wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

bytesrevealer

https://bytesrevealer.online/ VULNEX https://www.vulnex.com/ Bytes Revealer Version: 0.4 Bytes Revealer is a powerful reverse engineering and binary analysis tool designed for security researchers, forensic analysts, and developers. With features like hex view, visual representation, string...

DFIR-O365RC

Table of contents: 1. Module description 2. Installation and prerequisites 1. Using Docker 2. Manual Installation 3. Managing the DFIR-O365RC application 1. Creating the application 2. Updating the application 3. Removing the application 4. Permissions and license requirements 5. Functions includ...

DFIR_Resources_REvil_Kaseya

Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack Yesterday Sophos and Huntress Labs identified that Kaseya, a remote management provider popular with MSPs, was compromised to deploy a supply chain ransomware attack. A large number of organisations wer...

MozCache

MozCache Bash script Simple shell script to perform forensic analysis of the Mozilla-Browsers cache Firefox, Iceweasel and Seamonkey. The script orders by date the files cached from a browser of the Mozilla family using the cache version 2. Together with the name of each file the script generates...

lmg

Linux Memory Grabber Un script para volcar la memoria de Linux y crear perfiles de VolatilityTM. Hal Pomeranz [email protected], 2020-02-01 ¡AGRADECIMIENTOS! "Si he visto más lejos es por estar sobre los hombros de gigantes." Issac Newton Hay muchas personas que merecen agradecimiento por...

prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

ALFA

ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...

Remote-Desktop-Caching-

Remote-Desktop-Caching- This tool allows one to recover old RDP mstsc session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG...

forensic-msvpn

Análisis forense de Microsoft Remote Access VPN Este repositorio contiene recursos relacionados con el análisis forense realizado sobre Microsoft Remote Access VPN y disponibles en esta entrada de blog: https://www.synacktiv.com/publications/forensic-aspects-of-microsoft-remote-access-vpn.html. u...

RdpCacheStitcher

RdpCacheStitcher RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps. Using raw RDP cache tile bitmaps extracted by tools like e.g. ANSSI's BMC-Tools https://github.com/ANSSI-FR/bmc-tools as input, it provides a graphical user...

columbo

Columbo Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and machine learning models to identify adversaries behaviour and their possible locations in compromise...

physical-analyzer-scripts

physical-analyzer-scripts Scripts de Python de Cellebrite Physical Analyzer para ayudar a los analistas con funcionalidad extendida...

interrogate

Interrogate Interrogate es una herramienta de prueba de concepto para la identificación de claves criptográficas en material binario independientemente del sistema operativo objetivo, principalmente para el análisis de volcados de memoria y uso forense. Capaz de identificar claves AES, Serpent,...

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis...

FAMA

DEPRECATED: LabCIF - Forensic Analysis for Mobile Apps Getting Started Android extraction and analysis framework with an integrated Autopsy Module. Dump easily user data from a device and generate powerful reports for Autopsy or external applications. Functionalities Extract user application data...

PacketStreamer

PacketStreamer Deepfence PacketStreamer is a high-performance remote packet capture and collection tool. It is used by Deepfence's ThreatStryker security observability platform to gather network traffic on demand from cloud workloads for forensic analysis. Primary design goals: Stay light, captur...

gradle-static-analysis-plugin

DEPRECATED Gradle static analysis plugin ⚠️ A fork of this project is maintained at https://github.com/GradleUp/static-analysis-plugin/ Please migrate by using com.gradleup.static-analysis plugin id instead. A Gradle plugin to easily apply the same setup of static analysis tools across different...

iOSForensic

iOSForensic iosForensic es una herramienta de Python para ayudar en el análisis forense en iOS. Obtiene archivos, registros, extrae bases de datos sqlite3 y descomprime archivos .plist en xml. Instalación Simplemente clone este repositorio git e instale las dependencias. Dependencias Linux OpenSS...

CitrixNetscalerAnalysis

Cuaderno de análisis de Citrix Un notebook de Jupyter para ayudar a automatizar parte del análisis forense relacionado con hosts de Citrix Netscaler comprometidos mediante CVE-2019-19781. Para obtener ayuda sobre cómo recuperar los artefactos que examinar, consulta este script de triaje de Citrix...