osxcollector

OSXCollector Manual OSXCollector is a forensic evidence collection & analysis toolkit for OSX. Forensic Collection The collection script runs on a potentially infected machine and outputs a JSON file that describes the target machine. OSXCollector gathers information from plists, SQLite databases...

ai-reverse-engineering

Rev·Deck — AI-Assisted Reverse Engineering with Ghidra Rev·Deck is a local, single-user static-analysis workstation. It pairs an evidence-first web UI with an LLM copilot over a binary analyzed by a headless Ghidra service: browse deterministic evidence functions, strings, imports,...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

nebula

Nebula Cybersecurity harness built around the operator Acknowledgement First, I would like to thank Almighty God, who is the source of all knowledge. Without Him, this would not be possible. Use Nebula only on systems and networks you own or are explicitly authorized to test. Key features One...

CVE-2020-5902

CVE-2020-5902 Exploit for CVE-2020-5902 POC bash version...

IPED

IPED Digital Forensic Tool IPED is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners. History IPED - Digital Evidence Processor and Indexer translated from Portugue...

numasec

numasec The open source AI security agent. Give your terminal a security brain. Run security workflows with your local tools, agents, runbooks, findings, evidence, replay and reports. npm install -g numasec Demo | Why | What it feels like | Try it | What it does | Commands | Architecture | Roadma...

CVE-2025-27520-PoC

CVE-2025-27520 — Safe Educational Simulation / PoC Demo Stand ⚠️ Important: This is a safe educational simulation of the CVE-2025-27520 vulnerability. The project includes a simulation service Flask and a safe PoC scanner Python. On receiving a test marker, the simulation creates an evidence file...

awesome-incident-response

Awesome Incident Response A curated list of tools and resources for security incident response, aimed to help security analysts and DFIR teams. Digital Forensics and Incident Response DFIR teams are groups of people in an organization responsible for managing the response to a security incident,...

amcache-evilhunter

AmCache-EvilHunter AmCache-EvilHunter is a command-line tool to parse and analyze Windows Amcache.hve registry hives, identify evidence of execution, suspicious executables, and integrate VirusTotal/OpenTIP lookups for enhanced threat intelligence...

autonomous-offensive-llm-handbook

📖 Read the handbook online : follow the lessons from your first fixture run to an agent with clear limits. The model proposes, the code disposes AUTONOMOUS SECURITY / THE BUILDER'S FIELD MANUAL Read the website · Start the course · Run the lab · Connect your model · The build sequence A practical...

EuConform

EuConform 🇪🇺 Open-Source Evidence Toolkit For AI Compliance Open evidence format • Local bias evaluation • Schema validation • CycloneDX interoperability Offline-first • Privacy-preserving • Reusable artifacts • WCAG 2.2 AA accessible EuConform defines an open evidence format for AI compliance and...

IAGA-Sentinel

IAGA Sentinel The EU AI Act conformity evidence layer for AI agents. Cryptographically signed, replay-verifiable evidence of every action an agent routes through it, structured to support AI Act Article 12 record-keeping and Annex IV documentation. Documentation · Setup in one prompt · Quickstart...

badBANANA-threat-observatory

badBANANA // THREAT OBSERVATORY Inspect exploited vulnerabilities and threat indicators, check their source evidence, and review retained changes. Open the live Observatory · Try the KEV walkthrough · Source coverage · Run it yourself The Observatory brings CISA KEV, ThreatFox, URLhaus, and...

skill-scanner

Skill Scanner A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. It combines pattern-based detection YAML + YARA-X, AST and dataflow analysis , an optional LLM-as-a-judge , and a bounded CEL decision layer over typed...

agent-bom

Find vulnerable software behind your AI agents—and trace the exposure evidence. Open security scanner and self-hosted control plane for AI, MCP, and cloud infrastructure. For AppSec and platform engineers responsible for AI agents and MCP servers: scan a repository, correlate its findings with...

An-Integrated-Wireless-Network-Forensic-Analysis-Framework

An-Integrated-Wireless-Network-Forensic-Analysis-Framework This framework combines a set of existing open source tools into an integrated package that automates the forensics investigation process. It is able to capture wireless network traffic, to analyze the captured traffic according to the...

ForensicMiner

ForensicMiner v1.4 "ForensicMiner, Redefine DFIR Automations" Created & Maintained by: Eilay Yosfan What is ForensicMiner ? ForensicMiner, a PowerShell-based DFIR automation tool, revolutionizes the field of digital investigations. Designed for efficiency, it automates artifact and evidence...

dpapi-toolkit

DPAPI-toolkit An offline toolkit for Windows DPAPI evidence. You collect the files, point the tool at an artifact, and it recognizes the format and tells you exactly which master key it needs; you supply the key material and it decrypts. Most DPAPI tooling is one script per format, or a feature...

RXScan

RXScan Reconnaissance & Evidence Engine Bounded reconnaissance and evidence correlation in Rust. RXScan combines network reconnaissance, public-source search, investigation, and evidence correlation in one CLI. It can discover hosts and ports, identify observed services, collect bounded protocol...