#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
0vercl0k/cve-2022-21971PoC for CVE-2022-21971 "Windows Runtime Remote Code Execution Vulnerability"
certcc/keyfinderA tool for finding and analyzing private (and public) key files, including support for Android APK files.
gabriellandau/edrsandblast-godfaultEDRSandblast-GodFault
cado-security/varcVolatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use…
504ensicslabs/dammDifferential Analysis of Malware in Memory
labcif/famaForensic Analysis for Mobile Apps (FAMA) -- module for the Autopsy Forensic Browser
jamf/cve-2020-1206-pocCVE-2020-1206 Uninitialized Kernel Memory Read POC
cado-security/rip_rawRip Raw is a small tool to analyse the memory of compromised Linux systems.
0x0v1/audixAudix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring
daddycocoaman/dumpscanFinding secrets in kernel and user memory
anttikurittu/kirjuriKirjuri is a web application for managing cases and physical forensic evidence items.
mandiant/ioc-scanner-cve-2019-19781Indicator of Compromise Scanner for CVE-2019-19781
mandiant/citrix-ioc-scanner-cve-2023-3519Bash-based scanner detecting indicators of compromise from CVE-2023-3519 exploitation on Citrix ADC appliances, supporting live and forensic image…
0vercl0k/cve-2022-21974PoC for CVE-2022-21974 "Roaming Security Rights Management Services Remote Code Execution Vulnerability"
0vercl0k/cve-2021-32537PoC for CVE-2021-32537: an out-of-bounds memory access that leads to pool corruption in the Windows kernel.
soteria-security/hafnium-iocA PowerShell script to identify indicators of exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-26865
adamrpostjr/cve-2021-27065Quick One Line Powershell scripts to detect for webshells, possible zips, and logs.
