#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
emrekybs/mrhandlerSSH-based Linux incident response tool that executes diagnostic commands to collect network configs, logs, user accounts, and processes, then…
emrekybs/bluefishAutomation tool designed to simplify the analysis of PCAP (Packet Capture) files
halildeniz/networkassessmentNetworkAssessment: Network Compromise Assessment Tool
guibacellar/texTelegram intelligence collection tool for researchers and investigators. Scrapes groups, messages, media, and user data with OCR, Elasticsearch…
velocidex/linpmemLinux kernel driver for physical memory acquisition, enabling read access to any physical address including reserved memory and memory holes, with…
tastypepperoni/pplbladeBypasses PPL protection to dump LSASS process memory, obfuscates dump files with XOR, and exfiltrates them remotely via RAW or SMB without writing to…
letsdefend/awesome-soc-analystUseful resources for SOC Analyst and SOC Analyst candidates.
naksyn/moduleshiftingStealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctypes
qeeqbox/analyzerAnalyze, extract and visualize features, artifacts and IoCs of files and memory dumps (Windows, Linux, Android, iPhone, Blackberry, macOS binaries,…
cristianzsh/forensictoolsCollection of forensic tools
nowsecure/r2fridaRadare2 and Frida better together.
lem0nsec/shellghostA memory-based evasion technique which makes shellcode invisible from process start to end.
k1nd0ne/volwebA centralized and enhanced memory analysis platform
jessek/hashdeepCross-platform hashing toolset for computing message digests (MD5, SHA-1, SHA-256, Tiger, Whirlpool) with recursive directory traversal and file…
ioactive/platboxPlatform security assessment tool for dumping and analyzing UEFI/SMM registers, PCI config space, physical memory, SPI flash, and S3 bootscripts with…
joeavanzato/trawlerPowerShell script helping Incident Responders discover potential adversary persistence mechanisms.
unicornunicode/factCollects, processes, and visualizes forensic data from cloud and on-premise machine clusters for incident response and digital investigations.
fox-it/dissectDissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from…
