296 matches found
msidump
msidump MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner. On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we...
TuxResponse
TuxResponse v1.1 Linux Incident Response TuxResponse is incident response script for linux systems written in bash. It can automate incident response activities on Linux systems and enable you to triage systems quickly, while not compromising with the results. Usually corporate systems would have...
MongoBleed-DFIR-Triage-Script-CVE-2025-14847
Eric Capuano1 posted an excellent blog regarding MongoBleed CVE-2025-14847 and indicators to look out for. PoC by Joe Desimone2 shows exactly how the memory leak exploit works and Kevin Beaumont3 has an excellent write-up on the vulnerability see reference section for links. MongoBleed Triage...
AFLTriage
AFLTriage AFLTriage is a tool to triage crashing input files using a debugger. It is designed to be portable and not require any run-time dependencies, besides libc and an external debugger. It supports triaging crashes generated by any program, not just AFL, but recognizes AFL directories...
RPC-Triage
RPC-Triage Static vs dynamic, read this first. It is worth being clear about the line between dynamic and static analysis up front: this tool does its ranking purely through static analysis. It reads the compiled MIDL / NDR structures straight out of the binary and never executes anything. Static...
gaia
Gaia - Attack Surface Discovery & AI-Assisted Triage Gaia is a CLI-first attack surface analysis tool that discovers endpoints and parameters, reduces noise, and highlights security-relevant risks using static heuristics and optional AI reasoning. It orchestrates Katana, gau, arjun, linkfinder, a...
BurpIA
BurpIA BurpIA turns Burp Suite into an AI-assisted web security testing environment. It analyzes real HTTP traffic with LLMs 12+ providers or local models, validates findings with autonomous CLI agents over Burp MCP, and keeps every result traceable — works on Burp Suite Community and Professiona...
CVE-2026-23918-Passive-Audit
CVE-2026-23918 audit script alternatively you could just curl the headers and take a peek, but here comes the: Non-invasive HTTP metadata auditor for Apache HTTP Server CVE-2026-23918 https://www.openwall.com/lists/oss-security/2026/05/04/19 exposure triage. The tool sends ordinary HTTP HEAD/GET...
cve-2026-31431-check
cve-2026-31431-check cve-2026-31431-check is a small Bash triage script for checking local Linux exposure and mitigation indicators for CVE-2026-31431, also known as "Copy Fail." The script targets Debian, Ubuntu, and Debian-family derivatives including Linux Mint, Pop!OS, and similar...
Kage-DFIR-toolkit
--- Point Kage at a suspect Windows host and it runs the whole triage in one chain: CyLR collects the artefacts, Hayabusa correlates the event logs against Sigma, THOR Lite scans for YARA matches, VirusTotal and AbuseIPDB qualify the indicators, and the AI provider of your choice drafts the...
PETriage
PETriage A fast, cross-platform PE Portable Executable surface analysis tool for malware triage, written in Rust. Designed for analysts who need practical PE triage on Linux, macOS, and Windows without relying on a Windows-only workflow. Formerly readpe renamed to avoid naming collisions with...
SuperMem
Overview A python script developed to process Windows memory images based on triage type. Requirements Python3 Bulk Extractor Volatility2 with Community Plugins Volatility3 Plaso Yara How to Use Quick Triage python3 winSuperMem.py -f memdump.mem -o output/ -tt 1 Full Triage python3 winSuperMem.py...
tanuki
Tanuki Linux Active Directory triage for AI coding agents. Protocol-first, zero noise. Quick Start • Dual-Engine Architecture • Live Lab Validation • Demo Video • Decision Ladder • Before & After • Tooling & Usage • Agent Setup • Lineage & Credits Quick Start 1-Line Universal Install Tanuki is 10...
C0deVari4nt
C0deVari4nt Description C0deVari4nt is a variant analysis and visualisation tool that inspects codebases for similar vulnerabilities. It leverages CodeQL, a semantic code analysis engine, to query code based on user-controlled CodeQL query templates and passes the results to our client interface...
KapeFiles
KAPE Files Community-created Targets and Modules for use with KAPE Download KAPE · Report a Bug · Request Feature KapeFiles KAPE Overview KAPE is an efficient and highly configurable triage program that will target essentially any device or storage location, find forensically useful artifacts, an...
ubuntils
ubuntils Forensic triage for live Ubuntu systems — automated artifact collection, persistence detection, and guided remediation in about a minute. The Problem When you suspect a Linux system is compromised, the first 30-40 minutes are usually spent running the same ten commands in sequence: check...
memOptix
memOptix This Jupyter notebook was created to assist DFIR professionals with triaging Windows memory dumps. Please note that this notebook was created based on the output generated from CrowdStrike's Supermem python script https://github.com/CrowdStrike/SuperMem. SuperMem triage mode 2 or 3 shoul...
binviz
binviz Binary visualiser & triage tool: linked interactive views entropy, histograms, image/dot-plot surfaces, control-flow graphs over a single shared address-space model. pipx install binviz && binviz serve What it does Open a file and every view is looking at the same address space. Select a...
mac-monitor
🎉 Welcome to "Mac Monitor's" official new home! Mac Monitor is an advanced, stand-alone system monitoring tool tailor-made for macOS security research, malware triage, and system troubleshooting. Leveraging Apple's Endpoint Security ES and System Extension APIs, it collects and enriches system...