#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
m10ust/machscopemacOS IPC, launchd, Mach-O, and trust relationship explorer — zero-dependency terminal-native forensic tool
ph4l4nx/ctf-s-toolsRepository to index useful tools for CTF's
korczis/foremostFile carving utility that recovers deleted files from disk images and raw drives by matching headers, footers, and internal structures via…
viralmaniar/remote-desktop-caching-This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to…
0vercl0k/cve-2021-32537PoC for CVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel.
corelight/log-add-http-post-bodiesAdd POST body excerpt to Bro's HTTP log
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
sleuthkit/scalpelFile carving and indexing tool for digital forensics, recovering files from disk images based on header/footer pattern matching, regular expressions,…
kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysisReverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…
thalium/iceboxVirtual Machine Introspection, Tracing & Debugging
devianntsec/cve-2021-4034Master's thesis research on CVE-2021-4034 (PwnKit) local privilege escalation. Multi-payload Python exploit with 7 modes including interactive shell,…
daffainfo/vol-rsVolatility 3 ported to Rust. Same output, much faster.
encrypter15/cve-2025-29824Proof-of-concept exploit for CVE-2025-29824, a use-after-free vulnerability in the Windows CLFS kernel driver, demonstrating privilege escalation to…
withsecurelabs/remotepspyLive monitoring tool for remote PowerShell sessions using ETW to capture and decode WinRM/PSRP protocol, providing command execution traces and…
meirwah/awesome-incident-responseCurated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…
nccgroup/baskervilleSelective protocol extractor from PCAPs or interfaces
stephenfewer/reflectivedllinjectionReflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a…
mindcrypt/covertchannels-steganographyA list of covert channels and steganography/steganalysis resources (books, papers & tools)
