

<!DOCTYPE html>

<html lang="en-US">
<head>
  <meta charset="UTF-8">
  <meta http-equiv="X-UA-Compatible" content="IE=Edge">

  <link rel="stylesheet" href="/assets/css/just-the-docs-default.css">

  <link rel="stylesheet" href="/assets/css/just-the-docs-head-nav.css" id="jtd-head-nav-stylesheet">

  <style id="jtd-nav-activation">
  
    .site-nav ul li a {
      background-image: none;
    }

  </style>

  

  
    <script src="/assets/js/vendor/lunr.min.js"></script>
  

  <script src="/assets/js/just-the-docs.js"></script>

  <meta name="viewport" content="width=device-width, initial-scale=1">

  



  <!-- Begin Jekyll SEO tag v2.8.0 -->
<title>Francis Villalon - Portfolio | CTF writeups, self-study labs, and home lab documentation covering digital forensics, incident response, malware analysis, and memory forensics.</title>
<meta name="generator" content="Jekyll v3.10.0" />
<meta property="og:title" content="Francis Villalon - Portfolio" />
<meta property="og:locale" content="en_US" />
<meta name="description" content="CTF writeups, self-study labs, and home lab documentation covering digital forensics, incident response, malware analysis, and memory forensics." />
<meta property="og:description" content="CTF writeups, self-study labs, and home lab documentation covering digital forensics, incident response, malware analysis, and memory forensics." />
<link rel="canonical" href="https://fdv.sh/assets/css/just-the-docs-head-nav.css" />
<meta property="og:url" content="https://fdv.sh/assets/css/just-the-docs-head-nav.css" />
<meta property="og:site_name" content="Francis Villalon - Portfolio" />
<meta property="og:type" content="website" />
<meta name="twitter:card" content="summary" />
<meta property="twitter:title" content="Francis Villalon - Portfolio" />
<script type="application/ld+json">
{"@context":"https://schema.org","@type":"WebPage","description":"CTF writeups, self-study labs, and home lab documentation covering digital forensics, incident response, malware analysis, and memory forensics.","headline":"Francis Villalon - Portfolio","url":"https://fdv.sh/assets/css/just-the-docs-head-nav.css"}</script>
<!-- End Jekyll SEO tag -->


  <link rel="icon" href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 100%22><text y=%22.9em%22 font-size=%2290%22>%F0%9F%9B%A1%EF%B8%8F</text></svg>">

<script src="https://cdn.jsdelivr.net/npm/mermaid@10/dist/mermaid.min.js"></script>

<style>
  .site-header {
    display: flex !important;
    flex-direction: column;
    align-items: center;
    height: auto !important;
    max-height: none !important;
    min-height: 0 !important;
    padding: 40px 16px 28px 16px !important;
    border-bottom: 1px solid rgba(128, 128, 128, 0.25) !important;
    text-align: center;
  }

  .site-title {
    font-size: 17px !important;
    font-weight: 600;
    letter-spacing: -0.01em;
    padding: 0 !important;
    line-height: 1.3 !important;
    display: flex;
    align-items: center;
    gap: 8px;
  }

  .site-title::before {
    content: "🛡";
    font-size: 18px;
  }

  .site-title.profile-title {
    flex-direction: column;
    gap: 4px;
    width: 100%;
  }

  .site-title.profile-title::before {
    content: none;
  }

  .profile-avatar {
    width: 104px;
    height: 104px;
    border-radius: 50%;
    border: 3px solid rgba(255, 255, 255, 0.12);
    margin-bottom: 14px;
  }

  .profile-name {
    font-size: 19px;
    font-weight: 700;
  }

  .profile-brand {
    font-size: 12px;
    font-weight: 400;
    opacity: 0.55;
    margin-top: 2px;
  }

  .profile-links {
    display: flex;
    align-items: center;
    justify-content: center;
    gap: 8px;
    margin-top: 14px;
    font-size: 13px;
  }

  .profile-links a {
    color: #a996f5;
    text-decoration: none;
  }

  .profile-links a:hover {
    text-decoration: underline;
  }

  .profile-links-sep {
    opacity: 0.4;
  }

  .aux-nav {
    font-size: 14px !important;
  }

  /* The theme caps the search box (and its results dropdown, separately) at
     33.5rem regardless of how much header space is actually free - stretch
     both to fill the row instead. */
  .search-input-wrap {
    max-width: none !important;
  }

  @media (min-width: 50rem) {
    .search-active .search-input-wrap {
      width: 100% !important;
    }

    .search-results {
      width: 100% !important;
    }
  }

  .aux-nav-list-item .site-button,
  .aux-nav-list-item a {
    font-weight: 500;
  }

  .breadcrumb-nav-list-item {
    font-size: 15px !important;
  }

  .breadcrumb-nav-list-item::after {
    font-size: 15px;
  }

  .nav-list .nav-list-item > .nav-list {
    display: block !important;
    max-height: 0;
    overflow: hidden;
  }

  /* Guide line: drawn per-item (not as a border on the parent <ul>) so it
     doesn't depend on how that box's border behaves through the
     max-height/overflow expand animation. Each item nested two or more
     levels deep (i.e. inside another item's own children) draws the line
     flush with its own left edge - since deeper items are already pushed
     further right by the theme's own per-level padding, this naturally
     staircases outward with depth instead of needing a offset per level. */
  .nav-list .nav-list-item {
    position: relative;
  }

  .nav-list .nav-list .nav-list-item::before {
    content: "";
    position: absolute;
    top: 0;
    bottom: 0;
    left: 0;
    width: 1px;
    background: rgba(128, 128, 128, 0.28);
  }

  .nav-list .nav-list-item.active > .nav-list {
    max-height: 1200px;
  }

  /* Transitions are opt-in via .nav-animate, added by JS only on an actual
     click of the expander arrow - not when JS auto-opens the current page's
     section on load, which would otherwise replay the expand animation on
     every navigation. */
  .nav-list .nav-list-item.nav-animate > .nav-list {
    transition: max-height 0.28s ease;
  }

  .nav-list .nav-list-item.active.nav-animate > .nav-list {
    transition: max-height 0.4s ease;
  }

  .nav-list-item.nav-animate > .nav-list-expander svg {
    transition: transform 0.25s ease;
  }

  .nav-list-item > .nav-list-link {
    cursor: pointer;
  }

  .gh-alert {
    border-left-width: 4px !important;
    border-radius: 0 6px 6px 0;
    padding: 12px 16px !important;
  }

  .gh-alert-title {
    margin: 0 0 6px 0 !important;
    font-weight: 600;
    display: flex;
    align-items: center;
    gap: 6px;
  }

  .gh-alert-note { border-left-color: #4493f8 !important; background: rgba(68, 147, 248, 0.1) !important; }
  .gh-alert-tip { border-left-color: #3fb950 !important; background: rgba(63, 185, 80, 0.1) !important; }
  .gh-alert-important { border-left-color: #ab7df8 !important; background: rgba(171, 125, 248, 0.1) !important; }
  .gh-alert-warning { border-left-color: #d29922 !important; background: rgba(210, 153, 34, 0.1) !important; }
  .gh-alert-caution { border-left-color: #f85149 !important; background: rgba(248, 81, 73, 0.1) !important; }

  .gh-alert-note .gh-alert-title { color: #4493f8; }
  .gh-alert-tip .gh-alert-title { color: #3fb950; }
  .gh-alert-important .gh-alert-title { color: #ab7df8; }
  .gh-alert-warning .gh-alert-title { color: #d29922; }
  .gh-alert-caution .gh-alert-title { color: #f85149; }

  .whoami {
    margin: 32px 0;
    border: 1px solid rgba(128, 128, 128, 0.3);
    border-radius: 8px;
    overflow: hidden;
    background: rgba(128, 128, 128, 0.05);
    font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace;
  }

  .whoami-titlebar {
    display: flex;
    align-items: center;
    gap: 6px;
    padding: 10px 14px;
    background: rgba(128, 128, 128, 0.12);
    border-bottom: 1px solid rgba(128, 128, 128, 0.3);
  }

  .whoami-dot {
    width: 10px;
    height: 10px;
    border-radius: 50%;
    display: inline-block;
  }

  .whoami-dot-red { background: #ff5f56; }
  .whoami-dot-yellow { background: #ffbd2e; }
  .whoami-dot-green { background: #27c93f; }

  .whoami-titletext {
    margin-left: 8px;
    font-size: 12px;
    opacity: 0.6;
  }

  .whoami-body {
    padding: 18px 20px;
    font-size: 14px;
    line-height: 1.6;
  }

  .whoami-body p {
    margin: 0 0 6px 0;
  }

  .whoami-prompt {
    color: #27c93f;
  }

  .whoami-name {
    font-size: 17px;
    font-weight: 600;
    margin-top: 10px !important;
  }

  .whoami-focus {
    opacity: 0.6;
    margin-bottom: 14px !important;
  }

  .whoami-bio {
    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
    opacity: 0.85;
    margin-bottom: 14px !important;
  }

  .whoami-links a {
    margin-right: 16px;
    color: #7253ed;
  }

  .side-bar .nav-list-link,
  .site-nav .nav-list-link {
    font-size: 15px !important;
    padding-top: 7px !important;
    padding-bottom: 7px !important;
    color: rgba(255, 255, 255, 0.75) !important;
  }

  .side-bar .nav-list-link:hover,
  .site-nav .nav-list-link:hover {
    color: rgba(255, 255, 255, 0.95) !important;
  }

  .side-bar .nav-list-link.active {
    color: #ffffff !important;
    font-weight: 600;
  }

  .writeup-grid {
    display: grid;
    grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
    gap: 12px;
    margin: 32px 0;
  }

  .writeup-card {
    display: flex;
    flex-direction: column;
    justify-content: space-between;
    gap: 10px;
    min-height: 76px;
    padding: 14px 16px;
    border: 1px solid rgba(128, 128, 128, 0.3);
    border-radius: 8px;
    text-decoration: none;
    color: inherit;
    transition: border-color 0.15s ease, transform 0.15s ease;
  }

  .writeup-card:hover {
    border-color: #7253ed;
    transform: translateY(-2px);
  }

  .writeup-card-title {
    font-size: 14px;
    font-weight: 500;
    white-space: nowrap;
    overflow: hidden;
    text-overflow: ellipsis;
  }

  .difficulty-pill {
    align-self: flex-start;
    font-size: 10px;
    font-weight: 600;
    text-transform: uppercase;
    letter-spacing: 0.04em;
    padding: 2px 8px;
    border-radius: 999px;
  }

  .difficulty-easy {
    color: #27c93f;
    background: rgba(39, 201, 63, 0.15);
  }

  .difficulty-medium {
    color: #ffbd2e;
    background: rgba(255, 189, 46, 0.15);
  }

  .difficulty-hard {
    color: #ff5f56;
    background: rgba(255, 95, 86, 0.15);
  }

  .category-grid {
    display: grid;
    grid-template-columns: repeat(auto-fill, minmax(220px, 1fr));
    gap: 16px;
    margin: 32px 0;
  }

  .category-card {
    display: flex;
    flex-direction: column;
    padding: 20px;
    border: 1px solid rgba(128, 128, 128, 0.3);
    border-radius: 8px;
    text-decoration: none;
    color: inherit;
    transition: border-color 0.15s ease, transform 0.15s ease;
  }

  .category-card:hover {
    border-color: #7253ed;
    transform: translateY(-2px);
  }

  .category-card .category-card-title {
    margin: 0 0 8px 0;
    font-size: 16px;
    font-weight: 600;
  }

  .category-card p {
    margin: 0 0 12px 0;
    font-size: 13px;
    opacity: 0.75;
    line-height: 1.5;
  }

  .category-card .category-count {
    margin-top: auto;
    padding-top: 12px;
    font-size: 11px;
    text-transform: uppercase;
    letter-spacing: 0.05em;
    opacity: 0.55;
  }

  #page-toc {
    position: fixed;
    top: 100px;
    right: 24px;
    width: 220px;
    max-height: calc(100vh - 140px);
    overflow-y: auto;
    font-size: 14.5px;
    line-height: 1.5;
    z-index: 5;
  }

  #page-toc .page-toc-title {
    font-weight: 600;
    text-transform: uppercase;
    font-size: 11px;
    letter-spacing: 0.05em;
    opacity: 0.6;
    margin-bottom: 8px;
  }

  #page-toc ul {
    list-style: none;
    margin: 0;
    padding: 0;
  }

  /* Every nested level (not the outermost list) gets its own guide line and
     indent step, so depth reads as a staircase of lines like a file tree. */
  #page-toc li > ul {
    margin-left: 0.7rem;
    padding-left: 0.65rem;
    border-left: 1px solid rgba(128, 128, 128, 0.3);
  }

  #page-toc li {
    margin: 0;
  }

  #page-toc a {
    display: flex;
    align-items: center;
    gap: 5px;
    padding: 3px 0 3px 4px;
    color: inherit;
    opacity: 0.65;
    text-decoration: none;
    border-left: 2px solid transparent;
    margin-left: -1px;
  }

  #page-toc a:hover {
    opacity: 1;
  }

  #page-toc a.toc-h1 {
    font-weight: 600;
    opacity: 0.85;
  }

  #page-toc a.active {
    opacity: 1;
    border-left: 2px solid #7253ed;
  }

  /* Clickable caret next to any heading that has nested sub-headings under
     it - toggles that section collapsed without following the link (the
     link itself still navigates to the heading as normal). */
  #page-toc .toc-caret {
    flex: none;
    display: inline-flex;
    align-items: center;
    justify-content: center;
    width: 14px;
    height: 14px;
    margin-left: -3px;
    cursor: pointer;
  }

  #page-toc .toc-caret::before {
    content: "";
    width: 0;
    height: 0;
    border-left: 4px solid currentColor;
    border-top: 3px solid transparent;
    border-bottom: 3px solid transparent;
    opacity: 0.55;
    transform: rotate(90deg);
    transition: transform 0.15s ease;
  }

  #page-toc .toc-collapsed > a > .toc-caret::before {
    transform: rotate(0deg);
  }

  #page-toc .toc-collapsed > ul {
    display: none;
  }

  @media (max-width: 1400px) {
    #page-toc {
      display: none;
    }
  }

  .tag-pills {
    display: flex;
    flex-wrap: wrap;
    gap: 6px;
    margin: 4px 0 32px 0 !important;
  }

  .tag-pill {
    font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace;
    font-size: 11px;
    padding: 3px 9px;
    border-radius: 999px;
    background: rgba(114, 83, 237, 0.14);
    color: #a996f5;
    white-space: nowrap;
  }

  .main-content h1 {
    margin-top: 52px !important;
    padding-top: 24px !important;
    border-top: 1px solid rgba(128, 128, 128, 0.2);
  }

  .main-content h1:first-of-type {
    margin-top: 0 !important;
    padding-top: 0 !important;
    border-top: none;
  }

  .main-content h2 {
    margin-top: 36px !important;
    padding-left: 12px;
    border-left: 3px solid rgba(114, 83, 237, 0.45);
  }

  .main-content h3 {
    margin-top: 28px !important;
  }

  .main-content p {
    line-height: 1.7;
  }

  /* Inline code (e.g. `192.168.20.100`) defaults to 0.75em in the theme,
     which reads noticeably smaller than surrounding text. Bump it up,
     scoped the same way the theme scopes its own background/border style
     for inline code, so fenced code blocks are unaffected. */
  .main-content :not(pre, figure) > code {
    font-size: 0.95em;
  }

  .main-content blockquote {
    border-left: 3px solid #7253ed;
    background: rgba(114, 83, 237, 0.08);
    padding: 10px 16px;
    border-radius: 0 6px 6px 0;
    margin: 16px 0 !important;
  }

  .main-content blockquote p {
    margin: 0 !important;
    opacity: 0.85;
  }

  .main-content p:has(> em:only-child) {
    font-size: 12px;
    opacity: 0.6;
    text-align: center;
    margin-top: 4px !important;
    margin-bottom: 28px !important;
  }

  .main-content p:has(> img:only-child) {
    text-align: center;
    margin-bottom: 4px !important;
  }

  /* Image lightbox - click any content image to zoom without zooming the page */
  .main-content img {
    cursor: zoom-in;
    transition: opacity 0.15s ease;
  }

  .main-content img:hover {
    opacity: 0.92;
  }

  .lightbox-overlay {
    position: fixed;
    inset: 0;
    z-index: 1000;
    display: flex;
    align-items: center;
    justify-content: center;
    padding: 5vh 5vw;
    background: rgba(0, 0, 0, 0.75);
    opacity: 0;
    visibility: hidden;
    transition: opacity 0.2s ease;
  }

  .lightbox-overlay.lightbox-open {
    opacity: 1;
    visibility: visible;
  }

  .lightbox-overlay img {
    max-width: 100%;
    max-height: 90vh;
    border-radius: 6px;
    box-shadow: 0 20px 60px rgba(0, 0, 0, 0.5);
    cursor: zoom-out;
    transform: scale(0.96);
    transition: transform 0.2s ease;
  }

  .lightbox-overlay.lightbox-open img {
    transform: scale(1);
  }

  .lightbox-close {
    position: fixed;
    top: 20px;
    right: 24px;
    width: 40px;
    height: 40px;
    border: none;
    border-radius: 50%;
    background: rgba(255, 255, 255, 0.1);
    color: #fff;
    font-size: 20px;
    line-height: 1;
    cursor: pointer;
    display: flex;
    align-items: center;
    justify-content: center;
    transition: background 0.15s ease;
  }

  .lightbox-close:hover {
    background: rgba(255, 255, 255, 0.2);
  }

  /* Hide the theme's default "This site uses Just the Docs..." credit line.
     MIT license only requires the notice travel with the source, not a
     visible on-page badge - this div has no other content in it. */
  .site-footer {
    display: none !important;
  }
</style>

<script>
  // Mark a nav-list-item as animatable the moment its expander arrow is
  // actually clicked (capture phase runs before just-the-docs.js's own
  // bubble-phase handler toggles .active). This keeps the expand/collapse
  // transition for manual clicks while skipping it when the theme's JS
  // auto-opens the current page's section on every page load.
  document.addEventListener(
    "click",
    function (e) {
      var btn = e.target.closest && e.target.closest(".nav-list-expander");
      if (btn && btn.parentNode) {
        btn.parentNode.classList.add("nav-animate");
      }
    },
    true
  );

  document.addEventListener("DOMContentLoaded", function () {
    var siteTitle = document.querySelector(".site-title");
    if (!siteTitle) return;

    siteTitle.innerHTML = "";
    siteTitle.classList.add("profile-title");

    var avatar = document.createElement("img");
    avatar.className = "profile-avatar";
    avatar.src = "https://github.com/FrancisVillalon.png";
    avatar.alt = "";
    siteTitle.appendChild(avatar);

    var name = document.createElement("span");
    name.className = "profile-name";
    name.textContent = "Francis Villalon";
    siteTitle.appendChild(name);

    var brand = document.createElement("span");
    brand.className = "profile-brand";
    brand.textContent = "Cybersecurity";
    siteTitle.appendChild(brand);

    var links = document.createElement("div");
    links.className = "profile-links";
    links.innerHTML =
      '<a href="https://github.com/FrancisVillalon" target="_blank" rel="noopener">GitHub</a>' +
      '<span class="profile-links-sep">&middot;</span>' +
      '<a href="https://linkedin.com/in/francisvillalon" target="_blank" rel="noopener">LinkedIn</a>';
    siteTitle.insertAdjacentElement("afterend", links);
  });

  document.addEventListener("DOMContentLoaded", function () {
    var content = document.querySelector(".main-content");
    if (!content) return;

    var firstP = content.querySelector("p");
    if (firstP) {
      var tagText = firstP.textContent.trim();
      if (/^(#\S+\s*)+$/.test(tagText)) {
        var tags = tagText.split(/\s+/).filter(Boolean);
        firstP.textContent = "";
        firstP.className = "tag-pills";
        tags.forEach(function (tag) {
          var span = document.createElement("span");
          span.className = "tag-pill";
          span.textContent = tag;
          firstP.appendChild(span);
        });
      }
    }
  });

  document.addEventListener("DOMContentLoaded", function () {
    var content = document.querySelector(".main-content");
    if (!content) return;

    var headings = content.querySelectorAll("h1, h2, h3");
    if (headings.length < 2) return;

    var toc = document.createElement("nav");
    toc.id = "page-toc";

    var title = document.createElement("div");
    title.className = "page-toc-title";
    title.textContent = "On this page";
    toc.appendChild(title);

    // Build an actual nested <ul> tree (h1 > h2 > h3) rather than one flat
    // list, so each depth gets its own guide line/indent step in CSS and
    // parents can show a "this branches" caret via .toc-has-children.
    var rootList = document.createElement("ul");
    var stack = [{ level: 0, ul: rootList, li: null }];

    headings.forEach(function (heading, i) {
      if (!heading.id) {
        heading.id = "toc-heading-" + i;
      }
      var level = parseInt(heading.tagName.slice(1), 10);

      while (stack.length > 1 && stack[stack.length - 1].level >= level) {
        stack.pop();
      }

      var parent = stack[stack.length - 1];
      if (!parent.ul) {
        parent.ul = document.createElement("ul");
        parent.li.appendChild(parent.ul);
        parent.li.classList.add("toc-has-children");

        var caret = document.createElement("span");
        caret.className = "toc-caret";
        caret.setAttribute("role", "button");
        caret.setAttribute("aria-label", "Toggle section");
        var parentLink = parent.li.querySelector("a");
        parentLink.insertBefore(caret, parentLink.firstChild);
      }

      var li = document.createElement("li");
      var a = document.createElement("a");
      a.href = "#" + heading.id;
      a.textContent = heading.textContent.trim().replace(/\s*#\s*$/, "");
      a.className = "toc-" + heading.tagName.toLowerCase();
      a.dataset.target = heading.id;
      li.appendChild(a);
      parent.ul.appendChild(li);

      stack.push({ level: level, ul: null, li: li });
    });

    toc.appendChild(rootList);
    document.body.appendChild(toc);

    toc.addEventListener("click", function (e) {
      var caret = e.target.closest(".toc-caret");
      if (!caret) return;
      e.preventDefault();
      e.stopPropagation();
      caret.closest("li").classList.toggle("toc-collapsed");
    });

    var links = toc.querySelectorAll("a");
    var observer = new IntersectionObserver(
      function (entries) {
        entries.forEach(function (entry) {
          var link = toc.querySelector('a[data-target="' + entry.target.id + '"]');
          if (!link) return;
          if (entry.isIntersecting) {
            links.forEach(function (l) { l.classList.remove("active"); });
            link.classList.add("active");
          }
        });
      },
      { rootMargin: "0px 0px -70% 0px" }
    );

    headings.forEach(function (heading) {
      observer.observe(heading);
    });
  });

  document.addEventListener("DOMContentLoaded", function () {
    var alertLabels = {
      NOTE: "Note",
      TIP: "Tip",
      IMPORTANT: "Important",
      WARNING: "Warning",
      CAUTION: "Caution"
    };
    var alertIcons = {
      NOTE: "ℹ️",
      TIP: "💡",
      IMPORTANT: "❗",
      WARNING: "⚠️",
      CAUTION: "🛑"
    };

    document.querySelectorAll(".main-content blockquote").forEach(function (bq) {
      var p = bq.querySelector("p:first-child");
      if (!p || !p.firstChild || p.firstChild.nodeType !== Node.TEXT_NODE) return;

      var text = p.firstChild.textContent;
      var match = text.match(/^\s*\[!(NOTE|TIP|IMPORTANT|WARNING|CAUTION)\]\s*/i);
      if (!match) return;

      var type = match[1].toUpperCase();
      p.firstChild.textContent = text.slice(match[0].length);

      bq.classList.add("gh-alert", "gh-alert-" + type.toLowerCase());

      var title = document.createElement("p");
      title.className = "gh-alert-title";
      title.textContent = alertIcons[type] + " " + alertLabels[type];
      bq.insertBefore(title, bq.firstChild);
    });
  });

  document.addEventListener("DOMContentLoaded", function () {
    var content = document.querySelector(".main-content");
    if (!content) return;

    var overlay = document.createElement("div");
    overlay.className = "lightbox-overlay";

    var overlayImg = document.createElement("img");
    overlay.appendChild(overlayImg);

    var closeBtn = document.createElement("button");
    closeBtn.className = "lightbox-close";
    closeBtn.setAttribute("aria-label", "Close");
    closeBtn.innerHTML = "&times;";
    // Appended inside overlay (not document.body) so it inherits the
    // overlay's own visibility/opacity state via CSS instead of needing a
    // separately toggled `hidden` attribute, which display:flex overrode.
    overlay.appendChild(closeBtn);

    document.body.appendChild(overlay);

    function openLightbox(img) {
      overlayImg.src = img.currentSrc || img.src;
      overlayImg.alt = img.alt || "";
      overlay.classList.add("lightbox-open");
      document.body.style.overflow = "hidden";
    }

    function closeLightbox() {
      overlay.classList.remove("lightbox-open");
      document.body.style.overflow = "";
    }

    content.querySelectorAll("img").forEach(function (img) {
      img.addEventListener("click", function () {
        openLightbox(img);
      });
    });

    overlay.addEventListener("click", closeLightbox);
    closeBtn.addEventListener("click", closeLightbox);
    document.addEventListener("keydown", function (e) {
      if (e.key === "Escape") closeLightbox();
    });
  });

  document.addEventListener("DOMContentLoaded", function () {
    if (!window.mermaid) return;

    // Kramdown has no built-in mermaid renderer - a ```mermaid fenced code
    // block just comes out as <pre><code class="language-mermaid">raw text
    // (unlike GitHub, which renders these natively). Swap each one for a
    // <div class="mermaid"> containing the decoded source, then let the
    // mermaid.js library (loaded above) render it client-side.
    var blocks = document.querySelectorAll("code.language-mermaid");
    if (!blocks.length) return;

    blocks.forEach(function (code) {
      var pre = code.closest("pre") || code;
      var div = document.createElement("div");
      div.className = "mermaid";
      div.textContent = code.textContent;
      pre.replaceWith(div);
    });

    mermaid.initialize({ startOnLoad: false, theme: "dark" });
    mermaid.run({ querySelector: ".mermaid" });
  });
</script>


</head>

<body>
  <a class="skip-to-main" href="#main-content">Skip to main content</a>
  <svg xmlns="http://www.w3.org/2000/svg" class="d-none">
  <symbol id="svg-link" viewBox="0 0 24 24">
  <title>Link</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-link">
    <path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path>
  </svg>
</symbol>

  <symbol id="svg-menu" viewBox="0 0 24 24">
  <title>Menu</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-menu">
    <line x1="3" y1="12" x2="21" y2="12"></line><line x1="3" y1="6" x2="21" y2="6"></line><line x1="3" y1="18" x2="21" y2="18"></line>
  </svg>
</symbol>

  <symbol id="svg-arrow-right" viewBox="0 0 24 24">
  <title>Expand</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-chevron-right">
    <polyline points="9 18 15 12 9 6"></polyline>
  </svg>
</symbol>

  <!-- Feather. MIT License: https://github.com/feathericons/feather/blob/master/LICENSE -->
<symbol id="svg-external-link" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-external-link">
  <title id="svg-external-link-title">(external link)</title>
  <path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path><polyline points="15 3 21 3 21 9"></polyline><line x1="10" y1="14" x2="21" y2="3"></line>
</symbol>

  
    <symbol id="svg-doc" viewBox="0 0 24 24">
  <title>Document</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-file">
    <path d="M13 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V9z"></path><polyline points="13 2 13 9 20 9"></polyline>
  </svg>
</symbol>

    <symbol id="svg-search" viewBox="0 0 24 24">
  <title>Search</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-search">
    <circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line>
  </svg>
</symbol>

  
  
    <!-- Bootstrap Icons. MIT License: https://github.com/twbs/icons/blob/main/LICENSE.md -->
<symbol id="svg-copy" viewBox="0 0 16 16">
  <title>Copy</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="bi bi-clipboard" viewBox="0 0 16 16">
    <path d="M4 1.5H3a2 2 0 0 0-2 2V14a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3.5a2 2 0 0 0-2-2h-1v1h1a1 1 0 0 1 1 1V14a1 1 0 0 1-1 1H3a1 1 0 0 1-1-1V3.5a1 1 0 0 1 1-1h1v-1z"/>
    <path d="M9.5 1a.5.5 0 0 1 .5.5v1a.5.5 0 0 1-.5.5h-3a.5.5 0 0 1-.5-.5v-1a.5.5 0 0 1 .5-.5h3zm-3-1A1.5 1.5 0 0 0 5 1.5v1A1.5 1.5 0 0 0 6.5 4h3A1.5 1.5 0 0 0 11 2.5v-1A1.5 1.5 0 0 0 9.5 0h-3z"/>
  </svg>
</symbol>
<symbol id="svg-copied" viewBox="0 0 16 16">
  <title>Copied</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="bi bi-clipboard-check-fill" viewBox="0 0 16 16">
    <path d="M6.5 0A1.5 1.5 0 0 0 5 1.5v1A1.5 1.5 0 0 0 6.5 4h3A1.5 1.5 0 0 0 11 2.5v-1A1.5 1.5 0 0 0 9.5 0h-3Zm3 1a.5.5 0 0 1 .5.5v1a.5.5 0 0 1-.5.5h-3a.5.5 0 0 1-.5-.5v-1a.5.5 0 0 1 .5-.5h3Z"/>
    <path d="M4 1.5H3a2 2 0 0 0-2 2V14a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3.5a2 2 0 0 0-2-2h-1v1A2.5 2.5 0 0 1 9.5 5h-3A2.5 2.5 0 0 1 4 2.5v-1Zm6.854 7.354-3 3a.5.5 0 0 1-.708 0l-1.5-1.5a.5.5 0 0 1 .708-.708L7.5 10.793l2.646-2.647a.5.5 0 0 1 .708.708Z"/>
  </svg>
</symbol>

  
</svg>

  
    <header class="side-bar">
  <div class="site-header">
    <a href="/" class="site-title lh-tight">
  Francis Villalon - Portfolio

</a>
    <button id="menu-button" class="site-button btn-reset" aria-label="Menu" aria-expanded="false">
      <svg viewBox="0 0 24 24" class="icon" aria-hidden="true"><use xlink:href="#svg-menu"></use></svg>
    </button>
  </div>

  <nav aria-label="Main" id="site-nav" class="site-nav">
  
  
    <ul class="nav-list"><li class="nav-list-item"><a href="/" class="nav-list-link">Home</a></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Cyberdefenders submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cyberdefender-writeups/" class="nav-list-link">Cyberdefenders</a><ul class="nav-list"><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Malware Analysis submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cyberdefender-writeups/malware%20analysis/" class="nav-list-link">Malware Analysis</a><ul class="nav-list"><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/ATMii%20Lab/ATMii%20Lab.html" class="nav-list-link">ATMii Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/AgentTesla/AgentTesla.html" class="nav-list-link">AgentTesla</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/MalDoc101/MalDoc101.html" class="nav-list-link">MalDoc101</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/MalaCrypt/MalaCrypt.html" class="nav-list-link">MalaCrypt</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/Obfuscated/Obfuscated.html" class="nav-list-link">Obfuscated</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/TeleStealer/TeleStealer.html" class="nav-list-link">TeleStealer</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/XLM%20Macros%20Lab/XLM%20Macros%20Lab.html" class="nav-list-link">XLM Macros Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/XWorm/XWorm.html" class="nav-list-link">XWorm</a></li></ul></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Endpoint Forensics submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cyberdefender-writeups/endpoint%20forensics/" class="nav-list-link">Endpoint Forensics</a><ul class="nav-list"><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/Amadey%20-%20APT-C-36%20Lab/Amadey%20-%20APT-C-36%20Lab.html" class="nav-list-link">Amadey - APT-C-36 Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/Andromeda%20Bot%20-%20UNC4210%20Lab/Andromeda%20Bot%20-%20UNC4210%20Lab.html" class="nav-list-link">Andromeda Bot - UNC4210 Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/BlackEnergy/BlackEnergy.html" class="nav-list-link">BlackEnergy</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/Brave/Brave.html" class="nav-list-link">Brave</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/DumpMe/DumpMe.html" class="nav-list-link">DumpMe</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/QBot/QBot.html" class="nav-list-link">QBot</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/Volatility%20Traces%20Lab/Volatility%20Traces%20Lab.html" class="nav-list-link">Volatility Traces Lab</a></li></ul></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Network Forensics submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cyberdefender-writeups/network%20forensics/" class="nav-list-link">Network Forensics</a><ul class="nav-list"><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/HoneyBOT/HoneyBOT.html" class="nav-list-link">HoneyBOT</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/Malware%20Traffic%20Analysis%201/Malware%20Traffic%20Analysis%201.html" class="nav-list-link">Malware Traffic Analysis 1</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/PsExec%20Hunt%20Lab/PsExec%20Hunt%20Lab.html" class="nav-list-link">PsExec Hunt Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/RCEMiner%20Lab/RCEMiner%20Lab.html" class="nav-list-link">RCEMiner Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/RetailBreach/RetailBreach.html" class="nav-list-link">RetailBreach</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/Tomcat%20Takeover%20Lab/Tomcat%20Takeover%20Lab.html" class="nav-list-link">Tomcat Takeover Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/XLMRat%20Lab/XLMRat%20Lab.html" class="nav-list-link">XLMRat Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/XXE%20Infiltration%20Lab/XXE%20Infiltration%20Lab.html" class="nav-list-link">XXE Infiltration Lab</a></li></ul></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Reverse Engineering submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cyberdefender-writeups/reverse%20engineering/" class="nav-list-link">Reverse Engineering</a><ul class="nav-list"><li class="nav-list-item"><a href="/cyberdefender-writeups/reverse%20engineering/RE101/RE101.html" class="nav-list-link">RE101</a></li></ul></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Threat Hunting submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cyberdefender-writeups/threat%20hunting/" class="nav-list-link">Threat Hunting</a><ul class="nav-list"><li class="nav-list-item"><a href="/cyberdefender-writeups/threat%20hunting/REvil/REvil.html" class="nav-list-link">REvil</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/threat%20hunting/NerisBot/NerisBot.html" class="nav-list-link">NerisBot</a></li></ul></li></ul></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="MemLabs submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/memlabs-writeups/" class="nav-list-link">MemLabs</a><ul class="nav-list"><li class="nav-list-item"><a href="/memlabs-writeups/lab1/lab1-memlabs.html" class="nav-list-link">Lab 1 - Beginner's Luck</a></li><li class="nav-list-item"><a href="/memlabs-writeups/lab2/lab2-memlabs.html" class="nav-list-link">Lab 2 - A New World</a></li><li class="nav-list-item"><a href="/memlabs-writeups/lab3/lab3-memlabs.html" class="nav-list-link">Lab 3 - The Evil Twin</a></li><li class="nav-list-item"><a href="/memlabs-writeups/lab4/lab4-memlabs.html" class="nav-list-link">Lab 4 - Obsession</a></li><li class="nav-list-item"><a href="/memlabs-writeups/lab5/lab5-memlabs.html" class="nav-list-link">Lab 5 - Black Tuesday</a></li><li class="nav-list-item"><a href="/memlabs-writeups/lab6/lab6-memlabs.html" class="nav-list-link">Lab 6 - The Reckoning</a></li></ul></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Home Lab submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cybersecurity-home-lab/" class="nav-list-link">Home Lab</a><ul class="nav-list"><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Infrastructure submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cybersecurity-home-lab/infrastructure/" class="nav-list-link">Infrastructure</a><ul class="nav-list"><li class="nav-list-item"><a href="/cybersecurity-home-lab/infrastructure/EDGE-RTR01.html" class="nav-list-link">EDGE-RTR01</a></li><li class="nav-list-item"><a href="/cybersecurity-home-lab/infrastructure/PFSENSE-FW01.html" class="nav-list-link">PFSENSE-FW01</a></li><li class="nav-list-item"><a href="/cybersecurity-home-lab/infrastructure/ATTACKER01.html" class="nav-list-link">ATTACKER01</a></li><li class="nav-list-item"><a href="/cybersecurity-home-lab/infrastructure/DC01.html" class="nav-list-link">DC01</a></li><li class="nav-list-item"><a href="/cybersecurity-home-lab/infrastructure/WAZUH-SIEM01.html" class="nav-list-link">WAZUH-SIEM01</a></li><li class="nav-list-item"><a href="/cybersecurity-home-lab/infrastructure/SURICATA-BR01.html" class="nav-list-link">SURICATA-BR01</a></li><li class="nav-list-item"><a href="/cybersecurity-home-lab/infrastructure/NESSUS-SCAN01.html" class="nav-list-link">NESSUS-SCAN01</a></li><li class="nav-list-item"><a href="/cybersecurity-home-lab/infrastructure/PC01.html" class="nav-list-link">PC01</a></li><li class="nav-list-item"><a href="/cybersecurity-home-lab/infrastructure/AGENTICAI-01.html" class="nav-list-link">AGENTICAI-01</a></li></ul></li><li class="nav-list-item"><a href="/cybersecurity-home-lab/Agentic%20AI%20Exploitation.html" class="nav-list-link">Agentic AI Exploitation</a></li><li class="nav-list-item"><a href="/cybersecurity-home-lab/Agentic%20AI%20Detection.html" class="nav-list-link">Agentic AI Detection</a></li></ul></li></ul>
  
</nav>


<div class="d-md-block d-none site-footer">
  
  
    This site uses <a href="https://github.com/just-the-docs/just-the-docs">Just the Docs</a>, a documentation theme for Jekyll.
  
  </div>
</header>

  
  <div class="main" id="top">
    <div id="main-header" class="main-header">
  
    

<div class="search" role="search">
  <div class="search-input-wrap">
    <input type="text" id="search-input" class="search-input" tabindex="0" placeholder="Search Francis Villalon - Portfolio" autocomplete="off">
    <label for="search-input" class="search-label">
      <span class="sr-only">Search Francis Villalon - Portfolio</span>
      <svg viewBox="0 0 24 24" class="search-icon" aria-hidden="true"><use xlink:href="#svg-search"></use></svg>
    </label>
  </div>
  <div id="search-results" class="search-results"></div>
</div>

  
  
  
</div>

    <div class="main-content-wrap">
      
      <div id="main-content" class="main-content">
        <main>
          
            

          

          
            
          
        </main>
        
<hr>
<footer>
  

  

  <div class="d-md-none mt-4 fs-2">
    
    
      This site uses <a href="https://github.com/just-the-docs/just-the-docs">Just the Docs</a>, a documentation theme for Jekyll.
    
  </div>
</footer>

      </div>
    </div>
    
      

<div class="search-overlay"></div>

    
  </div>

  
</body>
</html>

