ), Accept for content type negotiation.
        • Response Headers: WWW-Authenticate, Content-Type, Set-Cookie, CORS headers.
        • Status Codes: e.g., 200 OK, 201 Created, 404 Not Found, 405 Method Not Allowed, 500 Internal Server Error.
      • Versioning: Ensures older clients continue functioning; can be implemented via URL path (/v1), Accept headers, or custom headers.
    • API Fingerprinting & Discovery:
      • Key info to gather:
        1. API endpoints and domains (e.g., api.example.com)
        2. Versioning method
        3. Programming language and backend storage (SQL, NoSQL, caches like Redis)
        4. Authentication mechanism
      • Techniques: Public documentation review, subdomain enumeration, intercepting client traffic via proxies, and deducing backend details from headers or job postings.
    • Debugging & Automated Testing:
      • Proxy Tools: Burp Suite for intercepting, modifying, and forwarding API requests.
      • API Testing Tools: Postman to construct requests, specify methods, headers, and bodies (JSON payloads).
      • Fuzzing: Automated testing by sending malformed/unexpected inputs to detect exceptions or abnormal HTTP responses (e.g., 500 errors).
    • Authentication vs. Authorization:
      • Authentication: Verifying identity (ID/password, tokens, cookies, API keys, JWT, OAuth).
      • Authorization: Determining allowed actions for an authenticated client (e.g., admin vs. user privileges).
    • Core takeaway: Understanding API architecture, endpoints, authentication/authorization mechanisms, and using proxy/debugging tools is essential for secure interaction, discovery, and testing of APIs.


    You can listen and download our episodes for free on more than 10 different platforms:
    https://linktr.ee/cybercode_academy

    Get the books of the CyberCode Academy podcast:
    đź“š The book series: 416 lessons, 12 books, hundreds of original diagrams: security, networking and programming.
    https://cybercodeacademy.gumroad.com/
    11 min

About CyberCode Academy

From the publisher's feed

Welcome to CyberCode Academy — your audio classroom for Programming and Cybersecurity.
🎧 Each course is divided into a series of short, focused episodes that take you from beginner to…