DFIR-LABS
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
ctfdigital-forensicsdisk-forensics+6
557
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
exmak-s/cve-2021-46702Proof-of-concept script that analyzes Windows memory dumps to recover visited Tor onion services, bypassing Tor Browser's anonymity by exploiting…
volatilityfoundation/dwarf2jsonconvert ELF/DWARF symbol and type information into vol3's intermediate JSON
darnellwashingtonjr94-art/sandb0x-xtract0rAutomated cross-platform sandbox that detonates suspicious files in isolated VMs/emulators, captures network and memory artifacts, and creates LLM…
kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysisReverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…
kaandemir993/redline-stealer-c2-defender-bypass-payload-analysis"Reverse engineering analysis of RedLine Stealer, a .NET-based info-stealer that uses C2 domains (198.46.86.63, tempuri.org), Windows Defender…
hackmichnet/aztokenfinderOffensive token-harvesting utility that searches x64 process memory and TokenBroker cache files for Azure AD/O365 JWT tokens across Office, Edge,…
0vercl0k/kdmp-parserA Windows kernel dump C++ parser library with Python 3 bindings.
nccgroup/detectwindowscopyonwriteforapiEnumerate various traits from Windows processes as an aid to threat hunting
nccgroup/libdlmallocHeap analysis tooling for dlmalloc
nccgroup/libmempoolHeap analysis tooling for mempool
nccgroup/libtalloclibtalloc is a python script for use with GDB that can be used to analyse the "trivial allocator" (talloc)
nccgroup/windowsmempagedeltaA Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection
malvuln/ransomlordRansomLord is a proof-of-concept Anti-Ransomware exploitation tool that automates the creation of PE files, used to compromise ransomware…
smarttfoxx/cve-2026-29923The pstrip64.sys kernel driver exposes an IOCTL that allows low-privileged users to map arbitrary ranges of physical memory into their own virtual…
joe-desimone/patriotIn-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…
ox1111/cve-2022-32932Technical analysis and proof-of-concept for CVE-2022-32932, a double fetch vulnerability in Apple's ANE kernel driver leading to out-of-bounds write…
eap2468/cve-2022-3699Proof of Concept exploit for CVE-2022-3699