Awesome GitHub RepositoriesDigital Forensics

This project is a comprehensive cybersecurity tool collection designed to support security research, penetration testing, and vulnerability assessment. It functions as a unified penetration testing suite, providing a centralized environment where professionals can access a wide range of offensive security utilities to identify system weaknesses and study attack vectors. The platform distinguishes itself through a modular architecture that aggregates disparate security scripts into a single, hierarchical command-line interface. It simplifies the management of these utilities by integrating ext

This project is a comprehensive, community-curated directory of cybersecurity resources, tools, and educational materials. It functions as a centralized index for researchers and students to discover frameworks and utilities across the entire security lifecycle, ranging from initial vulnerability assessment to post-exploitation analysis. The repository distinguishes itself through a hierarchical taxonomy that organizes diverse security disciplines into a searchable, version-controlled knowledge base. Rather than hosting software directly, it utilizes a decentralized aggregation model that lin

This project is a comprehensive, curated directory of cybersecurity resources, software, and documentation designed to support system and network protection. It serves as a centralized knowledge base and index for security professionals, aggregating industry-standard practices and open-source tools across a wide range of technical domains. The repository distinguishes itself by providing a structured collection of methodologies and frameworks for security operations. It covers critical areas including threat intelligence, digital forensics, infrastructure auditing, and vulnerability assessmen

John is a command-line security utility designed for password strength auditing and cryptographic hash recovery. It functions as a professional tool for identifying weak user credentials and recovering access to protected files, archives, and private keys across various operating systems, databases, and applications. The software distinguishes itself through a high-performance architecture that utilizes processor-level vector instructions to perform parallel cryptographic operations. It incorporates a rule-based mutation engine that transforms dictionary words into complex candidates based on

Unredacter ist ein Computer-Vision-Tool zur Textrekonstruktion und Bildforensik, das darauf ausgelegt ist, versteckte Zeichen aus verpixelten Bildern wiederherzustellen. Es fungiert als Werkzeug zur Umkehrung der Verpixelung, um Text innerhalb verdeckter visueller Blöcke zu identifizieren. Das System verwendet einen Prozess, bei dem verpixelte Bildblöcke mit gerenderten Kandidatenzeichen verglichen werden, die den typografischen Stilen des Zieltextes entsprechen. Dies ermöglicht die Rekonstruktion verdeckter Informationen durch automatisierte visuelle Analyse. Das Projekt deckt Funktionen für digitale forensische Analysen, Tests zur Bildschwärzung und Bewertungen von Informationslecks ab, um die Wirksamkeit bildbasierter Maskierungstechniken zu überprüfen.

Volatility is a memory forensics framework and digital forensics tool designed to extract and analyze evidence from volatile computer memory dumps. It functions as a memory dump parser and analysis platform used to identify running processes, network connections, and loaded modules from a system RAM capture. The framework enables the reconstruction of system state to uncover malicious activity, such as rootkits and injected code, during malware incident response and threat hunting. It provides capabilities for digital forensic investigations to detect unauthorized access and indicators of com

pyWhat is a Python-based data extraction tool designed to scan files and text for sensitive identifiers, credentials, and network artifacts using regular expressions. It functions as a pattern matching engine and PII scanner capable of identifying personal identifiers and sensitive data patterns across directories and binary files. The project specializes in the identification of unknown data formats through file signatures and the extraction of high-value identifiers, such as URLs, IP addresses, and phone numbers, from network capture files. It utilizes a rarity-based filtering system and sp

This project is a community-curated repository of YARA rules used to detect malware, webshells, and other malicious patterns in files. It serves as a dataset of signatures for identifying known malware families, software packers, and threat intelligence indicators. The collection provides specialized detection capabilities for identifying exploit kits and anti-analysis evasion techniques, such as anti-debugging and anti-virtualization methods. It also includes signatures for cryptographic algorithm detection and the identification of unauthorized remote administration tools on servers. The r

EQGRP ist ein Remote-Access-Trojan-Framework und Post-Exploitation-Toolkit. Es bietet eine zentrale Command-and-Control-Infrastruktur für das Deployment persistenter Implants und die Verwaltung von Remote-Agenten über diverse Betriebssysteme hinweg. Das Projekt enthält Tools für digitale forensische Evasion, wie das Modifizieren von System-Logs und Dateisystem-Zeitstempeln, um Ausführungsspuren zu entfernen. Es bietet ein Netzwerk-Interzeptionssystem zum Abfangen und Rekonstruieren von Datenströmen durch Hooking in das System-Root sowie Exploits, die für Kernel-Privilege-Escalation entwickelt wurden, um Prozessberechtigungen auf administrative Root-Ebene zu heben. Das Toolkit deckt ein breites Spektrum an Funktionen ab, einschließlich Remote-Code-Execution, Shellcode-Packing für Signatur-Evasion sowie die Exfiltration und das Parsen von Mobilgerät-Logs und Telekommunikationsaufzeichnungen. Es bietet zudem Utilities für das Binden von Netzwerkports und das Durchsuchen entschlüsselter Archive.

Volatility3 ist ein Framework für Speicherforensik und ein Analysetool, das zum Parsen von flüchtigen Speicher-Dumps verwendet wird. Es extrahiert digitale Artefakte und rekonstruiert den Laufzeitzustand eines Systems, um Prozessinformationen, Netzwerk-Artefakte und andere forensische Beweise wiederherzustellen. Das System fungiert als Plugin-basiertes forensisches Engine und als Symbol-Resolver für Betriebssysteme. Es bildet rohe Speicheradressen auf bekannte Systemstrukturen unter Verwendung von Symboltabellen und Übersetzungsschichten ab und bietet eine erweiterbare Architektur für die Erstellung benutzerdefinierter Scanner und Renderer. Das Framework enthält einen Kommandozeilen-Speicherexplorer für die Echtzeit-Datenerkennung und eine programmierbare Schnittstelle zur Automatisierung der Erstellung von Speicherberichten. Es handhabt die Extraktion digitaler Artefakte und die Auflösung von System-Symbolen durch einen schichtbasierten Adressübersetzungsprozess.

This project is a curated, version-controlled directory of software and resources designed for cybersecurity professionals and researchers. It functions as a centralized knowledge base that aggregates and organizes external security utilities into a structured taxonomy to facilitate discovery and access for specialized research and testing tasks. The repository distinguishes itself through a community-driven model where external resource locations are verified and maintained by contributors. By leveraging a distributed version control system, the project ensures the historical integrity and c

FOCA is a digital forensics metadata analyzer and open-source intelligence tool used to extract hidden information from various document types. It functions as a metadata extraction tool that isolates technical data and EXIF information from PDFs, office documents, and SVG files. The system integrates an open-source intelligence scanner that identifies and downloads target files from the web using multiple search engine APIs. This allows for the automated discovery and acquisition of remote web assets for batch analysis and digital evidence gathering. The software provides capabilities for d

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe

Hayabusa is a Windows event log analyzer, threat hunting tool, and forensic timeline generator. It functions as a detection engine that applies threat patterns to logs to identify suspicious behavior and security threats. The project distinguishes itself through the ability to synchronize detection rules from remote repositories and tune risk levels to prioritize critical alerts. It also provides specialized forensic capabilities, such as extracting event log data into chronological records for incident response investigations. The tool's broader capabilities include security log enrichment

Autopsy is a digital forensic analysis platform and evidence management suite used to process disk images and file systems. It provides a graphical interface for performing deep forensic examinations of computer hard drives to identify and extract digital artifacts for investigations. The platform is built as a Java-based forensic framework that integrates native libraries to perform direct disk image analysis. It utilizes a modular architecture, allowing for the extension of data ingestion and report generation through the use of plugins. The system manages digital evidence within a central