Research, forensic CTF writeups, and challenges by Marco Ferrara (imb0ru).https://imb0ru.github.io/enhttps://imb0ru.github.io/blog/challenges/foreigner/https://imb0ru.github.io/blog/challenges/foreigner/Geolocate a deceptively ordinary parking-lot photo. The title is the clue: an Italian goes abroad without ever boarding a plane.Sun, 28 Jun 2026 00:00:00 GMTosintgeolocationimagehttps://imb0ru.github.io/blog/challenges/cousin/https://imb0ru.github.io/blog/challenges/cousin/An attachment-less OSINT/CTI chain: from an ESET Botconf 2022 talk to the three TA410 sub-teams and the FlowCloud implant, ending in a SHA1-derived flag.Sun, 28 Jun 2026 00:00:00 GMTosintctiaptta410yaramalwarehttps://imb0ru.github.io/blog/challenges/nfz/https://imb0ru.github.io/blog/challenges/nfz/A seized DJI Mavic 3 microSD card with deleted photos. The flag survives in the EXIF thumbnail of a partially overwritten JPEG.Sun, 28 Jun 2026 00:00:00 GMTforensicsdronedjiexfatfile-carvingexifhttps://imb0ru.github.io/blog/challenges/waypoint/https://imb0ru.github.io/blog/challenges/waypoint/Fifty DJI flight logs from one 'test' afternoon. Overlay every GPS trace and the drone's real message appears written in the sky.Sun, 28 Jun 2026 00:00:00 GMTdroneflight-loggpsmischttps://imb0ru.github.io/blog/challenges/downlink/https://imb0ru.github.io/blog/challenges/downlink/An SDR-captured RF recording hides MAVLink2 drone telemetry. Demodulate the FSK/Manchester signal and reassemble the flag from chunked STATUSTEXT messages.Sun, 28 Jun 2026 00:00:00 GMTforensicssdrrfmavlinkdspdronehttps://imb0ru.github.io/blog/challenges/uncxxxx/https://imb0ru.github.io/blog/challenges/uncxxxx/A trojanized RVTools installer infects a Windows workstation. Triage the disk image, trace the SMOKEDHAM kill chain across bytecode, PowerShell, a C2 capture, and OSINT to rebuild a 3-part flag.Sun, 28 Jun 2026 00:00:00 GMTforensicsdisk-forensicsmalware-analysisnetwork-forensicsosintsmokedhamreversinghttps://imb0ru.github.io/blog/writeups/gianbrunos-clicker/https://imb0ru.github.io/blog/writeups/gianbrunos-clicker/Bhackari CTF forensics on Gianbruno's seized PC: one flag hides in a base64-encoded filename inside the .minecraft folder, the second is painted into the autoclicker GUI bitmap embedded in the PE.Tue, 02 Jun 2026 00:00:00 GMTforensicsntfsprefetchbase64pebitmapminecrafthttps://imb0ru.github.io/blog/writeups/gianbrunos-injection-client/https://imb0ru.github.io/blog/writeups/gianbrunos-injection-client/Bhackari CTF: the Titan Launcher on Gianbruno's disk is a red herring. The real Minecraft injection client is xproc64.exe hiding in System32. Part 1 reads the flag from its PE version info; Part 2 reverses the Rust binary to recover the XOR/AES-protected payload it injects.Tue, 02 Jun 2026 00:00:00 GMTforensicsreversingrustntfspeaesxorsha256minecrafthttps://imb0ru.github.io/blog/research/volweb-yara-scope-pr/https://imb0ru.github.io/blog/research/volweb-yara-scope-pr/After the v3.16.0 release I kept working on VolWeb: a new pull request adds explicit YARA scan scope selection (VAD vs Kernel) and fixes the FileScan Dump button.Thu, 28 May 2026 00:00:00 GMTvolwebyaramemory-forensicsdfiropen-sourcehttps://imb0ru.github.io/blog/research/volweb-v3-16-merge/https://imb0ru.github.io/blog/research/volweb-v3-16-merge/After open-sourcing my VolWeb fork, the whole thing was merged into the official repository and shipped in the v3.16.0 release. I'm now an official contributor to the project.Tue, 10 Mar 2026 00:00:00 GMTvolwebyaravolatility3memory-forensicsdfiropen-sourcehttps://imb0ru.github.io/blog/research/volweb-thesis/https://imb0ru.github.io/blog/research/volweb-thesis/My BSc thesis at the University of Bari: a VolWeb extension that natively integrates YARA pattern matching into the Volatility 3 web interface, now open source.Thu, 16 Oct 2025 00:00:00 GMTvolwebyaravolatility3memory-forensicsdfiropen-sourcehttps://imb0ru.github.io/blog/notes/locked-shields-2025/https://imb0ru.github.io/blog/notes/locked-shields-2025/I took part in Locked Shields 2025, the world's largest live-fire cyber defence exercise (NATO CCDCOE). In Blue Team 13's forensics unit we analysed a compromised ICS and an infected mobile device, and placed 3rd overall.Tue, 03 Jun 2025 00:00:00 GMTlocked-shieldsnato-ccdcoeblue-teamdigital-forensicsincident-responseicshttps://imb0ru.github.io/blog/notes/hackinschool/https://imb0ru.github.io/blog/notes/hackinschool/A recap of HackInSchool: a cybersecurity day for around 140 high-school students at the University of Bari, where I ran a session on steganography and we held a Jeopardy CTF.Thu, 21 Mar 2024 00:00:00 GMToutreacheducationctfsteganographydigital-forensicsmntcrl