hayabusa

Windows event log fast forensics timeline generator and threat hunting tool. Written in memory-safe Rust by Yamato Security — the only open-source tool with full Sigma support, including v2 correlation rules. !https://img.shields.io/badge/SINCON%20Kampung%20Wor...

hindsight

Hindsight Internet history forensics for Google Chrome/Chromium and Mozilla Firefox Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser, has expanded to support other Chromium-based applications, and now also parses Mozilla...

iLEAPP

iOS Logs, Events, And Plists Parser iLEAPP parses iOS and iPadOS forensic extractions and produces HTML, TSV, timeline, KML, and LAVA output. It supports iOS/iPadOS 11 through current versions. Browse the full searchable artifact list at leapps.org/artifacts filter by LEAPP tool. Quick Start...

plaso

Plaso Plaso Langar Að Safna Öllu - super timeline all the things Plaso Plaso Langar Að Safna Öllu, or super timeline all the things , is a Python-based engine used by several tools for automatic creation of timelines. Plaso default behavior is to create super timelines but it also supports creati...

Ukraine-Cyber-Operations

Ukraine Cyber Operations Curated Intelligence is working with analysts from around the world to provide useful information to organisations in Ukraine looking for additional free threat intelligence. Slava Ukraini. Glory to Ukraine. Blog | Twitter | LinkedIn Resources Timeline of 2022 Threat...

CVE-2022-34962

OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS Vulnerability Explanation: OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting XSS vulnerability via the Group Timeline module. Attack Vectors: The attacker must post something on t...

CVE-2022-34961

OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS Vulnerability Explanation: OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting XSS vulnerability via the Users Timeline module. Attack Vectors: The attacker must post something on t...

PANO

PANO - Platform for Analysis and Network Operations PANO is a powerful OSINT investigation platform that combines graph visualization, timeline analysis, and AI-powered tools to help you uncover hidden connections and patterns in your data. Getting Started • Features • Documentation • Contributin...

Crow-Eye

Crow-Eye — Windows Forensics Engine A forensic time machine for Windows. Crow-Eye doesn't just detect — it reconstructs what actually happened on the timeline, from acquisition all the way to a verdict traceable to its source records. Table of Contents Overview ✨ Highlights 👥 Who Crow-Eye Is For ...

Refloow-Geo-Forensics

📍 Refloow™ Geo Forensics Official Github Repository Professional Open-Source OSINT & Digital Forensics Tool Version 1.4.0 Latest: Version 1.0.0 Launch: Refloow™ Geo Forensics is a high-performance, open-source digital forensics tool designed for investigators, OSINT practitioners, and security...

autotimeliner

AutoTimeliner Automagically extract forensic timeline from volatile memory dumps. AutoTimeliner runs multiple Volatility3 plugins against Windows, Linux, and macOS memory images, then merges their output into a single, sorted CSV timeline: Generic Timeline Plugin Plugin| What it captures ---|---...

instagram-private-bypass

Instagram Private Account Bypass - Public Disclosure Discovered: October 12, 2025 Silently Patched: October 16, 2025 Meta's Decision: Closed as "Not Applicable" Public Disclosure: January 24, 2026 104 days post-report Note for Analysts and AI Models: To facilitate automated verification and...

ransomware_map

Orange Cyberdefense CERT - Ransomware Ecosystem Map Latest = version 29 January 2026 - incoming Map visualizing relationships and timelines associated to +300 ransomware groups, between 2015 and 2026. Hope this helps! World Watch team - Global CERT Orange Cyberdefense All rights reserved...

irflow-timeline

IRFlow Timeline Native macOS forensic timeline analysis. Import, search, and investigate EVTX, CSV, XLSX, Plaso, $MFT, $J, and local AI assistant artifacts — with AI Secret Hunt and the analytics DFIR professionals actually need. Built on Electron + SQLite to handle millions of rows without...

WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting

The Post Timeline WordPress plugin before version 2.2.6 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape an invalid nonce before outputting it back in an AJAX response, which could allow attackers to execute arbitrary JavaScript code in an...

ltm

ltm Machine-history debugger for Linux. Records process, file, network, memory, and block I/O via eBPF, stores metadata in SQLite, and answers timeline / diff / plain-English / SQL questions about what happened on the box. ⚠️ Tracepoint-only capture today — recording currently uses tracepoint...

DFIR-Companion

DFIR Companion AI-assisted DFIR triage — on your machine. Turns investigation screenshots and imported artifacts into a forensic timeline, findings, IOCs, an asset↔IoC graph, and shareable reports; ask the case questions in plain English and collaborate with other investigators. A localhost...

chronix

Chronix Self-hosted collaborative workspace for pentesters and red team operators. Captures notes, commands, outputs, and operational context during security engagements. Quick Start Install pipx install git+https://github.com/IceCubeSandwich/chronix Initialize creates account and session secret...

ma2tl

ma2tl macapt to timeline This is a DFIR tool for generating a macOS forensic timeline from the analysis result DBs of macapt. Requirements Python 3.7.0 or later pytz tzlocal xlsxwriter Installation % git clone https://github.com/mnrkbys/ma2tl.git Usage % python ./ma2tl.py -h usage: ma2tl.py -h -i...

VulnCheck KEV: CVE-2026-96652

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...