#1Digital forensics, evidence collection, timeline analysis, and incident investigation tools.
Kitploit recommended
blakebratcher/wcw-cyberring-pav-decryptorCryptanalysis of a proprietary 1999 video DRM system. Recovers 61 encrypted wrestling videos from the WCW Internet Powerdisk CD-ROM through static…
professorquantumuniverse/vetoOpen-source Android client for VirusTotal. Scan files, URLs, and installed apps against 70+ antivirus engines. View detailed reports with hashes,…
iomoath/filewatchtowerFWT is a security analysis and file monitoring tool that utilizes Sysmon events.
giordanosconti/icloudkitextractorExperimental .NET/WPF forensic toolkit for iCloud auth, CloudKit/MMCS backup download, and Octagon/PCS recovery (ADP, Recovery Key, Lockdown Mode).…
withsecurelabs/esfangESF modular ingestion tool for development and research.
lpefferkorn/ipdecapDecapsulate traffic encapsulated within GRE, IPIP, 6in4, ESP (ipsec) protocols, can also remove IEEE 802.1Q (virtual lan) header. Works with pcap…
camp0/aiengineProgrammable packet inspection engine with NIDS, DNS classification, frequency analysis, and auto-regex generation. Supports Python/Ruby/Java/Lua…
romaissaadjailia/get-applockereventlogThis is a repo for fetching Applocker event log by parsing the win-event log
4n6ist/usn_analyticsIt's not just UsnJrnl (USN Journal Records/Change Journal Records) parser.
slaughterjames/excelpeekStatic analysis tool for investigating potentially malicious Microsoft Excel files, extracting metadata, macros, and embedded objects to aid digital…
formerlab/shadow-fleet-tracker-lightOpen source Baltic Sea shadow fleet tracker. 1200+ vessels, live AIS, cable proximity alerts. No cloud, no subscription, runs locally
bicurico/vaxdLightweight Windows disassembler, PE inspection and patch-assistance tool for native EXE/DLL files.
antisurveillanceagency/shadownetShadowNet is an anonymous routing protocol that forces all connections (system-wide) to go through Tor while implementing Mixnet-like…
hullabrian/eventhorizonTool that gathers a customizable set of ETW telemetry and generates user-defined detections
ignacioj/whacamoleLive memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment…
josue87/burpmetafinderBurp Suite extension for extracting metadata from files
tomer8007/mtproto-dissectorWireshark plugin for dissecting the Telegram protocol
cosmic-zip/witchcraftWITCHCRAFT is a cyberdeck toolkit built for runners who dive deep into the mesh. It’s your all-in-one rig for data-ghosting, ICE-breaking, and…
