[Process PEB Finder] Tool to find and display PEB Address of running Processes

Process PEB Finder is the console based tool to find and display PEB Address of running Processes on your system.

PEB (Process Environment Block) is the part of Process memory where is stores important information including loaded modules, startup paramenters, environment variables, debug information etc.

Process PEB Finder helps you to quickly get the address of PEB for any Process. By default it displays PEB address of all running Processes. However you can get the PEB address of specific process by entering either its ID or name.

This tool will be more useful for debuggers and researchers. Being a command-line tool makes it easy for automation.

It is available in both 32-bit & 64-bit versions and works on all platforms starting from Windows XP to Windows 8.

Download Process PEB Finder v1.0

[Show Threads] Tool to list all the Threads in the running Process

Show Threads is the small command-line Tool to list all the Threads in the running Process.

You can either specify the Process ID or Process Name to enumerate the threads. For each thread, it displays Thread ID and the Base Priority.

Being a command-line tool makes it easy for automation. It can be handy tool for developers as well as researchers.

Show Threads is fully portable and can be run directly without installation. Also it includes separate versions for 32-bit and 64-bit systems.

It works on all the platforms starting from Windows XP to Windows 8.

Download Show Threads v1.0

[Santoku 0.4] Distribution dedicated to mobile forensics, malware analysis and security testing

Santoku includes a number of open source tools dedicated to helping you in every aspect of your mobile forensics, malware analysis, and security testing needs, including:

Development Tools:

• Android SDK Manager
• AXMLPrinter2
• Fastboot
• Heimdall (src | howto)
• Heimdall (GUI) (src | howto)
• SBF Flash

Penetration Testing:

• Burp Suite
• Ettercap
• Mercury
• nmap
• OWASP ZAP
• SSL Strip
• w3af (Console)
• w3af (GUI)
• Zenmap (As Root)

Wireless Analyzers:

• Chaosreader
• dnschef
• DSniff
• TCPDUMP
• Wireshark
• Wireshark (As Root)

Device Forensics:

• AFLogical Open Source Edition (src | howto)
• Android Brute Force Encryption (src | howto)
• ExifTool
• iPhone Backup Analyzer (GUI) (src | howto)
• libimobiledevice (src | howto)
• scalpel
• Sleuth Kit

Download Santoku 0.4

[ShellNoob v1.0] Shellcode Writing Toolkit

ShellNoob is a writing toolkit, that helps you to writting some shellcodes, converting to different formats, resolving some boring steps.

Features:

• convert shellcode between different formats (currently supported: asm, bin, hex, obj, exe, C, python, ruby, pretty)
• interactive opcode-to-binary conversion (and viceversa) mode. This is useful when you cannot use specific bytes in the shellcode.
• resolve syscall numbers and constants (not exactly implemented yet)
• portable and easily deployable (it only relies on gcc/as/objdump and python). And it just one python file!
• in-place development: you run ShellNoob directly on the target architecture!
• other options: prepend breakpoint, 32bit/64bit switch.
• read from stdin / write to stdout support (use “-” as filename)

Use Cases
$ ./shellnoob.py -h
./shellnoob.py [--from-INPUT] (input_file_path | - ) [--to-OUTPUT] [output_file_path | - ]
./shellnoob.py -i (for interactive mode)
./shellnoob.py -c (insert a breakpoint at the beginning of the shellcode)
./shellnoob.py --64 (64bits mode)
./shellnoob.py --get-const <const>
./shellnoob.py --get-sysnum <sysnum>
supported INPUT format: asm, obj, bin, hex
supported OUTPUT format: asm, obj, exe, bin, hex, C, python, bash, ruby, pretty

Download ShellNoob v1.0

[TcpLogView v1.05] Another TCP Connection Log

TcpLogView is a simple utility that monitors the opened TCP connections on your system, and adds a new log line every time that a TCP connection is opened or closed. For every log line, the following information is displayed: Even Time, Event Type (Open, Close, Listen), Local Address, Remote Address, Remote Host Name, Local Port, Remote Port, Process ID, Process Name, and the country information of the Remote IP (Requires to download IP to country file separately.)

System Requirements & Limitations

• This utility works on any version of Windows, starting from Windows 2000 and up to Windows 8. On 64-bit systems, you should use the x64 build of TcpLogView.
• This utility creates the TCP log by taking a snapshot of currently open TCP connections, and comparing it to the previous snapshot. This means that if a TCP connection is opened for a very short time, then TcpLogView will not be able to capture it.
• On Windows Vista/7/8 with UAC turned on, you should run TcpLogView as administrator if you want to get full process information. 

More details and Download TcpLogView v1.05

[DEFT 7] Distribution with the best freeware Windows Computer Forensic tools

DEFT 7 is based on the new Kernel 3 (Linux side) and the DART (Digital Advanced Response Toolkit) with the best freeware Windows Computer Forensic tools. It’s a new concept of Computer Forensic system that use LXDE as desktop environment and WINE for execute Windows tools under Linux and mount manager as tool for device management.

It is a very professional and stable system that includes an excellent hardware detection and the best free and open source applications dedicated to Incident Response, Cyber Intelligence and Computer Forensics.

DEFT is meant to be used by:

• Military
• Police
• Investigators
• IT Auditors
• Individuals

Screenshots

Download DEFT 7

[BSNL Password Decryptor] Tool to Recover the Login Password of BSNL modem/router

BSNL Password Decryptor is a free desktop tool to instantly recover the Login Password of BSNL modem/router.

If you have lost login authentication password of your BSNL modem and you have backup configuration file then you can use this tool to quickly recover your password.

It supports dual mode of password recovery. You can either enter the encrypted BSNL password directly or specify the BSNL Modem's backup configuration file. In second case, it will automatically detect the login password from config file and decrypt it instantly.

Note that it currently supports limited number of BSNL modems (mainly UT-300 Series). Hence it may or may not work with other models.

This can be very handy tool for all Network Administrators as well as penetration testers.

It is successfully tested on both 32 bit & 64 bit windows systems starting from Windows XP to Windows 8

Download BSNL Password Decryptor