#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
sterrasec/apk-meditmemory search and patch tool on debuggable apk without root & ndk
marcosd4h/memhunterLive hunting of code injection techniques
anssi-fr/dfir-o365rcPowerShell module for Office 365 and Azure log collection
enkomio/shed.NET runtime inspector
advanced-threat-research/dotdumperAn automatic unpacker and logger for DotNet Framework targeting files
nccgroup/asatoolsMain repository to pull all NCC Group Cisco ASA-related tool projects.
samueltulach/nullmapUsing CVE-2023-21768 to manual map kernel mode driver
op7ic/blueteam.labBlue Team detection lab created with Terraform and Ansible in Azure.
forensicxlab/vision-procmonA ProcessMonitor visualization application written in rust.
joe-desimone/patriotIn-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…
kd8bny/limeaideA python application designed to remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host.
davidjacobson/safetextScript to remove homoglyphs and zero-width characters to allow for safe distribution of documents from anonymous sources.
naksyn/moduleshiftingStealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctypes
jas502n/cve-2018-17182Linux kernel use-after-free (UAF) privilege escalation exploit for CVE-2018-17182, providing root shell access on affected kernels (3.16 to 4.18.8).…
amossys/memitmTool to make in memory man in the middle
iss4cf0ng/ironpeRust-based Windows PE manual loader that maps and executes x86/x64 executables from memory, demonstrating internal loader behavior and PE structure…
cristianzsh/amcache-evilhunterParse and analyze a Windows Amcache.hve registry hive, VirusTotal integration.
ffri/cve-2025-24204PoC and technical details of CVE-2025-24204
