awesome-android-security

Awesome-Android-Security Table of Contents Blog How To's Papers Books Trainings Tools Static Analysis Tools Dynamic Analysis Tools Online APK Analyzers Online APK Decompiler Forensic Analysis Tools Labs Talks Misc Bug Bounty & Writeups Cheat Sheet Checklist Bug Bounty Report Blogs 1-click Exploit...

DFIR-O365RC

Tabla de contenidos: 1. Descripción del módulo 2. Instalación y requisitos 1. Usando Docker 2. Instalación manual 3. Gestión de la aplicación DFIR-O365RC 1. Creación de la aplicación 2. Actualización de la aplicación 3. Eliminación de la aplicación 4. Requisitos de permisos y licencias 5. Funcion...

columbo

Columbo Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and machine learning models to identify adversaries behaviour and their possible locations in compromise...

physical-analyzer-scripts

physical-analyzer-scripts Cellebrite Physical Analyzer python scripts to aid analysts with extended functionality...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

CitrixNetscalerAnalysis

Citrix Analysis Notebook A jupyter notebook to aid in automating some of the forensic analysis related to Citrix Netscaler hosts compromised via CVE-2019-19781. For help retrieving artifacts to examine see this Citrix triage script. All notes/suggestions are welcome. Feel free to submit pull...

ALFA

ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...

interrogate

Interrogate Interrogate is a proof-of-concept tool for identification of cryptographic keys in binary material regardless of target operating system, first and foremost for memory dump analysis and forensic usage. Able to identify AES, Serpent, Twofish and DER-encoded RSA keys as of version 0.0.4...

bytesrevealer

https://bytesrevealer.online/ VULNEX https://www.vulnex.com/ Bytes Revealer Version: 0.4 Bytes Revealer is a powerful reverse engineering and binary analysis tool designed for security researchers, forensic analysts, and developers. With features like hex view, visual representation, string...

MozCache

MozCache Bash script Simple shell script to perform forensic analysis of the Mozilla-Browsers cache Firefox, Iceweasel and Seamonkey. The script orders by date the files cached from a browser of the Mozilla family using the cache version 2. Together with the name of each file the script generates...

lmg

Linux Memory Grabber Un script para volcar la memoria de Linux y crear perfiles de VolatilityTM. Hal Pomeranz [email protected], 2020-02-01 ¡AGRADECIMIENTOS! "Si he visto más lejos es por estar sobre los hombros de gigantes." Issac Newton Hay muchas personas que merecen agradecimiento por...

RdpCacheStitcher

RdpCacheStitcher RdpCacheStitcher es una herramienta que ayuda a los analistas forenses a reconstruir imágenes útiles a partir de mapas de bits de la caché de RDP. Utilizando como entrada los mapas de bits de teselas de la caché RDP sin procesar extraídos por herramientas como, por ejemplo,...

Remote-Desktop-Caching-

Remote-Desktop-Caching- This tool allows one to recover old RDP mstsc session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG...

forensic-msvpn

Microsoft Remote Access VPN Forensic analysis This repository contains resources related to the forensic analysis made on Microsoft Remote Access VPN and available on this blog post: https://www.synacktiv.com/publications/forensic-aspects-of-microsoft-remote-access-vpn.html. a Velociraptor client...

DFIR_Resources_REvil_Kaseya

Recursos para profesionales de DFIR que responden al ataque de ransomware REvil en la cadena de suministro de Kaseya Ayer, Sophos y Huntress Labs identificaron que Kaseya, un proveedor de gestión remota popular entre los MSP, fue comprometido para implementar un ataque de ransomware en la cadena ...

prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis

joomla-cve-2015-8562-exploit-y-linux-forensic-analysis...

FAMA

OBSOLETO: LabCIF - Análisis Forense para Aplicaciones Móviles Comenzando Marco de extracción y análisis para Android con un módulo Autopsy integrado. Extraiga fácilmente datos de usuario de un dispositivo y genere informes potentes para Autopsy o aplicaciones externas. Funcionalidades Extraer dat...

PacketStreamer

PacketStreamer Deepfence PacketStreamer es una herramienta de alto rendimiento para la captura y recolección remota de paquetes. Es utilizada por la plataforma de observabilidad de seguridad ThreatStryker de Deepfence para recopilar tráfico de red bajo demanda desde cargas de trabajo en la nube c...