#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
kashithecomfy/comfyengineComfyEngine is a memory exploration toolkit built for people who need to monitor, patch, and script a running process.
concinnity-risks/ransomcoinpublicA DFIR tool to extract cryptocoin addresses and other indicators of compromise from binaries.
cybercentrecanada/cartPython implementation of the CaRT library for (un)inerting files.
reecdeep/hivev5_keystream_decryptorbad stuffs by bad guys
zypherion-technologies/nemesis.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.
slaughterjames/excelpeekStatic analysis tool for investigating potentially malicious Microsoft Excel files, extracting metadata, macros, and embedded objects to aid digital…
iomoath/filewatchtowerFWT is a security analysis and file monitoring tool that utilizes Sysmon events.
jazho76/page_table_walkWalk x86-64 page tables by hand in qemu and gdb. Decompose a virtual address, follow cr3 through all levels of physical memory, and extract a flag…
nccgroup/yaml2yaraGenerate bulk YARA rules from YAML input
juanbindez/cve-2026-31431Copy Fail - CVE-2026-31431
s1lkys/cve-2023-30367-mremoteng-password-dumperOriginal PoC for CVE-2023-30367
nccgroup/memaddressanalysisResearch project related to memory address analysis
corelight/zeek-quicBro analyzer that detects Google's QUIC protocol
rnb-team/loghoundPost-Exploitation EVTX Analyzer for BloodHound Mapping
ic3-512/linux-root-kitEnd-to-end simulation of a Python dependency confusion attack, sudo privilege escalation (CVE-2025-32463), and rootkit-based persistence - with full…
rockrid3r/cve-2023-5178Exploit for CVE-2023-5178
nao-sec/ramnit_traffic_parserParsing Ramnit's traffic
haruu77g/phantomprintPassive hybrid fingerprinting engine — identify hosts without sending a single packet
