jgru

vmi-gui-reconstruction

Proof-of-concept code to reconstruct the GUI of a Xen guest running Windows

xmpp-mitm

Python utility that decrypts TLS encrypted XMPP traffic by acting as an active MITM and looking for STARTTLS requests

ansible-drakvuf

Ansible role to install the black-box binary analysis DRAKVUF

ansible-cuckoo-virtualbox

Ansible role to deploy a Cuckoo sandbox host, which uses VirtualBox VMs as machinery

hashlab

Generates lists of hashes of known benign and common files from Vagrant boxes in an automated manner for the use of whitelisting in DFIR workflows.

libja3

WIP! - C-Library to compute JA3 TLS fingerprints

ufed-geo2x

This is a simple utility to extract geolocation data from a .xml-report of Cellebrite's UFED Physical Analyzer.

grus-ghidra-scripts

Just a collection of my Ghidra/scripts to aid malware reversing

stream-to-s3

Stream data from stdin into an S3-bucket

toolkit-obfuscator

Collection of simple scripts to modifiy a live response toolkit

backdoors

Simple linux backdoors and hiding techniques

community

Volatility plugins developed and maintained by the community

CVE-2021-3156

CVE-2021-3156: Sudo heap overflow exploit for Debian 10

dfxml_cpp

C++ implementation of DFXML reader and writer

dfxml_python

Digital Forensics XML packages in Python

digital-forensics-lab

Free hands-on digital forensics labs for students and faculty

drakvuf

DRAKVUF Black-box Binary Analysis

drakvuf-ci

eml_parser

python eml parser module

filetags

Management of simple tags within file names

kernel-fuzzer-for-xen-project

Kernel Fuzzer for Xen Project (KF/x) - Hypervisor-based fuzzing using Xen VM forking, VMI & AFL

memory-replay

Mirror of Dr Tamas K Lengyel's memory replay from https://xenbits.xen.org/git-http/people/tklengyel/memory-replay.git

opencl-playground

Solving tasks by outsourcing computation on the graphics adapter with the usage of OpenCL

pafish

Pafish is a demonstration tool that employs several techniques to detect sandboxes and analysis environments in the same way as malware families do.

prisma

Command Line STDOUT Colorer

reg-parser

RegRipper3.0

RegRipper3.0

reversing-class

LERN GHIDRA

sflock

Sample staging & detonation utility to be used in combination with Cuckoo Sandbox.

swap_digger

swap_digger is a tool used to automate Linux swap analysis during post-exploitation or forensics. It automates swap extraction and searches for Linux user credentials, web forms credentials, web forms emails, http basic authentication, Wifi SSID and keys, etc.