https://r3d.page/r3A minimal, responsive and feature-rich Jekyll theme for technical writing. 2026-09-24T21:37:03+03:00 r3dzyoud https://r3d.page/ Jekyll © 2026 r3dzyoud /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png M4CR0SC0PE: VBA Macro Analysis with LLM2026-07-01T10:00:00+03:00 2026-08-01T23:19:14+03:00 https://r3d.page/posts/m4cr0sc0pe-vba-macro-analysis/ r3dzyoud Overview M4CR0SC0PE is my graduation project at Jordan University of Science and Technology (JUST), Faculty of Computer and Information Technology — a fully static analysis pipeline for detecting and analyzing malicious VBA macros in Microsoft Office documents. The core idea: combine deep static code analysis with Large Language Model semantic reasoning to produce explainable malware reports ... REV: Packed Trojan, DLL, Rootkit & IDAPython2026-06-08T10:00:00+03:00 2026-08-02T14:56:08+03:00 https://r3d.page/posts/rev-project2-packed-trojan-dll-rootkit/ r3dzyoud Overview Five reverse engineering exercises: a UPX-packed Trojan analyzed in IDA Pro, a custom-encrypted DLL reversed in Ghidra + IDAPython, a Base64-obfuscated VBScript downloader, a rootkit kernel driver with hooked Windows APIs, and an automation pipeline comparing IDA Pro vs Ghidra decompilation output (96 vs 71 functions). All samples are known malicious artifacts from public reposito... REV: RedLine Stealer — Static & Dynamic Analysis2026-06-01T10:00:00+03:00 2026-08-02T14:36:52+03:00 https://r3d.page/posts/rev-project1-redline-stealer-analysis/ r3dzyoud Overview This post walks through a complete static and dynamic analysis of a real-world malware sample pulled from MalwareBazaar — cataloged under the signature Backdoor.TeamViewer, carrying the file name WEXTRACT.EXE .MUI, and flagged on VirusTotal as RedLine Stealer (Trojan). The workflow covers isolated lab setup, sample acquisition and hashing, PE structure and metadata dissection across n... Session Hijacking & JWT Tampering2026-05-22T10:00:00+03:00 2026-08-01T23:13:08+03:00 https://r3d.page/posts/eh2-lab4-session-hijacking-jwt/ r3dzyoud Overview This lab demonstrates a complete session hijacking attack chain against an ASP.NET web application, followed by the proper mitigations. The attack leverages an unprotected session cookie transmitted over HTTP — captured via Firefox’s Network panel and Wireshark, then replayed with a Python script to impersonate an authenticated user without ever knowing the password. The lab also incl... SQL Injection: sqlmap & Parameterized Queries2026-05-15T10:00:00+03:00 2026-08-01T23:13:08+03:00 https://r3d.page/posts/eh2-lab3-sql-injection-sqlmap-defense/ r3dzyoud Overview This lab simulates a full SQL injection attack chain against a real ASP.NET web application running on IIS with a Microsoft SQL Server backend — then switches to blue team to implement proper defenses. The vulnerable app is deployed intentionally to demonstrate classic SQLi, and then patched using parameterized queries. Environment: Kali Linux (Attacker): 192.168.0.101 Windows S...