#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
magnetforensics/swishdbgextIncident Response & Digital Forensics Debugging Extension
cr0nx/awesome-linux-attack-forensics-purplelabsThis page is a result of the ongoing hands-on research around advanced Linux attacks, detection and forensics techniques and tools.
polo35/cve-2020-0022CVE-2020-0022 vulnerability exploitation on Bouygues BBox Miami (Android TV 8.0 - ARM32 Cortex A9)
bughuntar/cve-2025-5777CVE-2025-5777 Citrix NetScaler Memory Leak Exploit (CitrixBleed 2)
adamwhitehat/judge-jury-and-executableA file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…
citrix/ioc-scanner-cve-2019-19781Indicator of Compromise Scanner for CVE-2019-19781
kaandemir993/darktortilla-rat-telegram-exfiltration-payload-extraction-analysisReverse engineering analysis of DarkTortilla RAT, a sophisticated malware that steals credit card data, decrypts browser passwords, and exfiltrates…
rshipp/awesome-malware-analysisDefund the Police.
equifox/ksdumperDumping processes using the power of kernel space !
aburgh/disk-arbitratorA Mac OS X forensic utility which manages file system mounting in support of forensic procedures.
themittenmac/truetreeA command line tool for pstree-like output on macOS with additional pid capturing capabilities
paolomonti42/saltSALT - SLUB ALlocator Tracer for the Linux kernel
secunnix/cve-2024-27398CVE-2024-27398 POC
thiasap/oppo-pgem10-ghostlockOPPO Find X6 Pro GhostLock (CVE-2026-43499) exploit adaptation
0linear/cve-2026-62958Proof-of-concept for CVE-2026-62958: crafts a malformed ELF to trigger an out-of-bounds read in Libriscv and crash the sandbox with SIGSEGV.
mvt-project/mvtForensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…
otrf/security-datasetsRe-play Security Events
lem0nsec/shellghostA memory-based evasion technique which makes shellcode invisible from process start to end.
