aes-finder

AES Finder Utility to find AES keys in running process memory. Works for 128, 192 and 256-bit keys. Usage Open aes-finder.sln solution in Visual Studio 2013 to compile source. Alternatively use gcc/clang: root@kitploit: g++ -O3 -march=native -fomit-frame-pointer aes-finder.cpp -o aes-finder To...

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. id: CVE-2015-2080 info: name: Eclipse Jetty 9.2.9.v20150224 - Sensitive Information Leakage author: pikpikcu severity: high description: Eclip...

KeePass-dump-py

KeePass-dump-py My attempt to re-write the original KeePass 2.X Master Password Dumper CVE-2023-32784 POC in python. Please head over to Original POC for more details about the vulnerability and exploitation process. What this script does: 1. Checks if KeePass process is running, otherwise it...

Hawk

Hawk Silently intercept SSH and SU credentials in real-time Hawk monitors sshd and su processes, extracting passwords from memory via ptrace without modifying target processes. Zero writes. Pure read-only credential harvesting. Demo How It Works Hawk leverages Linux's /proc filesystem to discover...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 आवश्यक -m |region|referenced|ioc -p |PID वैकल्पिक -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

Loki-RS

Loki-RS A rewrite of Loki in Rust. High-performance, multi-threaded YARA & IOC scanner in a single binary. Status : Beta. Works, but still under active development. Features YARA scanning of files and process memory yara-x IOC matching MD5/SHA1/SHA256 hashes, filename patterns, C2 indicators...

CobaltStrikeScan

CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Windows process memory for evidence of DLL injection classic or reflective injection and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4...

python-haystack

python-haystack memory forensics |travis| |coverage| |landscape| |pypi| |docs| Quick Start: Quick usage guide in the docs/ folder. Haystack-reverse CLI in the docs/ folder. More documentation Introduction: python-haystack is an heap analysis framework, focused on searching and reversing of C...

proctools

proctools Small toolkit for extracting information and dumping sensitive strings from Windows processes . Made to accompany FormThief. procsearch - find sensitive strings in target process memory searches for parsed string in readable process memory, if found, displays a range of valid ASCII char...

ATMMalScan

Introduction ATMMalScan is a commandline tool for Windows operating systems version 7 and higher, which helps to search for malware traces on an ATM during the DFIR process. This tool examines the running processes of a system, as well as the hard disk, depending on the specified file path. To sc...

ShellCodeEmulator

Windows shellcode emulation tool based upon unicorn framework. ShellcodeEmulator emulates Windows shellcode with the help of windbg process memory dumps. You can provide shellcode to analyze with any Windows process dump image. The tool will emulate as much as of the userland code using the...

aes-finder

AES खोजक चल रही प्रक्रिया मेमोरी में AES कुंजियाँ खोजने की उपयोगिता। 128, 192 और 256-बिट कुंजियों के लिए काम करता है। उपयोग स्रोत को संकलित करने के लिए Visual Studio 2013 में aes-finder.sln समाधान खोलें। वैकल्पिक रूप से gcc/clang का उपयोग करें: root@kitploit: g++ -O3 -march=native...

AzTokenFinder

AzTokenFinder Is a small tool to extract JWT or JWT like looking data from different processes, like PowerShell, Excel, Word or others. The idea was inspired from the blog post https://mrd0x.com/stealing-tokens-from-office-applications/ from the amazing @mrd0x. In the new release, I added the...

truffleproc

truffleproc — hunt secrets in process memory Usage Run truffleproc.sh against your current Bash shell e.g. $$: root@kitploit: $ ./truffleproc.sh $$ coredumping pid 6174 Reading symbols from od... Reading symbols from /usr/lib/systemd/systemd... Reading symbols from...

CVE-2026-53604

nebula-mesh (a self-hosted control plane for Slack Nebula mesh VPN by forgekeep ) is affected by a key-zeroization flaw in its web UI mobile-bundle path. The renderMobileBundle handler passes a decrypted *pki.CAManager containing the CA's ed25519 private key into mobilebundle.Build, which never c...

KeePass-CVE-2023-32784-Exploitation-and-Defense

KeePass मेमोरी लीक भेद्यता CVE-2023-32784: शोषण और रक्षा वास्तुकला उद्देश्य KeePass Password Safe v2.53 में CVE-2023-32784 भेद्यता का विश्लेषण करना, मेमोरी डंपिंग के माध्यम से मास्टर पासवर्ड निष्कर्षण प्रदर्शित करना, और मजबूत पहचान और शमन नियंत्रण तैयार करना। भेद्यता KeePass मास्टर पासवर्ड इनपुट ...

keepass-exfil-forensics

KeePass Memory Exfiltration — Network Forensics Investigation Recovers exfiltrated data from PCAP traffic by reversing a hex → Base64 → XOR obfuscation chain used in a real DFIR CTF scenario TryHackMe, then exploits CVE-2023-32784 to recover a KeePass master password straight from a process memor...

varc

varc Volatile Artifact Collector varc collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use when investigating a security incident. It creates a zip, which contains a number of different pieces of data to understand what is...

memscan

memscan Searches for strings, regex, credit card numbers of magnetic stripe card tracks in a process's memory space Memory/Process Scanner Written by Matt Lewis, NCC Group 2014 Updated by Tom Watson, NCC Group 2015 Thanks to Jesse Bullock for lots of great ideas Released as open source by NCC Gro...

watcher

Anti Reverse Shell Hello my name is themoon also known shalev, i created this project to help people who run servers with lower security. You can use this project to protect your computer from attackers who may try to reverse shell your computer Informations on this project You can view how this...