
Sandb0x-Xtract0r
Automated cross-platform sandbox that detonates suspicious files in isolated VMs/emulators, captures network and memory artifacts, and creates LLM…

Automated cross-platform sandbox that detonates suspicious files in isolated VMs/emulators, captures network and memory artifacts, and creates LLM…

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…

A network sniffer that logs all DNS server replies for use in a passive DNS setup

Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.

PacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…

A Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.

Downloaded a packet capture (.pcapng) file from malware-traffic-analysis.net which was an example of an attempted attack against a webserver using…

Forensic triage of DNS cache poisoning in legacy hardware. Includes PCAP analysis of 839-byte unsolicited record injections, CVE-2025-40778 mapping,…

Controlled reproduction of CVE-2017-0144 (EternalBlue) in an isolated AWS EC2 lab — exploit analysis, Wireshark traffic capture, and MITRE ATT&CK…

Malware Configuration And Payload Extraction

All-in-One malware analysis tool.

TCP/IP packet demultiplexer. Download from:

Visualize network topologies and collect graph statistics based on pcap files

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

A network packet forensics tool for SSH

It was developed to speed up the processes of SOC Analysts during analysis

create cypher create statements for neo4j out of netstat files from multiple machines

Zeek support for Community ID flow hashing.