Digital Forensics

mandiant/capa

Rule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…

androguard/androguard

Reverse engineering and pentesting for Android applications

google/grr

Remote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…

frankwxu/digital-forensics-lab

Free hands-on digital forensics labs for students and faculty

darthton/blackbone

Windows memory hacking library

a-poc/blueteam-tools

Tools and Techniques for Blue Team / Incident Response

bishopfox/unredacter

Never ever ever use pixelation as a redaction technique

alessandroz/lazagne

Cross-platform credential recovery tool that extracts stored passwords from browsers, email clients, databases, system mechanisms, and network…

didierstevens/didierstevenssuite

Collection of Python scripts for malware analysis, file format parsing, hashing, and forensic triage, including PDF, OLE, and XOR analysis utilities.

hugsy/gef

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

bee-san/pywhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it…

volatilityfoundation/volatility3

Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…

clong/detectionlab

Automate the creation of a lab environment complete with security tooling and logging best practices

velocidex/velociraptor

Digging Deeper....

rizinorg/rizin

UNIX-like reverse engineering framework and command-line toolset.

mandiant/flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.