autotimeliner

AutoTimeliner 自动从易失性内存转储中提取取证时间线。 AutoTimeliner 对 Windows、Linux 和 macOS 内存镜像运行多个 Volatility3 插件，然后将它们的输出合并为一个单一的、排序后的 CSV 时间线： 通用时间线插件 插件| 捕获内容 ---|--- timeliner| 跨插件时间戳事件（支持时适用于所有操作系统系列） Windows 插件集 插件| 捕获内容 ---|--- timeliner| 来自进程、注册表、句柄等的时间戳 mftscan| 内存中找到的 MFT 文件条目 shellbags|...

ShellCodeEmulator

基于 unicorn framework 的 Windows shellcode 模拟工具 ShellcodeEmulator 借助 windbg 进程内存转储来模拟 Windows shellcode。你可以提供任意 Windows 进程转储镜像随同 shellcode 一起分析。该工具将利用 shellcode 字节和提供的转储镜像，尽可能模拟用户态代码。 你可以在 shellcode 调用的 API 与内核层之间添加自定义系统调用处理程序或任何处理程序。这样可以提供用户栈的完整视图。它将使你能够调查绕过高层调用栈中宽松 API 钩子的 shellcode。 安装 1. 安装...

Vol3xp

Vol3xp, 内存取证框架Volatility 3的资源管理器插件 WinObj - Windows内核对象资源管理器，对https://github.com/kslgroup/WinObj的改进，适用于volatility 3 winobj.py WinObj 与WinObj sysinternals非常相似 同样支持结构分析器和来自VolExp的WinObjGui。 RAMMap - 物理地址映射 pfn.py RAMMap 与Rammap SysInternals非常相似，但额外会标记任何可疑页面（更多信息请阅读PDF文件）。 此模块包含3个插件： 1. P2V -...

CVE-2023-32784-EXPLOIT-REPORT

Demostración del Exploit CVE-2023-32784 Resumen del Proyecto Este repositorio proporciona una demostración de CVE-2023-32784, una vulnerabilidad crítica encontrada en versiones de KeePass anteriores a la 2.54. El exploit permite la recuperación de la contraseña maestra a través de volcados de...

rip_raw

Rip Raw Rip Raw is a small tool to analyse the memory of compromised Linux systems. It is similar in purpose to Bulk Extractor, but particularly focused on extracting system Logs from memory dumps from Linux systems. This enables you to analyse systems without needing to generate a profile. This ...

rip_raw

Rip Raw Rip Raw 是一个用于分析受感染 Linux 系统内存的小型工具。 其目的类似于 Bulk Extractor，但特别专注于从 Linux 系统的内存转储中提取系统日志。 这使您无需生成配置文件即可分析系统。 它不能替代 Rekall 和 Volatility 等使用配置文件进行更结构化内存分析的工具。 Rip Raw 通过获取原始二进制文件（如内存转储）并使用以下方式提取文件和日志： 文本/二进制边界 文件头部和文件幻数 日志条目 然后将其放入 zip 文件中，供其他工具（如 Cado Response 或 SIEM（如 Splunk））进行二次处理（示例如下）。 ...

Rockwell Automation ControlLogix Ethernet Modules Insecure Default Initialization of Resource (CVE-2025-7353)

The affected ControlLogix Ethernet modules ship with a web-based debugger WDB agent enabled by default. A remote attacker who can reach the module using a specific IP address can connect to the WDB agent and perform memory dumps, modify memory, and control the execution flow of the module. This...

Security Bulletin: Security Vulnerability in the IBM Java Runtime Environment (JRE) affect the 3592 Enterprise Tape Controller

Summary Vulnerabilities in in the IBM Java Runtime Environment JRE , affect the 3592 Enterprise Tape Controller. These vulnerabilities were disclosed in the Java Critical Patch Updates for July and October 2015 Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An unspecified vulnerability a...

hdd-toolkit

HDD Firmware Toolkit A comprehensive Python toolkit for dumpi...

CVE-2026-33448

CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modified server can force the client to dump the contents of a small portion of memory to the log files potentially revealing secrets...

CVE-2026-33448

CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modified server can force the client to dump the contents of a small portion of memory to the log files potentially revealing secrets...

CVE-2026-33448 Format string vulnerability in MacOS clients prior to 14.50

CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modified server can force the client to dump the contents of a small portion of memory to the log files potentially revealing secrets...

CVE-2026-24319

In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could potentially lead to unauthorized operations within the B1 environment, including modification of company data. This issue results in a high...

CVE-2026-24319

In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could potentially lead to unauthorized operations within the B1 environment, including modification of company data. This issue results in a high...

SAP Business One 安全漏洞

SAP Business One is a business management software developed by the German company SAP. This software includes functions such as financial management, operational management, and human resource management. There is a security vulnerability in SAP Business One, which stems from sensitive informati...

PT-2026-7218

In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could potentially lead to unauthorized operations within the B1 environment, including modification of company data. This issue results in a high...

Vulnerability fixed in Microsoft SQL Server

Microsoft has fixed a vulnerability in SQL Server A malicious party can exploit the vulnerability to gain unauthorized access to DEBUG functionality and thereby generate, among other things, memory dumps. These dumps can also involve memory outside the scope of SQL Server, allowing the malicious...

CVE-2025-66910

Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login,...

PT-2025-52456

Name of the Vulnerable Software and Affected Versions Turms Server versions prior to 0.10.0-SNAPSHOT Description The software stores administrator passwords in plaintext within memory, specifically in the rawPassword field of AdminInfo objects, to improve authentication speed. This bypasses the...

EUVD-2025-204537

Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login,...