EmailAnalyzer is a command-line application for analyzing suspicious email files (.eml). It extracts headers, links, attachments, digests (hashes), and authentication results (SPF/DKIM/DMARC) from email messages. The tool provides investigation features that generate links to threat intelligence services (VirusTotal, AbuseIPDB, URLScan) for indicators of compromise found in emails. Output can be displayed in the terminal or saved as JSON or HTML reports. The architecture is modular with separate functions for each analysis component, all depending only on the Python standard library, making them highly reusable.
ImHex is a cross-platform hex editor and binary analysis tool designed for reverse engineers, programmers, and digital forensics. It provides a rich GUI built on Dear ImGui and GLFW, with a modular plugin architecture that allows extending functionality through dynamically loaded plugins. The core library (libimhex) implements a provider abstraction for various data sources (files, disks, process memory, GDB, SSH, UDP, etc.), an event-driven communication system, a content registry for registering views, tools, settings, and data inspectors, and a pattern language engine for declarative binary parsing. The application includes built-in plugins for hex editing, data inspection, disassembly (Capstone), diffing, YARA rule matching, hashing, decompression, visualizations (3D, plots, images), scripting (C and .NET), and a Model Context Protocol (MCP) server for AI-assisted analysis. It supports undo/redo, bookmarks, patches, projects, themes, layouts, achievements, tutorials, and a command palette. The codebase is well-structured with clear separation between core library, plugins, and platform-specific code, though some components are tightly coupled to ImGui internals and the custom pattern language.
HAITI (HAsh IdenTIfIer) is a Ruby library and CLI tool for identifying hash types from input strings. It matches against a comprehensive database of over 675 hash types (including modern algorithms like SHA3, Blake2, and VeraCrypt) using regex patterns. The library provides concise output with hashcat mode numbers, John the Ripper format names, and example hashes. Multiple CLI entry points exist: the main `haiti` command, `haiti-parsable` for script-friendly output, `haiti-fzf` for interactive selection, and `hashcat-haiti`/`john-haiti` for converting hashes into hashcat/JtR formats. The codebase is well-structured, with clean separation between the identification engine, data definitions, and CLI wrappers. It includes comprehensive documentation (man pages, YARD API docs, a docsify site) and is packaged for numerous Linux distributions and Homebrew. The identification logic is straightforward but effective: iterate over a JSON array of prototypes, apply each regex to the input, and return matching types. The data file (`prototypes.json`) is manually maintained and extended with each release.
AutoRuns is a PowerShell module for live incident response that enumerates Windows autorun artifacts used by legitimate programs and malware to achieve persistence. It scans over 20 categories of autostart execution points (ASEPs) including registry keys (Run, RunOnce, BootExecute, AppInit, etc.), file system locations (Startup folders), scheduled tasks, WMI subscriptions, services and drivers, Office addins, and more. The module provides three main functions: Get-PSAutorun to collect artifacts, New-AutoRunsBaseLine to create a baseline snapshot, and Compare-AutoRunsBaseLine to compare two baselines for change detection. It supports optional file hashing (MD5, SHA1, SHA256) and digital signature verification via Get-AuthenticodeSignature. The architecture is a single PowerShell script module (AutoRuns.psm1) with internal helper functions for registry reading, path normalization, and command-line parsing. It relies solely on PowerShell 4.0+ and Windows built-in APIs, with no external dependencies. The module is designed for forensic analysts and incident responders to quickly identify persistence mechanisms on a live Windows system.
Radare2 is a modular reverse engineering framework written in C. It provides a comprehensive set of libraries and command-line tools for binary analysis, disassembly, debugging, emulation, and file format parsing. The architecture is plugin-based: every major subsystem (architectures, binary formats, I/O backends, debuggers, filesystems, crypto, scripting languages) is implemented as a plugin registered via a common RLibStruct pattern. The core library (libr/) contains reusable data structures (RBTrees, RBuffer, RStrBuf, RList, etc.), utilities (base64, ASN.1, regex, event system, thread wrappers), and analysis engines (ESIL emulator, search algorithms, type propagation). The framework supports dozens of CPU architectures (x86, ARM, MIPS, RISC-V, etc.) and binary formats (ELF, PE, Mach-O, DEX, etc.), and can be extended via language bindings (JavaScript, Python, Rust, etc.) and a package manager (r2pm). Despite its large codebase and some legacy components, the project is actively maintained with continuous integration, fuzz testing, and a responsive issue tracker.
libfsrefs is a C library for reading and parsing the Microsoft Resilient File System (ReFS). It provides a forensic-oriented API to access volume headers, checkpoints, metadata blocks, file entries, and directory structures. The library is read-only and currently supports ReFS version 1 (experimental). It includes a command-line tool `fsrefsinfo` that outputs volume details and can generate bodyfile-format timelines for digital forensics. The architecture follows the libyal ecosystem pattern: layered parsing with abstractions for file I/O (libbfio), error handling (libcerror), and string encoding (libuna). The codebase is well-structured with extensive unit tests, OSS-Fuzz integration, and cross-platform build support via autotools and MSVC. While the library is not intended as a standalone application, it is a robust foundation for forensic tools that need to analyze ReFS volumes.
DSInternals is a comprehensive .NET library and PowerShell module for Active Directory security auditing, forensic analysis, and offline/in-place manipulation of AD databases. It provides the ability to extract password hashes (NT, LM, Kerberos), decrypt DPAPI backup keys, recover LAPS and gMSA secrets, parse FIDO2/Windows Hello key credentials, and query DNS zones and signing keys. The library supports multiple access modes: offline via ESENT/ISAM (ntds.dit), online via RPC replication (DRSR), LDAP/ADSI, and SAM/LSA native APIs. The PowerShell module exposes over 50 cmdlets organized into logical groups (ADDB, ADRepl, ADSI, LSA, SAM, Hash, Encryption). The codebase is heavily oriented toward reverse-engineering of Microsoft's internal AD structures and protocols, with extensive unit tests using real-world binary vectors. While the primary use case is security auditing (e.g., penetration testing, incident response), the library also provides utilities for password quality testing, domain controller recovery, and offline account modifications. The architecture is modular, with clear separation between common data models, data store access, replication, and PowerShell cmdlets, making it a robust toolkit for Windows domain administrators and security professionals.
Sherlock is a monolithic Python CLI for username enumeration across social networks. For a given username it fans out concurrent HTTP probes to roughly 400 external sites (defined declaratively in sherlock_project/resources/data.json), then classifies each response as Claimed / Available / Unknown / Illegal / WAF using three detection modes: HTTP status code, presence/absence of a site-specific error message in the response body, or redirect behavior (redirects disabled, 2xx/3xx means claimed). Requests run in parallel via a requests-futures session capped at 20 workers; an optional per-site regex short-circuits illegal usernames without sending a request, and hardcoded fingerprint strings detect Cloudflare / PerimeterX / AWS WAF blocks. The CLI accepts one or more usernames, supports {?} wildcard expansion into `_`, `-`, `.` variants, and reports results to the terminal via a QueryNotify observer, with optional .txt, .csv, and .xlsx export. The system is fully data-driven: no per-site code exists. Each manifest entry declares the probe URL, error detection method, error signatures, optional headers/request method/JSON payload, and NSFW flag; a JSON Schema (data.schema.json) enforces conditional consistency (e.g., errorMsg required when errorType includes 'message'). By default the manifest is fetched live from https://data.sherlockproject.xyz, with an ephemeral false-positive exclusion list pulled from a dedicated GitHub branch; --local, --json, and --site flags override this behavior. Entry points are the `sherlock` console script, `python -m sherlock_project`, a Docker image entrypoint, and an Apify Actor (.actor/) that wraps the Docker image and pushes JSON results into an Apify dataset. Engineering strengths include the declarative manifest/schema design, a genuinely useful test suite (schema validation, live-target probe tests, randomized false-positive fuzzing, a Unicode regression test for issue #2730), and CI that runs a tox matrix across Python 3.10-3.14t on three OSes, validates only manifest entries modified by a PR, comments the validation summary back on the PR, and updates the exclusions list daily. Weaknesses: nearly all orchestration and output-format logic lives in a ~1,200-line sherlock.py; notify.py uses a module-global result counter; sites.py has mutable default arguments and a dead username_unclaimed parameter; the --print-found flag is always True (store_true combined with default=True); stem is an unused declared dependency; and the request layer relies on requests-futures, an effectively unmaintained library. The project is actively maintained and extremely popular (93k+ stars), and its health depends on hundreds of external sites remaining stable, hence the extensive removed-sites documentation and dedicated false-positive/false-negative issue templates. Technical drift is moderate rather than severe: the Python ^3.9 floor is now EOL, requests-futures is unmaintained, the WAF fingerprint catalog has not been extended since late 2024, and the PyPI readme still documents removed --tor flags.
androidqf is a Go-based Android forensic data acquisition tool designed to collect various types of data from an Android device via ADB. The tool automates the gathering of device properties, system logs, running processes, services, settings, diagnostic information, installed applications (with optional APK extraction), and device backups. It stores the collected data in a timestamped directory and optionally encrypts and compresses the archive using age encryption if a public key is provided. The application follows a modular architecture where each data collection task is implemented as a separate module adhering to a common interface. The core components include a cross-platform ADB wrapper that automatically deploys platform-specific binaries, an asset embedding mechanism for distributing native dependencies, and an acquisition manager that handles the lifecycle of data collection and secure storage. The tool interacts with the device through ADB commands, collects data into structured files and directories, and provides user prompts for configurable options such as backup scope and APK selection. Despite the README indicating the project is not maintained, the repository shows recent commit activity and the codebase demonstrates solid engineering practices. Dependencies are up to date, and the tool is built for cross-platform use (Windows, macOS, Linux) with automated build and release workflows. The modular design allows for extensibility, and the reusable components (such as the ADB wrapper and asset deployment) could be adapted for other projects requiring Android device interaction.
WDExtract is a command-line utility for extracting and analyzing Windows Defender/Virus Definition files. It processes VDM (Virus Definition Module) containers and MRT.exe (Malicious Removal Tool) files to extract embedded data, including PE executables, DLLs, and security signatures. The tool can also merge base VDM files with their delta updates and extract raw RMDX containers without further processing. Built with C++ and Windows API, it uses zlib for decompression and implements custom logic for parsing PE files, applying VCDIFF delta patches, and extracting resources from PE files. The application is actively maintained with recent commits and uses GitHub Actions for Windows-based builds.
LinuxGun is a collection of Bash shell scripts for Linux security incident response and system hardening. The core scripts (`linuxGun.sh`, `linuxGunPro.sh`, `linuxcheck.sh`) perform comprehensive checks across system information, user accounts, network connections, processes, files, logs, backdoors, tunnels, webshells, malware, memory, hacker tools, kernel modules, Kubernetes, and baseline security configurations. The toolset is designed for emergency triage by system administrators and security analysts, with color-coded output and modular function organization. It includes auxiliary tools for IP blocking (`blockIP.sh`), network interface monitoring (`monitorInter.sh`), process-to-IP connection mapping (`monitorPs2Ip.sh`), and a file upload server (`uploadServer.py`) for transmitting results. The repository also contains AI skill definitions (in `AI-skills/old/`) that describe an automated incident response workflow via SSH, though these appear to be experimental or deprecated. The codebase is functional but shows signs of rapid iteration, hardcoded assumptions (CentOS 7, specific command availability), incomplete modules, and mixed-language comments (Chinese/English). It is not a polished library but a practical, field-tested toolkit for Linux forensics.