The Questions Nobody Answers
Cybersecurity Career Reality
From Course to Company
Every student finishes a cybersecurity course and hits the same wall — "I know the theory, but what does the job actually look like? What tools do real companies use? How do you actually investigate a hack?" This guide answers every question the industry won't tell you.
📑 What's Inside
🔧
Real Job Roles & The Tools Companies Actually Use
Most courses teach you concepts. Here's what companies actually pay for — each role, the tools they use daily, and what the work really looks like. This is what hiring managers expect you to know.
🛡️ SOC Analyst (Tier 1 / Tier 2 / Tier 3)
Most Common Entry-Level Cybersecurity Job
Reality: You are not hacking. You are triaging alerts from a SIEM dashboard, investigating whether alerts are false positives or real incidents, and escalating confirmed threats. About 70% of your alerts will be false positives — your job is to filter signal from noise fast.
| Tool Category | Real Tools Companies Use | What You Do With It |
|---|---|---|
| SIEM | Splunk, Microsoft Sentinel, Elastic Security, IBM QRadar, Chronicle | Query logs across 1000+ systems. Write SPL/KQL queries to hunt threats. This is your primary screen all day. |
| EDR / XDR | CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Carbon Black | Investigate endpoint alerts — suspicious process trees, lateral movement, ransomware indicators. Isolate compromised machines. |
| NDR | Darktrace, Vectra, Zeek (open-source) | Network anomaly detection — unusual data exfiltration, beaconing to C2 servers. |
| SOAR | Splunk Phantom, Cortex XSOAR, Swimlane | Automated playbooks — e.g., "if phishing email reported → auto-quarantine, scan attachments, block sender IP." |
| Threat Intel | VirusTotal, AlienVault OTX, Recorded Future, MISP | Look up suspicious IPs/hashes/domains. Enrich alerts with threat context. |
| Ticketing | ServiceNow, Jira, TheHive | Document every investigation. If you didn't write it down, it didn't happen. |
| Forensics | Volatility, Autopsy, KAPE, Velociraptor | Memory dumps and disk imaging when an incident is confirmed. |
"The most important skill for a SOC analyst isn't knowing tools — it's knowing how to ask the right questions when an alert fires. Who triggered this? From where? At what time? Is this normal for this user? What else happened 5 minutes before and after?"
⚔️ Penetration Tester / Ethical Hacker
What "Hacking" Actually Looks Like Professionally
Reality: You are not just running Nessus and printing a report. Automated scanners find ~20% of vulnerabilities. The other 80% comes from manual testing — chaining misconfigurations, testing business logic, and thinking like an adversary. You spend significant time writing reports.
| Phase | Real Tools | What Actually Happens |
|---|---|---|
| Recon | Nmap, Masscan, Amass, Subfinder, Shodan, theHarvester, Google Dorks | Map the attack surface. Find subdomains, open ports, exposed services. This is where you find what Nessus misses. |
| Web App Testing | Burp Suite Pro, OWASP ZAP, Caido, sqlmap, ffuf, nuclei | Manually test for SQLi, XSS, IDOR, SSRF, auth bypass. Burp Suite is your primary tool — you live in it. |
| Network Exploitation | Metasploit, CrackMapExec, Impacket, Responder, BloodHound, Mimikatz | Active Directory attacks — LLMNR poisoning, kerberoasting, pass-the-hash, DCSync. |
| Cloud Testing | ScoutSuite, Prowler, Pacu, Cloudsplaining | S3 bucket misconfigs, IAM privilege escalation, exposed cloud resources. |
| Reporting | Dradis, Ghostwriter, AttackForge, custom templates | Write findings with CVSS scores, remediation steps, and executive summaries. This is 30-40% of the job. |
"I've been on engagements where Nessus found 5 'medium' findings. Manual testing found critical SQLi, exposed admin panels with default creds, and an S3 bucket with customer PII. Scanners are a starting point — never the whole story."
🔬 Digital Forensics & Incident Response (DFIR)
When Something Is Already On Fire
Reality: You get called when a breach is confirmed. Your job: figure out how they got in, what they took, how long they've been inside, and how to kick them out — often under extreme time pressure. You work with legal teams because everything you find must be court-admissible.
Disk Forensics
FTK Imager / EnCase / X-Ways
Forensic disk imaging with write-blockers. Create bit-for-bit copies admissible in court.
Memory Forensics
Volatility 3 / Rekall
Analyze RAM dumps — find injected code, encryption keys, running malware, network connections that no longer exist on disk.
Triage Collection
KAPE / Velociraptor
Rapidly collect forensic artifacts (event logs, registry, prefetch, $MFT) from live systems across an enterprise.
Mobile Forensics
Cellebrite UFED / GrayKey / Magnet AXIOM
Extract data from locked phones — messages, call logs, GPS history, app data. Law enforcement grade.
Timeline Analysis
Plaso / log2timeline
Build a Super Timeline — reconstruct every event across all systems to understand the attacker's full path.
Network Forensics
Wireshark / Zeek / NetworkMiner
Analyze PCAPs — reconstruct file transfers, extract malware payloads, trace C2 communication.
🎯 Threat Hunter
Proactive — Finding Threats Before Alerts Fire
Reality: Unlike SOC analysts who respond to alerts, threat hunters hypothesize about what attackers might do and then search for evidence of it — even when no alert has fired. You ask: "If I were an attacker who already bypassed the SIEM, what would I do next — and what trace would that leave?"
Key Tools
Splunk (SPL), Elastic (KQL), Azure Data Explorer, Snowflake, Python (Pandas, Jupyter), MITRE ATT&CK Navigator, BloodHound, Sysmon
You write complex queries across petabytes of logs. You build detection rules. You think in TTPs (Tactics, Techniques, Procedures), not IOCs.
🕵️
Real Investigation Workflows — Step by Step
These are the questions students ask repeatedly and never get answered. Each scenario includes exactly what a real investigator or analyst would do — tools, steps, and the methodology behind them.
📱
Scenario: "Someone Hacked My Phone — How Do I Investigate?"
This is one of the most common cases — a person suspects their phone has been compromised (strange apps, battery draining fast, messages being read, calls being forwarded). Here's the actual investigation methodology used by mobile forensics professionals.
Preserve Evidence — Stop Using the Phone Immediately
Isolate the device. Put it in airplane mode — do NOT power it off (RAM evidence is lost on shutdown). If possible, put it in a Faraday bag to prevent remote wipe. Do not factory reset — that destroys all evidence.
Check for Spyware / Stalkerware Indicators
Android: Check Settings → Accessibility → Installed Services — spyware often registers as an accessibility service. Check Settings → Apps → Special Access → Device Admin for unauthorized admin apps. Look for apps named "System Update," "WiFi Service," or generic names you don't recognize.
iPhone: Check Settings → General → VPN & Device Management for unknown MDM profiles. Check for short-lived profiles that were installed and removed (check logs). Jailbreak detection: if Cydia or Sileo appears, the device has been jailbroken — massive security risk.
iPhone: Check Settings → General → VPN & Device Management for unknown MDM profiles. Check for short-lived profiles that were installed and removed (check logs). Jailbreak detection: if Cydia or Sileo appears, the device has been jailbroken — massive security risk.
Check Call Forwarding & SMS Redirection
Dial *#21# — shows if calls are being forwarded. Dial *#62# — shows forwarding when unreachable. Dial *#67# — shows forwarding when busy. If any number appears that you don't recognize, someone is receiving your calls. Cancel with ##002#.
Check Account Activity — Google / Apple ID
Google: Go to myaccount.google.com → Security → Your Devices. Check for unknown devices. Check Security → Recent Security Activity for logins from unfamiliar locations or devices.
Apple: Go to appleid.apple.com → Devices. Check for unknown devices signed into your account. Check Settings → [your name] on iPhone for listed devices.
Apple: Go to appleid.apple.com → Devices. Check for unknown devices signed into your account. Check Settings → [your name] on iPhone for listed devices.
Forensic Acquisition (Professional Step)
Tools used: Cellebrite UFED (law enforcement grade — extracts full file system including deleted data), Magnet AXIOM (analyzes extractions — maps GPS history, reconstructs chats, timeline analysis), GrayKey (iPhone brute-force unlock tool — used by law enforcement with warrants), Oxygen Forensic Detective (cloud extraction — pulls data from iCloud/Google backups including deleted content).
What these tools extract: SMS/MMS, call logs with timestamps and cell tower locations, GPS location history, WhatsApp/Telegram/Signal messages (if database accessible), deleted files from SQLite databases, app usage timestamps, browser history, WiFi connection history (maps physical locations), Bluetooth pairings (who was nearby).
What these tools extract: SMS/MMS, call logs with timestamps and cell tower locations, GPS location history, WhatsApp/Telegram/Signal messages (if database accessible), deleted files from SQLite databases, app usage timestamps, browser history, WiFi connection history (maps physical locations), Bluetooth pairings (who was nearby).
Report to Authorities
Phone hacking is a criminal offense in most jurisdictions. File a report with your local cyber crime unit or police. Provide them with: the forensic extraction report, screenshots of suspicious activity, IMEI number (dial *#06#), carrier call records (request from your mobile provider — they keep CDR logs for months/years).
⚠️ Important Reality Check
Tracking the attacker's exact physical location from a phone hack requires cell tower triangulation data, which only law enforcement can obtain from mobile carriers with a court order. As a civilian or corporate investigator, your role is to preserve evidence, identify HOW the compromise happened, and provide actionable findings to law enforcement. You cannot legally perform real-time GPS tracking on another person's device.
🏦
Scenario: "Money Was Stolen From My Bank Account — How to Investigate?"
Financial fraud investigation follows a completely different methodology than general cybersecurity. The key is following the money — whether it's traditional banking, cryptocurrency, or payment apps.
Immediate Actions — Freeze Everything
Call your bank's fraud department immediately — don't wait. Request a chargeback on unauthorized transactions. Freeze all cards. Change online banking password from a clean device. Enable 2FA. Request your bank to put a fraud alert on your account and credit report.
Collect Transaction Evidence
Download bank statements covering the fraud period (CSV/PDF). Note: transaction amount, date/time, recipient account/routing number, transaction reference number, IP address of the transaction (ask the bank — they log this), device fingerprint (bank logs the browser/device used). Every transaction has a digital fingerprint — the bank has it even if they don't show it to you.
Identify the Attack Vector
Common vectors to investigate:
• Phishing: Did you click a link in an email/SMS before the fraud? Check email sent items for unusual activity. Check email login history for unknown IPs.
• SIM Swap: Did your phone suddenly lose service before the fraud? Call your carrier — ask if a SIM swap was performed on your number.
• Credential Stuffing: Check haveibeenpwned.com — were your credentials in a known breach? Reused passwords across sites?
• Malware: Run a full antivirus scan. Check for remote access tools (AnyDesk, TeamViewer, ScreenConnect) you didn't install.
• Insider: Did anyone have physical or shared access to your device/account?
• Phishing: Did you click a link in an email/SMS before the fraud? Check email sent items for unusual activity. Check email login history for unknown IPs.
• SIM Swap: Did your phone suddenly lose service before the fraud? Call your carrier — ask if a SIM swap was performed on your number.
• Credential Stuffing: Check haveibeenpwned.com — were your credentials in a known breach? Reused passwords across sites?
• Malware: Run a full antivirus scan. Check for remote access tools (AnyDesk, TeamViewer, ScreenConnect) you didn't install.
• Insider: Did anyone have physical or shared access to your device/account?
Cryptocurrency Tracing (If Crypto Was Stolen)
Tools used by professionals:
• Chainalysis Reactor — Industry standard. Maps blockchain transaction flows from victim wallet through mixers/tumblers to exchange cashout points. Used by FBI, IRS, and most major exchanges.
• TRM Labs — Competitor to Chainalysis. Strong on cross-chain tracing (BTC → ETH → etc).
• Elliptic — Focused on Bitcoin and Ethereum forensics. Good for sanctions/illicit entity attribution.
• Etherscan / Blockchain.com Explorer — Free. Trace Bitcoin/Ethereum transactions manually. Follow the flow wallet by wallet. Time-consuming but effective for simple cases.
Methodology: Start from your wallet → trace outgoing transaction → follow through intermediary wallets → identify "peel chains" where small amounts are repeatedly split off → look for consolidation at exchange deposit addresses → exchanges have KYC (know your customer) data → law enforcement can subpoena the exchange for the identity behind the receiving wallet.
• Chainalysis Reactor — Industry standard. Maps blockchain transaction flows from victim wallet through mixers/tumblers to exchange cashout points. Used by FBI, IRS, and most major exchanges.
• TRM Labs — Competitor to Chainalysis. Strong on cross-chain tracing (BTC → ETH → etc).
• Elliptic — Focused on Bitcoin and Ethereum forensics. Good for sanctions/illicit entity attribution.
• Etherscan / Blockchain.com Explorer — Free. Trace Bitcoin/Ethereum transactions manually. Follow the flow wallet by wallet. Time-consuming but effective for simple cases.
Methodology: Start from your wallet → trace outgoing transaction → follow through intermediary wallets → identify "peel chains" where small amounts are repeatedly split off → look for consolidation at exchange deposit addresses → exchanges have KYC (know your customer) data → law enforcement can subpoena the exchange for the identity behind the receiving wallet.
File Reports
• Local Police: File a report with the cyber crime unit. Provide transaction records and evidence.
• IC3 (FBI): File at ic3.gov — for U.S.-related financial cybercrime.
• Your Bank's Fraud Department: They have their own investigation team. Cooperate fully.
• Credit Bureaus: Place fraud alerts with Equifax, Experian, and TransUnion.
• IC3 (FBI): File at ic3.gov — for U.S.-related financial cybercrime.
• Your Bank's Fraud Department: They have their own investigation team. Cooperate fully.
• Credit Bureaus: Place fraud alerts with Equifax, Experian, and TransUnion.
💀
Scenario: "I Have a Suspicious .exe File — How Do I Find the Attacker?"
Someone sent you a suspicious executable, or you found one on a compromised machine. You want to know: who made it, where it connects to, and who's behind it. Here's the professional malware analysis workflow.
Step 1: Get the Hash (File Fingerprint)
Windows: certutil -hashfile suspicious.exe SHA256
Linux: sha256sum suspicious.exe
This hash uniquely identifies the file. Search this hash on VirusTotal — if it's known malware, you instantly get: which AV engines detect it, when it was first seen, related samples, C2 IP addresses, domains, URLs extracted from the sample, and MITRE ATT&CK techniques mapped.
Linux: sha256sum suspicious.exe
This hash uniquely identifies the file. Search this hash on VirusTotal — if it's known malware, you instantly get: which AV engines detect it, when it was first seen, related samples, C2 IP addresses, domains, URLs extracted from the sample, and MITRE ATT&CK techniques mapped.
Step 2: Extract Strings — Find IPs, URLs, and Clues
Use strings (Sysinternals) or FLOSS (FireEye) to extract readable strings from the binary. Focus on: IP addresses (regex: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}), domain names / URLs, user-agent strings, registry key paths, file paths, mutex names (unique identifiers), and error messages. These reveal the C2 infrastructure.
Step 3: Sandbox Analysis — Detonate Safely
DO NOT run the file on your real machine. Use:
• ANY.RUN — Interactive online sandbox. Upload the file, it runs in a VM, records every: network connection, DNS query, file created, registry key modified, process spawned. You can interact with the malware in real-time. Extracts C2 IPs, domains, and payloads automatically.
• Joe Sandbox — Deeper analysis. More detailed reports. Better at evasive malware detection.
• VirusTotal — Has a sandbox feature but limited. Good for quick triage.
• Triage (tria.ge) — Fast. Good behavioral analysis reports with MITRE mappings.
What you get from sandbox analysis: Destination IP addresses (C2 servers), DNS requests made, HTTP/HTTPS requests — full URLs including URI paths and User-Agent, files dropped on disk, registry keys created/modified, mutexes created, process injection targets, and screenshots of the malware's behavior.
• ANY.RUN — Interactive online sandbox. Upload the file, it runs in a VM, records every: network connection, DNS query, file created, registry key modified, process spawned. You can interact with the malware in real-time. Extracts C2 IPs, domains, and payloads automatically.
• Joe Sandbox — Deeper analysis. More detailed reports. Better at evasive malware detection.
• VirusTotal — Has a sandbox feature but limited. Good for quick triage.
• Triage (tria.ge) — Fast. Good behavioral analysis reports with MITRE mappings.
What you get from sandbox analysis: Destination IP addresses (C2 servers), DNS requests made, HTTP/HTTPS requests — full URLs including URI paths and User-Agent, files dropped on disk, registry keys created/modified, mutexes created, process injection targets, and screenshots of the malware's behavior.
Step 4: Pivot from IP Address to Attacker
Once you have the C2 IP from the sandbox:
• Whois lookup: whois [IP] — reveals hosting provider, IP range owner, abuse contact email.
• Reverse DNS: dig -x [IP] — reveals PTR record. Sometimes contains the actual domain name.
• Shodan search: Search the IP on Shodan — see what services are running. If it's a C2 panel, you may find login pages.
• VirusTotal IP lookup: See if this IP has been used in other malware campaigns — reveals the threat actor group.
• Passive DNS (RiskIQ / SecurityTrails): See all domains that have ever pointed to this IP — may reveal infrastructure connected to the attacker.
To find the actual person: You need law enforcement. Submit the hosting provider's abuse contact with all evidence. If the C2 uses a domain, the domain registrar can be subpoenaed for the registrant's identity. This is beyond civilian capability — your role is to gather the evidence for law enforcement.
• Whois lookup: whois [IP] — reveals hosting provider, IP range owner, abuse contact email.
• Reverse DNS: dig -x [IP] — reveals PTR record. Sometimes contains the actual domain name.
• Shodan search: Search the IP on Shodan — see what services are running. If it's a C2 panel, you may find login pages.
• VirusTotal IP lookup: See if this IP has been used in other malware campaigns — reveals the threat actor group.
• Passive DNS (RiskIQ / SecurityTrails): See all domains that have ever pointed to this IP — may reveal infrastructure connected to the attacker.
To find the actual person: You need law enforcement. Submit the hosting provider's abuse contact with all evidence. If the C2 uses a domain, the domain registrar can be subpoenaed for the registrant's identity. This is beyond civilian capability — your role is to gather the evidence for law enforcement.
Step 5: PE Header Analysis (Windows EXE Deep Dive)
Use PeStudio or pestr to examine:
• Compilation timestamp: When was the malware compiled? Helps timeline the campaign.
• Imports: What Windows API functions does it call? CreateRemoteThread + VirtualAllocEx = process injection. WSAStartup = network activity. RegCreateKeyEx = registry persistence.
• Sections: Are section names unusual (UPX0, UPX1 = packed with UPX)? High entropy sections = encrypted/packed code.
• Resources: Is there another executable embedded in the resources section? Common in droppers.
• Compilation timestamp: When was the malware compiled? Helps timeline the campaign.
• Imports: What Windows API functions does it call? CreateRemoteThread + VirtualAllocEx = process injection. WSAStartup = network activity. RegCreateKeyEx = registry persistence.
• Sections: Are section names unusual (UPX0, UPX1 = packed with UPX)? High entropy sections = encrypted/packed code.
• Resources: Is there another executable embedded in the resources section? Common in droppers.
✅ Quick Answer: How to Find the Attacker's IP from an EXE
1. Hash the file → sha256sum suspicious.exe
2. Upload hash to VirusTotal.com — check "Relations" tab for contacted IPs
3. Upload file to ANY.RUN → see live network connections → copy destination IP
4. Run strings suspicious.exe | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' for hardcoded IPs
5. Use FLOSS (FireEye) for obfuscated string extraction — catches encoded C2 addresses
💬
Scenario: "Someone Is Calling from a WhatsApp/Unknown Number — How to Investigate?"
You receive calls or messages from an unknown number via WhatsApp, Telegram, or direct call — threatening, harassing, or suspicious. Here's what a professional OSINT investigator does to identify the person behind the number.
Step 1: Normalize the Phone Number
Convert the number to E.164 international format (+CountryCode Number). For example: Indian number 9876543210 becomes +919876543210. US number (415) 555-0117 becomes +14155550117. This format is essential — every OSINT tool uses it. Use PhoneInfoga to validate, determine carrier, line type (mobile/VoIP/landline), and country.
Step 2: Check Carrier and Line Type
• PhoneInfoga (free, open-source): phoneinfoga scan -n +14155550117 — reveals carrier, country, line type.
• FreeCarrierLookup.com — Shows current carrier (important: numbers can be ported, so the carrier may have changed).
• If it's VoIP (Google Voice, TextNow, Burner): Much harder to trace. The number was created online with minimal verification. You can report to the VoIP provider's abuse department.
• FreeCarrierLookup.com — Shows current carrier (important: numbers can be ported, so the carrier may have changed).
• If it's VoIP (Google Voice, TextNow, Burner): Much harder to trace. The number was created online with minimal verification. You can report to the VoIP provider's abuse department.
Step 3: Reverse Lookup — Who Owns This Number?
• Truecaller — Most comprehensive global phone directory. Search the number. Shows name, carrier, location (city/country), and if other users have reported it as spam.
• Sync.ME — Alternative to Truecaller. Also shows linked social media profiles.
• Epieos — Searches Google, Skype, WhatsApp, and other platforms simultaneously. Finds where this number is registered.
• OSINT Industries — 70+ phone lookup modules. Professional-grade. Finds linked emails, real names, social media, and breach data.
• Google Search: Search the number in all formats: "(415) 555-0117", "415-555-0117", "14155550117", "+14155550117". Different sites store numbers in different formats.
• Sync.ME — Alternative to Truecaller. Also shows linked social media profiles.
• Epieos — Searches Google, Skype, WhatsApp, and other platforms simultaneously. Finds where this number is registered.
• OSINT Industries — 70+ phone lookup modules. Professional-grade. Finds linked emails, real names, social media, and breach data.
• Google Search: Search the number in all formats: "(415) 555-0117", "415-555-0117", "14155550117", "+14155550117". Different sites store numbers in different formats.
Step 4: WhatsApp-Specific Investigation
• Save the number in your contacts (use a burner phone/secondary device for safety). Open WhatsApp — if the person has a WhatsApp account, their profile picture, status, and "last seen" become visible.
• Profile picture: Download it. Run through reverse image search (Google Images, Yandex Images, TinEye, PimEyes for face search). This can link to their Facebook, Instagram, LinkedIn, or dating app profiles.
• Status text: May contain names, locations, or identifiers.
• About section: Often contains real name, job title, or personal info.
• Check if the number is business: WhatsApp Business accounts display business name, category, address, website, and email — goldmine of PII.
• Profile picture: Download it. Run through reverse image search (Google Images, Yandex Images, TinEye, PimEyes for face search). This can link to their Facebook, Instagram, LinkedIn, or dating app profiles.
• Status text: May contain names, locations, or identifiers.
• About section: Often contains real name, job title, or personal info.
• Check if the number is business: WhatsApp Business accounts display business name, category, address, website, and email — goldmine of PII.
Step 5: Pivot to Social Media & Breach Data
• Maltego — Professional OSINT platform. Start with phone number → transform to social media profiles, emails, domains, IPs. Visual link analysis.
• Holehe — Checks if the email (found from phone) is registered on 100+ platforms (Twitter, Instagram, Spotify, etc.)
• DeHashed / HaveIBeenPwned — Check if the number/email appears in data breaches. Breach data often includes: full name, address, IP addresses, passwords, linked accounts.
• Sherlock / maigret — Username search across 300+ social platforms. If you found a username from WhatsApp or breach data, find every platform they're on.
• Holehe — Checks if the email (found from phone) is registered on 100+ platforms (Twitter, Instagram, Spotify, etc.)
• DeHashed / HaveIBeenPwned — Check if the number/email appears in data breaches. Breach data often includes: full name, address, IP addresses, passwords, linked accounts.
• Sherlock / maigret — Username search across 300+ social platforms. If you found a username from WhatsApp or breach data, find every platform they're on.
🔍 Phone Investigation Tool Stack (Professional)
PhoneInfoga
Number validation, carrier lookup, VoIP detection. Free. Open-source.
Truecaller
Global phone directory. Name + location + spam reports.
Epieos
Cross-platform search. Finds where the number is registered (Google, Skype, WhatsApp).
Maltego
Visual link analysis. Pivot from phone → email → social → domain → IP.
OSINT Industries
70+ modules. Professional-grade phone-to-identity lookup.
Holehe
Check if email is registered on 100+ platforms. Free.
👤
Scenario: "Someone Is Stalking/Harassing Me on Social Media — How to Identify Them?"
A fake or anonymous account is harassing, stalking, or threatening you on Instagram, Facebook, Twitter, or another platform. You want to find out who's really behind it. This is a real OSINT investigation methodology.
Document Everything Before They Delete It
Take screenshots of everything — profile, posts, messages, comments, friend/follower list. Save URLs. Note dates, times, and timezone. Download their profile picture and any images they've posted. Do not block them yet — blocking may alert them and cause deletion of evidence. Use a secondary account or ask a friend to monitor if you need distance.
Profile Picture Reverse Image Search
Download the profile picture at the highest resolution available. Run through:
• Google Images (images.google.com — upload or paste URL)
• Yandex Images — Often better than Google for face matching. Finds eastern European/Russian sources Google misses.
• PimEyes — AI-powered facial recognition search. Scans the web for the same face. Finds photos even if they've been cropped, filtered, or slightly modified. This is the most powerful tool — it often links back to a real LinkedIn, Facebook, or company website with the person's real name.
• FaceCheck.ID — Alternative to PimEyes. Also good for finding social media profiles from a face.
If the profile picture is a celebrity, stock photo, or AI-generated: This person is using a fake identity. Note that as evidence — it shows intent to deceive.
• Google Images (images.google.com — upload or paste URL)
• Yandex Images — Often better than Google for face matching. Finds eastern European/Russian sources Google misses.
• PimEyes — AI-powered facial recognition search. Scans the web for the same face. Finds photos even if they've been cropped, filtered, or slightly modified. This is the most powerful tool — it often links back to a real LinkedIn, Facebook, or company website with the person's real name.
• FaceCheck.ID — Alternative to PimEyes. Also good for finding social media profiles from a face.
If the profile picture is a celebrity, stock photo, or AI-generated: This person is using a fake identity. Note that as evidence — it shows intent to deceive.
Username Investigation
The username is often reused across platforms. Use:
• Sherlock — sherlock username — checks 300+ social networks. Finds every platform where this username exists.
• maigret — Similar to Sherlock, often finds different results. Run both.
• WhatsMyName (whatsmyname.app) — Web-based username enumeration across 500+ sites.
• Namechk (namechk.com) — Checks username availability (also reveals where it's already taken = where the person has accounts).
Check the oldest account you find: The first platform they registered on often uses their real name or contains more personal information.
• Sherlock — sherlock username — checks 300+ social networks. Finds every platform where this username exists.
• maigret — Similar to Sherlock, often finds different results. Run both.
• WhatsMyName (whatsmyname.app) — Web-based username enumeration across 500+ sites.
• Namechk (namechk.com) — Checks username availability (also reveals where it's already taken = where the person has accounts).
Check the oldest account you find: The first platform they registered on often uses their real name or contains more personal information.
Analyze Their Content & Metadata
• Writing style: Unique phrases, typos, slang, emoji usage. Compare with known contacts.
• Posted images: Check EXIF data using exiftool — may reveal GPS coordinates, camera model, date/time taken. (Instagram strips EXIF, but many smaller platforms don't.)
• Background analysis: What's in the background of their photos? Landmarks, street signs, store names, license plates, weather, vegetation — all reveal location.
• Posting schedule: What timezone do they post in? Consistent timing reveals their timezone and likely country.
• Friends/followers: Look through who they follow and who follows them. Even fake accounts frequently interact with one or two real accounts — often their real identity or close associates.
• Posted images: Check EXIF data using exiftool — may reveal GPS coordinates, camera model, date/time taken. (Instagram strips EXIF, but many smaller platforms don't.)
• Background analysis: What's in the background of their photos? Landmarks, street signs, store names, license plates, weather, vegetation — all reveal location.
• Posting schedule: What timezone do they post in? Consistent timing reveals their timezone and likely country.
• Friends/followers: Look through who they follow and who follows them. Even fake accounts frequently interact with one or two real accounts — often their real identity or close associates.
Platform Reporting & Law Enforcement
• Report to the platform: Every major platform has a reporting mechanism for harassment/stalking. They can provide account metadata (IP logs, device info, email) to law enforcement with a subpoena.
• File a police report: Cyberstalking is a crime in most jurisdictions. Provide all documented evidence. Law enforcement can subpoena the platform for: IP addresses used to log in, device fingerprint, email address on file, phone number on file, and account creation date/location.
• Restraining order: If the person is identified and local, a restraining/protection order is enforceable.
• File a police report: Cyberstalking is a crime in most jurisdictions. Provide all documented evidence. Law enforcement can subpoena the platform for: IP addresses used to log in, device fingerprint, email address on file, phone number on file, and account creation date/location.
• Restraining order: If the person is identified and local, a restraining/protection order is enforceable.
📞
Scenario: "Receiving Abusive / Threatening Phone Calls — How to Track the Caller?"
You're receiving threatening, harassing, or abusive calls from a number — possibly spoofed, possibly real. Here's how a professional investigator or law enforcement tracks the source.
Determine If the Number Is Spoofed
Caller ID spoofing is trivially easy — anyone can make a call appear to come from any number. Do not trust the displayed number. Indicators of spoofing: the "caller" claims to be from a government agency or bank (verify by hanging up and calling the official number), the number looks like your own (neighbor spoofing), the caller asks for money, gift cards, or personal information.
If spoofed: The caller ID is useless for identification. You need carrier-level data. Only law enforcement can obtain this with a subpoena to the carrier.
If spoofed: The caller ID is useless for identification. You need carrier-level data. Only law enforcement can obtain this with a subpoena to the carrier.
Request Call Detail Records (CDR) from Your Carrier
Your mobile carrier maintains Call Detail Records that include: calling number, called number, call start time and duration, cell tower(s) the call connected through, IMSI/IMEI of devices involved. You can request your own CDR from your carrier (some provide it in your account portal). For the caller's identity, law enforcement must subpoena the caller's carrier.
Trap & Trace (Law Enforcement Only)
Pen Register / Trap and Trace: Law enforcement can place a court-ordered device on your phone line that records the signaling information for all incoming calls — even spoofed ones. This captures the actual originating number (ANI — Automatic Number Identification), which is different from the caller ID display and cannot be spoofed. This is the gold standard for identifying abusive callers.
Cell Tower Triangulation (Law Enforcement Only)
Mobile carriers know which cell tower(s) handled every call. With multiple towers, investigators can triangulate the caller's physical location at the time of the call — typically accurate to within 50-300 meters in urban areas. This requires a court order. GPS data from the caller's phone (if a smartphone) provides even more precise location.
What You Can Do Without Law Enforcement
• Record calls if legal in your jurisdiction (check one-party vs two-party consent laws).
• Note everything: Time, date, duration, what was said, background noise, accent, speech patterns.
• Background noise analysis: Traffic sounds, announcements (airport, train station), religious calls to prayer, distinctive music — all reveal location.
• Use TrapCall (commercial service) — unmasks blocked/private numbers on your line by routing through their system. Works for blocked caller ID, not spoofed numbers.
• Change your number: If the abuse is ongoing and you can't identify the caller, this is often the most practical solution while law enforcement investigates.
• Note everything: Time, date, duration, what was said, background noise, accent, speech patterns.
• Background noise analysis: Traffic sounds, announcements (airport, train station), religious calls to prayer, distinctive music — all reveal location.
• Use TrapCall (commercial service) — unmasks blocked/private numbers on your line by routing through their system. Works for blocked caller ID, not spoofed numbers.
• Change your number: If the abuse is ongoing and you can't identify the caller, this is often the most practical solution while law enforcement investigates.
⚠️ Critical Reality: Why You Can't "Just Track" a Caller
There is no tool or website where you can enter a phone number and get the caller's exact GPS location in real time. Those services are scams. Phone location tracking requires carrier-level access, which is only available to law enforcement with a court order. What you CAN do is gather enough evidence for law enforcement to take action. Document everything, file a police report, and push for a subpoena.
📡
SOC Analyst — A Real Day in the Life
This is what a Tier 1/Tier 2 SOC analyst actually does — hour by hour. No theory. No textbook. This is the reality that nobody tells students.
🕐 A Typical SOC Analyst Shift (8 Hours)
08:00 — Shift Start
Read handoff notes from the previous shift. Check overnight alerts in the SIEM queue. Review threat intel feeds for new IOCs (malicious IPs, hashes, domains discovered overnight). Morning standup meeting — 10 minutes.
08:30 – 12:00 — Alert Triage (Peak Focus)
This is the core of the job. SIEM queue has 30-50 alerts. You open each one: Read the alert description → check the risk score → look at the raw log → determine if it's a false positive or real. ~70% are false positives. Example: "Suspicious login from Russia" → check if user is on vacation → check if VPN was used → if legitimate, document and close. If suspicious → escalate to Tier 2. Every decision goes in the ticket.
12:00 – 13:00 — Lunch / Shift Change Overlap
Usually staggered with teammates so someone is always watching the queue.
13:00 – 16:00 — Deep-Dive Investigations
Now you investigate the alerts that were escalated. Pull endpoint telemetry from CrowdStrike/SentinelOne — what processes were running? Pull firewall logs — what traffic went where? Check threat intel — is this a known C2 IP? Build a timeline: what happened, in what order, across which systems. If it's a confirmed incident → execute containment: isolate the host from the network, block the IP at the firewall, reset compromised credentials.
16:00 – 16:30 — Documentation & Handoff
Write up incident reports. Update runbooks if you discovered a new detection method. Document MTTR (Mean Time to Respond) metrics. Write handoff notes for the next shift — "Alert #4421 escalated, waiting on user confirmation. C2 IP 203.0.113.45 blocked at firewall. Monitor for reconnection attempts."
📊 What SOC Analysts Actually Do (Reality vs. Expectation)
| What Students Think | What Actually Happens |
|---|---|
| "I'll be hacking attackers back" | You will never hack back. That's illegal. You monitor, detect, contain, and document. |
| "I'll use advanced tools all day" | You'll use the SIEM 80% of the time, EDR 15%, and other tools 5%. Master the SIEM query language (SPL/KQL). |
| "Every alert is a real attack" | ~70% are false positives. Your #1 skill: quickly determining what's real vs. noise. |
| "I'll work alone investigating" | SOC is highly collaborative. You escalate to Tier 2/3, coordinate with IT, and brief management during incidents. |
| "I just need technical skills" | Communication is equally important. You must clearly document and explain incidents to non-technical stakeholders. |
| "Certifications guarantee the job" | They help get interviews. Demonstrated skills (home lab, CTF writeups, GitHub projects) get jobs. |
🐛
Bug Bounty Reality: Why Nessus Alone Finds Nothing
The most common question: "I ran Nessus/Nikto/OpenVAS on a bug bounty target and found nothing. How do people actually find bugs?" Here's the truth.
🔍 Automated Scanners vs. Manual Testing — The Gap
Automated scanners work by matching patterns (signatures). They check: is this version vulnerable to CVE-X? Is this port open? Is this header missing? They cannot test business logic, chain multiple low-severity issues into critical impact, or understand application context.
| What Scanners Find (~20%) | What Manual Testing Finds (~80%) |
|---|---|
| Known CVEs in outdated software versions | Business logic flaws (e.g., buying items with negative quantity for free) |
| Missing security headers (CSP, HSTS) | IDOR — accessing other users' data by changing an ID in the URL |
| Open ports with known vulnerable services | Authentication bypass via parameter manipulation |
| Default credentials on common services | Race conditions (TOCTOU) in checkout/payment flows |
| Basic SQLi in obvious parameters | Blind/Time-based SQLi in hidden or POST parameters |
| Exposed directory listings | OAuth misconfigurations leading to account takeover |
| SSRF via PDF generation, webhooks, or image processing | |
| JWT token manipulation (none algorithm, weak secrets) |
🛠️ What Successful Bug Hunters Actually Do
Reconnaissance — Map the Real Attack Surface
Run subfinder, amass, and crt.sh to find subdomains. Run httpx to probe which are live. Use waybackurls and gau to find historical endpoints. Use Google Dorks to find exposed files. This is where you find the dev server with no auth, the staging environment with debug mode on, the old API version still running. Scanners don't do this.
Manual Parameter Discovery
Use ffuf with parameter wordlists to discover hidden parameters. Use arjun or paramspider. Fuzz for: ?redirect=, ?file=, ?id=, ?callback=, ?url=, ?path=. These are SSRF, LFI, IDOR, and open redirect entry points — scanners rarely discover hidden parameters.
Understand the Application Logic
Actually use the application. Register an account. Go through every flow. Ask: "What happens if I change this ID in the URL? What if I make this value negative? What if I skip this step? What if I use another user's token? What if I change the role from 'user' to 'admin' in the JWT?" This is the thinking that finds bugs no scanner can detect.
Use Automation as an Assistant, Not a Replacement
Run nuclei with custom templates on all discovered subdomains and endpoints — NOT as your primary tool, but as a second pass after manual recon. Run dalfox for XSS on parameters you've already identified manually. Automate the repetitive parts; think through the creative parts.
"People ask me what tool I use. I say my brain. Tools execute what I tell them to. The value isn't knowing how to run Nessus — it's knowing WHERE to look and WHAT questions to ask the application."
— Every successful bug bounty hunter
— Every successful bug bounty hunter
🔬
Complete Digital Forensics Toolkit
These are the actual tools used by forensic investigators in companies, law enforcement, and incident response firms. Organized by what you're investigating.
💾 Disk & File System Forensics
Imaging
FTK Imager
Create forensic disk images (E01, DD, AFF). Free. Industry standard for court-admissible imaging.
Imaging
Guymager
Linux-based forensic imager. Fast. Supports multiple compression formats.
Analysis
Autopsy / The Sleuth Kit
Free. Analyze disk images. Recover deleted files. Timeline analysis. File carving.
Analysis
X-Ways Forensics
Professional. Extremely fast. Low resource usage. Used by many law enforcement agencies.
Triage
KAPE
Rapidly collect forensic artifacts from live systems. Targets: event logs, registry, prefetch, $MFT, browser history, and more.
Triage
Velociraptor
Enterprise-wide forensic collection and monitoring. Query thousands of endpoints simultaneously.
🧠 Memory Forensics
Primary
Volatility 3
Analyze RAM dumps. Find: injected code, running processes (including hidden), network connections, registry keys in memory, encryption keys, passwords in plaintext. The gold standard.
Acquisition
Magnet RAM Capture
Free. Capture memory from live Windows systems. Minimal footprint.
Acquisition
LiME
Linux Memory Extractor. Loadable kernel module for capturing Linux RAM.
Analysis
Rekall
Alternative to Volatility. Good for Linux and macOS memory analysis.
📱 Mobile Forensics
Extraction
Cellebrite UFED
Industry standard for mobile extraction. Supports iOS and Android. Logical, file system, and physical extraction. Law enforcement grade. Expensive.
Extraction
GrayKey
iPhone brute-force unlock. Used by law enforcement with warrants. Can bypass iPhone passcodes.
Analysis
Magnet AXIOM
Analyze mobile + computer evidence together. Reconstructs: messages, GPS history, call logs, app data, browser history, cloud data.
Analysis
Oxygen Forensic Detective
Cloud extraction — pulls data from iCloud, Google, WhatsApp backups, social media. Finds deleted content.
Open Source
Android Debug Bridge (ADB)
Free. Extract data from Android devices with USB debugging enabled. adb backup -apk -shared -all -system
Open Source
iLEAPP / ALEAPP
Free. Parse iOS/Android forensic extractions. HTML reports. Parse SQLite databases, plists, and logs.
🌐 Network Forensics
Packet Analysis
Wireshark
Analyze PCAP files. Reconstruct TCP streams. Extract transferred files. Follow conversations. The universal network forensics tool.
Network Monitoring
Zeek (formerly Bro)
Network security monitor. Generates rich logs: connection summaries, HTTP requests, DNS queries, SSL certificates, file transfers.
File Extraction
NetworkMiner
Extract files, certificates, and credentials from PCAPs. Passive — doesn't send any packets.
Flow Analysis
SiLK / FlowBAT
Analyze NetFlow/IPFIX data. Find top talkers, unusual ports, beaconing patterns.
💰 Blockchain & Cryptocurrency Forensics
Professional
Chainalysis Reactor
Industry standard. Maps transaction flows. Clusters wallets. Identifies exchange cashout points. Used by FBI, IRS, Europol.
Professional
TRM Labs
Cross-chain tracing (BTC, ETH, multi-chain). Strong sanctions/illicit entity database.
Professional
Elliptic
Bitcoin/Ethereum focus. Sanctions screening. Wallet risk scoring.
Free
Etherscan / Blockchain.com Explorer
Manual transaction tracing. Follow the money wallet by wallet. Free.
Free
Breadcrumbs
Free blockchain analytics with address clustering and path mapping.
🗺️
From Student to Hired — The Real Roadmap
You finished a course. Now what? Here's exactly what to do next — based on what companies actually look for.
📋 The 6 Things That Actually Get You Hired
Build a Home Lab (This is #1 — Non-Negotiable)
Install VirtualBox/VMware. Set up: a Windows domain controller, a Windows client, a Linux server, a Kali Linux attack VM, Security Onion (free SIEM), Splunk Free. Practice: forward Windows event logs to Splunk, simulate an attack from Kali, detect it in Splunk. This demonstrates more competence than any certification. Document it on GitHub.
Learn the SIEM Query Language
If you want a SOC job, learn SPL (Splunk) or KQL (Azure Sentinel / Microsoft Defender). Both have free tiers. Practice: write queries to find failed logins, account lockouts, unusual process execution, lateral movement. You will use these every single day on the job.
Get One Practical Certification
Not CompTIA Security+ (too theoretical). Get: BLT1 (Blue Team Level 1 — pure hands-on SOC), HTB CDSA (SOC Analyst cert from HackTheBox), BTL1 or eJPT for pentesting. These prove you can DO the work, not just talk about it.
Do CTFs and Write Writeups
HackTheBox, TryHackMe, Blue Team Labs Online, LetsDefend. For every challenge you solve: write a blog post or GitHub writeup explaining WHAT you did and WHY. Hiring managers read these. They prove analytical thinking better than a resume bullet.
Learn to Script (Python or PowerShell)
You don't need to be a developer. You need to: parse logs, automate alerts, extract IOCs, query APIs. Learn: Python (requests, pandas, re), PowerShell (Get-WinEvent, Invoke-Command). Write scripts that solve real problems and put them on GitHub.
Network and Apply Strategically
LinkedIn: post your CTF writeups and home lab documentation. Connect with people working at companies you want to join. Apply to SOC Analyst Tier 1 and Jr. Pentester roles specifically — these are the only realistic entry-level cybersecurity positions. Expect 50-100 applications. It's a numbers game.
✅ The Reality Check Summary
Nobody hires you because you "know cybersecurity." They hire you because you can: triage alerts in a SIEM, write Splunk queries, analyze a phishing email, read a PCAP in Wireshark, document an investigation clearly, and demonstrate these skills with evidence. The course teaches you concepts. The home lab proves you can actually DO the work. Build the home lab.
