Remote-Desktop-Caching-

Remote-Desktop-Caching- This tool allows one to recover old RDP mstsc session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG...

physical-analyzer-scripts

physical-analyzer-scripts Scripts de Python de Cellebrite Physical Analyzer para ayudar a los analistas con funcionalidad extendida...

ALFA

ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...

columbo

Columbo Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and machine learning models to identify adversaries behaviour and their possible locations in compromise...

interrogate

Interrogate Interrogate es una herramienta de prueba de concepto para la identificación de claves criptográficas en material binario independientemente del sistema operativo objetivo, principalmente para el análisis de volcados de memoria y uso forense. Capaz de identificar claves AES, Serpent,...

bytesrevealer

https://bytesrevealer.online/ VULNEX https://www.vulnex.com/ Bytes Revealer Version: 0.4 Bytes Revealer is a powerful reverse engineering and binary analysis tool designed for security researchers, forensic analysts, and developers. With features like hex view, visual representation, string...

prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

awesome-android-security

Awesome-Android-Security Table of Contents Blog How To's Papers Books Trainings Tools Static Analysis Tools Dynamic Analysis Tools Online APK Analyzers Online APK Decompiler Forensic Analysis Tools Labs Talks Misc Bug Bounty & Writeups Cheat Sheet Checklist Bug Bounty Report Blogs 1-click Exploit...

MozCache

MozCache Script Bash Script de shell simple para realizar análisis forense de la caché de navegadores Mozilla Firefox, Iceweasel y Seamonkey. El script ordena por fecha los archivos cacheados de un navegador de la familia Mozilla usando la versión 2 de la caché. Junto con el nombre de cada archiv...

RdpCacheStitcher

RdpCacheStitcher RdpCacheStitcher es una herramienta que ayuda a los analistas forenses a reconstruir imágenes útiles a partir de mapas de bits de la caché de RDP. Utilizando como entrada los mapas de bits de teselas de la caché RDP sin procesar extraídos por herramientas como, por ejemplo,...

DFIR_Resources_REvil_Kaseya

Recursos para profesionales de DFIR que responden al ataque de ransomware REvil en la cadena de suministro de Kaseya Ayer, Sophos y Huntress Labs identificaron que Kaseya, un proveedor de gestión remota popular entre los MSP, fue comprometido para implementar un ataque de ransomware en la cadena ...

lmg

Linux Memory Grabber 用于转储 Linux 内存并创建 VolatilityTM 配置文件的脚本。 Hal Pomeranz [email protected], 2020-02-01 致谢 “如果说我看得比别人更远，那是因为我站在巨人的肩膀上。” —— 艾萨克·牛顿 很多人应该为这个简单小工具的实现而获得感谢： —— 微软的优秀团队，感谢他们提供了 AVML —— Joe Sylve，感谢他在 LiME 上的工作 —— 整个 VolatilityTM 开发团队的持续付出。 我尤其要感谢 Andrew Case，他在我开发工具的过程中回答了许多烦人的问题。 ...

DFIR-O365RC

目录 1. 模块描述 2. 安装和先决条件 1. 使用 Docker 2. 手动安装 3. 管理 DFIR-O365RC 应用程序 1. 创建应用程序 2. 更新应用程序 3. 移除应用程序 4. 权限和许可证要求 5. 模块包含的函数 6. 生成的文件 DFIR-O365RC 在 SSTIC 2021（信息技术与通信安全研讨会）上进行了展示。演示文稿的幻灯片和录制视频（法文）可在此处获取：链接。 ⚠️ 2024年3月31日，Microsoft 弃用了 我们用于 DFIR-O365RC 的身份验证方法。因此，我们于2024年8月发布了 2.0.0 版本，其中包含关于身份验证的重大变更...

forensic-msvpn

Microsoft Remote Access VPN Forensic analysis This repository contains resources related to the forensic analysis made on Microsoft Remote Access VPN and available on this blog post: https://www.synacktiv.com/publications/forensic-aspects-of-microsoft-remote-access-vpn.html. a Velociraptor client...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis

joomla-cve-2015-8562-exploit-y-linux-forensic-analysis...

FAMA

已弃用：LabCIF - 移动应用取证分析 入门指南 Android 数据提取与分析框架，集成 Autopsy 模块。轻松从设备中转储用户数据，并为 Autopsy 或外部应用生成强大报告。 功能 通过 ADB 从 Android 设备提取用户应用数据（需要 root 和 ADB）。 从 Android 镜像或挂载路径转储用户数据。 轻松构建特定 Android 应用的模块。 生成清晰可读的 JSON 报告。 完全集成 Autopsy 兼容性（数据源处理器模块、摄取模块、报告模块、地理定位、通信和时间线支持）。 基于当前案例导出 HTML 报告。 报告截图 先决条件 Python（2.7...

PacketStreamer

PacketStreamer Deepfence PacketStreamer 是一款高性能远程数据包捕获与收集工具。它被 Deepfence 的 ThreatStryker 安全可观测性平台用于按需从云工作负载中采集网络流量，以供取证分析。 主要设计目标： 保持轻量，仅负责捕获和传输，不做额外处理 可移植性，支持 虚拟机、Kubernetes 和 AWS Fargate 。Linux 和 Windows 均可使用 PacketStreamer 传感器 部署在目标服务器上。传感器捕获流量、应用过滤器，然后将流量传输到中央接收器。流量流可选择通过 TLS 进行压缩和/或加密。...

iOSForensic

iOSForensic iosForensic es una herramienta de Python para ayudar en el análisis forense en iOS. Obtiene archivos, registros, extrae bases de datos sqlite3 y descomprime archivos .plist en xml. Instalación Simplemente clone este repositorio git e instale las dependencias. Dependencias Linux OpenSS...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...