CobaltStrikeParser

CobaltStrikeParser Python parser for CobaltStrike Beacon's configuration Description Use parsebeaconconfig.py for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode default true. Many stageless beacons are PEs where the beacon code itself is stored in the .data section...

BSOD_bitlocker_recover

BitLocker VMK Carving Tool This Python script helps you extract potential BitLocker Volume Master Keys VMKs from memory dump files, such as those generated by a Blue Screen of Death BSOD. It's a command-line utility designed to assist in forensic investigations where BitLocker encryption is...

VolExp

VolExp Volatility Explorer This program allows the user to access a Memory Dump. It can also function as a plugin to the Volatility Framework https://github.com/volatilityfoundation/volatility. This program functions similarly to Process Explorer/Hacker, but additionally it allows the user access...

WSASS

WSASS This is a tool that uses the old WerfaultSecure.exe program to dump the memory of processes protected by PPL Protected Process Light, such as LSASS.EXE. The output is in Windows MINIDUMP format. This tool automatically replaces the"MDMP" magic header with a PNG magic header. After the dump ...

autotimeliner

AutoTimeliner Automagically extract forensic timeline from volatile memory dumps. AutoTimeliner runs multiple Volatility3 plugins against Windows, Linux, and macOS memory images, then merges their output into a single, sorted CSV timeline: Generic Timeline Plugin Plugin| What it captures ---|---...

blindsight

blindsight "There's no such things as survival of the fittest. Survival of the most adequate, maybe. It doesn't matter whether a solution's optimal. All that matters is whether it beats the alternative." -- Peter Watts, Blindsight 2006 Red teaming tool to dump LSASS memory, bypassing basic...

gentlemen-decryptor

The Gentlemen Ransomware Decryptor The first publicly available decryption method for The Gentlemen ransomware. The Gentlemen also known as hastalamuerte is currently the most active ransomware-as-a-service RaaS operation globally, with 320+ confirmed victims as of Q1 2026. Until now, every major...

CVE-2023-30367-mRemoteNG-password-dumper

mRemoteNG = v1.77.3.1784-NB Password Dumper CVE-2023-30367 Multi-Remote Next Generation Connection Manager mRemoteNG is free software that enables users to store and manage multi-protocol connection configurations to remotely connect to systems. mRemoteNG configuration files can be stored in an...

interrogate

Interrogate Interrogate is a proof-of-concept tool for identification of cryptographic keys in binary material regardless of target operating system, first and foremost for memory dump analysis and forensic usage. Able to identify AES, Serpent, Twofish and DER-encoded RSA keys as of version 0.0.4...

CVE-2023-32784

keepass-dump-masterkey Usage python3 poc.py Preview As a reminder, the first character cannot be found in the dump, and for the second the script will only give you a few possibilities, in any case we recommend you to run the bruteforce on 2 chars with the script below root@kitploit: !/bin/sh...

radare2-scripts

radare2 Scripts Summary A 'collection' of scripts to be used with radare2. r2bincarver.py - A script used to carve files from memory dumps. r2hashfuncdecoder.py - A script used to decode hashed functions, commonly found in shellcode. Scripts Binary Carver This script will carve files from memory...

PPLBlade

PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3...

KeePass-dump-py

KeePass-dump-py My attempt to re-write the original KeePass 2.X Master Password Dumper CVE-2023-32784 POC in python. Please head over to Original POC for more details about the vulnerability and exploitation process. What this script does: 1. Checks if KeePass process is running, otherwise it...

Netgrave

Netgrave A tool for retrieving login credentials from Netwave IP cameras using a memory dump vulnerability CVE-2018-17240. This project was inspired by expcamera and offers performance and efficiency improvements. This tool works for all platforms as it does not use any Linux CLI tools through...

kdmp-parser

kdmp-parser This C++ library parses Windows kernel full dumps .dump /f in WinDbg, BMP dumps .dump /ka in WinDbg as well as more recent dump types that were introduced in 2022. The library supports loading 64-bit dumps and provides read access to things like: The context record, The exception...

Memory-analysis

Memory-analysis Contains tools to perform malware and forensic analysis in Memory. Plugins: Dyrescan.py - parses Dyreconfig in memory. Rat9002.py - parses 9002 rat config in memory. plugx.py - parses plugx config in memory modified to also parse config size: 0x170c. ghostrat.py - parses ghostrat...

keepass_dump

Keepass-Dumper This is my PoC implementation for CVE-2023-32784 My version is a python port of @vdohney's PoC along with a few changes and additional features. Changes One change, was to use known strings that can be found within the dump file in order to more accurately jump to the location of t...

IRTriage

Incident Response Triage: Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael'...

CVE-2024-33901-ProofOfConcept

CVE-2024-33901-ProofOfConcept Short program that demonstrates the vulnerability CVE-2024-33901 in KeePassXC version 2.7.7 The report for the class might need the source code linked, so that's why I created the repo for this How to replicate the vulnerability 1. Open KeePassXC and authenticate the...

mimipenguin

MimiPenguin 2.0 Una herramienta para extraer la contraseña de inicio de sesión del usuario actual de escritorio Linux. Adaptada de la idea detrás de la popular herramienta de Windows mimikatz. Se le asignó CVE-2018-20781 https://vulners.com/cve/CVE-2018-20781. Dato curioso: aún no se ha corregido...