#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
yampelo/beagleBeagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
securityjoes/masterparserMasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
mthcht/threathunting-keywordsAwesome list of keywords and artifacts for Threat Hunting sessions
jamf/aftermathSwift-based macOS incident response framework for collecting and analyzing host artifacts, including filesystem timestamps, browser data, unified…
0x36/pixel_gpu_exploitAndroid 14 kernel exploit for Pixel7/8 Pro
malvuln/ransomlordRansomLord is a proof-of-concept Anti-Ransomware exploitation tool that automates the creation of PE files, used to compromise ransomware…
vah13/extracttvpasswordstool to extract passwords from TeamViewer memory using Frida
dfir-orc/dfir-orcForensics artefact collection tool for systems running Microsoft Windows
monnappa22/limonLimon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators…
kudaes/shelterROP-based sleep obfuscation to evade memory scanners
travisfoley/dfirtriageDigital forensic acquisition tool for Windows based incident response.
arinerron/heaptracehelps visualize heap operations for pwn and debugging
idov31/novahypervisorWindows hypervisor for Intel x64: defensive host hypervisor for Windows designed to mitigate kernel-level attacks including BYOVD, compatible with…
crowdstrike/supermemA python script developed to process Windows memory images based on triage type.
codeyourweb/fastfinderIncident Response - Fast suspicious file finder
offensive-panda/lsassreflectdumpingThis tool leverages the Process Forking technique using the RtlCreateProcessReflection API to clone the lsass.exe process. Once the clone is created,…
leesh3288/cve-2025-32023PoC & Exploit for CVE-2025-32023 / PlaidCTF 2025 "Zerodeo"
