#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
sneakynachos/cve-2026-84118-who-labeled-the-crit-as-a-highProof-of-concept for CVE-2026-84118, a SpiderMonkey GC use-after-free leading to out-of-bounds read/write and potential code execution. Includes…
ymsniper/umbraExternal read-only game overlay for Linux. Derived offsets, composed skeletons, optional kernel module for ptrace-independent memory reads and…
stephenfewer/reflectivedllinjectionReflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a…
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
daffainfo/vol-rsVolatility 3 ported to Rust. Same output, much faster.
mastercodeon314/ksdumper-11A revival of the classic and legendary KsDumper
amperclock/cve-2023-32784-kdbxpassdmpRetrieves the master password from Keepass memory dump, using a hint of bruteforce.
withsecurelabs/volatility-pluginsVolatility plugins for memory forensics, including detection of Gargoyle memory scanning evasion techniques.
withsecurelabs/dotnet-gargoyleA spiritual .NET equivalent to the Gargoyle memory scanning evasion technique
withsecurelabs/radare2-scriptsCollection of radare2 scripts for malware analysis: carve binaries from memory dumps, patch PE headers, and decode hashed function imports in…
withsecurelabs/memory-carving-scriptsScripts for extracting useful information from infected memory dumps
ledlight33/copyfail-dfirInteractive DFIR walkthrough of CVE-2026-31431 (Copy Fail) - from SIEM alert to confirmed verdict. Real Volatility 3 commands, verified methodology.
krish-foren6/cve-2026-31431-report-copy-fail-vulnerability-Detailed analysis of the Copy Fail vulnerability (CVE-2026-31431) in the Linux kernel, including memory corruption mechanism, privilege escalation…
tzwlhack/cve-2021-21017Proof-of-concept exploit for CVE-2021-21017, an Adobe Reader type confusion leading to out-of-bounds read and heap overflow, with technical analysis…
ppwwiinn/cve-2026-2763-pocProof-of-concept exploit for CVE-2026-2763, a use-after-free in Mozilla's JavaScript engine, demonstrating a constrained 1-bit write primitive…
enfilade-labs/cve-2026-20687-applejpegdriver-uafCVE-2026-20687: AppleJPEGDriver startDecoder Timeout UAF — iOS/macOS kernel vulnerability leading to deferred panic (A19 Pro, iOS 26.3 RC)
cyhe50/cve-2025-54874-pocProof-of-concept demonstrating a memory leak in OpenJPEG 2.5.1 via crafted JP2 files, triggering opj_read_header failure and heap leak, with valgrind…
adilkurtulmus/linux-copy-fail-cve-2026-31431Proof-of-concept exploit for CVE-2026-31431 (Copy-Fail), a Linux kernel AF_ALG and splice() flaw enabling page cache poisoning and local privilege…
