Open-source alternatives to Volatility3

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

This project is a desktop client for YouTube Music, serving as a cross-platform wrapper that encapsulates the web-based music service within a dedicated application environment. It provides native operating system integration and enhanced window controls for streaming audio. The application is distinguished by its extensibility, featuring a plugin system that allows the execution of custom scripts to modify frontend markup and application behavior. It also supports visual customization through the injection of external stylesheets to modify the user interface themes. The software manages aud

Vorpal is a Node.js interactive CLI framework and terminal user interface library used to build extensible command-line shells. It functions as an interactive command-line parser that converts string input into executable functions, managing the lifecycle of terminal sessions and command routing. The framework is distinguished by a plugin-based extension architecture that allows external modules to register new commands, shared behaviors, and complete command suites into the core environment. It supports the creation of custom shell environments with specialized namespaces and a system for pe

DbGate is a universal database management tool and SQL client that provides a unified interface for querying and administering multiple SQL and NoSQL databases. It functions as a multi-database administration GUI and SQL IDE, allowing users to write and execute scripts and manage database schemas. The project distinguishes itself by acting as an API client and explorer for REST, GraphQL, and OData services, enabling users to fetch and export data from these endpoints. It also serves as a data integration tool, facilitating the movement of records between diverse databases and file formats suc

Hayabusa is a Windows event log analyzer, threat hunting tool, and forensic timeline generator. It functions as a detection engine that applies threat patterns to logs to identify suspicious behavior and security threats. The project distinguishes itself through the ability to synchronize detection rules from remote repositories and tune risk levels to prioritize critical alerts. It also provides specialized forensic capabilities, such as extracting event log data into chronological records for incident response investigations. The tool's broader capabilities include security log enrichment

Lynis is an automated security auditing and system hardening framework designed for UNIX-based operating systems. It functions as a command-line utility that inspects local system configurations to identify security vulnerabilities, configuration weaknesses, and compliance gaps. By executing a series of modular tests, the tool generates actionable reports and remediation suggestions to assist in strengthening system defenses. The project distinguishes itself through a highly modular architecture that relies on shell-script-based execution and native system inspection. Users can define custom

Ladon is an internal network penetration scanner and vulnerability assessment tool designed to identify high-risk security flaws and assets across network segments. It operates as a fileless security scanner, executing its engine and modules directly in memory to avoid leaving a disk footprint on target systems. The project is distinguished by its integration as a plugin for command beacons, specifically within the Cobalt Strike framework. This allows for memory-resident network discovery and vulnerability detection. It further supports stealth operations through payload and script obfuscatio

Benthos is a stream processing engine and data integration pipeline used for routing, transforming, and connecting data streams between diverse sources and sinks. It functions as event routing middleware and a change data capture tool, streaming real-time database modifications as discrete events for downstream processing. The system utilizes a declarative pipeline configuration, where data flow and processing logic are defined in a single static file. It features a specialized domain-specific language for mapping, filtering, and enriching data payloads, allowing for complex transformations w

Armortools is a 3D PBR texture painting suite and mesh texture workflow tool. It provides a system for painting physically based rendering materials directly onto 3D meshes using a combination of layer and mask support, a GPU-accelerated texture baker for extracting geometry data from high-polygon models, and a node-based material editor for creating procedural textures. The software features integrated neural network tools for AI texture authoring, allowing the generation of PBR maps from text prompts, image-based material extraction, and texture upscaling via local nodes. It also implements

Objection is a dynamic instrumentation framework and runtime exploration toolkit for mobile application security analysis. It provides a command-line interface to interact with the memory and state of iOS and Android applications during active execution, serving as a toolkit for runtime analysis and security testing. The project distinguishes itself by providing specialized capabilities to bypass common mobile security controls, including SSL pinning, biometric authentication, and root or jailbreak detection. It enables the extraction of sensitive credentials and data from secure storage syst

Chainsaw is a Windows forensic analysis tool used for parsing system databases and extracting security artefacts. It functions as a forensic artefact extractor and a scanner for identifying security threats and log tampering within Windows event logs. The project distinguishes itself by implementing a Sigma rule forensic scanner that applies standardized detection logic and custom rule sets to event logs and forensic artefacts. It enables threat hunting workflows by matching event data against patterns to identify malicious activity, lateral movement, and brute force attacks. The tool's capa

pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode, and hooks. It functions as an in-memory implant detector, malware unpacker, and process callstack analyzer designed to locate and dump memory patches and injected code from running processes. The project identifies advanced evasion techniques, such as process hollowing and reflective injection, by verifying portable executable structures in memory. It distinguishes itself by analyzing process callstacks to detect anomalies and redirections and by reconstructing executable heade

Gotify is a self-hosted notification server designed to centralize the receipt and dispatch of real-time messages. It provides a RESTful API and a WebSocket gateway, allowing users to programmatically send alerts and push notifications to connected clients. By maintaining a private infrastructure, the platform ensures full control over message history, data retention, and access management. The system distinguishes itself through a modular, plugin-based architecture that allows for the extension of core functionality, including custom HTTP endpoints and webhook event processing. It supports g

Sigma is a suite of tools for defining generic log signatures and translating them for multiple backends. It provides a structured way to define malicious behavior and detection logic independently of any specific backend technology, acting as a translation engine that maps generic event fields and correlation logic to the proprietary query languages of security data lakes and SIEM platforms. The project features a plugin-based multi-backend query generator that exports security detections into various database and log management formats. It also includes a threat framework mapping tool that

Foreman is a lifecycle infrastructure management platform used for automating the provisioning, configuration, and monitoring of physical, virtual, and cloud servers. It serves as a central hub for managing the entire lifespan of a server, from initial deployment and operating system upgrades to decommissioning and auditing. The platform functions as a hybrid cloud manager and bare-metal provisioning tool, providing a unified interface to control virtual machine lifecycles across diverse hypervisors and public cloud providers. It automates hardware discovery and operating system deployment us

Forem is an open-source platform designed for building and managing technical communities. It functions as a social publishing engine that enables members to share long-form content, participate in threaded discussions, and engage through social interactions. The platform provides tools for organizations to maintain branded profiles, host community hackathons, and facilitate collaborative learning through structured educational tracks. Beyond its social features, Forem integrates advanced capabilities for AI agent workflow orchestration and codebase knowledge graphing. It allows developers to

AVML - Acquire Volatile Memory for Linux

LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisitio

Raycast Extensions is an open-source platform for building and distributing self-contained plugins that integrate with the Raycast desktop application. It provides an extension plugin framework where developers create packages using TypeScript, React, and Node.js, with each extension declaring its commands and permissions through a static manifest. The platform includes a hot-reload development server that watches source files and triggers live UI updates without restarting the host application. The platform distinguishes itself through deep AI integration capabilities, allowing extensions to

MagicMirror is an open source framework for creating personalized information dashboards, specifically designed for use as a modular smart mirror platform and a plugin-based dashboard framework. It functions as a system for aggregating data feeds and modular components to create a centralized information hub. The platform utilizes a module-based plugin architecture that allows for the development and integration of custom third-party plugins through a standardized interface. This extensibility enables the creation of personalized displays and custom data widgets. The system supports a headle

Unredacter is a computer vision text reconstructor and image forensics utility designed to recover hidden characters from pixelated images. It functions as a tool for reversing pixelation to identify text within obscured visual blocks. The system uses a process of comparing pixelated image blocks against rendered candidate characters that match the typographic styles of the target text. This allows for the reconstruction of obscured information through automated visual analysis. The project covers capabilities for digital forensics analysis, image redaction testing, and information leakage a

frida-dexdump is an Android memory forensics tool that recovers Dalvik Executable (DEX) files from running application processes using the Frida dynamic instrumentation framework. It functions as a Frida-based runtime analyzer and DEX memory dumper, capable of extracting obfuscated or packed DEX files without modifying the Android system. The tool distinguishes itself through its ability to repair corrupted or missing DEX file headers using heuristic analysis and fuzzy matching techniques. It employs fuzzy boundary detection to identify DEX file boundaries in memory even when headers are dama

Hapi is a configuration-driven web framework for building secure and scalable HTTP servers and APIs on the Node.js runtime. It functions as a REST API development framework and an enterprise server implementation focused on stability, security, and comprehensive input validation. The framework is built around a plugin-based architecture, allowing core functionality and custom logic to be organized into modular, registerable plugins. It serves as an HTTP request lifecycle manager, enabling the interception and modification of requests through pre-handlers and extensions before they reach the f

FOCA is a digital forensics metadata analyzer and open-source intelligence tool used to extract hidden information from various document types. It functions as a metadata extraction tool that isolates technical data and EXIF information from PDFs, office documents, and SVG files. The system integrates an open-source intelligence scanner that identifies and downloads target files from the web using multiple search engine APIs. This allows for the automated discovery and acquisition of remote web assets for batch analysis and digital evidence gathering. The software provides capabilities for d

DataX is a distributed data integration framework and plugin-based ETL tool designed for synchronizing large datasets between heterogeneous sources and destinations. It functions as a JDBC data migration engine and offline synchronization tool, enabling the movement of data between relational databases, NoSQL stores, and object storage. The system utilizes a plugin-based connector architecture that decouples reader and writer logic, allowing it to map and transform data types across different storage engines using a standardized internal representation. This design supports heterogeneous data

pyWhat is a Python-based data extraction tool designed to scan files and text for sensitive identifiers, credentials, and network artifacts using regular expressions. It functions as a pattern matching engine and PII scanner capable of identifying personal identifiers and sensitive data patterns across directories and binary files. The project specializes in the identification of unknown data formats through file signatures and the extraction of high-value identifiers, such as URLs, IP addresses, and phone numbers, from network capture files. It utilizes a rarity-based filtering system and sp

Small is a cross-platform plugin framework and modularization tool designed to break monolithic mobile applications into independent components. It provides a modular mobile architecture that allows developers to split applications into decoupled plugins to reduce system complexity and memory usage across multiple operating systems. The framework includes a dynamic module loader for on-demand feature loading to improve startup times and a dependency injection service registry that connects feature modules to a central core for service discovery. The system provides a platform abstraction lay