Blog
Blog
Everything in one place, writeups, challenges, research, and notes.
Foreigner
Geolocate a deceptively ordinary parking-lot photo. The title is the clue: an Italian goes abroad without ever boarding a plane.
Cousin
An attachment-less OSINT/CTI chain: from an ESET Botconf 2022 talk to the three TA410 sub-teams and the FlowCloud implant, ending in a SHA1-derived flag.
NFZ
A seized DJI Mavic 3 microSD card with deleted photos. The flag survives in the EXIF thumbnail of a partially overwritten JPEG.
Waypoint
Fifty DJI flight logs from one 'test' afternoon. Overlay every GPS trace and the drone's real message appears written in the sky.
Downlink
An SDR-captured RF recording hides MAVLink2 drone telemetry. Demodulate the FSK/Manchester signal and reassemble the flag from chunked STATUSTEXT messages.
UNCXXXX
A trojanized RVTools installer infects a Windows workstation. Triage the disk image, trace the SMOKEDHAM kill chain across bytecode, PowerShell, a C2 capture, and OSINT to rebuild a 3-part flag.
Gianbruno's Clicker
Bhackari CTF forensics on Gianbruno's seized PC: one flag hides in a base64-encoded filename inside the .minecraft folder, the second is painted into the autoclicker GUI bitmap embedded in the PE.
Gianbruno's Injection Client
Bhackari CTF: the Titan Launcher on Gianbruno's disk is a red herring. The real Minecraft injection client is xproc64.exe hiding in System32. Part 1 reads the flag from its PE version info; Part 2 reverses the Rust binary to recover the XOR/AES-protected payload it injects.
Another VolWeb PR: explicit YARA scan scope selection
After the v3.16.0 release I kept working on VolWeb: a new pull request adds explicit YARA scan scope selection (VAD vs Kernel) and fixes the FileScan Dump button.
VolWeb v3.16.0: my thesis fork merged into the official project
After open-sourcing my VolWeb fork, the whole thing was merged into the official repository and shipped in the v3.16.0 release. I'm now an official contributor to the project.
YARA on VolWeb: my thesis extension, open-sourced
My BSc thesis at the University of Bari: a VolWeb extension that natively integrates YARA pattern matching into the Volatility 3 web interface, now open source.
Locked Shields 2025: forensics with Blue Team 13
I took part in Locked Shields 2025, the world's largest live-fire cyber defence exercise (NATO CCDCOE). In Blue Team 13's forensics unit we analysed a compromised ICS and an infected mobile device, and placed 3rd overall.
HackInSchool: teaching cybersecurity to high-schoolers
A recap of HackInSchool: a cybersecurity day for around 140 high-school students at the University of Bari, where I ran a session on steganography and we held a Jeopardy CTF.