#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
nccgroup/metadataplusA tool to use novel locations to extract metadata from Office documents.
0xsp-srd/aetherWindows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…
whw0x455/cve-2023-41992Proof-of-concept for CVE-2023-41992, a macOS kernel vulnerability, demonstrating exploitation techniques and providing a patch analysis.
hwbp/ntdll-unhookproper ntdll .text section unhooking via native api. unlike other unhookers this doesnt leave 2 ntdlls loaded. x86/x64/wow64 supported.
alchemist3dot14/cve-2025-2783Simulated PoC for CVE-2025-2783 — a sandbox escape vulnerability in Chrome's Mojo IPC. Includes phishing delivery, memory fuzzing, IPC simulation,…
nccgroup/libdlmallocHeap analysis tooling for dlmalloc
z-jxy/keepass_dumpKeePass 2.X dumper (CVE-2023-32784)
t-tani/yama-devYet Another Memory Analyzer for malware detection
rails/rails-forensics-cve-2026-66066Forensic toolkit and agent skills for investigating Rails Active Storage/libvips CVE-2026-66066: detects crafted blob indicators, exposure windows,…
nccgroup/windowspatchdetectorExperimental Windows .text section Patch Detector
synacktiv/cachedata_decryptA simple Toolkit to BF and decrypt Windows EntraId CacheData
alonhr/notsecdrvA PoC for CVE-2018-7249
princessauroraj/chinese-cybercrime-researchResources to learn more about Chinese-language cybercrime actors.
dump-guy/powershell-toolsCollection of some easy of use tools - in powershell.
feliam/cve-2013-2730Proof-of-concept exploit for CVE-2013-2730, demonstrating a memory corruption vulnerability with a C-based implementation for security research and…
4d4j/cormem-read-pocThis tool demonstrates CVE-2026-38194, a vulnerability in Teledyne Digital Imaging Sapera Memory Manager (v9.0.0.0 and below). The CORMEM.SYS kernel…
permanet/permanetCryptographically verifiable web archiving. Playwright capture → SHA-256 Merkle hash → Bitcoin-anchored OpenTimestamps → permanent Arweave storage.
malgamy/scripts-with-malware-analysis
