digital-forensics-lab
frankwxu/digital-forensics-labFree hands-on digital forensics labs for students and faculty
ai-securityctfdigital-forensics+9
2.9k
frankwxu/digital-forensics-labFree hands-on digital forensics labs for students and faculty
darnellwashingtonjr94-art/sandb0x-xtract0rAutomated cross-platform sandbox that detonates suspicious files in isolated VMs/emulators, captures network and memory artifacts, and creates LLM…
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
basitsajidapply-stack/soc-investigation-cve-2024-49138Investigation and Incident Response report for LetsDefend Alert SOC335 (CVE-2024-49138 Exploitation)
pugazhendii22/keepass-exfil-forensicsNetwork forensics writeup + tooling for a TryHackMe DFIR challenge: reverses a hex→Base64→XOR exfiltration chain from PCAP traffic, then recovers a…
abiral-timalsina/cyber-defenders-lab-My write-ups from CyberDefenders' Blue Team labs, solved using Wireshark. Covers TeamCity RCE (CVE-2024-27198), XSS session hijacking, and…
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
zedocun/incident-analysis-response-check-point-security-gateway-cve-2024-24919-lfi-exploitationIncident Response (IR) case study documenting the investigation of an exploitation attempt targeting CVE-2024-24919 (Arbitrary File Read) on a Check…
alzeaty1/security-writeupsCTF writeups and teaching scripts for web security, bug bounty techniques, and network forensics, with blank-value versions for active practice.
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
nicholasc03/dns-poisoning-triage-labForensic triage of DNS cache poisoning in legacy hardware. Includes PCAP analysis of 839-byte unsolicited record injections, CVE-2025-40778 mapping,…
jhatchi/nexacorp-dfir-inc-2026-001DFIR investigation + 7 Suricata rules on a simulated NexaCorp intrusion (vsftpd 2.3.4 CVE-2011-2523 + MITRE Caldera C2). 4-day solo engagement…
stevehenderson/lab_xz_backdoorSome labs looking at the xz backdoor vulnerability (CVE-2024-3094)
gosecure/pyrdpRDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact
trinadh-dasari-cyber/eternalblue-ms17-010-researchControlled reproduction of CVE-2017-0144 (EternalBlue) in an isolated AWS EC2 lab — exploit analysis, Wireshark traffic capture, and MITRE ATT&CK…
srixivas/pcapxray❄️ PcapXray - A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight…
weirdmachine64/sharkmcpA swiss-knife MCP server for analysing PCAP files
nour833/stegoforgeThe ultimate steganography and digital forensics toolkit. Hide and extract data across images, audio, video, documents, and network packets, or run…