watchtowrlabs/watchtowr-vs-netscaler-cve-2026-8451Python exploit tool for CVE-2026-8451 Citrix Netscaler memory overread vulnerability. Generates detection artifacts by leaking memory from target…
joe-desimone/patriotIn-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…
pandaadir05/ghostDetects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process…
sekoialab/fastir_collectorLive Windows forensic acquisition tool that collects system artefacts (registry, memory, disk, files) into CSV/JSON for early compromise detection…
hullabrian/eventhorizonTool that gathers a customizable set of ETW telemetry and generates user-defined detections
codewhitesec/handlekatzPIC-based Lsass memory dumper using cloned handles to evade detection, producing obfuscated dumps with minimal memory footprint for red team…
sho-luv/mongobleedCVE-2025-14847 (MongoBleed) scanner and exploit tool. Unauthenticated MongoDB heap memory leak via zlib decompression. Detection, memory extraction,…
orlyjamie/mimikittenzA post-exploitation powershell tool for extracting juicy info from memory.
parrotsec/mimikatzTool for extracting Windows credentials (passwords, hashes, Kerberos tickets) from memory and performing pass-the-hash, pass-the-ticket, and golden…
microsoft/avmlPortable Linux RAM acquisition tool for forensics and incident response, capturing LiME-compatible images with optional compression and remote…
glmcdona/process-dumpWindows tool for dumping malware PE files from memory back to disk for analysis.
xre0us/multidumpMultiDump is a post-exploitation tool for dumping and extracting LSASS memory discreetly.
forrest-orr/monetaMoneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
travisfoley/dfirtriageDigital forensic acquisition tool for Windows based incident response.
sterrasec/ipa-meditMemory modification tool for re-signed ipa supports iOS apps running on iPhone and Apple Silicon Mac without jailbreaking.
ioactive/platboxPlatform security assessment tool for dumping and analyzing UEFI/SMM registers, PCI config space, physical memory, SPI flash, and S3 bootscripts with…
dougwithseismic/dezlock-dumpRuntime schema + RTTI extraction tool for Deadlock, CS2, Dota, and others (Source 2). No source2gen required.
