PExtractor_v0.18b_binary_and_src.rar
Developement by: http://l-bytes.tk
Description: PExtractor is a forensics tool that can extract all files from an executable file created by a joiner or similar.
Update Time: 2008-01-26
File Size: 47KB
Download Url: PExtractor_v0.18b_binary_and_src.rar.zip [Getlink]
Showing posts with label Forensics. Show all posts
PE Explorer 1.96
Developement by: http://www.heaventools.com/
Description: PE Explorer is the most feature-packed tool for inspecting the inner workings of PE files (EXE, DLL, ActiveX controls, and several other Windows executable formats). It comes with a PE File Viewer, Disassembler, Exported/Imported API Function Viewer, API Function Syntax Lookup, Resource Editor & Dependency Scanner. Once inside, file structure can be analyzed and optimized, problems diagnosed, changes made and resources repaired. It tells you just about every little detail you could possibly want to know about a PE file.
Update Time: 2006-12-02
File Size: 2498KB
Download Url: PE.Explorer.1.96.zip [Getlink]
LaBrea Honeypot 2.5
Developement by: http://labrea.sourceforge.net/
Description: LaBrea takes over unused IP addresses, and creates virtual servers that are attractive to worms, hackers, and other denizens of the Internet. The program answers connection attempts in such a way that the machine at the other end gets "stuck", sometimes for a very long time.
Update Time: 2006-12-02
File Size: 244KB
Download Url: LaBrea.Honeypot.2.5.zip [Getlink]
NTLast™ v3.0
Developement by: http://www.foundstone.com/
Description: NTLast is specifically targeted for serious security and IIS administration. Scheduled review of your NT event logs is critical for your network. A server breach can be uncovered by regular system auditing. Identifying and tracking who has gained access to your system, then documenting the details is now made easier with NTLast. This tool is able to quickly report on the status of IIS users, as well as filter out web server logons from console logons. Key Features Reads saved .evt files - makes it easy to search through your archives Allows you to search before, after, and between dates - again to zoom in on something Filters logons From a certain host - helps you zoom in on suspected intrusions Can save files in a csv format w/ time field formatted for Excel Filters out and distinguishes web log usage - cuts down search time
Update Time: 2006-12-09
File Size: 104KB
Download Url: NTLast™.v3.0.zip [Getlink]
ShoWin v2.0
Developement by: http://www.foundstone.com/
Description: ShoWin displays useful information about windows by dragging a cursor over them.Perhaps one of the most popular uses of this program is to display hidden password editbox fields (text behind the asterisks *****). This will work in many programs although Microsoft have changed the way things work in some of their applications, most notably MS Office products and Windows 2000. ShoWin will not work in these cases. Neither will it work for password entry boxes on web pages, at least with most web browsers.Additional features include the ability to enable windows that have been disabled, unhide hidden windows (try the program with the include invisibles option set and see how many windows you have on your desktop that you didnt know about!) and force windows to stay on top or be placed below others.
Update Time: 2006-12-09
File Size: 8KB
Download Url: ShoWin.v2.0.zip [Getlink]
RegVac Registry Cleaner (latest)
Developement by: Unknow
Description: Latest version of RegVac-----------------------------------cleans registery files and optimize youre system
Update Time: 2008-01-07
File Size: 3675KB
Download Url: RegVac.Registry.Cleaner.(latest).zip [Getlink]
Patchit v2.0
Developement by: http://www.foundstone.com/
Description: A file byte-patching utility. This is driven by a simple scripting language. It can patch sequences of bytes in any file, search for byte patterns (with wildcards) and also extract and utilise DLL exported function addresses as source positions in files to be patched. The total command list is as follows: MESSAGE <"message"> Displays a message during script execution. DIR <"directory path"> Optional directory path to search for files. For compatibility it is advisable not to use specific drive names in the path. FILE <"filename"> [filesize] Filename to patch. Optional filesize specifies the size that the file must match to be accepted. FIND [<*>]... Performs a search on the current file for the sequence of bytes that match ... up to max 256. Use the keyword * to match any byte. If a match is found then the PATCH file position value is set to the file position at which the found pattern begins. FUNCTION <"funcname"> Sets the current patch position to the file position of the given exported function name (case sensitive). It is assumed that the file being patched is a DLL. PATCH [[POS ] | [OFFSET ]] ... Patches the current file at optional file position/offset. Replaces orig_byte with new_byte. Fails if original byte read from file is not orig_byte. COPY <"orig_file"> <"new_file"> Copies "orig_file" to "new_file" DELETE <"filename"> Deletes the specified file. INIFILE <"filemame"> Specifies an INI file to be used in subsequent INI commands. This filename is relative to the last DIR directory path. INISECTION <"section"> Specifies an INI section name for use in subsequent INIWRITE commands INIWRITE <"keyname"> <"value"> Writes the given string value to the INI keyname in the previously specfied INI files section. What can this program be used for? Well I sometimes liked to reverse engineer programs, purely for my own benefit. I thought it would be useful to write a program that performed the dual tasks of altering an applications behavior and at the same time kept a documented note of exactly what I had done to achieve the result in the form of the commented script file.
Update Time: 2006-12-09
File Size: 11KB
Download Url: Patchit.v2.0.zip [Getlink]
xplico-0.5.7
Developement by: http://www.xplico.org/
Description: Xplico is an open source Network Forensic Analysis Tool (NFAT) that allows for data extraction from traffic captures. It supports extraction of mail from POP, IMAP, and SMTP, can extract VoIP streams, etc. This is the version that has a GUI allowing you to view photos, texts and videos contained in MMS messages.
Update Time: 2010-05-13
File Size: 1556KB
Download Url: xplico.0.5.7.zip [Getlink]
mp3nema-v0_4
Developement by: http://www.757labs.com/
Description: MP3nema is a tool aimed at analyzing and capturing data that is hidden between frames in an MP3 file or stream, otherwise noted as "out of band" data. This utility also supports adding data between frames and capturing streaming audio.
Update Time: 2009-04-09
File Size: 118KB
Download Url: mp3nema.v0_4.zip [Getlink]
dumpAutoComplete v0.7
Developement by: http://www.foundstone.com/
Description: This application will search for the default Firefox profile of the user who runs the tool and dump the AutoComplete cache in XML format to standard output. Alternatively, autocomplete files can be passed to the application and they will be parsed as well. This application understands mork based autocomplete files (Firefox 1.x) as well as SQLite based formhistory and webappsstore files (Firefox 2.x).The download package contains a standalone windows application. The MSVCR71.dll maybe needed on systems that do not already have this file. The full Python source code is also included and can be run on Windows, Mac OS X, Linux, or any other system with Python installed (the additional "pysqlite2" modulal is required for SQLite based file parsing).
Update Time: 2006-12-09
File Size: 1337KB
Download Url: dumpAutoComplete.v0.7.zip [Getlink]
pd_v1.1_lnx
Developement by: Unknow
Description: Process Dumper is able to make a dump of a running process in a forensical manner. Linux version.
Update Time: 2010-04-26
File Size: 212KB
Download Url: pd_v1.1_lnx.zip [Getlink]
pd_v1.1_win
Developement by: Unknow
Description: Process Dumper is able to make a dump of a running process in a forensical manner. Windows version.
Update Time: 2010-04-26
File Size: 46KB
Download Url: pd_v1.1_win.zip [Getlink]
dff-src-0.5.0
Developement by: http://www.digital-forensic.org/
Description: DFF (Digital Forensics Framework) is a simple but powerful tool with a flexible module system which will help you in your digital forensics works, including file recovery due to error or crash, evidence research and analysis, etc. DFF provides a robust architecture and some handy modules.
Update Time: 2010-03-17
File Size: 2838KB
Download Url: dff.src.0.5.0.zip [Getlink]
Vision v1.0
Developement by: http://www.foundstone.com/
Description: Vision, a host based Forensic Utility is the GUI successor to the well-known freeware tool, Fport. This innovative new product from Foundstone shows all of the open TCP and UDP ports on a machine, displays the service that is active on each port, and maps the ports to their respective applications. Vision allows users to access a large amount of supplementary information that is useful for determining host status by displaying detailed system information, applications running, as well as processes and ports in use. Key Features Interrogate ports and identify potential "Trojan" services by using the "Port Probe" command in the port mapper. Using "Port Probe", Vision will enable you to send a customized string of information to the port. Based on the response from the port, a determination can be made to either kill the port, using the "Kill" command, or leave it as is. View system events by sorting by application, process, service, port, remote IP, and device drivers in ascending or descending order. Identify and review detailed information about Services and Devices to determine if they are Running or Stopped.
Update Time: 2006-12-09
File Size: 2466KB
Download Url: Vision.v1.0.zip [Getlink]
metagoofil-1.2.tar.gz
Developement by: http://www.edge-security.com/soft.php
Description: Metagoofil is an information gathering tool designed for extracting the Meta-Data of public documents (pdf,doc,xls,ppt,etc) available on target/victim websites. It will generate a html page with the results of the Meta-Data extracted, plus a list of potential usernames.
Update Time: 2007-08-29
File Size: 9KB
Download Url: metagoofil.1.2.tar.gz.zip [Getlink]
Windows IR/CF Tools
Developement by: Unknow
Description: This project is the home of tools associated with the book "Windows Forensic Analysis", as well as other subsequent tools I have written and offer to the IR/CF community. These tools include RegRipper, etc.
Update Time: 2008-05-28
File Size: 1666KB
Download Url: Windows.IR/CF.Tools.zip [Getlink]
Faronics Anti-Executable 3.50.1111.406
Developement by: Unknow
Description: Faronics Anti-Executable protects workstations from unwanted software by preventing unauthorized executables from running. Anti-Executable ensures workstation integrity by scanning the entire workstation hard drive and creating a whitelist of all programs that are authorized for use, thereby preventing applications that are not on the list from executing or installing.
Update Time: 2010-05-20
File Size: 18585KB
Download Url: Faronics.Anti.Executable.3.50.1111.406.zip [Getlink]
Rifiuti v1.0
Developement by: http://www.foundstone.com/
Description: Many important files within Microsoft Windows have structures that are undocumented. One of the principals of computer forensics is that all analysis methodologies must be well documented and repeatable, and they must have an acceptable margin of error. Currently, there are a lack of open source methods and tools that forensic analysts can rely upon to examine the data found in proprietary Microsoft files.Many computer crime investigations require the reconstruction of a subjects Recycle Bin. Since this analysis technique is executed regularly, we researched the structure of the data found in the Recycle Bin repository files (INFO2 files). Rifiuti, the Italian word meaning "trash", was developed to examine the contents of the INFO2 file in the Recycle Bin. The foundation of Rifiutis examination methodology is presented in the white paper located here. Rifiuti will parse the information in an INFO2 file and output the results in a field delimited manner so that it may be imported into your favorite spreadsheet program. Rifiuti is built to work on multiple platforms and will execute on Windows (through Cygwin), Mac OS X, Linux, and *BSD platforms.
Update Time: 2006-12-09
File Size: 456KB
Download Url: Rifiuti.v1.0.zip [Getlink]
metagoofil-1.4.tar.gz
Developement by: http://www.edge-security.com/soft.php
Description: Metagoofil is an information gathering tool designed for extracting the Meta-Data of public documents (pdf,doc,xls,ppt,etc) available on target/victim websites. It will generate a html page with the results of the Meta-Data extracted, plus a list of potential usernames.
Update Time: 2008-04-22
File Size: 10KB
Download Url: metagoofil.1.4.tar.gz.zip [Getlink]
malheur-0.4.7
Developement by: http://www.mlsec.org/malheur/
Description: Malheur is a tool for automatic analysis of program behavior recorded from malicious software (malware). It is designed to support the regular analysis of malicious software and the development of detection and defense measures. It allows for identifying novel classes of malware with similar behavior and assigning unknown malware to discovered classes. It can be applied to recorded program behavior of various formats as long as monitored events are separated by delimiter symbols, e.g. as in reports generated by the popular malware sandboxes CWSandbox, Anubis, Norman Sandbox, and Joebox.
Update Time: 2010-02-24
File Size: 511KB
Download Url: malheur.0.4.7.zip [Getlink]