Lion Cipher Lab
Unroll a reported phishing link with a safe redirect resolver, and measure it against cloaking
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A user forwards you a link from an email they almost clicked. You cannot click it: one visit can tip off the operator and burn the investigation, and the link may land on a credential-harvest page. But you also cannot just read the shortened URL, because modern phishing hides the real destination behind a chain of hops: a shortener 301, a tracker 302, a meta-refresh, a JavaScript redirect, and server-side cloaking that shows a harmless page to anything that does not look like a real victim's browser. This lab has you stand up a safe, offline copy of exactly that chain, then build a small…
What you'll learn
- following a redirect chain one hop at a time with auto-redirect OFF, so you control every step
- recording each hop: status code, Location header, Server header, connect IP and timing
- parsing an HTML meta-refresh hop and FLAGGING a JavaScript location hop without executing it
- writing a stdlib resolver with http.client and urllib.parse (no third-party packages, no browser)
- building safety limits into an analysis tool: a hop cap, a scheme allowlist, and a private-IP / rebinding guard
- emitting an IOC list of every domain and URL seen, and scoring it against a reference key
- measuring curl -L vs your tool vs your tool with browser-like headers against a cloaked landing page
- the OPSEC of link analysis: why fetching from your own IP tips off the operator, and when to use a sandbox or urlscan instead
Steps in this lab
- The words first: redirect, hop, chain, cloaking, and IOC
- When to reach for this, and when NOT to
- Open two terminals, check Python and curl, make a folder
- Stand up the fake phishing chain on your own machine
- BEFORE: what curl -L does, and where it quietly stops
- Build the tool: a safe resolver in about 130 lines of stdlib Python
- AFTER (1): run the tool with its default, honest user-agent
- AFTER (2): browser-like headers, and beating a header cloak
- The cloak you cannot beat from your own IP
- Prove the safety rails actually fire
- Score it: curl vs the tool against the reference key
- The honest negatives, written down
- How a pro does it, and the OPSEC that protects the case