Advertisement
iscomsa

Most Important Security Tools and Resources For Security Res

Jul 23rd, 2018
5,667
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 23.91 KB | None | 0 0
  1. Hex Editors
  2. A hex editor (or binary file editor or byteeditor) is a type of computer program that allows for manipulation of the fundamental binary data that constitutes a computer file. The name ‘hex’ comes from ‘hexadecimal’: a standard numerical format for representing binary data.
  3.  
  4. HxD
  5. 010 Editor
  6. Hex Workshop
  7. HexFiend
  8. Hiew
  9. Disassemblers
  10. A disassembler is a computer program that translates machine language into assembly language—the inverse operation to that of an assembler.
  11.  
  12. A disassembler differs from a decompiler, which targets a high-level language rather than an assembly language. Disassembly, the output of a disassembler, is often formatted for human-readability rather than suitability for input to an assembler, making it principally a reverse-engineering tool.
  13. IDA Pro
  14. Binary Ninja
  15. Radare
  16. Hopper
  17. Capstone
  18. objdump
  19. fREedom
  20. plasma
  21. Detection and Classification
  22. AnalyzePE – Wrapper for a variety of tools for reporting on Windows PE files.
  23. Assemblyline – A scalable distributed file analysis framework.
  24. BinaryAlert – An open source, serverless AWS pipeline that scans and alerts on uploaded files based on a set of YARA rules.
  25. chkrootkit – Local Linux rootkit detection.
  26. ClamAV – Open source antivirus engine.
  27. Detect-It-Easy – A program for determining types of files.
  28. ExifTool – Read, write and edit file metadata.
  29. File Scanning Framework – Modular, recursive file scanning solution.
  30. hashdeep – Compute digest hashes with a variety of algorithms.
  31. Loki – Host based scanner for IOCs.
  32. Malfunction – Catalog and compare malware at a function level.
  33. MASTIFF – Static analysis framework.
  34. MultiScanner – Modular file scanning/analysis framework
  35. nsrllookup – A tool for looking up hashes in NIST’s National Software Reference Library database.
  36. packerid – A cross-platform Python alternative to PEiD.
  37. PEV – A multiplatform toolkit to work with PE files, providing feature-rich tools for proper analysis of suspicious binaries.
  38. Rootkit Hunter – Detect Linux rootkits.
  39. ssdeep – Compute fuzzy hashes.
  40. totalhash.py – Python script for easy searching of the TotalHash.cymru.com database.
  41. TrID – File identifier.
  42. YARA – Pattern matching tool for analysts.
  43. Yara rules generator – Generate yara rules based on a set of malware samples. Also contains a good strings DB to avoid false positives
  44. Dynamic Binary Instrumentation
  45. Dynamic Binary Instrumentation Tools
  46. Pin
  47. DynamoRio
  48. frida
  49. dyninst
  50. Mac Decrypt
  51. Mac Decrypting Tools
  52.  
  53. Cerbero Profiler – Select all -> Copy to new file
  54. AppEncryptor – Tool for decrypting
  55. Class-Dump – use deprotect option
  56. readmem – OS X Reverser’s process dumping tool
  57. Emulator
  58. Emulator Tools
  59.  
  60. Qemu
  61. unicorn
  62. Document Analysis
  63. Document Analysis Tools
  64.  
  65. Ole Tools
  66. Didier’s PDF Tools
  67. Origami
  68. Dynamic Analysis
  69. This introductory malware dynamic analysis class is dedicated to people who are starting to work on malware analysis or who want to know what kinds of artifacts left by malware can be detected via various tools.
  70.  
  71. The class will be a hands-on class where students can use various tools to look for how malware is: Persisting, Communicating, and Hiding
  72.  
  73. ProcessHacker
  74. Process Eplorer
  75. Process Monitor
  76. Autoruns
  77. Noriben
  78. API Montor
  79. iNetSim
  80. Wireshark
  81. Fakenet
  82. Volatility
  83. Dumpit
  84. LiME
  85. Cuckoo
  86. Objective-See Utilities
  87. XCode Instruments – XCode Instruments for Monitoring Files and Processes User Guide
  88. dtrace – sudo dtruss = strace dtrace recipes
  89. fs_uage – report system calls and page faults related to filesystem activity in real-time. File I/O: fs_usage -w -f filesystem
  90. dmesg – display the system message buffer
  91. Triton
  92. Deobfuscation
  93. Reverse XOR and other code obfuscation methods.
  94.  
  95. Balbuzard – A malware analysis tool for reversing obfuscation (XOR, ROL, etc) and more.
  96. de4dot – .NET deobfuscator and unpacker.
  97. ex_pe_xor & iheartxor – Two tools from Alexander Hanel for working with single-byte XOR encoded files.
  98. FLOSS – The FireEye Labs Obfuscated String Solver uses advanced static analysis techniques to automatically deobfuscate strings from malware binaries.
  99. NoMoreXOR – Guess a 256 byte XOR key using frequency analysis.
  100. PackerAttacker – A generic hidden code extractor for Windows malware.
  101. unpacker – Automated malware unpacker for Windows malware based on WinAppDbg.
  102. unxor – Guess XOR keys using known-plaintext attacks.
  103. VirtualDeobfuscator – Reverse engineering tool for virtualization wrappers.
  104. XORBruteForcer – A Python script for brute forcing single-byte XOR keys.
  105. XORSearch & XORStrings – A couple programs from Didier Stevens for finding XORed data.
  106. xortool – Guess XOR key length, as well as the key itself.
  107. Debugging
  108. IN this List we could see the tools for Disassemblers, debuggers, and other static and dynamic analysis tools.
  109.  
  110. Cross-Platform Debugging Tools
  111. gdb
  112. vdb
  113. lldb
  114. qira
  115. Windows-Only Debugging Tools
  116.  
  117. WinDbg
  118. ImmunityDebugger
  119. OllyDbg v1.10
  120. OllyDbg v2.01
  121. OllySnD
  122. Olly Shadow
  123. Olly CiMs
  124. Olly UST_2bg
  125. x64dbg
  126. Linux-Only Debugging Tools
  127.  
  128. DDD
  129. Reverse Engineering
  130. angr – Platform-agnostic binary analysis framework developed at UCSB’s Seclab.
  131. bamdetect – Identifies and extracts information from bots and other malware.
  132. BAP – Multiplatform and open source (MIT) binary analysis framework developed at CMU’s Cylab.
  133. BARF – Multiplatform, open source Binary Analysis and Reverse engineering Framework.
  134. binnavi – Binary analysis IDE for reverse engineering based on graph visualization.
  135. Binary ninja – A reversing engineering platform that is an alternative to IDA.
  136. Binwalk – Firmware analysis tool.
  137. Bokken – GUI for Pyew and Radare. (mirror)
  138. Capstone – Disassembly framework for binary analysis and reversing, with support for many architectures and bindings in several languages.
  139. codebro – Web based code browser using clang to provide basic code analysis.
  140. DECAF (Dynamic Executable Code Analysis Framework) – A binary analysis platform based on QEMU. DroidScope is now an extension to DECAF.
  141. dnSpy – .NET assembly editor, decompiler and debugger.
  142. Evan’s Debugger (EDB) – A modular debugger with a Qt GUI.
  143. Fibratus – Tool for exploration and tracing of the Windows kernel.
  144. FPort – Reports open TCP/IP and UDP ports in a live system and maps them to the owning application.
  145. GDB – The GNU debugger.
  146. GEF – GDB Enhanced Features, for exploiters and reverse engineers.
  147. hackers-grep – A utility to search for strings in PE executables including imports, exports, and debug symbols.
  148. Hopper – The macOS and Linux Disassembler.
  149. IDA Pro – Windows disassembler and debugger, with a free evaluation version.
  150. Immunity Debugger – Debugger for malware analysis and more, with a Python API.
  151. ILSpy – ILSpy is the open-source .NET assembly browser and decompiler.
  152. Kaitai Struct – DSL for file formats / network protocols / data structures reverse engineering and dissection, with code generation for C++, C#, Java, JavaScript, Perl, PHP, Python, Ruby.
  153. LIEF – LIEF provides a cross-platform library to parse, modify and abstract ELF, PE and MachO formats.
  154. ltrace – Dynamic analysis for Linux executables.
  155. objdump – Part of GNU binutils, for static analysis of Linux binaries.
  156. OllyDbg – An assembly-level debugger for Windows executables.
  157. PANDA – Platform for Architecture-Neutral Dynamic Analysis.
  158. PEDA – Python Exploit Development Assistance for GDB, an enhanced display with added commands.
  159. pestudio – Perform static analysis of Windows executables.
  160. Pharos – The Pharos binary analysis framework can be used to perform automated static analysis of binaries.
  161. plasma – Interactive disassembler for x86/ARM/MIPS.
  162. PPEE (puppy) – A Professional PE file Explorer for reversers, malware researchers and those who want to statically inspect PE files in more detail.
  163. Process Explorer – Advanced task manager for Windows.
  164. Process Hacker – Tool that monitors system resources.
  165. Process Monitor – Advanced monitoring tool for Windows programs.
  166. PSTools – Windows command-line tools that help manage and investigate live systems.
  167. Pyew – Python tool for malware analysis.
  168. PyREBox – Python scriptable reverse engineering sandbox by the Talos team at Cisco.
  169. QKD – QEMU with embedded WinDbg server for stealth debugging.
  170. Radare2 – Reverse engineering framework, with debugger support.
  171. RegShot – Registry compare utility that compares snapshots.
  172. RetDec – Retargetable machine-code decompiler with an online decompilation service and API that you can use in your tools.
  173. ROPMEU – A framework to analyze, dissect and decompile complex code-reuse attacks.
  174. SMRT – Sublime Malware Research Tool, a plugin for Sublime 3 to aid with malware analyis.
  175. strace – Dynamic analysis for Linux executables.
  176. Tritn – A dynamic binary analysis (DBA) framework.
  177. Udis86 – Disassembler library and tool for x86 and x86_64.
  178. Vivisect – Python tool for malware analysis.
  179. WinDbg – multipurpose debugger for the Microsoft Windows computer operating system, used to debug user mode applications, device drivers, and the kernel-mode memory dumps.
  180. X64dbg – An open-source x64/x32 debugger for windows.
  181. Binary Format and Binary Analysis
  182. The Compound File Binary Format is the basic container used by several different Microsoft file formats such as Microsoft Office documents and Microsoft Installer packages.
  183.  
  184. CFF Explorer
  185. Cerbero Profiler // Lite PE Insider
  186. Detect It Easy
  187. PeStudio
  188. PEiD
  189. MachoView
  190. nm – View Symbols
  191. file – File information
  192. codesign – Code signing information usage: codesign -dvvv filename
  193. Binary Analysis Resources
  194. Mobius Resources
  195. z3
  196. bap
  197. angr
  198. Decompiler
  199. A decompiler is a computer program that takes an executable file as input, and attempts to create a high level source file which can be recompiled successfully. It is therefore the opposite of a compiler, which takes a source file and makes an executable.
  200.  
  201. Generic Decompiler
  202. HexRay
  203. RetDec
  204. Boomerang
  205. Java Decompiler
  206.  
  207. Procyon
  208. JD-GUI
  209. JAD
  210. .NET Decompiler
  211.  
  212. JustDecompile
  213. dotPeek
  214. Delphi Decompiler
  215.  
  216. IDR
  217. Revendepro
  218. Python Decompiler
  219.  
  220. Uncompyle6
  221. Decompyle++
  222. Bytecode Analysis
  223. Bytecode Analysis Tools
  224.  
  225. dnSpy
  226. Bytecode Viewer
  227. Bytecode Visualizer
  228. JPEXS Flash Decompiler
  229. Import Reconstruction
  230. Import Reconstruction Tools
  231.  
  232. ImpRec
  233. Scylla
  234. LordPE
  235. Online Scanners and Sandboxes
  236. Following Tools are using for Web-based multi-AV scanners, and malware sandboxes for automated analysis.
  237.  
  238. anlyz.io – Online sandbox.
  239. AndroTotal – Free online analysis of APKs against multiple mobile antivirus apps.
  240. AVCaesar – Malware.lu online scanner and malware repository.
  241. Cryptam – Analyze suspicious office documents.
  242. Cuckoo Sandbox – Open source, self hosted sandbox and automated analysis system.
  243. cuckoo-modified – Modified version of Cuckoo Sandbox released under the GPL. Not merged upstream due to legal concerns by the author.
  244. cuckoo-modified-api – A Python API used to control a cuckoo-modified sandbox.
  245. DeepViz – Multi-format file analyzer with machine-learning classification.
  246. detux – A sandbox developed to do traffic analysis of Linux malwares and capturing IOCs.
  247. DRAKVUF – Dynamic malware analysis system.
  248. firmware.re – Unpacks, scans and analyzes almost any firmware package.
  249. HaboMalHunter – An Automated Malware Analysis Tool for Linux ELF Files.
  250. Hybrid Analysis – Online malware analysis tool, powered by VxSandbox.
  251. IRA – An asynchronous and customizable analysis platform for suspicious files.
  252. Joe Sandbox – Deep malware analysis with Joe Sandbox.
  253. Jotti – Free online multi-AV scanner.
  254. Limon – Sandbox for Analyzing Linux Malware.
  255. Malheur – Automatic sandboxed analysis of malware behavior.
  256. malsub – A Python RESTful API framework for online malware and URL analysis services.
  257. Malware config – Extract, decode and display online the configuration settings from common malwares.
  258. Malwr – Free analysis with an online Cuckoo Sandbox instance.
  259. MASTIFF Online – Online static analysis of malware.
  260. Metadefender.com – Scan a file, hash or IP address for malware (free).
  261. NetworkTotal – A service that analyzes pcap files and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware using Suricata configured with EmergingThreats Pro.
  262. Noriben – Uses Sysinternals Procmon to collect information about malware in a sandboxed environment.
  263. PDF Examiner – Analyse suspicious PDF files.
  264. ProcDot – A graphical malware analysis tool kit.
  265. Recomposer – A helper script for safely uploading binaries to sandbox sites.
  266. Sand droid – Automatic and complete Android application analysis system.
  267. SEE – Sandboxed Execution Environment (SEE) is a framework for building test automation in secured Environments.
  268. VirusTotal – Free online analysis of malware samples and URLs
  269. Visualize_Logs – Open source visualization library and command line tools for logs. (Cuckoo, Procmon, more to come…)
  270. Zeltser’s List – Free automated sandboxes and services, compiled by Lenny Zeltser.
  271. Document Analysis
  272. Document Analysis Tools
  273.  
  274. Ole Tools
  275. Didier’s PDF Tools
  276. Origami
  277. Scripting
  278. Scripting
  279.  
  280. IDA Python Src
  281. IDC Functions Doc
  282. Using IDAPython to Make your Life Easier
  283. Introduction to IDA Python
  284. The Beginner’s Guide to IDA Python
  285. IDA Plugin Contest
  286. onehawt IDA Plugin List
  287. pefile Python Libray
  288. Android
  289. Android tools
  290.  
  291. Android Developer Studio
  292. AndroGuard
  293. APKtool
  294. dex2jar
  295. Bytecode Viewer
  296. IDA Pro
  297. Yara
  298. Yara Resources
  299.  
  300. Yara docs
  301. Cheatsheet
  302. yarGen
  303. Yara First Presentation
  304. Memory Forensics
  305. Tools for dissecting malware in memory images or running systems.
  306.  
  307. BlackLight – Windows/MacOS forensics client supporting hiberfil, pagefile, raw memory analysis.
  308. DAMM – Differential Analysis of Malware in Memory, built on Volatility.
  309. evolve – Web interface for the Volatility Memory Forensics Framework.
  310. FindAES – Find AES encryption keys in memory.
  311. inVtero.net – High speed memory analysis framework developed in .NET supports all Windows x64, includes code integrity and write support.
  312. Muninn – A script to automate portions of analysis using Volatility, and create a readable report.
  313. Rekall – Memory analysis framework, forked from Volatility in 2013.
  314. TotalRecall – Script based on Volatility for automating various malware analysis tasks.
  315. VolDiff – Run Volatility on memory images before and after malware execution, and report changes.
  316. Volatility – Advanced memory forensics framework.
  317. VolUtility – Web Interface for Volatility Memory Analysis framework.
  318. WDBGARK – WinDBG Anti-RootKit Extension.
  319. WinDbg – Live memory inspection and kernel debugging for Windows systems.
  320. Windows Artifacts
  321. AChoir – A live incident response script for gathering Windows artifacts.
  322. python-evt – Python library for parsing Windows Event Logs.
  323. python-registry – Python library for parsing registry files.
  324. RegRipper (GitHub) – Plugin-based registry analysis tool.
  325. Storage and Workflow
  326. Aleph – Open Source Malware Analysis Pipeline System.
  327. CRITs – Collaborative Research Into Threats, a malware and threat repository.
  328. FAME – A malware analysis framework featuring a pipeline that can be extended with custom modules, which can be chained and interact with each other to perform end-to-end analysis.
  329. Malwarehouse – Store, tag, and search malware.
  330. Polichombr – A malware analysis platform designed to help analysts to reverse malwares collaboratively.
  331. stoQ – Distributed content analysis framework with extensive plugin support, from input to output, and everything in between.
  332. Viper – A binary management and analysis framework for analysts and researchers.
  333. Malware samples
  334. Malware samples collected for analysis.
  335.  
  336. Clean MX – Realtime database of malware and malicious domains.
  337. Contagio – A collection of recent malware samples and analyses.
  338. Exploit Database – Exploit and shellcode samples.
  339. Malshare – Large repository of malware actively scrapped from malicious sites.
  340. MalwareDB – Malware samples repository.
  341. Open Malware Project – Sample information and downloads. Formerly Offensive Computing.
  342. Ragpicker – Plugin based malware crawler with pre-analysis and reporting functionalities
  343. theZoo – Live malware samples for analysts.
  344. Tracker h3x – Agregator for malware corpus tracker and malicious download sites.
  345. ViruSign – Malware database that detected by many anti malware programs except ClamAV.
  346. VirusShae – Malware repository, registration required.
  347. VX Vault – Active collection of malware samples.
  348. Zeltser’s Sources – A list of malware sample sources put together by Lenny Zeltser.
  349. Zeus Source Code – Source for the Zeus trojan leaked in 2011.
  350. Courses
  351. Reverse Engineering Courses
  352.  
  353. Lenas Reversing for Newbies
  354. Open Security Training
  355. Dr. Fu’s Malware Analysis
  356. Binary Auditing Course
  357. TiGa’s Video Tutorials
  358. Legend of Random
  359. Modern Binary Exploitation
  360. RPISEC Malware Course
  361. SANS FOR 610 GREM
  362. REcon Training
  363. Blackhat Training
  364. Offensive Security
  365. Corelan Training
  366. Offensive and Defensive Android Reversing
  367. Domain Analysis
  368. Inspect domains and IP addresses.
  369.  
  370. badips.com – Community based IP blacklist service.
  371. boomerang – A tool designed for consistent and safe capture of off network web resources.
  372. Cymon – Threat intelligence tracker, with IP/domain/hash search.
  373. Desenmascara.me – One click tool to retrieve as much metadata as possible for a website and to assess its good standing.
  374. Dig – Free online dig and other network tools.
  375. dnstwist – Domain name permutation engine for detecting typo squatting, phishing and corporate espionage.
  376. IPinfo – Gather information about an IP or domain by searching online resources.
  377. Machinae – OSINT tool for gathering information about URLs, IPs, or hashes. Similar to Automator.
  378. mailchecker – Cross-language temporary email detection library.
  379. MaltegoVT – Maltego transform for the VirusTotal API. Allows domain/IP research, and searching for file hashes and scan reports.
  380. Multi rbl – Multiple DNS blacklist and forward confirmed reverse DNS lookup over more than 300 RBLs.
  381. NormShield Services – Free API Services for detecting possible phishing domains, blacklisted ip addresses and breached accounts.
  382. SpamCop – IP based spam block list.
  383. SpamHaus – Block list based on domains and IPs.
  384. Sucuri SiteCheck – Free Website Malware and Security Scanner.
  385. Talos Intelligence – Search for IP, domain or network owner. (Previously SenderBase.)
  386. TekDefense Automater – OSINT tool for gathering information about URLs, IPs, or hashes.
  387. URLQuery – Free URL Scanner.
  388. Whois – DomainTools free online whois search.
  389. Zeltser’s List – Free online tools for researching malicious websites, compiled by Lenny Zeltser.
  390. ZScalar Zulu – Zulu URL Risk Analyzer.
  391. Books
  392. Most Important books Reverse Engineering Books
  393. The IDA Pro Book
  394. Reverse Engineering for Beginners
  395. The Art of Assembly Languge
  396. Practical Reverse Engineering
  397. Reversing: Secrets of Reverse Engineering
  398. Practical Malware Analysis
  399. Malware Analyst’s Cookbook
  400. Gray Hat Hacking
  401. The Art of Memory Forensics
  402. Hacking: The Art of Exploitation
  403. Fuzzing for Software Security
  404. Art of Software Security Assessment
  405. The Antivirus Hacker’s Handbook
  406. The Rootkit Arsenal
  407. Windows Internals Part 1 Part 2
  408. Inside Windows Debugging
  409. iOS Reverse Engineering
  410. Documents and Shellcode
  411. Analyze malicious JS and shellcode from PDFs and Office documents. See also the browser malware section.
  412.  
  413. AnalyzePDF – A tool for analyzing PDFs and attempting to determine whether they are malicious.
  414. box-js – A tool for studying JavaScript malware, featuring JScript/WScript support and ActiveX emulation.
  415. diStorm – Disassembler for analyzing malicious shellcode.
  416. JS Beautifier – JavaScript unpacking and deobfuscation.
  417. JS Deobfuscator – Deobfuscate simple Javascript that use eval or document.write to conceal its code.
  418. libemu – Library and tools for x86 shellcode emulation.
  419. malpdfobj – Deconstruct malicious PDFs into a JSON representation.
  420. OfficeMalScanner – Scan for malicious traces in MS Office documents.
  421. olevba – A script for parsing OLE and OpenXML documents and extracting useful information.
  422. Origami PDF – A tool for analyzing malicious PDFs, and more.
  423. PDF Tols – pdfid, pdf-parser, and more from Didier Stevens.
  424. PDF X-Ray Lite – A PDF analysis tool, the backend-free version of PDF X-RAY.
  425. peepdf – Python tool for exploring possibly malicious PDFs.
  426. QuickSand – QuickSand is a compact C framework to analyze suspected malware documents to identify exploits in streams of different encodings and to locate and extract embedded executables.
  427. Spidermonkey – Mozilla’s JavaScript engine, for debugging malicious JS.
  428. Practice
  429. Practice Reverse Engineering. Be careful with malware.
  430.  
  431. Crackmes.de
  432. OSX Crackmes
  433. ESET Challenges
  434. Flare-on Challenges
  435. Github CTF Archives
  436. Reverse Engineering Challenges
  437. xorpd Advanced Assembly Exercises
  438. Virusshare.com
  439. Contagio
  440. Malware-Traffic-Analysis
  441. Malshae
  442. Malware Blacklist
  443. malwr.com
  444. vxvaut
  445. Open Source Threat Intelligence Tool
  446. Harvest and analyze IOCs.
  447.  
  448. AbuseHelper – An open-source framework for receiving and redistributing abuse feeds and threat intel.
  449. AlienVault Open Threat Exchange – Share and collaborate in developing Threat Intelligence.
  450. Combine – Tool to gather Threat Intelligence indicators from publicly available sources.
  451. Fileinel – Pull intelligence per file hash.
  452. Hostintel – Pull intelligence per host.
  453. IntelMQ – A tool for CERTs for processing incident data using a message queue.
  454. IOC Editor – A free editor for XML IOC files.
  455. ioc_writer – Python library for working with OpenIOC objects, from Mandiant.
  456. Massive Octo Spice – Previously known as CIF (Collective Intelligence Framework). Aggregates IOCs from various lists. Curated by the CSIRT Gadgets Foundation.
  457. MISP – Malware Information Sharing Platform curated by The MISP Project.
  458. Pulsedive – Free, community-driven threat intelligence platform collecting IOCs from open-source feeds.
  459. PyIOCe – A Python OpenIOC editor.
  460. RiskIQ – Research, connect, tag and share IPs and domains. (Was PassiveTotal.)
  461. threataggregator – Aggregates security threats from a number of sources, including some of those listed below in other resources.
  462. ThreatCrowd – A search engine for threats, with graphical visualization.
  463. ThreatTracker – A Python script to monitor and generate alerts based on IOCs indexed by a set of Google Custom Search Engines.
  464. TIQ-test – Data visualization and statistical analysis of Threat Intelligence feeds.
  465. Other Resources
  466. APT Notes – A collection of papers and notes related to Advanced Persistent Threats.
  467. File Formats posters – Nice visualization of commonly used file format (including PE & ELF).
  468. Honeynet Project – Honeypot tools, papers, and other resources.
  469. Kernel Mode – An active community devoted to malware analysis and kernel development.
  470. Malicious Software – Malware blog and resources by Lenny Zeltser.
  471. Malware Analysis Search – Custom Google search engine from Corey Harrell.
  472. Malware Analysis Tutorials – The Malware Analysis Tutorials by Dr. Xiang Fu, a great resource for learning practical malware analysis.
  473. Malware Samples and Traffic – This blog focuses on network traffic related to malware infections.
  474. Practical Malware Analysis tarter Kit – This package contains most of the software referenced in the Practical Malware Analysis book.
  475. RPISEC Malware Analysis – These are the course materials used in the Malware Analysis course at at Rensselaer Polytechnic Institute during Fall 2015.
  476. WindowsIR: Malware – Harlan Carvey’s page on Malware.
  477. Windows Registry specification – Windows registry file format specification.
  478. /r/csirt_tools – Subreddit for CSIRT tools and resources, with a malware analysis flair.
  479. /r/Malware – The malware subreddit.
  480. /r/ReverseEngineering – Reverse engineering subreddit, not limited to just malware.
  481. Credits
  482. This list is Created with helping of following Awesome Peoples.
  483.  
  484. Lenny Zeltser and other contributors for developing REMnux.
  485. Michail Hale Ligh, Steven Adair, Blake Hartstein, and Mather Richard for writing the Malware Analyst’s Cookbook, which was a big inspiration for creating the list;
  486. Satria Ady Pradana
  487. wtsxDev
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement