#1Digital forensics, evidence collection, timeline analysis, and incident investigation tools.
Kitploit recommended
withsecurelabs/macostriagecollectionscriptCollects comprehensive triage data from macOS for incident response, including system logs, file listings, browser data, shell history, and…
cyberclues/rtf_exploit_extractorScript to extract malicious payload and decoy document from CVE-2015-1641 exploit documents
onapsis/cve-2020-6287_recon-scannerBlack-box vulnerability scanner and indicator-of-compromise analyzer for CVE-2020-6287 (RECON) in SAP NetWeaver Java applications, enabling rapid…
raj3shp/persisthuntLinux Persistence Detection, Hunting and Artifact Collection script
z-jxy/keepass_dumpKeePass 2.X dumper (CVE-2023-32784)
afine-com/glassworm-hunterDetects GlassWorm supply chain attack payloads by scanning VS Code extensions, npm/PyPI packages, and git repos for invisible Unicode payloads,…
m0vi0/pacmapGraph-first network traffic visualizer for live capture and PCAP replay with checkpoint diffing, path tracing, and Wireshark-style display filters…
guettaf-hossam/superdiagnostictoolAI-powered Windows diagnostic & auto-repair tool using Google Gemini. Detect crashes, optimize performance, scan for malware, and generate PowerShell…
kadir/copy-fail-cve-2026-31431-iocDetection, mitigation, and IOC toolkit for Copy Fail CVE-2026-31431 Linux kernel page-cache privilege escalation
aradhyacp/secflowAI-driven automated threat analysis pipeline that routes files, URLs, IPs, domains, or images through specialized security analyzers and generates…
thebeanogamer/hstsparserA tool to parse Firefox and Chrome HSTS databases into forensic artifacts!
darksp33d/hyperhives-macos-infostealer-analysisFull static analysis of HyperHives macOS Rust infostealer — 571 decrypted config values, C2 infrastructure, DPRK/Contagious Interview attribution,…
telegrip/telegripGUI forensic tool for acquiring and analyzing Telegram data from Android devices. Parses messages, media, and metadata; generates integrity-verified…
alex188dot/agensicCryptographic terminal forensics and session replay for AI agents. Tracks, signs, and audits every command with provenance labels, replayable…
lupovis/honeypot-for-cve-2025-59287-wsusDefensive PoC decoy for CVE-2025-59287 (WSUS) - emulates WSUS endpoints, captures request bodies and metadata, saves evidence for forensic analysis,…
markuta/bw-dumpA proof-of-concept for (CVE-2023-38840) that extracts plaintext master passwords from a locked Bitwarden vault.
abdeljalilait/kerneleyeKernel-level security & attack response for Linux servers.
nccgroup/windowspatchdetectorExperimental Windows .text section Patch Detector
