Forensics | Penetration Testing Tools

peepdf

February 18, 2014portsForensicsforensics

peepdf is a Python tool to explore PDF files in order to find out if the file can be harmful or not. The aim of this tool is to provide all the necessary components that a security researcher could need in a PDF analysis without using 3 or 4 tools to make all the tasks.

RegRipper

February 18, 2014portsForensicsforensics, gui

RegRipper is an open source tool, written in Perl, for extracting/parsing information (keys, values, data) from the Registry and presenting it for analysis.

TrueCrack

February 18, 2014portsPassword Attacksforensics, gpu, passwords

TrueCrack is a brute-force password cracker for TrueCrypt volumes. It works on Linux and it is optimized for Nvidia Cuda technology.

Volatility

February 18, 2014portsForensicsforensics, memory

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.

Xplico

February 18, 2014portsForensics, Information Gatheringenumeration, forensics, infogathering, networking, voip

The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP, MGCP, H323), FTP, TFTP, and so on. Xplico is not a network protocol analyzer.

YARA

February 18, 2014portsReverse Engineeringforensics, reversing

With YARA you can create descriptions of malware families based on textual or binary patterns contained on samples of those families. Each description consists of a set of strings and a boolean expression which determines its logic. This package contains the command-line interface.

creddump

February 16, 2014portsPassword Attacksforensics, passwords

creddump is a python tool to extract various credentials and secrets from Windows registry hives.

CmosPwd

February 16, 2014portsPassword Attacksforensics, passwords

CmosPwd is a cross-platform tool to decrypt password stored in CMOS used to access a computer’s BIOS setup.

chntpw

February 16, 2014portsForensics, Password Attacksforensics, passwords

This little program provides a way to view information and change user passwords in a Windows NT/2000 user database file. Old passwords need not be known since they are overwritten.

bulk-extractor

February 16, 2014portsForensicsforensics

bulk_extractor is a program that extracts features such as email addresses, credit card numbers, URLs, and other types of information from digital evidence files.

Tag: forensics