In one sentence

RFC1918 and internet-facing addresses.

Why it matters (daily life)

Think about apps and places you already use: Gmail, PhonePe / Paytm / GPay, Instagram / Facebook / LinkedIn / X, college portals, office email, dating apps, and payment dashboards like Razorpay / Cashfree. This idea shows up there in simple form.

Security decisions fail when people skip fundamentals. This lesson builds vocabulary you will reuse in labs — without heavy jargon.

How it works

Concept → why it matters in daily apps → how it works → lab-only practice → mistakes → best practices.

Real-world example

Map the idea to Gmail, UPI apps, Instagram/LinkedIn, a college portal, or a small business using Razorpay/Cashfree — then contrast with a sanitized public breach write-up. Never touch live unauthorized targets.

Memory tip

Explain it to a friend in one minute using a story about a student, an employee, or a small shop — if you can, you understand it.

Real-world example (authorized thinking only)

• College: OTP forwarded to a “support” Telegram bot → account takeover of LMS / email.
• Job: Shared admin password on a sticky note → lateral move inside a small office network.
• Daily life: Fake “KYC update” page that looks like a bank app → credential harvest. Map which control (MFA, least privilege, verify URL, offline backup) would have blocked each case.

Step-by-step (on paper — safe)

1. Read the notes once.
2. Sketch the flow (who → what → risk → control).
3. Map one attacker action and one defender action.
4. Write one quiz question you could ask yourself tomorrow.

Practical lab (authorized environments only)

Complete the module lab summary tasks only inside CYNARKS authorized environments.

Never scan or attack PhonePe, college portals, social networks, or any system you do not own / lack written permission to test.

Common mistakes

Skipping scope, trusting scanners blindly, and copying exploits onto production systems.

Security best practices

Written authorization, evidence quality, least privilege, MFA on admin paths, and clear remediation owners.

Knowledge check

• Can you explain this in simple English with a daily-life example?
• Which CIA letter (Confidentiality / Integrity / Availability) does it touch most?
• What would you verify before claiming a finding in a real job?