dfirfpi

dpapilab. Windows DPAPI laboratory

decwindbx. A sort of a toolkit to decrypt Dropbox Windows DBX files

lsadecryptxp. LSASS LsaEncryptMemory(..decrypt..) for NT 5.1 and 5.2

HackInBo. Unofficial Collection of Slides and Programs of HackInBo

wbin_installer. Personal scripts to setup dfir tools on fedora

mvtu. MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

decoder. "secrets" decoding for FRITZ!OS devices

PayloadsAllTheThings. A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Bad-Pdf. Steal Net-NTLM Hash using Bad-PDF

MemLabs. Educational, CTF-styled labs for individuals interested in Memory Forensics

security-apis. A collective list of public APIs for use in security. Contributions welcome

Pentest-Tools.

Hob0Rules. Password cracking rules for Hashcat based on statistics and industry patterns

munin. Online hash checker for Virustotal and other services

PrivescCheck. Privilege Escalation Enumeration Script for Windows

etl-parser-ng. Event Trace Log file parser in pure Python

WindowsRpcClients. This respository is a collection of C# class libraries which implement RPC clients for various versions of the Windows Operating System from 7 to Windows 10.

r0ak. r0ak ("roak") is the Ring 0 Army Knife -- A Command Line Utility To Read/Write/Execute Ring Zero on for Windows 10 Systems

EVTX-ATTACK-SAMPLES. Windows Events Attack Samples

Zircolite. A standalone SIGMA-based detection tool for EVTX.

win-exec-calc-shellcode. A small, null-free Windows shellcode that executes calc.exe (x86/x64, all OS/SPs)