Hawk

Hawk Silently intercept SSH and SU credentials in real-time Hawk monitors sshd and su processes, extracting passwords from memory via ptrace without modifying target processes. Zero writes. Pure read-only credential harvesting. Demo How It Works Hawk leverages Linux's /proc filesystem to discover...

ShellCodeEmulator

Windows shellcode emulation tool based upon unicorn framework. ShellcodeEmulator emulates Windows shellcode with the help of windbg process memory dumps. You can provide shellcode to analyze with any Windows process dump image. The tool will emulate as much as of the userland code using the...

CobaltStrikeScan

CobaltStrikeScan Scan files or process memory for Cobalt Strike beacons and parse their configuration. CobaltStrikeScan scans Windows process memory for evidence of DLL injection classic or reflective injection and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4...

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. id: CVE-2015-2080 info: name: Eclipse Jetty 9.2.9.v20150224 - Sensitive Information Leakage author: pikpikcu severity: high description: Eclip...

Loki-RS

Loki-RS A rewrite of Loki in Rust. High-performance, multi-threaded YARA & IOC scanner in a single binary. Status : Beta. Works, but still under active development. Features YARA scanning of files and process memory yara-x IOC matching MD5/SHA1/SHA256 hashes, filename patterns, C2 indicators...

python-haystack

python-haystack memory forensics |travis| |coverage| |landscape| |pypi| |docs| Quick Start: Quick usage guide in the docs/ folder. Haystack-reverse CLI in the docs/ folder. More documentation Introduction: python-haystack is an heap analysis framework, focused on searching and reversing of C...

proctools

proctools Small toolkit for extracting information and dumping sensitive strings from Windows processes . Made to accompany FormThief. procsearch - find sensitive strings in target process memory searches for parsed string in readable process memory, if found, displays a range of valid ASCII char...

ATMMalScan

Introduction ATMMalScan is a commandline tool for Windows operating systems version 7 and higher, which helps to search for malware traces on an ATM during the DFIR process. This tool examines the running processes of a system, as well as the hard disk, depending on the specified file path. To sc...

aes-finder

AES Finder Utilitaire pour trouver des clés AES dans la mémoire des processus en cours d'exécution. Fonctionne pour les clés 128, 192 et 256 bits. Utilisation Ouvrez la solution aes-finder.sln dans Visual Studio 2013 pour compiler le source. Vous pouvez aussi utiliser gcc/clang : g++ -O3...

aes-finder

AES Finder Utility to find AES keys in running process memory. Works for 128, 192 and 256-bit keys. Usage Open aes-finder.sln solution in Visual Studio 2013 to compile source. Alternatively use gcc/clang: g++ -O3 -march=native -fomit-frame-pointer aes-finder.cpp -o aes-finder To search for keys i...

Exploit for CVE-2026-13043

🕷️ CVE-2026-13043 - Panda / WatchGuard Kernel Memory Access...

Filedumper

FileDumper - Memory Forensic Dumper FileDumper v1.0.1 A simple, powerful tool to dump files directly from process memory regions. Created in a late-night collaboration between human ingenuity and AI creativity — xAI's Grok + Kadir Isbirligi 2026 "Bir gece sohbet ettik, kod yazdık, masaya yumruk...

CVE-2025-65320

CVE-2025-65320 CVE-2025-65320: Cleartext Storage of Sensitive Information in Memory in Abacre Restaurant Point of Sale POS. All versions of Abacre Restaurant Point of Sale POS up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid...

CVE-2026-46571

In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfsfixfilename in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file...

CVE-2026-46571

In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfsfixfilename in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIS -m |region|referenced|ioc -p |PID OPTIONNEL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m La...

CVE-2026-77050 Potential denial-of-service vulnerability in get_supported_language_variant()

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.translation.getsupportedlanguagevariant is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory...

CVE-2023-32784-kdbxpassdmp

keepassdumper.py Python-порт vdohney/keepass-password-dumper CVE-2023-32784 — вся заслуга за оригинальную C-реализацию и лежащую в основе технику принадлежит vdohney. Скрипт сканирует дамп памяти процесса на предмет остаточных строк рендеринга, которые SecureTextBoxEx из KeePass 2.x оставляет пос...

KeePass-dump-py

KeePass-dump-py My attempt to re-write the original KeePass 2.X Master Password Dumper CVE-2023-32784 POC in python. Please head over to Original POC for more details about the vulnerability and exploitation process. What this script does: 1. Checks if KeePass process is running, otherwise it...

keepass-exfil-forensics

KeePass Memory Exfiltration — Network Forensics Investigation Recovers exfiltrated data from PCAP traffic by reversing a hex → Base64 → XOR obfuscation chain used in a real DFIR CTF scenario TryHackMe, then exploits CVE-2023-32784 to recover a KeePass master password straight from a process memor...