Kroll Artifact Parser and Extractor (KAPE)

Dnscat2

dnscat2 is a tool designed to create an encrypted command-and-control (C&C) channel over the DNS protocol. It enables secure communication and data tunneling out of restricted networks by leveraging DNS queries and responses, making it effective for penetration testing and secure remote access. ## Key Features - **Encrypted Communication** — All traffic is encrypted by default using ECDH key exchange, Salsa20 encryption, and SHA3 signatures. - **DNS Protocol Tunneling** — Uses DNS queries/responses to bypass firewalls and network restrictions, appearing as normal DNS traffic. - **Flexible Deployment** — Supports both authoritative DNS server traversal (stealthy) and direct UDP connections (faster). - **Session Management** — Provides an interactive console with multiple windows for managing clients, shells, and tunnels. - **Data Tunneling** — Can tunnel any data, including file transfers, shell sessions, and TCP connections (via port forwarding). - **Cross-Platform Client** — The client is written in C with minimal dependencies, running on Linux, Windows, FreeBSD, and macOS. ## Philosophy dnscat2 is purpose-built for command and control, prioritizing encryption and flexibility over generic internet tunneling. It treats DNS as a transport layer, enabling robust, protocol-agnostic data exchange.

Fibratus

Adversary tradecraft detection, protection, and hunting

DVCS Ripper

Rip web accessible (distributed) version control systems: SVN/GIT/HG...

USBRip

Tracking history of USB events on GNU/Linux