watcher

Anti Reverse Shell Hello my name is themoon also known shalev, i created this project to help people who run servers with lower security. You can use this project to protect your computer from attackers who may try to reverse shell your computer Informations on this project You can view how this...

Hawk

Hawk Silently intercept SSH and SU credentials in real-time Hawk monitors sshd and su processes, extracting passwords from memory via ptrace without modifying target processes. Zero writes. Pure read-only credential harvesting. Demo How It Works Hawk leverages Linux's /proc filesystem to discover...

varc

varc Volatile Artifact Collector varc collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use when investigating a security incident. It creates a zip, which contains a number of different pieces of data to understand what is...

Loki-RS

Loki-RS A rewrite of Loki in Rust. High-performance, multi-threaded YARA & IOC scanner in a single binary. Status : Beta. Works, but still under active development. Features YARA scanning of files and process memory yara-x IOC matching MD5/SHA1/SHA256 hashes, filename patterns, C2 indicators...

ATMMalScan

Introduction ATMMalScan is a commandline tool for Windows operating systems version 7 and higher, which helps to search for malware traces on an ATM during the DFIR process. This tool examines the running processes of a system, as well as the hard disk, depending on the specified file path. To sc...

python-haystack

python-haystack memory forensics |travis| |coverage| |landscape| |pypi| |docs| Quick Start: Quick usage guide in the docs/ folder. Haystack-reverse CLI in the docs/ folder. More documentation Introduction: python-haystack is an heap analysis framework, focused on searching and reversing of C...

proctools

proctools Small toolkit for extracting information and dumping sensitive strings from Windows processes . Made to accompany FormThief. procsearch - find sensitive strings in target process memory searches for parsed string in readable process memory, if found, displays a range of valid ASCII char...

Mhyprot2DrvControl

Mhyprot2DrvControl 一个允许使用 mhyprot2 驱动程序枚举进程模块、读写进程内存以及终止进程的库。 用法 构建并运行，有关可用函数及用法，请参阅 Driver\MhyProt2.cs。 演示...

CobaltStrikeScan

CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Windows process memory for evidence of DLL injection classic or reflective injection and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4...

ShellCodeEmulator

Windows shellcode emulation tool based upon unicorn framework. ShellcodeEmulator emulates Windows shellcode with the help of windbg process memory dumps. You can provide shellcode to analyze with any Windows process dump image. The tool will emulate as much as of the userland code using the...

aes-finder

AES Finder Utility to find AES keys in running process memory. Works for 128, 192 and 256-bit keys. Usage Open aes-finder.sln solution in Visual Studio 2013 to compile source. Alternatively use gcc/clang: root@kitploit: g++ -O3 -march=native -fomit-frame-pointer aes-finder.cpp -o aes-finder To...

aes-finder

AES查找器 用于在运行进程内存中查找AES密钥的实用程序。适用于128、192和256位密钥。 用法 在Visual Studio 2013中打开aes-finder.sln解决方案以编译源码。也可以使用gcc/clang： root@kitploit: g++ -O3 -march=native -fomit-frame-pointer aes-finder.cpp -o aes-finder 要搜索ID为123的进程中的密钥，执行以下命令： root@kitploit: aes-finder.exe -123 要搜索名称包含chrome.exe的任何进程中的密钥，执行以下命令：...

KeePass-dump-py

KeePass-dump-py My attempt to re-write the original KeePass 2.X Master Password Dumper CVE-2023-32784 POC in python. Please head over to Original POC for more details about the vulnerability and exploitation process. What this script does: 1. Checks if KeePass process is running, otherwise it...

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. id: CVE-2015-2080 info: name: Eclipse Jetty 9.2.9.v20150224 - Sensitive Information Leakage author: pikpikcu severity: high description: Eclip...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 必須 -m |region|referenced|ioc -p |PID オプション -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

Filedumper

FileDumper - Memory Forensic Dumper FileDumper v1.0.1 A simple, powerful tool to dump files directly from process memory regions. Created in a late-night collaboration between human ingenuity and AI creativity — xAI's Grok + Kadir Isbirligi 2026 "Bir gece sohbet ettik, kod yazdık, masaya yumruk...

CVE-2025-65320

CVE-2025-65320 CVE-2025-65320: Cleartext Storage of Sensitive Information in Memory in Abacre Restaurant Point of Sale POS. All versions of Abacre Restaurant Point of Sale POS up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid...

TencentOS Server 4: libpcap (TSSA-2026:1013)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1013 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-84564

An uninitialized memory issue was addressed with improved memory initialization. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may result i...

CVE-2026-84596

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory...