top of page


Josh Stroschein
Aug 23, 20192 min read
Finding Usernames with Burp Extensions
What Does this Extension Do? This is a relatively simple Burp extension that I created a while back to learn more about how to actually...
18 views

Josh Stroschein
Jul 15, 20193 min read
Anti-Analysis in an Office Document
Please note: This was a blog post I originally authored for Bromium. Due to changes in how they host their blog content, it has fallen...
7 views

Josh Stroschein
Jun 28, 20195 min read
Identifying a User Form in an Office Document
In this post, we will be looking into ways to identify and analyze the presence of a user form in an office document. As I discussed in a...
9 views

Josh Stroschein
Jun 4, 20198 min read
Analyzing Malicious Office Documents with OLEDUMP
Microsoft office documents are a common vehicle used by malware authors to deliver malware. These documents, used for malicious purposes,...
177 views

Josh Stroschein
Mar 16, 20182 min read
Debugging a 32 or 64-bit DLL with WinDbg
Debugging a DLL is not quite as straight forward as an executable, since you have to use rundll32 to load it and invoke DllMain. This is...
204 views
bottom of page