ntfsdump
oletools
| ntfsdump | oletools | |
|---|---|---|
| 1 | 5 | |
| 16 | 2,751 | |
| - | - | |
| 7.1 | 5.5 | |
| 3 months ago | 10 days ago | |
| Python | Python | |
| GNU General Public License v3.0 only | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
ntfsdump
-
Extraction of Artifacts from an NTFS Image File Using ntfsdump and ntfsfind
# Download source code from GitHub $ git pull https://github.com/sumeshi/ntfsdump $ cd ntfsdump # Install dependencies $ pip install poetry $ poetry install # Run command using poetry $ poetry run ntfsdump -h
oletools
-
How can I find a hidden flag inside a Microsoft word document?
oletools might help - https://github.com/decalage2/oletools
-
Excel Macro code(VBA code) protection site (free)
Resistance to several code extraction tools. ( eg. olevba)
-
The project with a single 11,000-line code file
I currently maintain a 5k line VBA Word macro - naturally it's business critical. It used to be longer with all the version-control-comments, but thankfully I've managed to get the macro file versioned under git and remove all of those green lines (look into oletools and git hooks - far from perfect, but good enough).
-
Mailflow rule: notify recipient and and senders adress in notification
Its a good direction but far from perfection. Office can use a huge amount of features which can execute code: Github oletools table
- This table shows the various techniques that can be used in malicious documents to trigger code execution, and the file formats in which they can be embedded. The last row suggests tools that can detect and analyse each technique.
What are some alternatives?
ntfsfind - An efficient tool for search files, directories, and alternate data streams directly from NTFS image files.
Open-Source Vulkan C++ API - Open-Source Vulkan C++ API
FATtools - Facilities to access (ex)FAT filesystems and disk images with Python 3
ViperMonkey - A VBA parser and emulation engine to analyze malicious macros.
INDXRipper - Carve file metadata from NTFS index ($I30) attributes
excel-contact-tools - Save a ton of time using this Excel macro addin when working with your colleagues' contact details in Excel
prowler - Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more
EVE-IPH - Code for the EVE Isk per Hour program
RecuperaBit - A tool for forensic file system reconstruction.
ReactSelfbot - The best (and now open source) Discord selfbot.
.NET Runtime - .NET is a cross-platform runtime for cloud, mobile, desktop, and IoT apps.
RestHome - Macro Controlled Broadlink RM/RM2/RM Pro/RM3/BlackBean/A1 Web server with REST API (like..)