#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
ricardojoserf/nativedumpDump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)
parrotsec/mimikatzTool for extracting Windows credentials (passwords, hashes, Kerberos tickets) from memory and performing pass-the-hash, pass-the-ticket, and golden…
microsoft/avmlPortable Linux RAM acquisition tool for forensics and incident response, capturing LiME-compatible images with optional compression and remote…
zodiacon/alltoolsAll reasonably stable tools
glmcdona/process-dumpWindows tool for dumping malware PE files from memory back to disk for analysis.
mmozeiko/aes-finderUtility to find AES keys in running processes
carmaa/inceptionInception is a physical memory manipulation and hacking tool exploiting PCI-based DMA. The tool can attack over FireWire, Thunderbolt, ExpressCard,…
tclahr/uacPortable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition,…
mattifestation/powershellarsenalA PowerShell Module Dedicated to Reverse Engineering
ion28/bluespawnAn Active Defense and EDR software to empower Blue Teams
dump-guy/malware-analysis-and-reverse-engineeringSome of my publicly available Malware analysis and Reverse engineering.
codewhitesec/handlekatzPIC-based Lsass memory dumper using cloned handles to evade detection, producing obfuscated dumps with minimal memory footprint for red team…
meckazin/chromekatzDump cookies and credentials directly from Chrome/Edge process memory
joe-desimone/mongobleedProof-of-concept exploit for CVE-2025-14847, a MongoDB zlib decompression vulnerability that leaks uninitialized server memory via crafted BSON…
lem0nsec/shellghostA memory-based evasion technique which makes shellcode invisible from process start to end.
census/shadowjemalloc heap exploitation framework
ccob/beaconeyeHunts out CobaltStrike beacons and logs operator command output
