<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Frédéric Bourla &#8211; SCRT Team Blog</title>
	<atom:link href="/author/fbo/feed/" rel="self" type="application/rss+xml" />
	<link>/</link>
	<description>Orange Cyberdefense Switzerland&#039;s technical blog</description>
	<lastBuildDate>Thu, 26 Mar 2026 09:17:01 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>/wp-content/uploads/2024/10/cropped-favicon-32x32-1-32x32.png</url>
	<title>Frédéric Bourla &#8211; SCRT Team Blog</title>
	<link>/</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Insomni’Hack 2026 &#8211; Golden Payout writeup</title>
		<link>/2026/03/25/insomnihack-2026-the-golden-payout-writeup/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Wed, 25 Mar 2026 23:35:02 +0000</pubDate>
				<category><![CDATA[Analytics]]></category>
		<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=7338</guid>

					<description><![CDATA[The challenge A massive data breach has just hit our corporate network. Highly sensitive documents have been spotted on a prominent Darknet leaking platform. Preliminary network telemetry has flagged suspicious outbound traffic originating from a specific workstation belonging to one of our DBAs. As part of the Rapid Response Investigation Team, you have been assigned &#8230; <a href="/2026/03/25/insomnihack-2026-the-golden-payout-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni’Hack 2026 &#8211; Golden Payout writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni’hack 2025 – GuLosity writeup</title>
		<link>/2025/03/19/insomnihack-2025-gulosity-writeup/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Wed, 19 Mar 2025 20:43:27 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=6964</guid>

					<description><![CDATA[The challenge A malware was provided from a real DFIR case that occurred in January 2024. The final payloads were disarmed here, to allow the analysts to dissect the binary safely until they fully understand the execution chain of a reflective shellcode loader named GuLoader [which initially led to the delivery of Remcos RAT with &#8230; <a href="/2025/03/19/insomnihack-2025-gulosity-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni’hack 2025 – GuLosity writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni’hack 2024 – Bash to the Future writeup</title>
		<link>/2024/04/28/insomnihack-2024-bash-to-the-future-writeup/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Sun, 28 Apr 2024 20:41:30 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Insomni'hack]]></category>
		<guid isPermaLink="false">/?p=5002</guid>

					<description><![CDATA[The Challenge You have been contracted to help COPERNIC Inc spot the light on a potential compromise. It seems that one of their scientists has been spied through a 20 years old malware&#8230; And fortunately, Zeus was on your side since the 4 Gb snapshot was carried out at the best possible time to facilitate &#8230; <a href="/2024/04/28/insomnihack-2024-bash-to-the-future-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni’hack 2024 – Bash to the Future writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack 2023 &#8211; hex-filtrate writeup</title>
		<link>/2023/04/01/hex-filtrate/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Sat, 01 Apr 2023 19:12:39 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[forensic]]></category>
		<guid isPermaLink="false">/?p=4160</guid>

					<description><![CDATA[In this forensic challenge, a company has been compromised and their initial investigation led to a suspicious workstation. The CEO was very anxious about a potential exfiltration, and we were provided with a network dump of that workstation in the hope that we would be able to help him make some sweet dreams again. After &#8230; <a href="/2023/04/01/hex-filtrate/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack 2023 &#8211; hex-filtrate writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack 2022 &#8211; Apiculture 2 write-up</title>
		<link>/2022/03/29/apiculture-2-write-up/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Tue, 29 Mar 2022 20:13:25 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[api]]></category>
		<category><![CDATA[web]]></category>
		<guid isPermaLink="false">/?p=3378</guid>

					<description><![CDATA[The Apiculture challenges are dedicated to API attacks. The second level basically looks like a webpage dedicated to beehives: A quick look in the Developer Tools reveals a call to the /api/v4/products/ endpoint: This endpoint indeed permits to get the beehives JSON. It is also impacted by an Improper Data Filtering vulnerability since it contains &#8230; <a href="/2022/03/29/apiculture-2-write-up/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack 2022 &#8211; Apiculture 2 write-up</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack 2022 &#8211; Apiculture 1 write-up</title>
		<link>/2022/03/29/insomnihack-2022-apiculture-1-write-up/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Tue, 29 Mar 2022 19:25:05 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[api]]></category>
		<category><![CDATA[web]]></category>
		<guid isPermaLink="false">/?p=3358</guid>

					<description><![CDATA[The Apiculture challenges are dedicated to API attacks. It is basically a honey’s addict website: To solve the first challenge, we should pay attention to the call to the /api/products/ API: This endpoint provides information to the Angular front-end so that the page can be rendered in the browser… But it is impacted by an &#8230; <a href="/2022/03/29/insomnihack-2022-apiculture-1-write-up/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack 2022 &#8211; Apiculture 1 write-up</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack 2022 &#8211; GDBug write-up</title>
		<link>/2022/03/29/gdbug-write-up/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Tue, 29 Mar 2022 19:21:00 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[reverse]]></category>
		<guid isPermaLink="false">/?p=3409</guid>

					<description><![CDATA[The GDBug file is an ELF binary: It simply requires a valid serial that we should identify: The strings do not reveal anything, besides a fake flag which is not accepted: Anyway, the binary doesn’t seem to have particular protections: There only seems to be a basic anti-debug: But old versions of GDB and Radare2 &#8230; <a href="/2022/03/29/gdbug-write-up/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack 2022 &#8211; GDBug write-up</span></a>]]></description>
		
		
		
			</item>
	</channel>
</rss>
