interplains / zero-breach
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
interplains / zero-breach
sherlock-project / sherlock
Hunt down social media accounts by username across social networks
mvt-project / mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
prowler-cloud / prowler
Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
bleachbit / bleachbit
BleachBit system cleaner for Windows and Linux
google / grr
GRR Rapid Response: remote live forensics for incident response
volatilityfoundation / volatility3
Volatility 3.0 development
jekil / awesome-hacking
Awesome hacking is an awesome collection of hacking tools.
ljagiello / ctf-skills
Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more
google / timesketch
Collaborative forensic timeline analysis
log2timeline / plaso
Super timeline all the things
RyanDFIR / hindsight
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
ahmedkhlief / APT-Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
domainaware / parsedmarc
A Python package and CLI for parsing aggregate and forensic DMARC reports
ForensicArtifacts / artifacts
Digital Forensics artifact repository
ydkhatri / mac_apt
macOS (& ios) Artifact Parsing Tool
frangelbarrera / OSINT-BIBLE
Comprehensive 2026 OSINT guide — 450+ tools, AI intelligence, methodologies & ethics across 35 sections for investigation & threat intel.
wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
asdfgh1445 / ctf-super-hub
面向小白用户的 CTF / 逆向 Skills 整合包：自动分流、头脑风暴、教学模式、比赛模式、只提示模式
google / turbinia
Automation and Scaling of Digital Forensics Tools
williballenthin / python-evtx
Pure Python parser for Windows Event Log files (.evtx)
chadi0x / TheBigBrother
The Big Brother is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.
MISP / misp-warninglists
Warning lists to inform users of MISP about potential false-positives or other information in indicators
AnonCatalyst / Ominis-OSINT
This Python application is an OSINT (Open Source Intelligence) tool called "Ominis OSINT - Web Hunter." It performs online information gathering by querying Google for search results related to a user-inputted query. The tool extracts relevant information such as titles, URLs, and potential mentions of the query in the results.
7onez / cti-expert
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
Azr43lKn1ght / DFIR-LABS
DFIR LABS - A compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.
fkie-cad / friTap
Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.
ImKKingshuk / LockKnife
LockKnife: The Ultimate Android Security Research Tool. A unified TUI workspace and headless CLI for deep Android security research, built for researchers and hackers. Powered by Python orchestration and a Rust-accelerated core, enabling AI agent–driven hacking, credential recovery/cracking, APK analysis, intelligence gathering, runtime inspection.
google / cloud-forensics-utils
Python library to carry out DFIR analysis on the Cloud
kelviq / tare
Ask Claude Code where your usage went. Token audit, limit diagnosis and usage forensics — built from the session logs already on your machine, nothing leaves it.
Shuo-Liang-0111 / RA-Bench
Real-event-anchored benchmark for detecting AI-generated videos in real-world crisis settings.
osintshifu / awesome-osint-repos
Continuously updated catalogue of open-source OSINT tools, skills, plugins, MCP servers, and agentic integrations.
RomanZhukov9 / Crypto-Recovery-Tool
Python-based cryptocurrency wallet forensics suite supporting 40+ wallet types on Windows, Linux, and macOS. Features encrypted vault analysis, wallet detection, seed recovery, multi-chain address derivation, threaded processing, and TXT/CSV/JSON export. Designed for security research, compliance, incident response, and blockchain investigations.
Asaf-Livne / raw-patch-attribution
Attribute an image to the model that generated it — from raw pixels, with a ~6M-parameter CNN (RPA).
Fenon-Robotics / egodup
Local-first detection and temporal localization of reused footage in egocentric video.
karim852 / Kage-DFIR-toolkit
Kage 影 is a Windows host DFIR triage console. Point it at a suspect machine, get everything back in one sealed chain: artefact collection, Sigma-correlated timeline, YARA verdicts, open sockets tied to processes, local accounts, disk root anomalies, logging blind spots, indicator reputation, and a calibrated risk score with the report behind it.
EmadAbedini / Dumplyzer
Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.
wushulin111 / ir-forensic-analysis
应急响应取证分析 — 11维检测 + 6源威胁情报
prox0959 / CyberCodex
Autonomous 23-Source Zero-Cost OSINT, Binary Image Forensics (EXIF/GPS/Stego), Data Breach/Leak & Threat Intelligence Engine in Pure Python
Technicalflight / image-prompt-reverse
把一张图片逆推成生成提示词（Image to Prompt）：中英双语重建提示词 + 风格标签 + 结构化 JSON prompt，零依赖校验脚本 | Forensic image-to-prompt reconstruction. AGPL-3.0 · Commercial use requires license.
DresdenGman / the-backtest-that-lied
Evidence-driven forensic investigation: how a near-perfect A-share ML prediction signal collapsed under rigorous validation