Andrea Fortuna
AboutSearch
Tools
DFIR Toolkit OSINT Toolkit
  • Aug 1, 2018

    Diffy: an interesting DFIR tool released from Netflix's SIRT

    The Netflix Security Intelligence and Response Team (SIRT) has released (under Apache 2.0 license) a triage tool to help digital forensics and incident response teams quickly identify compromised hosts on which to focus their response. … read more »
  • Jul 30, 2018

    Malhunt: automated malware search in memory dumps

    Recently i’ve published this post focused on hunting malware using volatility and Yara rules. … read more »
  • Jul 27, 2018

    Julian Bream: My Life in Music

    A 2 hour video biography of the great guitarist Julian Bream. … read more »
  • Jul 25, 2018

    Digital forensics chronicles: image identification issues on large memory dump with Volatility

    Spoiler: shame on DumpIT! … read more »
  • Jul 23, 2018

    Some thoughts about Lateral Movement techniques

    The ability to quickly and reliably detect lateral movement in the network is one of the most important skills in information security today: the lateral movement attack phase represents the biggest difference between a targeted and strategic attacks and a simplistic… read more »
  • Jul 20, 2018

    Friday suggested listening: Paco De Lucia, Concierto de Aranjuez

    Joaquín Rodrigo’s Concierto de Aranjuez is one of the most popular concertos of all time, one of the most original masterpieces of the 20th century. … read more »
  • Jul 18, 2018

    TCPDUMP: a simple cheatsheet

    Having a solid grasp of tcpdump is mandatory for anyone desiring a thorough understanding of TCP/IP. … read more »
  • Jul 16, 2018

    Finding malware on memory dumps using <a href="https://www.andreafortuna.org/volatility/">Volatility</a> and Yara rules

    Previously i’ve talked a lot about Volatility, and i’ve published also some articles about YARA. … read more »
  • Jul 13, 2018

    Shape of my Heart, my own guitar rendition in Drop D tuning

    “Shape of My Heart” is a song by Sting from his album “Ten Summoner’s Tales”, released in 1993. … read more »
  • Jul 11, 2018

    Application whitelisting on critical Windows systems: useful or not?

    Application whitelisting is the practice of specifying an index of approved software applications that are permitted to be present and active on a computer system. … read more »
  • Jul 9, 2018

    Nano text editor: my own cheatsheet

    Which is the best command line text editor? Seriously, i don’t know! … read more »
  • Jul 6, 2018

    Suggested listenings: "Villa-Lobos plays Villa-Lobos"

    Recently i have found on YouTube some wonderful recordings of Heitor Villa-Lobos playing his own music. … read more »
  • Jul 4, 2018

    Docker images under cryptojacking attack: how to check if a downloaded image is safe

    Researchers at Kromtech Security Center discovers seventeen malicious Docker containers with embedded cryptominer applications that permitted to cybercriminals to earn $90,000 in 30 days. … read more »
  • Jul 2, 2018

    Bash scripting: my own cheatsheet

    bash (Bourne Again shell) is the standard GNUshell, a powerful tool for the advanced and professional user. … read more »
  • Jun 29, 2018

    "Into The Flow", a new brief fingerstyle study

    This little piece has an interesting story. … read more »
  • Jun 27, 2018

    Pay attention to unknown USB sticks!

    Some days ago, with a colleague, i’ve talked about the real usefulness of USB hardware locks on critical clients/servers. … read more »
  • Jun 25, 2018

    Google App Engine and Python: a correct way to store configuration variables

    When you develop an application, often you could need to store some configurations. This data can contain a lot of sensitive informations, and this is a critical point if your sourcecode is hosted on a GitHub repository. … read more »
  • Jun 22, 2018

    Andrés Segovia’s daily practice routine

    It’s not a mistery: a musician needs to spend time with the instrument. … read more »
  • Jun 20, 2018

    Malware analysis: Gargoyle, a memory scanning evasion technique

    Gargoyle is a memory analysis evasion technique that uses return-oriented programming (RoP) for hiding all of a program’s executable code in non-executable memory when it is inactive, and temporarily mark it executable to do some work at a pre-defined interval… read more »
  • Jun 18, 2018

    Fun with network protocols, using Python and Impacket

    Impacket is a collection of Python classes, developed by Core Security, for working with network protocols, which provides a low-level programmatic access to the packets and, for some protocols such us SMB1-3 and MSRPC, the protocol implementation itself. … read more »
« Previous page Next page »

Andrea Fortuna

  • Andrea Fortuna
  • andrea@andreafortuna.org
  • andreafortuna
  • andreafortunaig
  • andrea-fortuna

Cybersecurity expert, software developer, experienced digital forensic analyst, musician