
passivedns
A network sniffer that logs all DNS server replies for use in a passive DNS setup

A network sniffer that logs all DNS server replies for use in a passive DNS setup

JA4+ is a suite of network fingerprinting standards

Malware samples, analysis exercises and other interesting resources.

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.

Malicious HTTP traffic explorer

Hands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

A network packet forensics tool for SSH

Flows-first PCAP TUI (case files, gorgeous UX). Do do do do.

A tool for processing a lot of pcaps using tshark

Extracts IP addresses from pcap/pcapng network traffic files and generates CSV reports with geolocation, ISP, and organizational details for each IP.

create cypher create statements for neo4j out of netstat files from multiple machines

Educational reverse engineering study of a Unity/IL2CPP Android game. Documents gateway protocol decoding, native anti-tampering SDK analysis, SSL…

Android Connections Forensics

Blue-team analysis of a malicious DOCX exploiting CVE-2017-0199, covering sandbox detonation, network forensics, IOC extraction, MITRE ATT&CK…

Remote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…
