


A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.

The ultimate steganography and digital forensics toolkit. Hide and extract data across images, audio, video, documents, and network packets, or run…

Network forensics writeup + tooling for a TryHackMe DFIR challenge: reverses a hex→Base64→XOR exfiltration chain from PCAP traffic, then recovers a…

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Remote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from…

TCP/IP packet demultiplexer. Download from:

FATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

'Packet Capture Forensic Evidence eXtractor' is a tool that finds and extracts files from packet capture files

Extracts IP addresses from pcap/pcapng network traffic files and generates CSV reports with geolocation, ISP, and organizational details for each IP.

create cypher create statements for neo4j out of netstat files from multiple machines

Lua plugin to extract data from Wireshark and convert it into MISP format

Decrypts Covenant C2 communications by extracting RSA private keys from minidumps, recovering AES session keys, and converting network captures to…

Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.

This framework combines a set of existing open source tools into an integrated package that automates the forensics investigation process. It is able…

Selective protocol extractor from PCAPs or interfaces