Forensics

CTFlearn-Writeups is a compilation of detailed solutions for various Capture The Flag challenges across multiple domains such as Cryptography, Forensics, and Web security. The tool serves as a reference for practitioners and enthusiasts looking to enhance their skills in cybersecurity challenge-solving. Notable features include categorized writeups that cover a range of problem types, providing structured insights into methodologies and techniques used in each challenge.

Awesome OSINT is a curated collection of open-source intelligence (OSINT) tools designed to facilitate various investigative processes, such as people searching, domain mapping, and breach data analysis. The repository categorizes tools based on specific use cases, including social media intelligence, geolocation, and threat intelligence, enabling users to efficiently select the appropriate resources for their OSINT needs. Notable features include frameworks that integrate multiple OSINT functions and extensive categorization for ease of navigation.

SECS (SECurity aSsistant) is a framework that transforms compatible AI coding agents into authorized security assistants, equipped to aid in various security lifecycle tasks such as reconnaissance, pentesting, and incident response. It features a governance policy, 35 curated agent skills for expert security methodologies, and a local toolchain with a practice lab, ensuring that all activities adhere to strict rules of engagement and operate within a controlled environment. Notably, the system incorporates an authorization gate to validate targets and enforce compliance, making it suitable for authorized security testing and defensive operations only.

FF-16-TUI is an interactive static analysis tool designed to identify frequently occurring local 16-bit patterns within files, aiding in the analysis of file structures and layouts. It features a text user interface that allows users to navigate through patterns efficiently while providing customizable filtering options for detailed pattern analysis. Notable functionalities include command-line usage with support for dictionary files, along with keyboard shortcuts for seamless interaction throughout various analysis panels.

FlareVM MCP is a Model Context Protocol server that facilitates remote access to a suite of over 48 Windows malware analysis tools within an isolated FlareVM environment, allowing seamless integration for AI agents and security analysts. Its notable features include remote file operations, comprehensive static and dynamic analysis capabilities, debugger integration, and a standardized interface for automatized workflows. This architecture enables enhanced malware examination while maintaining the security of the analysis environment.

Hermes Cybersecurity Lab is a comprehensive cybersecurity toolkit designed for the Hermes Agent, encompassing 2,077 skills, 131+ tools, and 28 frameworks, systematically organized across multiple repositories. Its primary use case includes security research, pentesting, forensics, and threat intelligence, with notable features like a preconfigured installation script, tool inventory awareness, and a structured methodology for tackling various phases of cybersecurity engagements. This ecosystem ensures continuous updates and knowledge accumulation, enhancing both operational efficiency and effectiveness in security practices.

Awesome OSINT Repositories is a comprehensive catalog that organizes open-source investigative tools into 12 distinct categories, each tailored to specific input types such as usernames, domains, and IP addresses. The repository features a diverse range of projects, with additional sections highlighting emerging tools and AI-agent integrations, providing users with a robust resource for enhancing their open-source intelligence capabilities. It emphasizes only publicly accessible source-code repositories, ensuring a focused selection of actionable tools for investigations.

Cyber Intelligence GPT is a specialized tool for operational security and cyber investigations, integrating OSINT, DFIR, threat intelligence, and AI security into a cohesive workflow. It enables users to collect, analyze, and report on information while providing capabilities for entity research, incident triage, and correlation of cyber threats across multiple public sources. Notable features include the ability to create collection plans, resolve contradictions, assess confidence in findings, and suggest strategic next actions based on intelligence gaps.

OSINT Skills is an open-source intelligence tool designed for automated investigations, enabling users to pivot between various data points such as emails, domains, and social accounts. Its main use case involves conducting comprehensive reconnaissance and attribution, with 28 integrated skills that utilize techniques like reverse image search and breach checks to generate detailed reports complete with sources and confidence levels. Notably, the tool allows interaction with AI agents to streamline the investigation process and provides extensive reference materials for each skill.

TraceTree is an advanced autonomous security tool designed to enhance development workflows with robust detection and protection capabilities. Its primary use case revolves around analyzing packages for malicious intent through sandbox isolation, syscall parsing, and machine learning-based anomaly detection, enabling developers to maintain security before package installations. Notable features include a multi-agent coordination server, a web dashboard for monitoring, and a behavioral receipt export for summarizing observed behaviors without compromising syscall logs.

OSWatcher is a tool designed for the preservation and analysis of historical operating system releases, allowing users to query a comprehensive graph of changes across OS versions from Windows 95 through 11 and Ubuntu 6.10 to 25.04. Using a Merkle graph model stored in Neo4j, it enables users to explore file evolutions, provenance of artifacts, and commonalities across releases, akin to a version control system for OS images. Notably, OSWatcher emphasizes offline image analysis rather than real-time monitoring, differentiating itself from similar tools like Oracle's OSWatcher Black Box.

Cyberseek is a comprehensive, local threat intelligence and defensive analysis tool designed for security teams, integrating asset visibility, reconnaissance, and indicator enrichment into a unified workspace. Key features include continuous monitoring of domains and IPs, email exposure checks, and robust reporting capabilities, while it also enables the mapping of observed behaviors to the MITRE ATT&CK framework and utilizes AI for evidence-bound summaries. The tool aims to facilitate investigation workflows by preserving local task history and analyst context, enhancing operational efficiency in cybersecurity tasks.

SearchToolkit is an advanced collection of resources designed for penetration testers, red teamers, blue teamers, and forensic analysts. It includes tools, hardware, cheatsheets, and references across various cybersecurity domains such as geolocation tracking, OSINT, malware analysis, and bug bounties. Notable features include a comprehensive navigation system for quick access to specific areas of cyber defense and offense, highlighting its utility in diverse cybersecurity tasks.

DeNuitkanizator is a utility designed for analyzing .exe files compiled with Nuitka and other packagers such as PyInstaller. Its primary use case is for reverse engineers and malware analysts, providing detailed extraction of metadata, strings, modules, and PE structure information, while also disassembling machine code and identifying potential suspicious patterns. Notably, it distinguishes between different packagers, retrieves network-related data, and analyzes the executable's PE structure, although it does not function as a decompiler.

memory-forensic is a cross-platform memory forensics toolkit designed for analyzing Windows kernel memory through an independent implementation that matches the output of Volatility 3. It reads various memory dump formats and allows users to retrieve detailed process and network connection information without needing Python or pre-staged symbol catalogs. Notably, it offers a self-profiling capability to locate kernel symbols and validate its results through rigorous comparison with reference implementations, ensuring high correctness in process recovery.

Awesome Memory Forensics is a curated repository focused on digital forensic tools and resources specifically for memory forensics, a critical approach for investigating sophisticated cyber attacks that evade traditional detection methods. The repository includes a variety of software tools for memory acquisition, analysis, as well as educational resources such as books, courses, and articles, facilitating a comprehensive exploration of volatile memory analysis in digital forensics. Notable features include a selection of both commercial and open-source tools that allow investigators to capture and analyze critical data in memory, ensuring enhanced effectiveness in digital investigations.

IG-Detective is a Python-based Open Source Intelligence (OSINT) tool designed for in-depth analysis of Instagram accounts, enabling users to extract location history, map social interactions, and generate automated reports. Notable features include advanced evasion techniques for stealthy data collection, interactive geospatial mapping, and various forensic modules such as account recovery enumeration and engagement audits. The tool optimizes performance with asynchronous data export and intelligent caching for efficient query handling.

Blackbird is a comprehensive real-time malware analysis platform designed for software reverse engineering and intrusion detection. Its primary use case involves performing detailed local analysis of malware through advanced features such as kernel capture, in-process telemetry, and flexible target execution workflows. Notable functionalities include memory behavior tracking, offline capture analysis, and a user-friendly interface that facilitates malware detonation and threat triage within a controlled virtual environment.

OSINT-Nexus is an open-source intelligence platform designed for security researchers, penetration testers, and intelligence analysts, integrating passive reconnaissance tools with AI-driven analysis. Notable features include advanced graph analytics, interactive visualizations, and AI-powered insights using Google Gemini, along with robust reporting capabilities in multiple formats. This cross-platform tool supports Windows and Linux, making it a versatile resource for gathering actionable intelligence from publicly available data.

The VSphereRansomwareRecovery tool provides a recovery solution for virtual machines affected by Babuk-family ransomware on ESXi hosts. It facilitates the restoration of virtual disks ending in `.babyk` through partition table rebuilding and file system recovery, ensuring minimal data loss in the process. Notable features include the capability to leverage AI agents for automated recovery steps and the assurance of recovering readable data from the majority of affected disk space.

DeMuxUSB is a C++20 tool suite designed for capturing, demultiplexing, and analyzing USB sessions involving Apple iDevices, focusing particularly on reverse engineering recovery and restore protocols. It enables forensic analysis by allowing users to examine device restores against known baselines to identify deviations or unauthorized modifications, with features such as detailed USB transaction tracking, protocol demultiplexing, and support for various input capture formats like PCAPNG. Noteworthy capabilities also include reconstructing USB device states and extracting TCP streams and plist data, making it a valuable resource for cybersecurity analysis and digital forensics in the Apple ecosystem.

Cyber Intelligence GPT is a custom AI tool designed to enhance open-source intelligence (OSINT) and cyber investigations by supporting the analysis, correlation, and reporting of data related to threat intelligence, digital forensics, and compliance. It features a comprehensive investigation workflow that enables users to create collection plans, pivot on identifiers, correlate evidence, and identify intelligence gaps, while adhering to lawful sources and practices. Notably, it encompasses various aspects of cybersecurity, including threat hunting, security operations, and OPSEC, making it a multifaceted resource for security professionals.

Assisted Log Enabler for AWS automates the activation of logging for various AWS services to aid customers in maintaining compliance and troubleshooting. It identifies resources without logging enabled and facilitates the setup of essential logs including Amazon VPC Flow Logs, AWS CloudTrail, and others, thus eliminating the need for users to have in-depth expertise in log management. Key features include support for both single and multi-account setups using AWS Organizations, the creation of necessary S3 buckets, and the capability to enable logging during security incidents.

McAFuse is an open-source utility designed for the Digital Forensics and Incident Response (DFIR) community to handle encrypted disk images created with the McAfee Full Disk Encryption (FDE) toolset. The tool provides a static read-only FUSE filesystem, allowing users to access both a plain FAT partition and the encrypted disk image, facilitating the analysis of encrypted data during digital investigations. Notable features include the ability to specify a keyfile for decryption, options for verbose output, and functionality to expose all disk contents beyond just the encrypted volumes.

AI for the Win is a hands-on training platform designed for security practitioners to develop AI-powered tools specifically for threat detection, incident response, and security automation. It features over 50 labs, including capstone projects and CTF challenges, focusing on practical applications such as phishing detection and security log analysis using advanced algorithms like Random Forest and LLMs. The platform also offers a Docker lab environment, sample datasets, and solution walkthroughs to facilitate immersive learning experiences.

ALPC Enumerator is a Windows userland tool designed to enumerate and classify Advanced Local Procedure Call (ALPC) ports, including those associated with Protected Process Light (PPL) processes that evade standard enumeration techniques. It dynamically resolves ALPC Port types and employs `NtQueryInformationProcess` for classification, addressing blind spots in conventional tools, thereby benefiting threat hunters and vulnerability researchers by accurately mapping high-privilege targets and identifying potentially malicious activity. Notably, it has been validated against kernel debugger output for precision and reliability.

CScorza is a personal GitHub profile showcasing various projects and stats related to the user's activity. It utilizes automated badges and visual elements to present information about the developer’s work and social connections, facilitating networking and project visibility. Notably, it emphasizes the integration of dynamic content to enhance presentation and engagement.

Detection Labs for Palantir-Style Activity is an educational resource designed for blue team practitioners focusing on detection engineering and threat hunting. It leverages open-source tools and Sigma rules within SIEM environments to enhance competencies in cybersecurity operations, incident response, and threat intelligence analysis. Notable features include a flexible simulation environment, advanced jitter analysis for continuous monitoring, and comprehensive learning resources for SOC management.

pgread is a tool designed to extract data from PostgreSQL databases without requiring user credentials, leveraging direct access to database files. It facilitates a range of output formats, such as JSON, SQL, and CSV, and includes features for password extraction, secret detection, and WAL (Write-Ahead Logging) analysis. Additionally, it supports low-level forensic operations like parsing database control files and recovery of deleted rows, making it adept for both security audits and database recovery tasks.

OSINT Skills is an open-source intelligence tool designed to facilitate automated investigations by agents like Cursor and Claude. It provides 28 customizable skills for various reconnaissance tasks, enabling users to pivot across data points such as emails, domains, and social accounts, all while generating reports with source citations and confidence levels. Key features include pre-defined workflows, individual techniques for advanced inquiries, and comprehensive reference materials for effective tradecraft in OSINT.

Cyber Security Sources is a comprehensive repository that aggregates various resources, methodologies, and checklists pertinent to distinct fields of cybersecurity. Its primary use case is to provide practitioners with a centralized reference for best practices and tools in cybersecurity. Notable features include curated lists that facilitate efficient resource identification and access for cybersecurity professionals.

Malware-Sandbox-mcp is a cloud-based tool designed to detonate suspicious files and URLs within multiple third-party malware sandboxes, providing normalized reports with threat intelligence data such as verdicts, indicators of compromise (IOCs), and MITRE ATT&CK techniques. It offers a streamlined asynchronous submission and polling mechanism, allowing users to efficiently manage and analyze malware reports while integrating with nine backend services and twenty analytical tools. Key features include a uniform report schema, customizable API key management for backends, and safety mechanisms to prevent exposure of sensitive data.

Anya is a fast, offline static malware analysis platform that processes a wide variety of file formats, including PE, ELF, PDF, and Office documents, without executing them. Key features include high-speed analysis of over 250 files per minute, detailed output such as hashes, entropy, and risk scores, while offering integration with MITRE ATT&CK mappings and support for both GUI and CLI interfaces across multiple operating systems. It should be noted that Anya is transitioning its development to the MalChela project for future enhancements.

Sherlock-rs is a Rust-based tool designed to hunt down social media accounts by a specified username across over 400 social networks. It provides features such as outputting results to text, CSV, or Excel files, supports proxy usage, customizable site analysis, and extensive debugging options, making it ideal for users needing comprehensive username availability checks across multiple platforms.

U92 is a specialized steganography tool that facilitates the embedding of files and directories into PNG images utilizing a Least Significant Bit (LSB) embedding method. It features continuous bitstream processing, integrated archive management for ZIP file creation, and robust integrity validation processes, ensuring accurate data recovery and minimal visual distortion during extraction. The utility supports command-line interaction for easy file embedding and extraction, making it a versatile solution for secure data concealment.

RAMBreaker is a modular memory-forensics framework that simplifies the analysis of RAM images using Volatility 2 and 3. It automatically detects the operating system and the appropriate Volatility engine to generate a self-contained, interactive HTML report, supporting Windows, Linux, and macOS environments. Notable features include the ability to extract Linux kernel symbols from the RAM image itself, minimizing reliance on external resources, and clear communication of limitations when analysis cannot be completed.

Ghost is a robust process injection detection tool developed in Rust, designed to monitor running processes for signs of code injection, memory manipulation, and other malicious activities on Windows, Linux, and macOS. Its notable features include detection of memory anomalies, shellcode patterns, API hooks, and thread hijacking, all while mapping behaviors to the MITRE ATT&CK framework to aid in threat documentation. The tool offers both a command-line interface and an interactive terminal UI, providing real-time scanning results and support for extensible features like YARA rule scanning and neural ML integration.

malsnitch is a command-line tool designed to assist malware reverse engineering by scanning various artifact formats for embedded secrets within binaries. Its notable features include the ability to detect hardcoded credentials, C2 infrastructure, and crypto keys in binary files, with support for multiple input formats such as raw strings dumps, FLOSS JSON output, and Binary Ninja exports. The tool also offers structured JSON output, automatic deduplication, and the capability to scan memory dumps, making it an efficient resource in identifying obscured sensitive information utilized by malware authors.

Kryon is an autonomous, local-first cybersecurity agent designed for comprehensive offensive security tasks including compliance audits, penetration testing, vulnerability hunting, digital forensics, and incident response from a single command. It features a skill-based architecture that dynamically loads over 110 playbooks and employs deterministic pre-hooks for critical detections, ensuring that it provides both a thorough assessment and actionable outputs without reliance on external APIs. Additionally, it supports a wide range of compliance frameworks across multiple sectors, making it adaptable for various organizational needs.

AttackGen is an advanced incident response testing tool designed for cybersecurity professionals, utilizing large language models and the MITRE ATT&CK and ATLAS frameworks to generate customized incident response scenarios. Key features include tailored scenarios based on threat actor groups, organization-specific parameters, a chat-based assistant for scenario updates, and integration with multiple AI APIs for enhanced scenario generation. It also provides user feedback mechanisms and downloadable scenarios in Markdown format, facilitating effective training and assessment of incident response capabilities.

Azazel is a lightweight eBPF-based runtime security tracer specifically designed for malware analysis sandboxes. It operates within isolated Docker containers to capture detailed telemetry data, such as syscalls, file interactions, and network activities, producing a JSON output that allows integration with various data processing tools. Notable features include zero runtime dependencies, compile-once run-everywhere capability, and built-in heuristics for automatic alerts on suspicious behaviors.

Rustinel is an open-source endpoint detection tool designed for Windows, Linux, and macOS systems, focusing on providing native telemetry and alerting capabilities. It supports detection formats like Sigma and YARA, enabling rule reuse without needing proprietary adaptations, and produces SIEM-ready alerts in the Elastic Common Schema format. Key features include hot reloading for rules and IOC management, active response options for Windows and Linux, and comprehensive logging of alerts.

Secuditor Lite is a Python-based diagnostic security tool designed for Windows environments, facilitating endpoint security assessments through a user-friendly graphical interface. Its primary use case involves identifying vulnerabilities, suspicious activities, and misconfigurations across systems and networks, while providing features like SSL/TLS interception analysis, operational security evaluations, and the generation of structured audit reports. The tool supports comprehensive security checks covering system hardware, network configurations, shared folder permissions, and a variety of security controls.

IOCX is a deterministic static IOC extraction engine designed for modern security pipelines, specifically focusing on malware analysis and incident response. It ensures zero execution risk by performing pure static analysis on Portable Executable (PE) files, delivering stable and reproducible outputs while effectively handling adversarial input. Key features include a binary-aware parser, high-performance extraction, and compatibility with CI/CD environments, positioning IOCX as a reliable tool for automated threat detection and defense.

Awesome Reverse Engineering & Malware Analysis is a comprehensive resource that serves as a curated guide for reverse engineering and malware analysis tools, methodologies, and educational content. It categorizes entries across various disciplines such as static and dynamic analysis, exploit development, and digital forensics while providing quality assurance by checking all links and content for relevance. Notable features include structured learning tracks for different areas of focus, detailed tagging for easy navigation, and inclusion of community resources to enhance collaboration and knowledge sharing.

The Cloud Forensics Utils repository provides tools for forensic teams to collect evidence from cloud platforms, specifically supporting Google Cloud Platform, Microsoft Azure, and Amazon Web Services. It features the `libcloudforensics` module, which includes functions essential for incident response in cloud environments, along with a command-line interface (CLI) for enhanced usability.

GRR Rapid Response is an incident response framework designed for remote live forensics, enabling security professionals to gather and analyze forensic data from remote systems. It features a Python client-agent that operates on target machines and a server infrastructure for management and communication with these clients, facilitating efficient and comprehensive incident investigation workflows. Notable features include real-time communication, remote system control, and the ability to execute live forensic collections with ease.

POCKINT is a portable OSINT tool designed for digital forensics and incident response professionals, facilitating efficient data mining of indicators such as URLs, IPs, and MD5s through an intuitive GUI. Its notable features include simplicity, portability, and powerful integration with various OSINT sources and APIs for enhanced data analysis capabilities. With a focus on providing essential functionalities without the complexity of traditional command line tools, POCKINT allows users to quickly perform iterative searches and gather intelligence.

Thumbtack is a web-based tool that offers a RESTful API for mounting and unmounting forensic disk images, effectively built upon the imagemounter library. It streamlines the forensic analysis process by providing a user-friendly interface to manage disk images, featuring various configurable options for directories, debugging modes, and monitoring capabilities. Notably, Thumbtack supports a variety of disk image formats through necessary external tools, ensuring versatility in forensic investigations.

Timesketch is an open-source tool designed for collaborative forensic timeline analysis, enabling users to create and organize timelines for enhanced data interpretation. Notable features include the ability to add annotations, comments, tags, and the capability for multiple collaborators to analyze timelines simultaneously. The tool's interface supports efficient exploration and contextual searching of data, making it ideal for forensic investigations.

Turbinia is an open-source framework designed for deploying, managing, and executing distributed forensic workloads to automate the processing of digital evidence in the cloud. It features a modular architecture that includes components for clients, servers, and workers, allowing for parallel processing of tasks by splitting large evidence sets. Although Turbinia is now in maintenance mode with no new features planned, it remains a potent tool for enhancing the efficiency and scalability of forensic analysis.

FaceForensics++ is a comprehensive dataset designed for detecting manipulated facial images, featuring 1000 original video sequences enhanced with four advanced face manipulation techniques: Deepfakes, Face2Face, FaceSwap, and NeuralTextures. It offers key features such as binary masks for image classification and segmentation tasks, an additional 1000 Deepfake models for data augmentation, and includes the FaceShifter method for high-fidelity identity-preserving face swaps, along with access to a benchmark for evaluating detection algorithms.

Ghiro is a digital forensics tool designed for processing and analyzing large volumes of image evidence. It automates the extraction of information from images, presenting results in well-structured reports for easy searching and case management, and supports multi-user environments with customizable permissions. Notable features include scalability for handling gigabytes of images, automated task processing, and user-defined case grouping.

Imago is a Python-based digital forensics tool that facilitates the extraction of digital evidence from images through recursive directory navigation. It supports the extraction of EXIF metadata, GPS coordinates, and generates perceptual hashes, while offering outputs in CSV or SQLite format. Notably, Imago also includes beta features for Error Level Analysis and nudity detection specifically for JPEG images.

Creds provides a collection of scripts and executables specifically designed for penetration testing and forensic analysis, with a primary focus on Windows and domain environments. Notable features include tools tailored to streamline the assessment of security vulnerabilities in these systems, making it suitable for security professionals and ethical hackers. Users are reminded to adhere to legal guidelines when utilizing these resources.

Awesome Incident Response is a curated repository that aggregates tools and resources specifically designed for Digital Forensics and Incident Response (DFIR) teams. It provides a comprehensive collection of categories such as evidence collection, log analysis, and incident management, facilitating security analysts in effectively responding to and managing security incidents. Notable features include adversary emulation tools, playbooks, and a wide range of resources for various operating systems, ensuring a well-rounded toolkit for incident response.

MasterParser v2.5 is a digital forensics and incident response tool designed for analyzing Linux logs within the /var/log directory, particularly targeting logs like auth.log. It streamlines the investigative process by extracting crucial information such as SSH logins, user creations, and IP addresses, presenting it in an easily digestible format for incident responders. The tool also offers extensive training materials and support for future log format integrations, making it an essential asset for security professionals working with Linux environments.

Sherloq is an open-source digital image forensic toolset designed for the analysis of images in legal contexts. It provides a modern Qt-based GUI, supports various image formats, and features an interactive environment to experiment with state-of-the-art algorithms, enabling users to conduct detailed forensic examinations and visualize results. Aimed at both researchers and enthusiasts, Sherloq encourages community involvement and the exploration of digital signal processing techniques without the constraints of proprietary software.

Aurora Incident Response is a cross-platform tool designed to streamline incident response documentation, making it easier for responders to track findings and manage tasks during investigations. It enhances the traditional "Spreadsheet of Doom" method by providing a visual timeline and lateral movement tracking, thereby improving oversight of investigation processes. The application is built on an Electron base, enabling compatibility across multiple operating systems, including MacOS, Windows, and Linux, with plans for mobile platform support.

OS X Auditor is a forensic tool designed for macOS that analyzes various system artifacts, including kernel extensions, agents, daemons, and user data. It extracts comprehensive information such as browser histories, quarantined files, and social account details, while also performing file reputation checks against multiple services. Although the tool is no longer maintained, it offers functionality to aggregate logs and generate reports in text or HTML formats.

copyfail-detect is a detection toolkit designed to identify exploitation attempts of CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel that alters page-cache data without modifying the actual disk file. It features multiple detection layers, including real-time eBPF monitoring of suspicious activities, auditd rules for syscall tracking, and a page-cache comparison tool for post-exploitation analysis, enabling proactive defense and investigation against the vulnerability. The toolkit also provides mitigation scripts and documentation for responders to safely address incidents involving the Copy Fail exploit.

The Offensive Security Forensics Portfolio is an educational repository showcasing practical skills in cybersecurity, particularly in forensic analysis, penetration testing, and vulnerability assessments. It features detailed documentation of various security techniques, including the implementation of Multi-Factor Authentication for SSH and memory forensics using the Volatility Framework, as well as threat hunting exercises with Splunk. This portfolio serves as a comprehensive example of applied offensive security methodologies within controlled environments.

Z-Jail is a lightweight multi-layer sandbox for executing native code on Linux, designed for scenarios such as CI pipelines and CTF challenges. It features seven ordered isolation layers that enforce security measures like namespaces, capability dropping, seccomp-BPF syscall whitelisting, and auditing with JSON logging, all within a compact ~81 KiB binary and without external dependencies. This makes Z-Jail a unique solution that balances minimalism and robust security for code execution environments.

Zombie Ant Farm is a toolset designed for offensive security practitioners to enhance evasion techniques against Linux Endpoint Detection and Response (EDR) systems. Its primary use case involves facilitating the development of custom offensive strategies through features such as distributed payload warehousing, in-memory payload delivery, and ASLR weakening shims, making it suitable for advanced penetration testing and research. The kit includes various components such as preloaders, evasion primitives, and a warehouse service, providing a modular approach to offensive operations.

HackingComm is a user-friendly penetration testing tool designed for individuals with limited terminal command knowledge. It simplifies common pentesting tasks on Kali Linux through a straightforward interface, allowing users to easily input required parameters while executing commands. Notable features include an installation script, guided prompts for user inputs, and reliance on Python for functionality, making it accessible for beginners in cybersecurity.

swap_digger is a Bash script designed for automating the analysis of Linux swap space for post-exploitation and forensic purposes. It extracts sensitive information such as user credentials, web form credentials, and WiFi keys from the swap area, and offers extensive options for customization, including extended searches and optional logging. The tool is especially useful in penetration testing scenarios and can operate on local or mounted swap devices.

AntiForensic.NET is a lightweight library designed for Windows that facilitates the eradication of forensic trace logs from a computer system. Its primary use case involves implementing various anti-forensic techniques to ensure user privacy by removing artifacts such as application logs, event logs, and cached data. Notable features include the automatic deletion of numerous types of logs and cache files, including Recycle Bin contents, recent items, and compatibility logs, thereby aiding users in evading potential tracing.

OpenRisk is an enterprise-grade risk management platform designed to streamline the identification, assessment, mitigation, and monitoring of IT and security risks through a scalable microservices architecture. Its key features include automated risk assessment, interactive real-time dashboards, and native integration with tools like Elastic and Splunk, making it suitable for CTOs, CISOs, and DevSecOps teams. With capabilities such as mitigation tracking and advanced analytics, OpenRisk enhances organizational risk oversight and compliance while enabling easy deployment via Docker and Kubernetes.

Darkelf is a comprehensive ecosystem that offers a suite of privacy-focused browsers and security tools for cybersecurity professionals, researchers, and privacy-conscious users. It features enterprise-grade browsing capabilities, AI-assisted analysis tools, OSINT utilities, and extensive documentation to support both users and developers in utilizing and contributing to its projects. Notable technologies include post-quantum cryptography readiness, anti-fingerprinting research, and local AI security analysis.

sigwood is a local-first command-line tool designed for threat hunting by analyzing existing log files from sources such as Zeek, DNS servers, and syslogs. Its primary use case is to detect anomalies, including beaconing, suspicious DNS queries, and unusual activity within a user’s network, without requiring any external deployment or configuration. Notable features include its simple installation process, a suite of detectors for various events, and the ability to run directly on logs without needing to send data to the cloud.

Tracehound is a Linux DFIR tool designed to parse host artifacts and compile them into a unified, UTC-normalized timeline, facilitating the analysis of attacker behavior during forensic investigations. It processes log files, mounted images, and evidence folders, employing detection rules with MITRE ATT&CK mappings to convert raw events into actionable findings. Notable features include exporting results in various formats such as JSON, HTML, or CSV, and capabilities for maintaining a timeline in SQLite for extensive datasets.

UTMStack is an open-source unified threat management platform that combines SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) functionalities for real-time correlation of log data, threat intelligence, and malware activity patterns. Its notable features include advanced threat detection and response, log management, AI-powered analysis, and security compliance support, allowing organizations to effectively identify and mitigate complex threats efficiently. By enabling correlation prior to data ingestion, UTMStack enhances the overall threat prevention capabilities and response times within cybersecurity infrastructures.

Kontext CLI is a runtime governance tool designed for AI agents, enabling local policy evaluations and pre-action enforcement to enhance security during tool usage. Its primary use case involves recording policy decisions and actions in an authorization ledger while blocking or allowing actions based on predefined rules. Notable features include support for self-serve setup on macOS, an observe mode for testing policies without interruptions, and compatibility with various agent environments to ensure secure operation across different platforms.

PCAP Hunter is an AI-enhanced threat hunting workbench designed for SOC analysts, enabling seamless integration of manual packet analysis with automated security monitoring. It features a user-centric interface for geographic flow aggregation, linked visual analysis, and a durable analysis workflow, while also providing optional Large Language Model assistance for enriched analysis. The tool supports visualization and investigation of packet captures through advanced filtering and responsive dashboard capabilities, ensuring comprehensive threat detection and evidence management.

Repo Forensics is a security tool designed to audit untrusted repositories before their integration with AI-agent plugins, skills, and MCP servers. It features a fully local and self-updating detection mechanism with zero dependencies and telemetry, ensuring a secure audit process. The tool supports live scanning against CVEs, incorporates over 800 patterns and 41 correlation rules, and operates effectively in offline environments.

Wildbox is a self-hosted, open-source security operations platform designed for comprehensive threat monitoring, analysis, and automated responses, allowing users to maintain full control over their data. It features aggregated threat intelligence from over 50 sources, cloud security posture management for major providers, and utilizes YAML-based playbooks for incident automation, alongside advanced LLM capabilities for enhanced threat analysis and reporting. The architecture is built on microservices, providing flexibility and scalability through a robust API gateway, identity management, and integrated data management tools.

AssemblyLine 4 is an open-source automated malware analysis framework designed to support both manual analysis and large-scale enterprise security operations through scalable file triage. Built on Kubernetes and Docker, it offers extensive integration capabilities with various security tools and provides a REST API for customizable extensions. Notable features include deep file analysis, interoperability with threat knowledge bases, and the ability to create additional analysis services via Python.

Defensive Security Hub is a comprehensive repository designed to support Security Operations Center (SOC) analysts by providing a curated collection of resources, tools, and references across various cybersecurity domains. Its primary use case involves enhancing the capabilities of SOC teams through structured access to training materials, threat hunting tools, DFIR methodologies, and intelligence frameworks. Notable features include a well-organized repository structure with sections on training courses, articles, blogs, and various security tools, facilitating quick navigation and resource discovery.

DFIRWS is a digital forensics and incident response (DFIR) tool designed to operate within a Windows Sandbox environment, facilitating streamlined setup and maintenance of necessary forensics tools. Its notable features include automated downloading and updating of DFIR tools through a PowerShell script, synchronization capabilities for offline environments, and a user-friendly configuration process for sandbox setups. This tool is particularly advantageous for cybersecurity professionals seeking to perform incident response without the complexities of managing an extensive DFIR toolkit.

Malware DB is a malware knowledge management system designed to catalog and manage the lifecycle of malware, benign, and unknown file samples, including their hashes, origins, and similarity metrics. Targeted at malware researchers and forensic investigators, it offers features such as sample categorization via custom taxonomies, group-based access permissions, file encryption, and advanced search capabilities based on file characteristics and Yara rules. This tool is currently in beta and emphasizes best practices for handling potentially harmful samples.

procscope is an eBPF-based process tracer for Linux that enables real-time observation of process behavior, including lifecycle events, file activity, and network connections, with minimal overhead and configuration. It is primarily designed for security researchers and incident responders to trace malware behavior and audit container workloads without the complexities of traditional monitoring tools like EDR. Notable features include support for various process-related events, file operations, and privilege transitions, allowing users to effectively monitor and analyze runtime activity.

SussyFinder is a PHP web application designed to scan directories for files with specific extensions, particularly PHP scripts, and identify potential malicious content through token and pattern analysis. It features a token-based comparison method that accounts for obfuscation techniques, allows for MD5 hash-based whitelisting and blacklisting, and presents results with color highlights for easy identification. The tool is particularly useful for web server environments but requires cautious use due to the potential for false positives and file deletion capabilities.

Triager is a DFIR automation platform designed for Windows triage collections, facilitating the processing and organization of various digital artifacts into investigation-ready CSV files. It features a command-line interface (Triager CLI) for parsing and searching processed results, as well as a web console for multi-case management, enabling centralized evidence analysis, role-based access, and collaboration across multiple machines. Notable capabilities include built-in support for integrating various forensic tools, cross-machine correlation, and advanced features such as AI assistance for generating reports and findings.

Reversecore MCP is an AI-powered server designed to facilitate reverse engineering and security analysis by integrating 120 analysis tools into a unified interface. It utilizes natural language processing to allow AI assistants to perform tasks like malware analysis, vulnerability research, and source code auditing, significantly simplifying the interaction with complex command-line tools. Notable features include structured tool results that AI can reason about and chain into follow-up queries, making it highly efficient for rapid security assessments and investigations.

Awesome is an open-source repository that aggregates a variety of tools and resources across multiple domains including communication, development, finance, and information security. Its primary use case is to provide users with a centralized catalog of high-quality software, libraries, and educational resources, aiding in quick access to knowledge and tools. Notable features include a structured table of contents for easy navigation and a focus on simplicity, readability, and collaboration best practices.

dz6 is a fast Vim-inspired hex editor designed for terminal environments, enabling efficient editing of large files in hex or ASCII formats. Notable features include Vim-like key bindings, customizable options, regex string filtering, and the ability to parse PE/ELF headers, making it suitable for tasks involving low-level file inspection and manipulation. The tool is cross-platform, open-source, and offers a variety of navigation and editing commands to enhance user experience.

ReverseLab is an open-source reverse engineering lab designed for capturing and analyzing various attack scenarios across multiple domains, including CTF pentesting, APK reverse engineering, and PE binary analysis. Its notable features include a comprehensive knowledge base organized into specialized categories, over 100 automation tools for rapid execution, and a modular architecture that supports various signal types and attack chains. Users can easily set up the tool on multiple platforms with provided scripts, ensuring a streamlined onboarding experience.

The TryHackMeRoadmap repository provides a curated list of over 350 free TryHackMe rooms, categorized by skill level and topic, aimed at enhancing the learning experience for cybersecurity enthusiasts. Its notable features include a structured approach that covers various areas such as network security and web exploitation, alongside self-contained rooms with practical exercises to facilitate hands-on learning. Regular updates ensure relevance and accessibility to new resources in the evolving cybersecurity landscape.

ImHex is a powerful hex editor designed for reverse engineers and programmers, providing a user-friendly interface suitable for working in low-light conditions. Its primary use case includes inspecting binary files and conducting memory analysis, with notable features such as plugin support, an online version, and comprehensive documentation. This tool enhances visibility and usability with its built-in dark theme and various customization options, facilitating efficient data manipulation and analysis.

Radare2 is a comprehensive reverse engineering framework designed for Unix environments, providing a suite of tools and libraries to facilitate tasks such as binary analysis, disassembly, and debugging. Notable features include support for scripting through an embedded JavaScript interpreter, local and remote debugging capabilities, and extensive plugin architecture that enables users to extend its functionality with various plugins. This tool is especially aimed at security researchers and developers looking for powerful solutions in binary exploitation and reverse engineering.

TryHackMeWriteups is a comprehensive repository that curates free TryHackMe rooms, providing organized resources for cybersecurity enthusiasts to learn and practice various skills. Notable features include categorized rooms across diverse topics, detailed notes and summaries, step-by-step writeups for Capture The Flag challenges, and continuous updates, making it an ideal starting point for beginners in cybersecurity and ethical hacking.

Flagy is a comprehensive toolkit designed for Capture The Flag competitions, integrating a wide array of cybersecurity tools across multiple domains including cryptography, forensics, reversing, steganography, and web security. Notable features include automated cryptanalysis tools, credential dumping utilities, and advanced reversing frameworks like Ghidra and radare2, all aimed at facilitating the installation and use of essential tools for both beginners and advanced users in security challenges.

flarevm-up automates the provisioning of Windows 10 virtual machines with FLARE VM tools installed, specifically designed for digital forensics and malware analysis. This tool utilizes Vagrant and VirtualBox to quickly set up multiple environments for blue team operations, facilitating rapid deployment for analysis tasks. Notable features include seamless integration of necessary forensic tools and straightforward setup instructions.

The TryHackMe_Writeups repository contains comprehensive writeups for various PwnBoxes and Rooms hosted on TryHackMe, aimed at assisting users in understanding the solutions to the challenges. Its primary use case is to provide guidance for users who may be struggling with specific tasks, while encouraging independent problem-solving. Notable features include a collection of detailed solutions that include flags and answers, structured to facilitate learning in cybersecurity challenges.

Zero-Setup is a Bash script designed to automate the installation of essential tools and software for cybersecurity professionals, facilitating the rapid configuration of a hacking environment with a single command. It categorizes various utilities, including cryptography, OSINT, steganography, and digital forensics tools, streamlining the setup process while ensuring comprehensive coverage of necessary resources for penetration testing and security analysis. Notable features include easy installation steps and a structured approach to organizing tools based on their respective domains.

Common-CTF-Challenges is a comprehensive resource for Capture the Flag (CTF) competitions, providing categorized notes, command references, and ready-to-use Python scripts for various exploitation techniques including cryptography, binary exploitation, web vulnerabilities, and forensics. Notable features include a structured directory for easy navigation and search functionality using tools like `grep` and `ripgrep` to quickly locate relevant resources during challenges. This tool serves as a practical aid for participants by consolidating essential techniques and scripts in a single, accessible repository.

CTF Tools is a curated repository that aggregates a variety of resources, websites, and tools specifically designed to assist in solving Capture The Flag (CTF) challenges. It organizes tools by category, providing practical links ranging from ASCII tables to cryptographic calculators, thus serving as a quick reference resource for CTF participants and teams during competitions. Notable features include a wide assortment of utility tools for cryptography, data conversion, and training resources, as well as guidelines for collaborative contributions to the repository.

CTF Kit is a versatile toolkit designed to enhance the efficiency of solving Capture The Flag (CTF) challenges by leveraging AI assistance for analysis and documentation. It features seamless integration with AI coding agents through the Claude Code Plugin, automating tasks such as challenge categorization, vulnerability detection, and writeup generation, while also supporting over 20 diverse tool integrations. Its dual architecture consists of a command-line interface for direct interactions and AI-powered skills to enhance the challenge-solving workflow during competitions.

CTF-Practice is a repository providing a collection of Capture the Flag (CTF) challenges tailored for beginners in the field of Cyber Forensics. Its primary use case is to facilitate hands-on learning and skill development in cybersecurity through practical problem-solving scenarios. Notable features include a variety of introductory-level challenges aimed at enhancing forensic analysis capabilities.

CTF-Writeups is a comprehensive repository offering detailed solutions and methodologies for various Capture The Flag (CTF) challenges, organized by categories such as Forensics and Cryptography. Its notable features include a step-by-step approach to problem-solving, a Graph View for visual exploration of relationships between challenges and concepts, and a dedicated section for tools and fundamental knowledge applicable to CTFs. This project serves as both a learning resource and a documentation platform for both solved and original challenges.

StegoForge is an advanced steganography toolkit designed for embedding and extracting hidden data within images, audio, and video files, while also providing a comprehensive suite for digital forensics analysis. Its features include AES-256-GCM encryption, a local web UI for interactions, support for batch processing, and the ability to simulate network behavior on payloads, making it suitable for security researchers and CTF (Capture The Flag) participants. The framework offers zero-dependency binaries for easy deployment across multiple operating systems.

InstaRecon is an open-source intelligence (OSINT) tool specifically designed for gathering publicly available information from Instagram profiles, aimed at cybersecurity professionals and ethical hackers. It features user intelligence gathering, engagement analysis, and the ability to extract detailed account metrics, business intelligence, and public contact information. The tool operates across multiple platforms, supports automatic dependency installation, and requires users to provide a valid Instagram session ID for functionality.

The "kali-dockerized" repository provides Docker images for Kali Linux and Ubuntu 26.04, tailored for bug bounty programs, penetration testing, security research, computer forensics, and reverse engineering. Key features include the use of the official Kali Linux Docker image with systemd support, compatibility with Docker's host network driver for enhanced performance, and tools for local deployment on Kubernetes clusters. The setup also includes installation instructions for utilities such as Dive for image exploration and Trivy for vulnerability scanning.

Vigil is an open-source, AI-powered security operations platform designed for comprehensive vulnerability management, incident response, and compliance tracking within a unified Express.js framework. Key features include six built-in scanners (Nmap, Nuclei, Trivy, Nikto, OpenSSL, DNS), 20 autonomous agents for parallel operations, and support for custom AI integrations, all while maintaining a lightweight architecture without external dependencies. The platform also offers advanced functionalities like role-based access control, two-factor authentication, and an encrypted credential vault for enhanced security.

Abster Intelligence is a privacy-centric open-source investigation workspace designed for OSINT, GEOINT, and cyber research. Its primary use case is to facilitate data analysis and evidence gathering without the risk of data leakage, employing a local-first architecture where all investigation data is stored in the user's browser, ensuring strict data sovereignty. Notable features include a dynamic relational graph engine for visualizing connections, support for querying various OSINT tools directly from the interface, and the ability to share investigations securely via encoded URLs without compromising data privacy.

Awesome Hacking & Cybersecurity Learning Path is a comprehensive resource designed to guide individuals from beginner to advanced levels in ethical hacking, penetration testing, and cybersecurity. It features curated materials on bug bounty hunting, OSINT tools, CTF challenges, and practical exercises for real-world scenarios, alongside essential concepts in networking and web application security. Notable features include detailed roadmaps for penetration testing, hands-on labs from platforms like TryHackMe and HackTheBox, and extensive coverage of privilege escalation techniques across multiple operating systems.

The Awesome OSINT Arsenal is a comprehensive open-source toolkit designed for open-source intelligence (OSINT) and cybersecurity, comprising over 753 tools organized into 50 categories. It facilitates quick installations on various Linux distributions and offers targeted scripts for specific tasks such as red teaming, blue teaming, and forensics, simplifying access to essential security resources. This toolkit supports multi-distro installers and includes a Termux subset for Android, enhancing its versatility for security researchers and practitioners.

FalconEye is a comprehensive, self-hosted OSINT investigator's toolkit designed to streamline the investigation process through eighteen specialized modules. It facilitates a wide range of investigative tasks including cryptocurrency wallet tracing, phishing kit analysis, and domain intelligence, all integrated within a single interface that promotes one-click connectivity between related tools. Key features include LLM-powered scam detection for email headers, multi-source IP reputation assessments, and a fictional persona generator, making it a versatile platform for cybersecurity professionals.

Odinova Digital Tiger is a discontinued application designed for Open-Source Intelligence (OSINT) that provides a comprehensive suite of tools for investigative workflows and data analysis. Notable features include a tabbed interface for document management and Markdown file viewing, HTML rendering for clear presentation, and dark theme support for enhanced usability. The tool aims to centralize OSINT operations, enabling efficient data management and promoting collaboration among users.

OSINT Bible 2026 is a comprehensive repository designed for the ethical practice of Open-Source Intelligence (OSINT), providing a curated compilation of procedures, tools, and methodologies for effective information gathering and analysis. Its primary use case is to assist researchers and investigators in performing lawful and ethical OSINT activities, featuring a wide array of investigation techniques, frameworks for automation, and specialized insights into various areas like threat intelligence and deep web research. Notable features include a structured quick index for easy navigation, a focus on ethical guidelines, and complementary resources like Abster Intelligence for private workspace management.

Tornado-demix is a forensic research toolkit designed for the de-anonymization of Tornado.Cash ETH transactions by leveraging public on-chain data. It utilizes a probabilistic heuristic to correlate deposit and withdrawal patterns based on transaction timing and fixed-denomination amounts, outputting likely exit addresses for further investigation. Key features include support for single and multiple wallet analysis, denomination-profile matching, and cluster tracing, all performed without compromising cryptographic integrity.

Coeus OSINT ToolBox is a comprehensive open-source intelligence platform designed for effective information gathering from various open sources. It provides a wide range of tools for conducting background checks, investigating individuals or usernames, and accessing anonymous communication services, as well as resources for searching both the surface and deep web. Notable features include tools for web resources, social media investigation, and guides on managing personal information online, making it a versatile tool for both individuals and organizations engaged in OSINT activities.

Cyberbro is a user-friendly application designed to extract Indicators of Compromise (IoCs) from unstructured input and assess their reputation using various threat intelligence services. Key features include automatic parsing of logs, multithreaded processing for rapid checks, comprehensive reporting capabilities, and integrations with major cybersecurity tools. Its lightweight deployment and support for advanced domain and abuse information make it suitable for both beginners and experienced analysts seeking efficient IoC management.

DorkTerm is a web-based tool for security researchers that facilitates the execution of Google Dork queries to identify potential vulnerabilities in a specified domain. It automates the generation and opening of 15 predefined Google Dork searches in separate tabs, enabling quick reconnaissance of common vulnerabilities, such as login pages and exposed files. The tool is lightweight and user-friendly, providing guidance for enabling popups to enhance its functionality.

Horus is a comprehensive investigative tool designed to assist users with data compilation and API interactions, serving as a pre-operations assistant. It features a modular architecture allowing for API configuration, functionality checks, and integration with services like Shodan, while requiring specific CLI tools for additional capabilities. The tool aims to streamline investigations by providing essential data management and interaction tools in one package.

Intel Codex is a comprehensive operational manual designed for digital investigators and security analysts, emphasizing OSINT methodologies and security protocols. It features over 40 standard operating procedures (SOPs), guides for various social media platforms, and case studies that illustrate practical applications in real-world investigations. Notable elements include legal and ethical compliance frameworks, detailed investigation techniques, and a focus on malware analysis and penetration testing methods.

Ominis-OSINT is a digital reconnaissance tool designed for gathering and analyzing publicly available information from various online sources. It notably offers features such as Google search filtering, an enhanced user interface, optimized threading for faster performance, and proxy validation for secure, anonymous searches. The tool specializes in username searches, providing detailed insights while mimicking human-like behavior to evade detection by anti-bot mechanisms.

OSINT Agent Skills is a structured knowledge base that equips autonomous AI agents with the methodologies and operating procedures of a senior open-source intelligence analyst. It provides curated resources including pivotal playbooks, tool registries, and reporting templates, ensuring AI agents conduct informed investigations while adhering to ethical standards and avoiding misinformation. This agent-agnostic framework enhances the rigor of OSINT tasks, automating data collection and enabling detailed, source-cited reports.

CTI Expert is a cyber threat intelligence and open-source intelligence analysis toolkit that enables users to convert Claude into a trained intelligence analyst, utilizing over 74 commands across 49 techniques. This tool operates without requiring API keys for its core functionalities, facilitating structured intelligence collection and analysis. Notable features include the capability to integrate personal API keys for enhanced functionality and ease of use with automatic detection of the keys in the configuration.

TIA is an autonomous AI security operations platform that utilizes 30 specialized AI agents for continuous threat detection, OSINT intelligence, and incident response without human intervention. Noteworthy features include real-time threat monitoring with a proven record of blocking over 563 attacks, zero breaches, and a cost-effective operation rate of $405 per month, making it ideal for organizations seeking robust cybersecurity solutions.

IntelOwl is an open-source Threat Intelligence management tool designed to provide comprehensive threat data regarding malware, IP addresses, and domains through a single API request. It features a fully-fledged REST API, a built-in graphical user interface for data visualization, and a modular plugin framework that allows for integration with various analyzers and connectors, facilitating automation for security analysts. Its scalability and speed in retrieving intelligence data make it suitable for enhancing the efficiency of security operations centers (SOCs).

The tool described in the repository focuses on utilizing blockchain analysis to uncover relationships between dark web services and trace cryptocurrency transactions, specifically Bitcoin. It leverages tools like Fresh Onions and Wallet Explorer to identify digital fingerprints of onion sites and analyze wallet connections, thereby enhancing the investigative capabilities of OSINT activities related to cryptocurrency crimes. Notable features include the ability to link onion sites, trace transactions to exchanges, and reveal ownership connections among dark web platforms.

WITCHCRAFT is an advanced cybersecurity toolkit designed for professionals engaged in operational security (OPSEC), offering functionalities for hacking, OSINT, and forensic analysis. Key features include a modular command structure for tasks such as port scanning, data mapping, and searching for keywords across numerous platforms, bolstered by a comprehensive spellbook containing unique wordlists and databases for enhanced reconnaissance. This tool serves as an all-in-one cyberdeck system for efficient data-ghosting, network penetration, and threat analysis.

Yaralyzer is a tool designed for the visual inspection of regex and YARA matches within binary and text files, allowing users to view the actual bytes matched along with their surrounding context. It supports scanning with customizable regex patterns or YARA rules, detecting potential character encodings of matched bytes, and can display results in various formats such as SVG and HTML. Notable features include the ability to force different character encodings on matched regions and export findings in a visually appealing format, facilitating deeper analysis of patterns within data.

Fingerprint is a forensic analysis tool designed to monitor and record changes to files and registry entries on Windows systems, allowing users to identify modifications potentially made by malware or unauthorized programs. It generates comparative fingerprints of system states in CSV format, facilitates use with external diff tools, and incorporates functionality to filter changes through Procmon logfiles, streamlining the detection of hidden data associated with software installations. Additionally, the tool is batch-friendly, enabling automation for targeted monitoring scenarios.

Logicytics is a forensic data collection tool designed for Windows systems, developed in Python to systematically retrieve and package extensive system data into a ZIP file for analysis. Its primary use case is to assist cybersecurity professionals in gathering sensitive information for forensic investigations. Notable features include its active development status and straightforward installation process, ensuring comprehensive data harvesting capabilities.

Sqlite3 Page Explorer is an Electron-based application that enables users to open and explore SQLite databases, allowing for in-depth examination of their internal structures, including schemas, tables, and indices. Its notable features include hierarchical navigation of B-Tree pages, parsing of cell content, and the ability to view both current and deleted data pages, making it an essential tool for software development, ethical hacking, troubleshooting, and academic studies related to database formats.

BST is a developing suite of security tools designed to facilitate various cybersecurity tasks. Its primary use case encompasses streamlining security assessments and enhancing defensive measures, with a focus on providing a comprehensive toolkit for security professionals. Notable features include modular architecture and the potential for integration with various security frameworks.

The Cyber Intelligence Toolkit is a comprehensive resource designed for investigators and analysts that integrates manuals, playbooks, checklists, and appendices for digital investigations. It focuses on OSINT methodologies, digital forensics, AI content detection, and operational security, enabling users to conduct structured and effective investigations. Notable features include standardized investigation frameworks and practical guidelines, making it adaptable for both field operations and detailed analyses.

File Scraper is a tool designed for extracting sensitive information from files using custom regular expressions, and it generates an interactive HTML report based on the findings. Its primary use case is in security assessments and data validation, where users can employ their regex expertise to customize the search patterns for various types of sensitive data, such as authentication tokens and credentials. Notable features include the ability to style the generated reports and collect specific data formats like Base64 and PEM, enhancing the tool's versatility for educational and practical cybersecurity applications.

Infosec House is a comprehensive repository offering a wide range of cybersecurity tools and resources tailored for both offensive and defensive strategies. It features over 1,100 entries across various categories including AI, API pentesting, incident response, malware analysis, and OSINT, providing cybersecurity professionals with essential resources to enhance their operations. Users can contribute to the repository by submitting pull requests or reporting issues, facilitating a collaborative environment for continuous improvement.

OSINT360 is a GPT-5.2-powered assistant tailored for open-source intelligence (OSINT), digital forensics (DFIR), and cyber investigations, offering comprehensive support for intelligence operations including collection, analysis, and reporting. Its notable features include command-based interaction for expedited workflows, structured reporting formats, a tool-first approach favoring open-source tools, and adherence to compliance and ethical standards. The tool also facilitates adversary profiling, compliance with global cyber laws, and integrates real-time intelligence through live web lookups.

Slacksploit is a forensic analysis framework designed to enumerate slack artifacts within various operating systems, including Windows, Mac, and Linux. It offers capabilities such as fetching cookies, retrieving user and Slack client logs, and extracting authentication tokens from levelDB files; additionally, it provides a GUI visualizer plugin for Slack user data and allows data export to CSV format. This tool is particularly useful for investigating and analyzing Slack-related data within a forensic context.

SpecterNet is an advanced network anonymization framework designed to route all system traffic through the Tor network, enhancing security and privacy. Its notable features include full traffic routing, built-in DNS and IPv6 leak protection, a kill switch to block traffic during Tor disconnections, and hardware identity spoofing. Additionally, it offers comprehensive leak testing, censorship bypassing capabilities, and a modern terminal interface for monitoring and management.

SuperLibrary is an educational repository designed to provide access to a collection of books and courses aimed at individuals who may face financial constraints in obtaining these learning resources. It emphasizes ethical usage, urging users to support authors and publishers whenever possible, while also featuring a disclaimer regarding copyright and legal responsibilities. Notable features include categorized content such as books and courses, fostering self-education in various subjects.

ThreatHunting-Keywords is a repository providing a comprehensive list of keywords to facilitate threat hunting activities in cybersecurity. It serves both blue teams and red teams, offering tools and methodologies for detecting and analyzing malicious activities that may evade automated security systems. Notable features include integration with SIEM tools like Splunk and ELK, DFIR optimized hunting strategies, and support for creating detections using YARA rules and SIGMA rules.

The ThreatHunting-Keywords-yara-rules repository provides a collection of YARA rules tailored for threat hunting sessions, enabling users to identify potential threats based on specific keywords associated with offensive and greyware tools. It features two main ruleset folders: one prioritizing broader detection coverage at the cost of performance, and another optimized for higher fidelity and efficiency, along with a Python script for cross-platform scanning capabilities. The rules are systematically organized and include specialized sets for different tool types while allowing for the identification of potential threats in various file formats.

Impacket-IoCs is a reference repository providing indicators of compromise (IoCs) for detecting activities driven by the Impacket toolkit, aimed at both blue and red team professionals. It features 73 detailed IoCs categorized by protocols such as Kerberos, SMB, NTLM, and LDAP, focusing on deeper, protocol-level signals rather than surface-level artifacts. The project serves to enhance the operational security of offensive tools and improve defensive strategies by offering practical detection methodologies for smaller teams without access to commercial solutions.

CyberChef MCP Server provides an interface for the Model Context Protocol (MCP) to utilize CyberChef's extensive library of 463 data manipulation operations, facilitating seamless integration with AI assistants for tasks such as encryption, encoding, and forensic analysis. Notable features include the ability to execute complex multi-step transformations with the `cyberchef_bake` tool, recipe management for saving and reusing workflows, and advanced enterprise capabilities like batch processing and telemetry analytics. This tool effectively bridges natural language AI intent with deterministic data processing capabilities.

Red Team Rising is a comprehensive resource repository designed for red and purple team professionals, encompassing topics like Penetration Testing, Digital Forensics, Exploit Development, and Malware Analysis. It provides curated study materials, reference links to training platforms and notable YouTube channels, as well as practical commands and tools for various OS distributions suited for cybersecurity tasks. Notable features include a wide array of recommended resources for self-study and a focus on both offensive and defensive security strategies.

PDB2JSON is an Azure Functions-based application designed for secure authentication of running memory in Windows systems through its extensive SHA256 hash database. The tool provides a JSON-based interface for remote interactions with a Code+PDB analysis server, enabling functionalities like symbol resolution and hash verification without uploading binary data. Its notable features include a just-in-time hashing methodology for integrity protection and automation support for memory dump analysis through various scripting examples.

The h4cker repository is a meticulously curated collection of cybersecurity resources, tools, scripts, and training materials, aimed at supporting various aspects of cybersecurity, including offensive and defensive strategies, cloud security, and AI security. Notable features include a structured taxonomy for easy navigation across different cybersecurity domains, dedicated sections for certifications and lab-building, and organized training references and resources. This repository serves as a valuable supplemental resource for professionals seeking to enhance their knowledge and skills in cybersecurity.

The "Awesome Cybersecurity Tools" repository serves as a comprehensive catalog of security tools aimed at students, red/blue teams, and cybersecurity professionals. It categorizes a wide range of tools across various domains, including reconnaissance, web application testing, cloud security, and digital forensics, ensuring that users have access to well-maintained and widely utilized software for security testing and defensive research. Notable features include a structured navigation system for efficient lookups and a strong emphasis on responsible and authorized usage of listed tools.

The Educational Cybersecurity Tools repository serves as a comprehensive catalog of over 150 tools aimed at ethical hacking, penetration testing, and cybersecurity education. It encompasses various categories including network scanning, vulnerability assessment, and malware analysis, while emphasizing that all tools are intended for educational purposes only and may not be used for unauthorized access to systems. Noteworthy features include detailed tool descriptions, an extensive list of categories, and a focus on promoting ethical standards in cybersecurity practices.

Flipper RF Lab transforms the Flipper Zero device into a sophisticated RF analysis and research tool, featuring 15 advanced capabilities such as RF fingerprinting, adaptive signal modeling, and real-time spectrum monitoring. It enables users to perform detailed signal capture and analysis, protocol reverse engineering, and long-term logging within the 300-928 MHz frequency range. Notable functionalities include real-time activity mapping, threat modeling, and a robust modular research mode, making it suitable for professional RF forensics.

The Security Reference Guide is a curated repository of cyber security resources tailored for SOC analysts, pentesters, DFIR practitioners, and other security-focused roles. It organizes valuable links into categories such as offensive and defensive operations, engineering fundamentals, and training resources, providing context to help users select the appropriate tools and materials quickly. Notably, the guide emphasizes legitimacy, cautioning against the misuse of tools for unethical purposes.

ThreatSwarm is a comprehensive penetration testing tool that utilizes 27 AI agents to execute the entire kill chain—from reconnaissance to exploitation, post-exploitation, digital forensics, and reporting—streamlined into a single command interface. It enforces strict scope limitations via `scope_check.py`, ensuring compliance with authorized testing parameters, while leveraging a library of 754 MITRE-mapped skills to guide its operations. Notably, it operates as a Claude Code plugin, eliminating the need for additional infrastructure like Docker or cloud accounts, and outputs detailed vulnerability reports with CVSS scoring.

OSINT-D2 is an advanced open-source intelligence platform designed to transform usernames and emails into comprehensive identity dossiers, leveraging agentic AI for autonomous investigations. The tool features multi-source correlation across over 30 platforms, cognitive profiling through a six-dimension analysis, and seamless integration with ScrapingAnt's proxy infrastructure for efficient data gathering. Additionally, it supports premium PDF reporting, incorporates breach exposure checks via HaveIBeenPwned, and offers cross-platform executable binaries.

Geiger is a read-only blast-radius triage tool designed for assessing the impact of leaked credentials by identifying what resources they can access. It excels in incident response and penetration testing scenarios by running dry-run recon against credentials to evaluate their reach without altering any systems. Notable features include the ability to process various input formats, integration with other security tools like TruffleHog and Nuclei, and the option for live testing to provide impact assessments while preserving a read-only modality.

The "Awesome AI Agent Attacks" repository provides a curated timeline of real-world security incidents involving AI agents from 2024 to 2026, detailing the specific impacts, root causes, and relevant CVEs associated with each breach. It serves as a factual resource, compiling numerous documented cases to facilitate a better understanding of AI-related vulnerabilities and attack patterns, while emphasizing transparency through sourced entries. Notable features include categorized incident summaries by year, key statistics, and an attack pattern taxonomy.

The Cybersec Toolkit is an advanced cybersecurity solution that incorporates AI integration through a Model Context Protocol (MCP) server, enabling interactive tool management during penetration testing and bug bounty hunting. It features a comprehensive repository of over 670 tools, categorized into 18 modules and 14 profiles, allowing for modular installation and multi-platform support, including Linux and Termux. Unique to this toolkit is its capability for the AI to autonomously drive tool execution based on problem context, providing a hybrid approach that combines operator control with AI assistance.

The Cybersecurity Interview Questions repository is a comprehensive collection of over 200 interview questions and answers, tailored for various roles in cybersecurity, including Red Team, Blue Team, and Incident Response. Its notable features include categorization by specific topics such as web security and internal network security, along with a user-friendly live site for browsing and searching content. The repository serves as a valuable resource for job seekers, students, and professionals looking to enhance their knowledge and prepare for cybersecurity interviews.

OffsetInspect is a PowerShell toolkit designed for byte-offset inspection, source correlation, binary comparison, and defensive detection-boundary analysis. It enables analysts to identify specific content at given byte offsets and the surrounding context, while also facilitating detection workflows inspired by ThreatCheck and offering a suite of red-team analysis and triage capabilities. Notable features include efficient file handling, contextual mapping, multi-region detection, and an in-memory approach to avoid interference with endpoint protection mechanisms.

SATAN2 is an advanced counter-forensics framework designed for security professionals, Red Teams, and privacy advocates, offering features for multi-pass data destruction, nested encryption, and forensic artifact forgery. Its primary use case is to effectively eliminate sensitive information and mislead forensic analysis, making it a formidable tool against incident-response efforts. Notable features include cross-platform support, modular architecture, and specialized modules for thorough deletion and deception on both Linux and Windows systems.

SilentSniffer is an educational tool designed as a web security diagnostic sandbox to demonstrate the extent of information exposure in modern web applications. Functioning entirely as a local client-side environment, it visually portrays how a user's device state and behavioral data can be accessed without consent, utilizing a zero-coupling dynamic plugin architecture for modular functionality. Notable features include a threat escalation hierarchy that categorizes information exposure severity and ensures no data leaves the user's device during operation.

The ULTIMATE CYBERSECURITY MASTER GUIDE serves as a comprehensive knowledge base for cybersecurity practitioners, encompassing insights from over 70 expert books and 90 internal documents. It features detailed guides and playbooks for various roles, including Red Team, Blue Team, and Purple Team operations, along with a flat catalog system for easy access to all resources. Notable elements include an extensive collection of OSINT tools and custom scripts, making it an essential reference for both novice and experienced cybersecurity professionals.

Gitxray is a security analysis tool designed to analyze GitHub repositories for OSINT and forensic purposes by utilizing the public GitHub REST APIs to extract valuable information efficiently. Its primary use case includes identifying sensitive data in contributor profiles, spotting threat actors or fake repositories, and conducting forensic investigations by filtering results by specific dates. Notable features include customizable text output, integration with VirusTotal for enhanced threat detection, and the ability to run comprehensive scans on repositories to gather extensive data.

Kautolog is an automated terminal logging tool designed for Kali/Linux systems that captures comprehensive session details, including prompts, commands, and outputs across multiple terminal tabs. Notable features include integration with `tmux`, optional log syncing with rclone, customizable log directories, and a replay functionality that supports timing and instant dumping of logs. The tool provides extensive configuration options for log management, including log rotation and cleanup.

Yggdrasil is a cybersecurity tool designed to automate the installation of missing tools and streamline the configuration of Kali Linux following a fresh setup. Its primary use case is enhancing setup efficiency for cybersecurity professionals by providing automation scripts for various cybersecurity tools, alongside features like systemd service monitoring and deployment category additions. Notable features include customizable installation paths, hardening options, and support for multiple programming environments, making it a versatile resource for security practitioners.

Digital Forensics Tools is a comprehensive repository that curates essential utilities for digital investigations, including tools for disk forensics, memory analysis, malware detection, and network monitoring. Key features include disk imaging, file recovery, and memory acquisition tools, alongside advanced utilities like Volatility for memory analysis and Autopsy for user-friendly disk examination. This toolkit serves as a valuable resource for cybersecurity professionals conducting forensic investigations and data recovery tasks.

The Big Brother V5.0 is an advanced Open Source Intelligence (OSINT) framework designed for comprehensive reconnaissance on individuals, organizations, or groups. It features a highly interactive holographic dashboard supported by 21 distinct intelligence modules that facilitate deep investigative analysis. The tool allows users to conduct detailed searches and surveillance, enhancing the capabilities for gathering critical data while also offering an exclusive service for more intensive intelligence requirements.

Information Security Tasks is a collaborative repository that serves as a comprehensive resource for cybersecurity professionals, offering real-world infosec notes and methodologies. It features extensive directories covering offensive and defensive security topics such as penetration testing, incident response, and vulnerability analysis, alongside daily auto-updates of news and tools. Notable elements include an organized structure for various cybersecurity domains, community submission options for resources, and insights into emerging threats like AI and cloud security.

Hunt down social media accounts by username across social networks

The ctf-skills repository provides an extensive collection of agent skills designed to facilitate the solving of Capture The Flag (CTF) challenges across various domains, including web exploitation, binary pwn, reverse engineering, and more. Notable features include support for multiple installation methods, a comprehensive tool installer script, and detailed skill documentation for on-demand use, allowing users to efficiently integrate the necessary tools as challenges arise. It is compatible with any tool adhering to the Agent Skills specification, enhancing its versatility in competitive cybersecurity contexts.

Operative Framework is a digital investigation tool designed for interacting with multiple targets, executing a variety of modules, and managing links with these targets. Its notable features include the ability to export reports in PDF format, support for crafting custom modules, and a RESTful API for integration, all underpinned by a redesigned architecture in Rust for enhanced performance and functionality.

734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Works with Claude Code, GitHub Copilot, OpenAI Codex CLI, Cursor, Gemini CLI & 20+ platforms · Penetration testing, DFIR, threat intel, cloud security & more · Apache 2.0

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

ASN / RPKI validity / BGP stats / IPv4v6 / Prefix / URL / ASPath / Organization / IP reputation / IP geolocation / IP fingerprinting / Network recon / lookup API server / Web traceroute server

A curated list of tools officially presented at Black Hat events

Awesome hacking is an awesome collection of hacking tools.

A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.

Tools and Techniques for Blue Team / Incident Response

Cybersecurity Career Path

Quickly Extracts IP's, Email Addresses, Hashes, Files, Credit Cards, Social Security Numbers and a lot More From Text

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

FAME Automates Malware Evaluation

🕵️ OSINT Tools for gathering information and actions forensics 🕵️

Anti Forensics Tool For Red Teamers, Used For Erasing Footprints In The Post Exploitation Phase.

Security Apps for Android

A curated list of penetration testing and ethical hacking tools, organized by category. This compilation includes tools from Kali Linux and other notable sources.

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

Dynamic unpacker based on PE-sieve

Malcom - Malware Communications Analyzer

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal

Open source templates you can use to bootstrap your security programs

A repository of sysmon configuration modules

a list of 350+ Free TryHackMe rooms to start learning cybersecurity with THM

Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.