Open-source alternatives to Fibratus

Seatbelt is a C# offensive security framework and host security auditor designed to perform endpoint surveys on Windows systems. It functions as a modular tool for identifying vulnerabilities, misconfigurations, and security-relevant artifacts on both local and remote hosts. The project distinguishes itself through a module-based check system that allows for the integration of custom security command units. It features a security event log parser to track logon and process activity, alongside a credential extraction utility for gathering browser history, saved passwords, and cloud credentials

This project is a Windows security removal tool designed to permanently disable and delete antivirus services and security monitoring components from the operating system. It functions as a system performance optimizer and policy manager to remove security mitigations and clear policy files that restrict application execution. The tool includes a Windows ISO customizer that embeds configuration files and unattended installation scripts into bootable images. This allows security features to be bypassed and services to be disabled before the initial system boot. The software covers broad capab

This project is a security tool installation framework and binary analysis toolkit designed to automate the deployment of research utilities. It provides a containerized security research environment and a system for managing Python and Ruby virtual environments to prevent dependency conflicts on the host machine. The framework distinguishes itself through a structured tool catalog and provisioning scripts that automate the installation of utilities into isolated directories. It utilizes executable symlink mapping to provide a unified command interface and supports the bootstrapping of consis

Bluetooth Honeypot

Fast incident overview

a low interaction honeypot.

A simple telnet honeypot

Port listener / honeypot in Rust with protocol guessing and safe string display

Robust data change tracking for Rails

Binary Analysis Platform

Capstone is a multi-architecture disassembly framework and binary translation system. It converts binary machine code into human-readable assembly instructions for a wide variety of hardware instruction set architectures and virtual machines. The framework supports a diverse range of targets, including x86, ARM, RISC-V, and MIPS, as well as virtual machine environments like WebAssembly and the Ethereum Virtual Machine. It functions as an instruction analysis tool capable of extracting granular decomposition data and semantic information from disassembled code. The engine is designed for low-

Angr is a binary analysis framework and static analysis tool used for reverse engineering compiled binaries. It serves as a binary decompiler and a lifting platform that translates machine code into a common intermediate representation to enable cross-architecture analysis. The framework integrates a symbolic execution engine and constraint solvers to determine the inputs required to reach specific program states. It also employs untrusted code sandboxing to isolate guest code from the host environment during analysis. Its capabilities cover control flow and data flow analysis, including the

LaZagne is a cross-platform credential recovery tool designed to extract passwords and secrets from operating systems, browsers, and applications. It functions as a security utility for retrieving stored credentials from compromised systems during penetration testing. The tool provides capabilities for decrypting domain credentials and extracting sensitive data from system storage, including memory dumps, credential managers, keychains, and password hashes. It recovers stored passwords from common software by accessing plaintext files, APIs, and local databases. The project supports digital

Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.

Uses Empire's (https://github.com/BC-SECURITY/Empire) RESTful API to automate gaining Domain and/or Enterprise Admin rights in Active Directory environments using some of the most common offensive TTPs.

A collection of tools developed by other researchers in the Computer Science area to process network traces. All the right reserved for the original authors.

HoneyWRT is a low interaction Python honeypot that is designed to mimic services or ports that might get targeted by attackers.

HoneySpider Network version of Capture-HPC

Honeyspider Network 2.1

Fast Incident Response

Using Intel's PIN tool to solve CTF problems

Python scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU

ROPMEMU is a framework to analyze, dissect and decompile complex code-reuse attacks.

Automated static analysis tools for binary programs

Boomerang Decompiler - Fighting the code-rot :)