#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
gracenolan/notesCurated study notes and interview preparation guide for security engineering roles, covering networking, web security, cryptography, malware…
jipegit/osxauditorOS X Auditor is a free Mac OS X computer forensics tool
wireshark/wiresharkWireshark's official code repository. You can keep the releases coming by donating at https://wiresharkfoundation.org/donate/.
mikeroyal/digital-forensics-guideDigital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
aloshdenny/reverse-synthidreverse engineering Gemini's SynthID detection
matthart1983/netwatchReal-time network diagnostics in your terminal. One command, zero config, instant visibility.
thewover/donutGenerates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs…
gamelinux/passivednsA network sniffer that logs all DNS server replies for use in a passive DNS setup
monoxgas/srdiShellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode
sbousseaden/evtx-attack-samplesCurated collection of Windows EVTX attack samples mapped to MITRE ATT&CK techniques, designed for testing detection scripts, DFIR training, and…
epasveer/seerSeer - a gui frontend to gdb
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
sans-blue-team/deepbluecliPowerShell-based threat hunting tool that analyzes Windows Event Logs to detect malicious activity including credential attacks, obfuscated commands,…
purp1ew0lf/blue-team-notesYou didn't think I'd go and leave the blue team out, right?
decalage2/oletoolsPython toolkit for analyzing MS OLE2 and Office documents, extracting VBA macros, detecting exploits, and performing forensic analysis of structured…
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
ericzimmerman/kapefilesThis repository serves as a place for community created Targets and Modules for use with KAPE.
foxio-llc/ja4JA4+ is a suite of network fingerprinting standards
