Archive | Forensics


24 November 2015 | 1,059 views

Rekall – Memory Forensic Framework

Rekall is a memory forensic framework that provides an end-to-end solution to incident responders and forensic analysts. From state of the art acquisition tools, to the most advanced open source memory analysis framework. It strives to be a complete end-to-end memory forensic framework, encapsulating acquisition, analysis, and reporting. In particular Rekall is the only memory […]

Continue Reading

30 October 2015 | 1,564 views

DAMM – Differential Analysis of Malware in Memory

Differential Analysis of Malware in Memory (DAMM) is a tool built on top of Volatility Framework. Its main objective is as a test bed for some newer techniques in memory analysis, including performance enhancements via persistent SQLite storage of plugin results (optional); comparing in-memory objects across multiple memory samples, for example processes running in an […]

Continue Reading

13 October 2015 | 2,211 views

Malheur – Automatic Malware Analysis Tool

Malheur is a automatic malware analysis tool for the automatic analysis of malware behaviour (program behaviour recorded from malicious software in a sandbox environment). It has been designed to support the regular analysis of malicious software and the development of detection and defence measures. Malheur allows for identifying novel classes of malware with similar behaviour […]

Continue Reading

06 October 2015 | 2,010 views

LiME – Linux Memory Extractor

LiMe is a Loadable Kernel Module (LKM) Linux memory extractor which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during […]

Continue Reading

03 March 2015 | 2,492 views

Appie – Portable Android Security Testing Suite

Appie is a collection of software packages in a portable Windows format to help with Android security testing, specifically penetration testing Android applications. Appie since its latest release can also help with security assessments, forensics and malware analysis. It is completely portable and can be carried on USB stick or your smartphone. Appie was designed […]

Continue Reading

29 November 2014 | 4,033 views

isowall – Completely Isolate A Device From The Local Network

Isowall is a mini-firewall that allows you to completely isolate a device from the local network. This is for allowing infected machines Internet access, but without endangering the local network. Building This project depends upon libpcap, and of course a C compiler. On Debian, the following should work:

This will put the binary isowall […]

Continue Reading

13 August 2014 | 6,036 views

ParanoiDF – PDF Analysis & Password Cracking Tool

ParanoiDF is a PDF Analysis Suite based on PeePDF by Jose Miguel Esparza. The tools/features that have been added are – Password cracking, redaction recovery, DRM removal, malicious JavaScript extraction, and more. We have posted about a few PDF related tools before, including the one this tool is based on: – peepdf – Analyze & […]

Continue Reading

06 August 2014 | 3,231 views

HoneyDrive 3 Released – The Premier Honeypot Bundle Distro

A new version of HoneyDrive, HoneyDrive 3 has been released codenamed Royal Jelly, Honeypots in a box is a great concept if you want to deploy a honeypot quickly without too much hassle. HoneyDrive is the premier honeypot Linux distro. It is a virtual appliance (OVA) with Xubuntu Desktop 12.04.4 LTS edition installed. It contains […]

Continue Reading

07 April 2014 | 2,502 views

Sysdig – Linux System Troubleshooting Tool

Sysdig is open source, Linux System Troubleshooting Tool: capture system state and activity from a running Linux instance, then save, filter and analyze. Think of it as strace + tcpdump + lsof + awesome sauce. With a little Lua cherry on top. Sysdig was born from a team’s constant frustration. System level troubleshooting is just […]

Continue Reading

03 April 2013 | 5,757 views

HoneyDrive Desktop v0.2 Released – Honeypot LiveCD

HoneyDrive is a virtual appliance (OVA) with Xubuntu Desktop 12.04 32-bit edition installed. It contains various honeypot software packages such as Kippo SSH honeypot, Dionaea malware honeypot, Honeyd low-interaction honeypot, Glastopf web honeypot along with Wordpot, Thug honeyclient and more. Additionally it includes useful pre-configured scripts and utilities to analyze, visualize and process the data […]

Continue Reading