
ja4
JA4+ is a suite of network fingerprinting standards

JA4+ is a suite of network fingerprinting standards


RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.

Hands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

Open-source network forensics toolkit for packet analysis, port scanning, host discovery, and IP geolocation. Supports ARP, ICMP, TCP, UDP pings and…

A curated collection of DFIR skills and workflows for InfoSec practitioners.

A network packet forensics tool for SSH

Collection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…

A swiss-knife MCP server for analysing PCAP files

A Zeek IPSec protocol analyzer based on Spicy.

A Zeek STUN protocol analyzer based on Spicy.

Blue-team analysis of a malicious DOCX exploiting CVE-2017-0199, covering sandbox detonation, network forensics, IOC extraction, MITRE ATT&CK…

Spring4Shell (CVE-2022-22965) DFIR lab with exploit simulation, Python WAF, IOC-based detection, and PCAP analysis.

A cross platform http sniffer with a web UI