#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
dinosn/php-cve-2026-10961x-lab-pocPHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full…
eset/malware-researchCode written as part of our various malware investigations
gmh5225/no-access-protection-x86It encrypts the text section and set the protection to NO_ACCESS.
ikow/php2shell-pocCVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis
xuehuolll/cve-2026-109618-109619-auditCVE-2026-109618 / CVE-2026-109619 audit: session poisoning to command execution reproduced; BGCTX OOM precondition reproduced; claimed progress-array…
r3n3r0/cve-2026-0006-step-2Research package demonstrating a leak-assisted ROP chain in Android media.swcodec via the CVE-2026-0006 APV decoder heap overflow, with payload…
blendin/3snakeTool for extracting information from newly spawned processes
boredhackerblog/plex2shell_pcapPacket capture artifacts of plex2shell exploitation against Plex, including lab and in-the-wild traffic, for building and validating detection…
mandiant/goresymParses Go binaries to recover symbols, function metadata, types, file paths, and embedded strings, including stripped or UPX-packed samples, with IDA…
didierstevens/didierstevenssuiteCollection of Python scripts for malware analysis, file format parsing, hashing, and forensic triage, including PDF, OLE, and XOR analysis utilities.
gmh5225/minidumpreaderParses Windows MiniDump (MDMP) files with Kaitai Struct, extracting memory strings and scanning them against YARA rules for forensic and malware…
ahmadhassan-bted/nasunoAI audio watermark removal & forensic anti-attribution toolkit. Neutralizes Suno, Udio, and neural fingerprints with ISO 226 perceptual masking.
lascc/dfirhubSearch Windows forensic artifacts, see where each one lives on disk, and copy the KAPE command to collect it. Also builds collection scripts and…
abraxas/qemu-colo-l4-oobQEMU 11.1.2 - High - Local/Remote - OOB - COLO filter-rewriter short IPv4 L4 heap overflow
abraxas/qemu-nvme-sgl-barQEMU 11.1.2 - High - Local - UAF - NVMe SGL span into BAR0 incomplete CVE-2021-3929
abraxas/qemu-xhci-complete-uafQEMU 11.1.2 - High - Local - UAF - xhci_complete leftover of CVE-2026-17588 doorbell DMA
abraxas/vbox-hgcm-ssm-cparmsVirtualBox 7.2.20 - High - Local - Heap overflow - HGCM SSM cParms wrap
abraxas/vbox-lsilogic-sas-configVirtualBox 7.2.20 - Critical - Local - Type confusion / arb R/W - SAS1068 CONFIG SCSI-SPI overlay
