Browser and email forensics
You read browser history, downloads and cookies from SQLite databases, and use email headers to reveal a phishing message’s real source and whether the user clicked.
Level 201 · 15 lessons · 12 practice labs
Lessons
Browser artefacts
- Where Chrome, Edge and Firefox keep their profiles
- Opening browser databases with sqlite3
- History and visits: converting browser timestamps
- Downloaded files and their source URLs
- Cookies, session tokens and the risk of theft
- Short task: find which site the user downloaded the malicious file from
Email artefacts
- Anatomy of an email header: the Received chain
- Reading SPF, DKIM and DMARC results from the header
- Mailbox formats: mbox, EML, PST and exports
- Extracting attachments safely and hashing them
- Short task: find the real sending server of a fake invoice
From phish to click
- Phishing indicators: lookalike domains and shortened links
- Proving the click with email, browser and proxy logs
- Fake login pages and traces of submitted forms
- Capstone: determine who clicked and entered a password in a phishing campaign
Practice labs
- Open browser history with sqlite3: List the last twenty visits from a browser history database with times converted.
- Which site the harmful file came from: Find the file's source address, referring page and save path from the download records.
- Cookies and session tokens: Find the still-valid session tokens in the cookie database and assess the risk if they were stolen.
- Read the Received chain: Order the Received lines of an email header bottom to top and find the first sending server.
- Interpret SPF, DKIM and DMARC results: Read the authentication results of three emails and justify which one is forged.
- The real sender of a fake invoice: Compare the displayed sender with the envelope sender and Received chain to prove the true source server.
- Split messages out of an mbox file: Count the messages in an mbox mailbox and list the subject lines.
- Extract and hash attachments safely: Extract an EML file's attachments without running them, identify their types and hash them.
- Find the campaign in a mailbox: Group the messages of one campaign in an exported mailbox by sender, subject and attachment hash.
- Mark the phishing indicators: Mark the look-alike domain, shortened link and urgency language in an email.
- Prove the click with three sources: Match email, browser history and proxy log to prove the user clicked the link.
- Who clicked and who entered a password: In Gelincik Okulları's prepared campaign data list separately those who clicked and those who submitted the fake form.
About this course
You read browser history, downloads and cookies from SQLite databases, and use email headers to reveal a phishing message’s real source and whether the user clicked.
What you will learn
- Browser artefacts
- Email artefacts
- From phish to click
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.