<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Insomni&#8217;hack &#8211; SCRT Team Blog</title>
	<atom:link href="/category/insomnihack/feed/" rel="self" type="application/rss+xml" />
	<link>/</link>
	<description>Orange Cyberdefense Switzerland&#039;s technical blog</description>
	<lastBuildDate>Tue, 14 Apr 2026 07:53:03 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>/wp-content/uploads/2024/10/cropped-favicon-32x32-1-32x32.png</url>
	<title>Insomni&#8217;hack &#8211; SCRT Team Blog</title>
	<link>/</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Insomni’Hack 2026 &#8211; Golden Payout writeup</title>
		<link>/2026/03/25/insomnihack-2026-the-golden-payout-writeup/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Wed, 25 Mar 2026 23:35:02 +0000</pubDate>
				<category><![CDATA[Analytics]]></category>
		<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=7338</guid>

					<description><![CDATA[The challenge A massive data breach has just hit our corporate network. Highly sensitive documents have been spotted on a prominent Darknet leaking platform. Preliminary network telemetry has flagged suspicious outbound traffic originating from a specific workstation belonging to one of our DBAs. As part of the Rapid Response Investigation Team, you have been assigned &#8230; <a href="/2026/03/25/insomnihack-2026-the-golden-payout-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni’Hack 2026 &#8211; Golden Payout writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni’hack 2025 – GuLosity writeup</title>
		<link>/2025/03/19/insomnihack-2025-gulosity-writeup/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Wed, 19 Mar 2025 20:43:27 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[forensics]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=6964</guid>

					<description><![CDATA[The challenge A malware was provided from a real DFIR case that occurred in January 2024. The final payloads were disarmed here, to allow the analysts to dissect the binary safely until they fully understand the execution chain of a reflective shellcode loader named GuLoader [which initially led to the delivery of Remcos RAT with &#8230; <a href="/2025/03/19/insomnihack-2025-gulosity-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni’hack 2025 – GuLosity writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni’hack 2024 – Bash to the Future writeup</title>
		<link>/2024/04/28/insomnihack-2024-bash-to-the-future-writeup/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Sun, 28 Apr 2024 20:41:30 +0000</pubDate>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Insomni'hack]]></category>
		<guid isPermaLink="false">/?p=5002</guid>

					<description><![CDATA[The Challenge You have been contracted to help COPERNIC Inc spot the light on a potential compromise. It seems that one of their scientists has been spied through a 20 years old malware&#8230; And fortunately, Zeus was on your side since the 4 Gb snapshot was carried out at the best possible time to facilitate &#8230; <a href="/2024/04/28/insomnihack-2024-bash-to-the-future-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni’hack 2024 – Bash to the Future writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack 2023 CTF Teaser &#8211; DoH ! writeup</title>
		<link>/2023/04/13/insomnihack-2023-ctf-teaser-doh-writeup/</link>
		
		<dc:creator><![CDATA[qlu]]></dc:creator>
		<pubDate>Thu, 13 Apr 2023 14:26:28 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=3973</guid>

					<description><![CDATA[For this 2023 edition, i chose to focus on the DoH (DNS Over Https) protocol because it has gained popularity for attackers as a command and control (C2) communication channel for hiding DNS traffic through HTTPS rather than using the traditional DNS tunneling. In this post, i will describe in details how to solve the &#8230; <a href="/2023/04/13/insomnihack-2023-ctf-teaser-doh-writeup/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack 2023 CTF Teaser &#8211; DoH ! writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack 2023 &#8211; hex-filtrate writeup</title>
		<link>/2023/04/01/hex-filtrate/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Sat, 01 Apr 2023 19:12:39 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[forensic]]></category>
		<guid isPermaLink="false">/?p=4160</guid>

					<description><![CDATA[In this forensic challenge, a company has been compromised and their initial investigation led to a suspicious workstation. The CEO was very anxious about a potential exfiltration, and we were provided with a network dump of that workstation in the hope that we would be able to help him make some sweet dreams again. After &#8230; <a href="/2023/04/01/hex-filtrate/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack 2023 &#8211; hex-filtrate writeup</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Splunk Boss Of The SOC (BOTS) @Insomni&#8217;hack</title>
		<link>/2022/04/04/splunk-boss-of-the-soc-bots-insomnihack/</link>
		
		<dc:creator><![CDATA[Quentin Brusa]]></dc:creator>
		<pubDate>Mon, 04 Apr 2022 09:28:41 +0000</pubDate>
				<category><![CDATA[Analytics]]></category>
		<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=3453</guid>

					<description><![CDATA[It&#8217;s was a pleasure this year to meet you at the 2022 edition of our amazing security conference Insomni&#8217;hack ! With Splunk collaboration, we come back this year with &#8220;Splunk Boss Of The SOC&#8221; challenge. What is BOTS and his history Boss Of The SOC (BOTS) is a blue-team version of capture the flag competition. &#8230; <a href="/2022/04/04/splunk-boss-of-the-soc-bots-insomnihack/" class="more-link">Continue reading <span class="screen-reader-text">Splunk Boss Of The SOC (BOTS) @Insomni&#8217;hack</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack 2022 &#8211; Apiculture 2 write-up</title>
		<link>/2022/03/29/apiculture-2-write-up/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Tue, 29 Mar 2022 20:13:25 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[api]]></category>
		<category><![CDATA[web]]></category>
		<guid isPermaLink="false">/?p=3378</guid>

					<description><![CDATA[The Apiculture challenges are dedicated to API attacks. The second level basically looks like a webpage dedicated to beehives: A quick look in the Developer Tools reveals a call to the /api/v4/products/ endpoint: This endpoint indeed permits to get the beehives JSON. It is also impacted by an Improper Data Filtering vulnerability since it contains &#8230; <a href="/2022/03/29/apiculture-2-write-up/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack 2022 &#8211; Apiculture 2 write-up</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack 2022 &#8211; Apiculture 1 write-up</title>
		<link>/2022/03/29/insomnihack-2022-apiculture-1-write-up/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Tue, 29 Mar 2022 19:25:05 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[api]]></category>
		<category><![CDATA[web]]></category>
		<guid isPermaLink="false">/?p=3358</guid>

					<description><![CDATA[The Apiculture challenges are dedicated to API attacks. It is basically a honey’s addict website: To solve the first challenge, we should pay attention to the call to the /api/products/ API: This endpoint provides information to the Angular front-end so that the page can be rendered in the browser… But it is impacted by an &#8230; <a href="/2022/03/29/insomnihack-2022-apiculture-1-write-up/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack 2022 &#8211; Apiculture 1 write-up</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Insomni&#8217;hack 2022 &#8211; GDBug write-up</title>
		<link>/2022/03/29/gdbug-write-up/</link>
		
		<dc:creator><![CDATA[Frédéric Bourla]]></dc:creator>
		<pubDate>Tue, 29 Mar 2022 19:21:00 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[reverse]]></category>
		<guid isPermaLink="false">/?p=3409</guid>

					<description><![CDATA[The GDBug file is an ELF binary: It simply requires a valid serial that we should identify: The strings do not reveal anything, besides a fake flag which is not accepted: Anyway, the binary doesn’t seem to have particular protections: There only seems to be a basic anti-debug: But old versions of GDB and Radare2 &#8230; <a href="/2022/03/29/gdbug-write-up/" class="more-link">Continue reading <span class="screen-reader-text">Insomni&#8217;hack 2022 &#8211; GDBug write-up</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>winhttpd writeup: private heaps pwning on Windows</title>
		<link>/2019/01/24/private-heaps-pwning-on-windows/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Thu, 24 Jan 2019 08:52:35 +0000</pubDate>
				<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[heap]]></category>
		<category><![CDATA[pwn]]></category>
		<category><![CDATA[windows]]></category>
		<category><![CDATA[writeup]]></category>
		<guid isPermaLink="false">/?p=2481</guid>

					<description><![CDATA[Following last week-end&#8217;s Insomni&#8217;hack teaser and popular demand, here is a detailed write-up for my winhttpd challenge, that implemented a custom multi-threaded httpd and was running on the latest version of Windows 10: This challenge is running on Windows Server 2019, Version 1809 (OS Build 17763.253). Since multi-threaded servers have obvious isolation issues for a &#8230; <a href="/2019/01/24/private-heaps-pwning-on-windows/" class="more-link">Continue reading <span class="screen-reader-text">winhttpd writeup: private heaps pwning on Windows</span></a>]]></description>
		
		
		
			</item>
	</channel>
</rss>
