Top 146 forensics open source projects

swap_digger is a tool used to automate Linux swap analysis during post-exploitation or forensics. It automates swap extraction and searches for Linux user credentials, web forms credentials, web forms emails, http basic authentication, Wifi SSID and keys, etc.

✭ 354

shell security hacking dfir forensics post-exploitation

Docker Explorer

A tool to help forensicate offline docker acquisitions

✭ 328

python docker forensics

Mac apt

macOS Artifact Parsing Tool

✭ 329

python macos dfir forensics

Malconfscan

Volatility plugin for extracts configuration data of known malware

✭ 327

python security malware memory forensics

Flare Wmi

✭ 321

python forensics

Ir Rescue

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

✭ 311

bash windows malware unix cybersecurity dfir forensics incident-response batch

Hackdroid

Android Apps, Roms and Platforms for Pentesting

✭ 310

android penetration-testing apk forensics wireless mitm anonymity ddos sniffing

Prowler

Prowler is a security tool to perform AWS security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains more than 200 controls covering CIS, ISO27001, GDPR, HIPAA, SOC2, ENS and other security frameworks.

Meerkat

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

✭ 284

powershell security analysis monitor log recon forensics threat-hunting scan response siem baseline threat

Recuperabit

A tool for forensic file system reconstruction.

✭ 280

python dfir forensics disk

Free Security Ebooks

Free Security and Hacking eBooks

✭ 3,132

security hacking penetration-testing kali-linux forensics ebooks cyber-security cloud-security hacking-ebooks hackers-handbook

wipedicks

Wipe files and drives securely with randoms ASCII dicks

✭ 94

python forensics wipe-files antiforensics random-ascii-dicks anti-forensics

bits parser

Extract BITS jobs from QMGR queue and store them as CSV records

✭ 64

python windows incident-response forensics

WiFi-Project

Pre-connection attacks, gaining access & post-connection attacks on WEP, WPA & WPA2. 🛰✔️

✭ 22

python security hacking wifi forensics cybersecurity pentesting

rair-core

RAIR: RAdare In Rust

✭ 63

rust shell framework static-analysis reverse-engineering disassembler forensics malware-analysis exploitation radare2 radare

dcfldd

Enhanced version of dd for forensics and security

✭ 27

c Makefile forensics forensic-analysis recovering-data wipe recovery-image forensics-investigations

ImageSplicingDetection

Illuminant inconsistencies for image splicing detection in forensics

✭ 36

c C++python matlab CMake Makefile forensics illuminant-inconsistencies image-splicing-detection

git-forensics-plugin

Jenkins plug-in that mines and analyzes data from a Git repository

✭ 19

java git jenkins forensics hacktoberfest code-forensics

lsrootkit

Rootkit Detector for UNIX

✭ 53

c linux unix rootkit forensics forensic-analysis rootkits antirootkit

sift-saltstack

Salt States for Configuring the SIFT Workstation

✭ 82

SaltStack python YARA shell perl Dockerfile configuration-management forensics saltstack sift sans

bootcode parser

A boot record parser that identifies known good signatures for MBR, VBR and IPL.

✭ 91

python windows forensics mbr ipl vbr bootkit boot-record bios

macOS-triage

macOS triage is a python script to collect various macOS logs, artifacts, and other data.

✭ 20

python macos forensics

mini-kali

Docker image for hacking

✭ 15

shell Dockerfile Vim Script hacking gdb forensics ctf kali-linux

ManTraNet-pytorch

Implementation of the famous Image Manipulation\Forgery Detector "ManTraNet" in Pytorch

truehunter

Truehunter

✭ 30

python entropy forensics dfir truecrypt veracrypt

ir scripts

incident response scripts

✭ 17

powershell windows incident-response forensics dfir sysmon threat-hunting

siemstress

Very basic CLI SIEM (Security Information and Event Management system).

pyaff4

The Python implementation of the AFF4 standard.

✭ 37

python forensics digital-forensics forensic-analysis compression-library compression-formats

CTF-Script-And-Template-Thrift-Shop

[180+ scripts] There are a few genuine gems in there. And a lot of spaghetti code. Most of these scripts were for solving CTF's. If you googles something for a CTF and landed here look at the scripts they're all fairly malleable. Sorry for the shitty naming conventions (not really). If you are a recruiter stop. I wont be able to rewrite half thi…

✭ 38

python shell perl javascript HTML c solutions hackathon hacking forensics dump ruby-script ctf bash-script ctf-solutions boot2root ctf-challenges bait-and-switch ringzer0team htb hackthebox codedump

robot hacking manual

Robot Hacking Manual (RHM). From robotics to cybersecurity. Papers, notes and writeups from a journey into robot cybersecurity.

LevelDBDumper

Dumps all of the Key/Value pairs from a LevelDB database

✭ 23

go shell Batchfile cli cross-platform leveldb forensics dfir whatsapp discord-forensics leveldb-database leveldb-dumper leveldb-dump

ForensicsTools

A list of free and open forensics analysis tools and other resources

✭ 392

windows macos linux open-source metadata tools timeline network forensics free awesome-list image-analysis digital-forensics forensic-analysis metada forensics-investigations computer-fore forensic-tools

MacForensics

Scripts to process macOS forensic artifacts

✭ 118

python macos mac osx forensics

smram parse

System Management RAM analysis tool

✭ 50

python security analysis firmware forensics dfir uefi smm reversing investigation

toolset

Useful tools for CTF competitions

✭ 31

cryptography crypto network forensics reverse toolset ctf pwnable pwning ctf-competitions

WELA

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

✭ 442

powershell windows log analysis timeline logs event threat forensics dfir response hunting sigma incident

dumproid

Android process memory dump tool without ndk.

✭ 55

go Makefile forensics android-security mobile-security

EventTranscriptParser

Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)

✭ 22

python windows forensics dfir cybersecurity eventtranscript diagnostic-data

sqbrite

SQBrite is a data recovery tool for SQLite databases

✭ 27

python ios sqlite databases forensics recovery

UnifiedLogReader

A parser for Unified logging tracev3 files

✭ 56

python macos forensics tracev3 unifiedlogs

PSTrace

Trace ScriptBlock execution for powershell v2

✭ 38

c C#CMake incident-response forensics dfir etw

DFIR-O365RC

PowerShell module for Office 365 and Azure log collection

✭ 158

powershell Dockerfile devops azure forensics dfir azure-active-directory office365 exchangeonline

memscrimper

Code for the DIMVA 2018 paper: "MemScrimper: Time- and Space-Efficient Storage of Malware Sandbox Memory Dumps"

✭ 25

C++python CMake compression sandbox malware forensics malware-research memory-dump

fingerprint denoising

U-Net for fingerprint denoising

✭ 19

python shell fingerprint forensics convolutional-neural-networks denoising

ad-privileged-audit

Provides various Windows Server Active Directory (AD) security-focused reports.

✭ 42

powershell security auditing security-audit active-directory forensics dfir cybersecurity security-hardening account-management risk-assessment information-gathering blueteam security-tools system-hardening purpleteam reporting-tool security-auditing-tool

iTunes Backup Reader

Python 3 Script to parse out iTunes backups

✭ 108

python backups ios mobile itunes forensics dfir kape itunes-backups

Imm2Virtual

This is a GUI (for Windows 64 bit) for a procedure to virtualize your EWF(E01), DD (raw), AFF disk image file without converting it, directly with VirtualBox, forensically proof.

✭ 40

pascal image disk virtualbox tool filesystem virtualization forensics e01 ewf

ingest-file

Ingestors extract the contents of mixed unstructured documents into structured (followthemoney) data.

✭ 40

python Dockerfile Makefile ocr excel forensics documents metadata-extraction document-extraction forensics-investigations email-forensics

nsa-codebreaker-2020

My solutions to the 2020 NSA Codebreaker Challenge

✭ 69

python go Dockerfile shell security cryptography reverse-engineering forensics ctf-writeups vulnerability ctf ctf-solutions write-ups write-up ctf-challenges ctf-challenge

uac

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

✭ 260