Blog

Blog

Everything in one place, writeups, challenges, research, and notes.

Challenges Mntcrl CTF 2026 Easy

Foreigner

Geolocate a deceptively ordinary parking-lot photo. The title is the clue: an Italian goes abroad without ever boarding a plane.

#osint#geolocation#image
Challenges Mntcrl CTF 2026 Medium

Cousin

An attachment-less OSINT/CTI chain: from an ESET Botconf 2022 talk to the three TA410 sub-teams and the FlowCloud implant, ending in a SHA1-derived flag.

#osint#cti#apt
Challenges Mntcrl CTF 2026 Medium

NFZ

A seized DJI Mavic 3 microSD card with deleted photos. The flag survives in the EXIF thumbnail of a partially overwritten JPEG.

#forensics#drone#dji
Challenges Mntcrl CTF 2026 Easy

Waypoint

Fifty DJI flight logs from one 'test' afternoon. Overlay every GPS trace and the drone's real message appears written in the sky.

#drone#flight-log#gps
Challenges Mntcrl CTF 2026 Hard

Downlink

An SDR-captured RF recording hides MAVLink2 drone telemetry. Demodulate the FSK/Manchester signal and reassemble the flag from chunked STATUSTEXT messages.

#forensics#sdr#rf
Challenges Mntcrl CTF 2026 Medium

UNCXXXX

A trojanized RVTools installer infects a Windows workstation. Triage the disk image, trace the SMOKEDHAM kill chain across bytecode, PowerShell, a C2 capture, and OSINT to rebuild a 3-part flag.

#forensics#disk-forensics#malware-analysis
Writeups Bhackari CTF 2026 Easy

Gianbruno's Clicker

Bhackari CTF forensics on Gianbruno's seized PC: one flag hides in a base64-encoded filename inside the .minecraft folder, the second is painted into the autoclicker GUI bitmap embedded in the PE.

#forensics#ntfs#prefetch
Writeups Bhackari CTF 2026 Medium

Gianbruno's Injection Client

Bhackari CTF: the Titan Launcher on Gianbruno's disk is a red herring. The real Minecraft injection client is xproc64.exe hiding in System32. Part 1 reads the flag from its PE version info; Part 2 reverses the Rust binary to recover the XOR/AES-protected payload it injects.

#forensics#reversing#rust
Research VolWeb · open source

Another VolWeb PR: explicit YARA scan scope selection

After the v3.16.0 release I kept working on VolWeb: a new pull request adds explicit YARA scan scope selection (VAD vs Kernel) and fixes the FileScan Dump button.

#volweb#yara#memory-forensics
Research VolWeb · open source

VolWeb v3.16.0: my thesis fork merged into the official project

After open-sourcing my VolWeb fork, the whole thing was merged into the official repository and shipped in the v3.16.0 release. I'm now an official contributor to the project.

#volweb#yara#volatility3
Research BSc thesis · University of Bari

YARA on VolWeb: my thesis extension, open-sourced

My BSc thesis at the University of Bari: a VolWeb extension that natively integrates YARA pattern matching into the Volatility 3 web interface, now open source.

#volweb#yara#volatility3
Notes Locked Shields 2025

Locked Shields 2025: forensics with Blue Team 13

I took part in Locked Shields 2025, the world's largest live-fire cyber defence exercise (NATO CCDCOE). In Blue Team 13's forensics unit we analysed a compromised ICS and an infected mobile device, and placed 3rd overall.

#locked-shields#nato-ccdcoe#blue-team
Notes Outreach

HackInSchool: teaching cybersecurity to high-schoolers

A recap of HackInSchool: a cybersecurity day for around 140 high-school students at the University of Bari, where I ran a session on steganography and we held a Jeopardy CTF.

#outreach#education#ctf