EricZimmerman / KapeFiles

C# based evtx parser with lots of extras

Prefetch Explorer Command Line

Parses $MFT from NTFS file systems

Full featured, offline Registry parser in C#

Volatility 3.0 development

PoC to record audio from a Bluetooth device

An advanced memory forensics framework

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

A bash inspired readline implementation for PowerShell

RDP Bitmap Cache parser

PowerShell Obfuscator

nanodlp

AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10

Livebox Component for Home assistant

clumsy makes your network condition on Windows significantly worse, but in a controlled and interactive manner.

The ultimate WinRM shell for hacking/pentesting

GUIslice drag & drop embedded GUI in C for touchscreen TFT on Arduino, Raspberry Pi, ARM, ESP8266 / ESP32 / M5stack using Adafruit-GFX / TFT_eSPI / UTFT / SDL

GUIslice drag & drop embedded GUI in C for touchscreen TFT on Arduino, Raspberry Pi, ARM, ESP8266 / ESP32 / M5stack using Adafruit-GFX / TFT_eSPI / UTFT / SDL

The modern text-based widget toolkit

Yara-Endpoint is a tool useful for incident response as well as anti-malware enpoint base on Yara signatures.

GoFetch is a tool to automatically exercise an attack plan generated by the BloodHound application.

A collection of phishing samples for researchers and detection developers.