#1Digital forensics, evidence collection, timeline analysis, and incident investigation tools.
Kitploit recommended
emrekybs/osintcaseAn OSINT investigation case mapping tool for organizing entities, relationships, evidence, and intelligence.
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
jpr5/ngrepngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression…
qg5casz/walletoolExtracts cryptocurrency private keys and addresses from wallet.dat files for Bitcoin and Litecoin, enabling wallet recovery and forensic analysis.
moond4rk/hackbrowserdataExtract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).
alessandroz/lazagneCross-platform credential recovery tool that extracts stored passwords from browsers, email clients, databases, system mechanisms, and network…
ragibson/steganographyLeast Significant Bit Steganography for bitmap images (.bmp and .png), WAV sound files, and byte sequences. Simple LSB Steganalysis (LSB extraction)…
emanuele-f/pcapdroidNo-root network monitor, firewall and PCAP dumper for Android
fkie-cad/fact_coreFirmware Analysis and Comparison Tool
crypt0p3g/dpapi-toolkitDrop any Windows DPAPI artifact and it identifies the format and the exact master key it needs, then decrypts once you supply the key. Offline, CLI +…
ytisf/thezooCurated repository of live malware samples and source code for educational malware analysis and research, with an organized database and CLI tools…
grizzzer/cve-2026-42978-poc-researchCVE-2026-42978 — Use-After-Free race condition in Windows Push Notifications (WpnService). Patch diff, root cause analysis, TOCTOU lab, Sysmon/ETW…
christophe.duvernois/usb-spyIntercepts and analyzes USB Mass Storage traffic at the block and file level, emulates USB devices, and supports custom Python stubs for security…
jeeberrr/honeypot-stuffStuff like malware analysis reports on things I captured from my honeypot
unicornunicode/factCollects, processes, and visualizes forensic data from cloud and on-premise machine clusters for incident response and digital investigations.
themittenmac/truetreeA command line tool for pstree-like output on macOS with additional pid capturing capabilities
google/grrRemote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…
