BSOD_bitlocker_recover

BitLocker VMK Carving Tool This Python script helps you extract potential BitLocker Volume Master Keys VMKs from memory dump files, such as those generated by a Blue Screen of Death BSOD. It's a command-line utility designed to assist in forensic investigations where BitLocker encryption is...

autotimeliner

AutoTimeliner Automagically extract forensic timeline from volatile memory dumps. AutoTimeliner runs multiple Volatility3 plugins against Windows, Linux, and macOS memory images, then merges their output into a single, sorted CSV timeline: Generic Timeline Plugin Plugin| What it captures ---|---...

fitness-app

Fitbit Open Source Android App This app is based on the work of Jiska Classen, Matthias Hanreich, Steffen Kreis, Tobias Krichel, Johannes Riedel and Sven Ströher. Features Scan for BLE Fitbit devices Authenticate against Fitbit server like the original app Obtain authentication credentials from t...

VolExp

VolExp Volatility Explorer This program allows the user to access a Memory Dump. It can also function as a plugin to the Volatility Framework https://github.com/volatilityfoundation/volatility. This program functions similarly to Process Explorer/Hacker, but additionally it allows the user access...

CobaltStrikeParser

CobaltStrikeParser Python parser for CobaltStrike Beacon's configuration Description Use parsebeaconconfig.py for stageless beacons, memory dumps or C2 urls with metasploit compatibility mode default true. Many stageless beacons are PEs where the beacon code itself is stored in the .data section...

HandleKatz

HandleKatz This tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same. It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of t...

DuplicateDump

DuplicateDump DuplicateDump is a fork of MirrorDump with following modifications: DInovke implementation LSA plugin DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly which would not be unloaded by LSASS process. That's why MirrorDump...

KeePwn

A python script to help red teamers discover KeePass instances and extract secrets. Features KeePass Discovery Look for KeePass installation files through SMB C$ share. Accept multiple target sources IP, CIDR, hostname, file. Check for KeePass metadata version, last access time. Check for running...

sshkey-grab

sshkey-grab This script uses a bug in ssh-agent that allows it to pull the last key added to the agent. This may allow the ability to recover a key that has been removed from ssh-agent via ssh-add -t, -d, or -D, provided that the ssh-agent was not terminated and a new key has not been added since...

lmg

Linux Memory Grabber A script for dumping Linux memory and creating VolatilityTM profiles. Hal Pomeranz [email protected], 2020-02-01 THANKS! "If I have seen further it is by standing on the shoulders of giants." Issac Newton There are a lot of people who deserve thanks for making this simpl...

SharpSphere

SharpSphere - Attacking vSphere Infrastructure Credit @jkcoote & @grzryc Full walk-through and examples available here. Version History 1.0 - Initial Release 2.0 - Added supported for pass-through authentication using SSPI. 2.1 - Added support for Linux target VMs with --linux, and added a...

IRTriage

Incident Response Triage: Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael'...

PPLBlade

PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk. Key functionalities : 1. Bypassing PPL protection 2. Obfuscating memory dump files to evade Defender signature-based detection mechanisms 3...

linux_screenshot_xwindows

Intro The goal of this volatility plugin is to extract a screenshot of all open X windows from a memory dump. Previous work The volatility plugin linuxxwindows realised by Adam Bridge https://github.com/bridgeythegeek/linuxxwindows extracts various metadata from the window objects registered to X...

gentlemen-decryptor

The Gentlemen Ransomware Decryptor The first publicly available decryption method for The Gentlemen ransomware. The Gentlemen also known as hastalamuerte is currently the most active ransomware-as-a-service RaaS operation globally, with 320+ confirmed victims as of Q1 2026. Until now, every major...

CVE-2023-32784-keepass-linux

KeePass 2.53/cmdline files and store the pid of ones with the keyword KeePass in their commandline argument. It'll then acquire the adresses of memory maps in /proc//maps that aren't directly associated with a library, meaning they have an empty file path. It'll then store the memory of all those...

keepass-exfil-forensics

KeePass Memory Exfiltration — Network Forensics Investigation Recovers exfiltrated data from PCAP traffic by reversing a hex → Base64 → XOR obfuscation chain used in a real DFIR CTF scenario TryHackMe, then exploits CVE-2023-32784 to recover a KeePass master password straight from a process memor...

keepass-password-dumper

KeePass 2.X Master Password Dumper CVE-2023-32784 Update The vulnerability was assigned CVE-2023-32784 and fixed in KeePass 2.54. Thanks again to Dominik Reichl for his fast response and creative fix! Clarification: the password has to be typed on a keyboard, not copied from a clipboard see the H...

Tenda-F3-V4

Tenda F3 Router Exploit & File Downloader This project is a tool for downloading various files from the Tenda F3 router v3/v4 through an unauthenticated vulnerability CVE-2020-35391. It allows you to get the configuration file, system log, and flash dump from a vulnerable router. Overview The...

DeadMatter

DeadMatter DeadMatter is a specialized tool written in C, designed to extract sensitive information, such as password hashes of active logon sessions, from memory dumps. It employs carving techniques to retrieve credentials from various file types, such as process or full memory dumps, either in...