DFIR · Forensic CTF player
Marco Ferrara
Digital Forensics & Incident Response
I investigate compromised systems and take forensic CTF challenges apart. Here I publish my research works, ctf writeups, and the challenges I design.
Latest
Fresh from the blog.
Foreigner
Geolocate a deceptively ordinary parking-lot photo. The title is the clue: an Italian goes abroad without ever boarding a plane.
Cousin
An attachment-less OSINT/CTI chain: from an ESET Botconf 2022 talk to the three TA410 sub-teams and the FlowCloud implant, ending in a SHA1-derived flag.
NFZ
A seized DJI Mavic 3 microSD card with deleted photos. The flag survives in the EXIF thumbnail of a partially overwritten JPEG.
Waypoint
Fifty DJI flight logs from one 'test' afternoon. Overlay every GPS trace and the drone's real message appears written in the sky.
Downlink
An SDR-captured RF recording hides MAVLink2 drone telemetry. Demodulate the FSK/Manchester signal and reassemble the flag from chunked STATUSTEXT messages.
UNCXXXX
A trojanized RVTools installer infects a Windows workstation. Triage the disk image, trace the SMOKEDHAM kill chain across bytecode, PowerShell, a C2 capture, and OSINT to rebuild a 3-part flag.