#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
anvilsecure/ulexecveExecutes arbitrary ELF binaries directly from memory on Linux without touching disk, enabling stealthy red-teaming and anti-forensic operations via a…
invictus-ir/alfaAutomated forensic analysis tool for Google Workspace audit logs. Acquires all log types, maps events to MITRE ATT&CK Cloud Framework, and identifies…
dissectmalware/pyonenoteA python library to parse OneNote (.one) files
kudaes/rustchainHide memory artifacts using ROP and hardware breakpoints.
jeffssh/cve-2021-30860Collection of materials relating to FORCEDENTRY
trolldbois/python-haystackProcess heap analysis framework - Windows/Linux - record type inference and forensics
crowdstrike/xwf-yara-scannerNative YARA scanner X-Tension for X-Ways Forensics, enabling in-snapshot file scanning with multi-threaded RVS support, report table output, and no…
tandasat/cve-2023-36427Report and exploit of CVE-2023-36427
principlecheck/kslkatzbofBeacon Object File for in-line LSASS credential extraction using the KslD.sys BYOVD technique. Extracts NT hashes and cleartext passwords from…
gengstah/windbg-mcpAn MCP (Model Context Protocol) server that turns all pybag Windows debugger functions into native MCP tools. It lets MCP-compatible clients (Claude…
zx41r/awesome-reverse-engineering-and-malware-analysisA verified map of reverse engineering and malware analysis. Disassemblers, unpacking, exploit dev, fuzzing, DFIR, and the deep-cut writeups other…
neo23x0/mongobleed-detectorDetection Script for MongoBleed Exploitation
memoryforensics1/vol3xpVolatility Explorer Suit (volatility 3)
mayhamad/memtracerLive memory analysis tool for detecting reflectively loaded .NET DLLs by scanning process memory regions for abnormal flags, page types, and PE…
lsecqt/sessionviewA portable C# utility for enumerating local and remote windows sessions
illegal-instruction-co/processhacker-mcpRuntime process analysis and memory hacking MCP server for AI agents. Supports dynamic extension loading, read-only mode, audit logging, and…
lethal-forensics/macos-collectormacos-collector - Automated Collection of macOS Forensic Artifacts for DFIR
nccgroup/libptmallocHeap analysis tooling for ptmalloc
