# URLs, File Hashes, Certificates, and Digital Artifacts

> Parse and defang URLs, use cryptographic and fuzzy hashes correctly, read X.509 certificates, and rank artefacts by durability.

Canonical: https://codelivly.com/rooms/cti-urls-hashes-certificates-artifacts
Last updated: 2026-10-28

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 5 |
| XP | 100 |

**Purpose.** Beyond IPs and domains, analysts handle URLs, file hashes, TLS certificates and host and network artefacts. This module teaches what each one identifies, how to handle it safely, how it links to other infrastructure, and how long it stays useful.

**Prerequisites.** Modules 1 and 2 of this learning path.

**Learning outcomes.** After this module you can:

- Parse a URL into its components, identify the true host behind deception tricks, and defang and refang indicators consistently.
- Identify MD5, SHA-1 and SHA-256 by length, and explain what ssdeep, TLSH and imphash add and where they mislead.
- Read the fields of an X.509 certificate and use SAN entries, fingerprints and public key hashes as pivots.
- Rank indicators and artefacts with the Pyramid of Pain and plan for indicator decay and false positives.

**Practical completion objective.** Correlate incident files and TLS connections against a synthetic intelligence set, discount misleading matches, and identify previously unknown C2 infrastructure from a certificate fingerprint.

## Lessons

1. URL Anatomy, Deception Tricks and Defanging (15 min)
2. Cryptographic Hashes, Fuzzy Hashes and Imphash (15 min)
3. X.509 Certificates as Intelligence (15 min)
4. Host and Network Artefacts and the Pyramid of Pain (15 min)
5. Lab: Correlate Hashes, Certificates and IPs Against an Intelligence Set (50 min)

## Related

- [Learning path: OSINT and Indicator Analysis](https://codelivly.com/learning-paths/cti-osint-indicator-analysis)
- [All rooms](https://codelivly.com/rooms)