MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Repository Index
77,353 visible repositories in the index
1–24 of 61 · Most stars
Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident response and DFIR.
- chrome
- macos
- windows
- pentest-tool
Free, open-source check for traces of mercenary spyware (Pegasus, Predator, Graphite, Candiru and more) on computers, Android phones and iPhone backups. Double-click apps for Windows, Mac and Linux, in 27 languages.
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
- pe-format
- hooking
- pe-dumper
- pe-analyzer
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
- python
- python-library
- olefile
- malware-analysis
Network Analysis Tool
Investigate malicious Windows logon by visualizing and analyzing Windows event log
- security
- dfir
- javascript
- visualization
An open-source digital image forensic toolset
- image-forensics
- image-processing
- gui
- toolkit
本程序旨在为安全应急响应人员对Linux主机排查时提供便利，实现主机侧Checklist的自动全面化检测，根据检测结果自动数据聚合，进行黑客攻击路径溯源。
- security
- security-scanning
- security-tools
- vulnerability-scanning
Inofficial Qualcomm Firehose / Sahara / Streaming / Diag Tools :)
- firehose
- sahara
- streaming
- diag
TestDisk & PhotoRec
- photorec
- disk
- testdisk
- datarecovery
The repository host gives no description.
- yellow-dots
- tracking-dots
- printer-forensic
Security sensor for realtime threat detection and protection
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
- pe-sieve
- anti-malware
- malware-analysis
- malware-detection
Super timeline all the things
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
Analyzing your wechat message history from android
:snowflake: PcapXray - A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction
TCP/IP packet demultiplexer. Download from:
- digital-forensics
- forensics
- tcp-protocol
- tcpip
detect stegano-hidden data in PNG & BMP
Collaborative Incident Response platform
- forensic
- incident-response
- csirt-tooling
- python