#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
memoryforensics1/vol3xpVolatility Explorer Suit (volatility 3)
nccgroup/memscanSearches for strings, regex, credit card numbers of magnetic stripe card tracks in a Windows process's memory space
ffri/cve-2025-24204PoC and technical details of CVE-2025-24204
david942j/heapinfoAn interactive memory info for pwning / exploiting
iss4cf0ng/ironpeRust-based Windows PE manual loader that maps and executes x86/x64 executables from memory, demonstrating internal loader behavior and PE structure…
airbus-cert/yara-ttdUse YARA rules on Time Travel Debugging traces
nccgroup/killedprocesscanaryA canary designed to minimize the impact from certain Ransomware actors
smolfiddle/sentinelnavSentinelNav: zero-dependency, pure Python binary visualization and forensics tool.
opsxcq/exploit-cve-2017-5715Spectre exploit
pubglite55/oppo-ghostlockOPPO Find N2 GhostLock (CVE-2026-43499) exploit adaptation
awrped/splinterRuntime JVM analysis toolkit for inspecting classes, methods, fields, constant pool, and bytecode
hackmichnet/aztokenfinderOffensive token-harvesting utility that searches x64 process memory and TokenBroker cache files for Azure AD/O365 JWT tokens across Office, Edge,…
mlcsec/proctoolsSmall toolkit for extracting information and dumping sensitive strings from Windows processes
principlecheck/kslkatzbofBeacon Object File for in-line LSASS credential extraction using the KslD.sys BYOVD technique. Extracts NT hashes and cleartext passwords from…
karollooool/cve-2026-50416-writeup-and-pocCVE-2026-50416: Windows 11 KASLR bypass
gengstah/windbg-mcpAn MCP (Model Context Protocol) server that turns all pybag Windows debugger functions into native MCP tools. It lets MCP-compatible clients (Claude…
rvazarkar/antipwnyA host based IDS written in C# Targetted at Metasploit
