DFIR-LABS
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
ctfdigital-forensicsdisk-forensics+6
557
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
basitsajidapply-stack/soc-investigation-cve-2024-49138Investigation and Incident Response report for LetsDefend Alert SOC335 (CVE-2024-49138 Exploitation)
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
darnellwashingtonjr94-art/sandb0x-xtract0rAutomated cross-platform sandbox that detonates suspicious files in isolated VMs/emulators, captures network and memory artifacts, and creates LLM…
alzeaty1/security-writeupsCTF writeups and teaching scripts for web security, bug bounty techniques, and network forensics, with blank-value versions for active practice.
pugazhendii22/keepass-exfil-forensicsNetwork forensics writeup + tooling for a TryHackMe DFIR challenge: reverses a hex→Base64→XOR exfiltration chain from PCAP traffic, then recovers a…
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
kybr-git/dc30-badge-challenge-writeupWriteup for the DEF CON 30 badge challenge
magentabear/cve-2019-11043-vulnerabilityHands-on lab reproducing CVE-2019-11043 PHP-FPM RCE behind nginx, demonstrating reverse-tunnel persistence, memory forensics, and network traffic…
abiral-timalsina/cyber-defenders-lab-My write-ups from CyberDefenders' Blue Team labs, solved using Wireshark. Covers TeamCity RCE (CVE-2024-27198), XSS session hijacking, and…
zedocun/incident-analysis-response-check-point-security-gateway-cve-2024-24919-lfi-exploitationIncident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check…
stevehenderson/lab_xz_backdoorSome labs looking at the xz backdoor vulnerability (CVE-2024-3094)
trinadh-dasari-cyber/eternalblue-ms17-010-researchControlled reproduction of CVE-2017-0144 (EternalBlue) in an isolated AWS EC2 lab — exploit analysis, Wireshark traffic capture, and MITRE ATT&CK…
nicholasc03/dns-poisoning-triage-labForensic triage of DNS cache poisoning in legacy hardware. Includes PCAP analysis of 839-byte unsolicited record injections, CVE-2025-40778 mapping,…
suyash-r-k/dfir-malware-investigationSpring4Shell (CVE-2022-22965) DFIR lab with exploit simulation, Python WAF, IOC-based detection, and PCAP analysis.
jhatchi/nexacorp-dfir-inc-2026-001DFIR investigation + 7 Suricata rules on a simulated NexaCorp intrusion (vsftpd 2.3.4 CVE-2011-2523 + MITRE Caldera C2). 4-day solo engagement…
nour833/stegoforgeThe ultimate steganography and digital forensics toolkit. Hide and extract data across images, audio, video, documents, and network packets, or run…