Andrea Fortuna
AboutSearch
Tools
DFIR Toolkit OSINT Toolkit
  • Mar 10, 2020

    Security analysis of Telegram Messenger

    Do you need a secure and private messenger? You shouldn't be use Telegram!… read more »
  • Mar 6, 2020

    Cold Boot attack in Digital Forensics

    Cold boot attack is a type of side channel attack in which an attacker with physical access to a computer performs a memory dump of a computer's random access memory by performing a hard reset of the target machine.… read more »
  • Mar 5, 2020

    SurfingAttack: manipulating voice assistant devices with ultrasonic waves

    A research team has recently discovered a new attack method that enables remote users to interact with voice-controlled device using ultrasonic waves transmitted through the surface on which is placed the target device… read more »
  • Mar 4, 2020

    RECmd: command line tool for Windows Registry analysis

    During an incident response, a fast analysis could be required, often on systems that aren't the workstation usually used by the analyst. So, I always suggest to create a small and simple toolkit that can be copied on a USB… read more »
  • Mar 3, 2020

    Ghostcat (CVE-2020-1938): ongoing scans for unpatched Apache Tomcat servers. Patch now!

    A brief update regarding the Ghostcat vulnerability that affects Apache Tomcat servers.… read more »
  • Feb 28, 2020

    Smart speakers records you more often than you think

    A research tried to quantify how often false activations happen and what the devices hear when they do… read more »
  • Feb 26, 2020

    IMP4GT: IMPersonation Attacks in 4G NeTworks

    The researchers who disclosed the #aLTEr attack last year (David Rupprecht, Thorsten Holz, and Christina Pöpper), have found new ways to exploit the lack of integrity protection on the 4G/5G user plane in a new attack called #Imp4Gt … read more »
  • Feb 25, 2020

    Ghostcat (CVE-2020-1938), a brand-new file inclusion vulnerability in Apache Tomcat

    Recently, a new vulnerability on Apache Tomcat AJP connector was disclosed.… read more »
  • Feb 21, 2020

    Full Disk Encryption: tools and setup suggestion for personal data protection

    In order to avoid #sourveillance, privacy invasion or information theft you must be sure that the data on your devices are secure, and the only way to do that in this day and age is to make sure they are… read more »
  • Feb 20, 2020

    Social Engineering in penetration tests: my point of view and my own custom tool

    Social engineering techniques are frequently part of an overall security penetration test because also the "human network" need to be tested.… read more »
  • Feb 19, 2020

    The "distroless" approach to Docker containers

    Most #Docker images build on full Linux distributions containing a lot of unnecessary complexity that affects application security. … read more »
  • Feb 18, 2020

    SweynTooth: Bluetooth vulnerabilities expose many BLE devices to attacks

    There's no rest for the (bluetooth) wearables! A team of security researchers have discovered numerous vulnerabilities in the Bluetooth Low Energy (BLE) implementations of major vendors. … read more »
  • Feb 14, 2020

    TLDR #2: Cross-Site Request Forgery

    Coss-Site Request Forgery (CSRF) is a type of attack that cuses a user’s web browser to perform an unwanted action on a trusted site, when the user is authenticated.… read more »
  • Feb 13, 2020

    BlueFrag (CVE-2020-0022): a critical bluetooth vulnerability in Android

    Security researchers at ERNW disclosed a vulnerability in Android bluetooth stack that lets attackers deliver malware to and steal data from nearby phones… read more »
  • Feb 12, 2020

    CVE-2020-2100: Jenkins servers can be exploited to perform DDoS attacks

    A vulnerability, discovered by Adam Thorn from the University of Cambridge, may allows attacker to abuse internet-facing Jenkins servers to mount and amplify reflective DDoS attacks… read more »
  • Feb 11, 2020

    OWASP Amass: in-depth attack surface mapping and asset discovery

    The #OWASP #Amass Project is tool developed to help information security professionals during the mapping process of attack perimeter. #penetrationtesting #golang #cybersecurity… read more »
  • Feb 7, 2020

    SpiderFoot 3.0: OSINT reconnaissance tool

    SpiderFoot is an OSINT automation tool for reconnaissance process, written in Python 3 and GPL-licensed. Recently, Steve Micallef released on GitHub [1] a new version (3) of SpiderFoot, with a lot of interesting enhancements. Web based UI or CLI Over 170 modules (see… read more »
  • Feb 6, 2020

    CVE-2019-18426: WhatsApp bug allowed remote access to users computers with just a text message

    Recently, developers of famous messaging app acknowledged and patched a major vulnerability that gave malicious users the ability to access files on a victim's computer. A target user may fall prey to this attack simply clicking a disguised link preview… read more »
  • Feb 5, 2020

    Simon Weckert Google Maps Hack: a hoax?

    Is it really possible to create a fake traffic jam on Google Maps? According to ArsTechnica [1] and TheRegister [2], the german artist Simon Wecker realized a performance art piece, named "Google Maps Hacks", walking around the roads of Berlin… read more »
  • Jan 31, 2020

    Some thoughts on Information Technology in a post-apocalyptic environment

    Some funny thoughts about information technology on a post-apocalyptic environment, and some info about a more serious project! When most people think about what to do after an apocalyptic event, the first time that comes to mind is food and… read more »
« Previous page Next page »

Andrea Fortuna

  • Andrea Fortuna
  • andrea@andreafortuna.org
  • andreafortuna
  • andreafortunaig
  • andrea-fortuna

Cybersecurity expert, software developer, experienced digital forensic analyst, musician