OSXAuditor

OS X Auditor OS X Auditor is a free Mac OS X computer forensics tool. OS X Auditor parses and hashes the following artifacts on the running system or a copy of a system you want to analyze: the kernel extensions the system agents and daemons the third party's agents and daemons the old and...

whids

IMPORTANT: this README and other documentation is not updated to reflect the changes made to latest beta releases as a lot of changes happened. All this will be updated in time when a stable version will be released see Roadmap until next release. Feel free to run beta releases on your own and as...

cve-2021-34527

CVE-2021-34527 CVE-2021-34527 LPE exploit using AddPrinterDriverEx - this is a weaponized version of the LPE that can be used to escalate a DLL to SYSTEM and will also clean up artifacts. The LPE impacts Windows Desktop 7,8,8.1,10,11 & Server 2008,2012,2016,2019. This visual studio project will...

CVE-2024-24590-ClearML-RCE-CMD-POC

ClearML Exploit Script This repository contains a Python exploit script for CVE-2024-24590 The script is designed to upload a malicious pickle file to ClearML, which executes a reverse shell or a custom command. Features Uploads a malicious pickle artifact to ClearML. Executes a reverse shell or ...

MrKaplan

Mr.Kaplan Description MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution. It works by saving information such as the time it ran, snapshot of files and associate each evidence to the related user. This tool is inspired by MoonWalk, a similar tool for Uni...

CVE-2024-24590-ClearML-RCE-Exploit

CVE-2024-24590 — ClearML Pickle Artifact RCE Overview...

persisthunt

Linux Persistence Detection, Hunting and Artifact Collection Summary Usage Example Detections Table of Techniques Summary persisthunt.sh helps speed up investigations by collecting targeted persistence-related artifacts and highlighting suspicious patterns commonly associated with Linux persisten...

watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882

watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882 Detection Artifact Generator for Oracle E-Business Suite CVE-2025-61882 See our blog post for technical details Detection in Action root@kitploit: python3 watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882.py --command 'bash -i &...

watchTowr-vs-Fortiweb-AuthBypass

watchTowr-vs-Fortiweb-AuthBypass Generador de Artefactos de Detección para la Omisión de Autenticación de FortiWeb Consulta nuestra publicación del blog para obtener detalles técnicos Detección en Acción root@kitploit: python watchTowr-vs-Fortiweb-AuthBypass.py 192.168.1.99 / | | |\ \ \ / / \ \ /...

sh4d0wup

sh4d0wup root@kitploit: % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low...

Fastir_Collector

FastIR Collector We changed our approach to live forensics acquisition, which means FastIR Collector is no longer maintained. We recommend using our newFastIR Artifacts collector instead Concepts This tool collects different artefacts on live Windows and records the results in csv or json files...

omnibus

OSINT Omnibus Developed & maintained by InQuest Table of Contents OSINT Omnibus Omnibus Documentation Vocabulary Running Omnibus API Keys Interactive Console Artifacts Overview Creating & Managing Artifacts Sessions Modules Machines Reporting Monitoring Modules OSINT Omnibus Developed & maintaine...

Veritensor

🛡️ Veritensor: AI Data & Artifact Security...

CVE-2024-24590

ClearML Exploit This repository contains a proof-of-concept exploit for a deserialization vulnerability in ClearML, allowing for remote command execution. This exploit demonstrates how to upload a malicious pickle artifact to ClearML to gain a reverse shell. Prerequisites Before you begin, ensure...

ForensicMiner

ForensicMiner v1.4 "ForensicMiner, Redefine DFIR Automations" Created & Maintained by: Eilay Yosfan What is ForensicMiner ? ForensicMiner, a PowerShell-based DFIR automation tool, revolutionizes the field of digital investigations. Designed for efficiency, it automates artifact and evidence...

Fennec

Fennec 🦊 fennec is an artifact collection tool written in Rust to be used during incident response on nix based systems. fennec allows you to write a configuration file that contains how to collect artifacts. Features 🌟 🦀 A single statically compiled binary 🔬 Execute any osquery SQL query 💻 Execu...

CVE-2024-24590

CVE-2024-24590 Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with. Usage 1. paste the credentials given and run...

bfac

BFAC Pruebas avanzadas de artefactos de archivos de respaldo para aplicaciones web BFAC Backup File Artifacts Checker es una herramienta automatizada que verifica artefactos de respaldo que pueden revelar el código fuente de la aplicación web. Los artefactos también pueden provocar la filtración ...

forensic-timeliner

Un motor de procesamiento forense de alta velocidad diseñado para investigadores de DFIR. Consolide rápidamente la salida CSV de las mejores herramientas de triaje en una mini línea de tiempo unificada con filtrado integrado, detección de artefactos, filtrado por fechas, etiquetado de palabras...

LEAF

Linux Evidence Acquisition Framework LEAF Author: Alexandra Cartwright April, 2022 Description Linux Evidence Acquisition Framework LEAF acquires artifacts and evidence from Linux EXT4 systems, accepting user input to customize the functionality of the tool for easier scalability. Offering severa...