#1
lawiet47/autoresponderAutomates incident response tasks via Carbon Black Response API: file/registry deletion, process killing, sensor isolation, binary collection, and…
pstirparo/machofilemachofile is a module to parse Mach-O binary files
ncsc-nl/citrix-2025Digital forensics and incident response tool using YARA rules to scan Citrix NetScaler core dumps, disk images, and live hosts for signs of…
d4vinci/exif-grabberA python tool that will extract exif data from picture with two methods
sydsec/sydOffline AI Security Assistant for Air-Gapped Pentesting
leonward/openfpcOpenFPC, Open Source Full Packet Capture
canyie/transitionplayerCVE-2026-0091, play with an issue in android window management to perform arbitrary code execution in Launcher process from adb
donctl/sandyRelease of the sandy framework.
nextronsystems/iocsIndicators of compromise from to analysis and research by Nextron Threat Research team
nextronsystems/evtx-baselineA repository hosting example goodware evtx logs containing sample software installation and basic user interaction
ifpdz/cve-2025-24104Technical writeup of CVE-2025-24104: an iOS sandbox escape via symlink validation bypass in backup restoration, enabling arbitrary file reads outside…
cloudflare/filterforgeTool for solving BPF filters and crafting packets based on these.
crypt0p3g/dpapi-toolkitDrop any Windows DPAPI artifact and it identifies the format and the exact master key it needs, then decrypts once you supply the key. Offline, CLI +…
0xsp-srd/aetherWindows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…
lethal-forensics/macos-collectormacos-collector - Automated Collection of macOS Forensic Artifacts for DFIR
