cobra@kirkwood:~/courses/cyber2$ cat README.md

Cybersecurity II

Year 3 of the Cobra Cyber pathway. Web development meets real-world security — build, break, and defend web applications. Includes weekly real-world incident analysis via CyberWatch.

Security+/CySA+ aligned Year 03 5 Units + CyberWatch Web Dev & AppSec

// live assignment

CyberWatch Weekly

Every week, real-world cybersecurity incidents are curated and analyzed for class discussion. Read the current briefing, identify the attack types, and come ready to discuss how defenders could have responded differently.

Updated weekly — includes incident summaries, severity ratings, threat actor attribution, and key vocabulary.

↗ Open CyberWatch Weekly
Quick Access // portals
↗ CyberWatch Weekly ↗ CompTIA Login ↗ CodeHS Login ↗ PicoCTF ↗ W3Schools
Course Units // web dev + application security
UNIT 01 Web Fundamentals: HTML, CSS & JavaScript Build before you break ▾

You need to understand how websites are built before you can understand how they're attacked. Build functional web pages from scratch using the three core languages of the web.

Topics covered

  • HTML structure, tags, and semantic elements
  • CSS selectors, box model, Flexbox
  • JavaScript basics (variables, functions, DOM)
  • Forms and user input handling
  • Responsive design and Bootstrap
  • How browsers parse and render pages
  • Developer tools (Inspect Element, Console)
// Quick reference: HTML skeleton
<!DOCTYPE html>
<html lang="en">
  <head><meta charset="UTF-8"></head>
  <body><h1>Hello, World!</h1></body>
</html>
UNIT 02 Web Application Security & OWASP Top 10 Attack & defend the web ▾

The OWASP Top 10 lists the most critical web application security risks. Learn each one — how it works, what damage it can cause, and how to defend against it.

OWASP Top 10 (2021)

A01
Broken Access Control
Users doing things they shouldn't be allowed to
A02
Cryptographic Failures
Weak or missing encryption of sensitive data
A03
Injection
SQL, NoSQL, OS, LDAP injection attacks
A04
Insecure Design
Flaws baked in at the design stage
A05
Security Misconfiguration
Default creds, open ports, verbose error messages
A06
Vulnerable & Outdated Components
Using libraries with known CVEs
A07
Identification & Auth Failures
Broken authentication, session hijacking
A08
Software & Data Integrity Failures
Insecure deserialization, CI/CD pipeline attacks
A09
Security Logging & Monitoring Failures
Not detecting or recording attacks
A10
Server-Side Request Forgery
Tricking servers into making unintended requests

Additional topics

  • Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
  • Input validation and sanitization
  • Content Security Policy (CSP) headers
UNIT 03 Ethical Hacking & Penetration Testing Think like an attacker ▾

Authorized, ethical hacking is one of the most valuable skills in cybersecurity. Learn the methodology, tools, and legal boundaries of penetration testing.

Topics covered

  • Ethical hacking vs. malicious hacking
  • Rules of engagement and authorization
  • Recon techniques (OSINT, passive & active)
  • Scanning with Nmap
  • Exploitation basics
  • Post-exploitation concepts
  • Reporting and remediation
  • Bug bounty programs
UNIT 04 Incident Response & Digital Forensics Investigate and contain ▾

When an attack succeeds, defenders need to detect it, contain it, eradicate it, and recover. Digital forensics helps us understand what happened — and gather evidence.

Topics covered

  • Incident Response lifecycle (PICERL)
  • Chain of custody in digital evidence
  • Log analysis and timeline reconstruction
  • Memory and disk forensics concepts
  • Malware analysis (static vs dynamic)
  • Threat hunting basics
  • Reporting and lessons learned
UNIT 05 Advanced Persistent Threats & Nation-State Attacks The big picture ▾

The most sophisticated attacks come from well-funded adversaries — nation-states and organized cybercrime groups. Learn how APTs operate, major incidents in history, and how CyberWatch Weekly connects to this bigger picture.

Topics covered

  • APT lifecycle and kill chain
  • Nation-state threat actors (Lazarus, APT28, etc.)
  • Supply chain attacks (SolarWinds, 3CX)
  • Critical infrastructure targeting
  • AI and autonomous agents in attacks
  • Geopolitics and cyber warfare
  • Analyzing real incidents (CyberWatch)
Key Vocabulary // study guide
SQL Injection
Inserting malicious SQL code into a web form or URL to manipulate a backend database — one of the oldest and most common web attacks.
XSS (Cross-Site Scripting)
Injecting malicious JavaScript into a web page that other users view — can steal cookies, session tokens, or redirect victims.
OWASP
Open Worldwide Application Security Project — nonprofit producing the industry-standard Top 10 list of web application security risks.
Penetration Testing
Authorized, simulated cyberattack against a system to find vulnerabilities before real attackers do. Requires explicit written permission.
OSINT
Open Source Intelligence — collecting information from publicly available sources (social media, WHOIS, public records) during the recon phase.
APT (Advanced Persistent Threat)
Long-term, stealthy attacks by skilled adversaries (often nation-states) who maintain unauthorized access to a network for months or years.
Kill Chain
Lockheed Martin's model of the 7 stages of a cyberattack: Recon → Weaponize → Deliver → Exploit → Install → Command & Control → Actions.
CSRF (Cross-Site Request Forgery)
Tricking an authenticated user's browser into making unintended requests to a site they're logged into — exploits the browser's trust.
Digital Forensics
The process of recovering, preserving, and analyzing digital evidence from computers, networks, or devices, following strict chain-of-custody rules.
Supply Chain Attack
Compromising a target's trusted vendor or software provider to gain access — e.g., poisoning an update mechanism to deliver malware to thousands of customers.
BOLA / IDOR
Broken Object Level Authorization (OWASP API Security Top 10 #1) / Insecure Direct Object Reference — accessing data by modifying an ID in a URL or request.
Agentic AI Attack
Emerging threat where AI agents with autonomous capabilities (file access, API calls, web browsing) are exploited via prompt injection to perform malicious actions.
Learning Resources // tools & platforms
CyberWatch Weekly Your weekly real-world incident briefing. Read before class — know the news. ↗ kihsweb.net/cyber-incidents.html OWASP Top 10 Official OWASP documentation on the 10 most critical web security risks. ↗ owasp.org W3Schools Quick reference for HTML, CSS, JavaScript, and SQL — bookmark this one. ↗ w3schools.com PicoCTF Practice web exploitation, forensics, crypto, and more in a legal, sandboxed environment. ↗ picoctf.org CodeHS Complete course assignments and track progress. ↗ codehs.com SmartDraw Create network diagrams, flowcharts, and security architecture visuals. ↗ smartdraw.com