Topics / #forensics

Forensics projects on GitHub

Digital forensics and investigation of systems and data.

As of October 17, 2026, the most-starred Forensics projects on GitHub are sherlock (94.3K stars), ImHex (55.4K stars) and x64dbg (49.9K stars). GitHub.Locker tracks 27 Forensics repositories with 540K stars combined. The fastest-growing on October 16 was sherlock, with +93 stars in a day.

27Projects

540KStars in total

+530Stars in a day

Browse in the catalog →github.com/topics/forensics ↗

Hot right now

Most stars gained in a day · Oct 16

+93

sherlock

sherlock-project/sherlock · ★ 94.3K

Sherlock hunts down social media accounts by username: give it a name and it checks across social networks for accounts registered under it.

+74

ImHex

WerWolv/ImHex · ★ 55.4K

ImHex is a hex editor built for reverse engineers, programmers, and anyone analyzing binary data, with a custom pattern language for parsing and highlighting file structures.

+71

Anthropic-Cybersecurity-Skills

mukul975/Anthropic-Cybersecurity-Skills · ★ 34.6K

An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.

+59

awesome-reverse-engineering

morluto/awesome-reverse-engineering · ★ 628

A curated list of reverse-engineering tools and learning resources covering binaries, applications, firmware, file formats, and protocols, organized by the task you need to do rather than alphabetically.

The all-time top

27 projects · by stars

#1 · sherlock-project/sherlock
sherlock
Sherlock hunts down social media accounts by username: give it a name and it checks across social networks for accounts registered under it.
94.3K
#2 · WerWolv/ImHex
ImHex
ImHex is a hex editor built for reverse engineers, programmers, and anyone analyzing binary data, with a custom pattern language for parsing and highlighting file structures.
55.4K
#3 · x64dbg/x64dbg
x64dbg
x64dbg is an open-source user-mode debugger for Windows, built specifically for reverse engineering and malware analysis.
49.9K

4
CyberChef
36.1Kgchq/CyberChef · JavaScript
CyberChef is a web app that bundles encoding, encryption, compression, hashing and other data-analysis operations ('cyber' operations) into a single drag-and-drop recipe builder that runs entirely in your browser.
- hashing
- encoding
- ctf
- parsing
5
Anthropic-Cybersecurity-Skills
34.6Kmukul975/Anthropic-Cybersecurity-Skills · Python
An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.
- container-security
- threat-hunting
- cloud-security
- vulnerability-management
6
h4cker
29.8KThe-Art-of-Hacking/h4cker · Jupyter Notebook
A curated collection of thousands of cybersecurity resources — references, scripts, tools, code, labs, and training material — maintained by Omar Santos as a companion to his books, video courses, and live training.
- cloud-security
- vulnerability-management
- vulnerability-research
- certification
7
radare2
25.1Kradareorg/radare2 · C
r2 (radare2) is a libre reverse engineering framework for Unix-like systems: a set of libraries, tools and plugins for analyzing, disassembling, emulating, debugging and modifying binaries.
- commandline
- disassembler
- debugger
- lgpl
8
Micro8
18KMicropoor/Micro8
A free, open-source series of penetration-testing lessons written by veteran Chinese pentester Micropoor and published as a GitBook. It covers code audit, web, intranet and domain penetration, tunneling, and log-based tracing.
- exploitation
- information-gathering
- pentest
- redteam
9
wazuh
17.3Kwazuh/wazuh · C++
Wazuh is a free, open source security platform (XDR and SIEM) for threat prevention, detection and response across on-premises, virtualized, containerized and cloud workloads.
- container-security
- pci-dss
- cloud-security
- security-hardening
10
awesome-hacking
17.3Kcarpedm20/awesome-hacking
A curated list of hacking tutorials, tools and resources covering system exploitation, reverse engineering, web security, network security, forensics, cryptography and wargames.
- hacking-tools
- ctf
- network-security
- cryptography
11
hacker-roadmap
15.7Ksundowndev/hacker-roadmap
This is a curated roadmap and toolkit index for learning and practicing ethical hacking: it explains what penetration testing is and groups hundreds of security tools, wordlists and references by category (recon, password attacks, wireless, exploitation, web hacking, post-exploitation, frameworks).
- wordlist
- password-cracking
- post-exploitation
- wireless
12
mvt
15.4Kmvt-project/mvt · Python
MVT (Mobile Verification Toolkit) is a collection of forensic utilities that help gather and analyze traces on Android and iOS devices to identify a potential compromise, originally built by Amnesty International's Security Lab during the Pegasus Project.
- investigation
- surveillance
- mobile-security
- incident-response
13
prowler
15Kprowler-cloud/prowler · Python
Prowler is an open-source cloud security platform that automates security and compliance checks across AWS, Azure, GCP, Kubernetes, M365, GitHub, and many other providers.
- multi-cloud
- security-hardening
- gdpr
- hardening
14
awesome-security
15Ksbilly/awesome-security
A curated, categorized collection of well-known security resources — software, libraries, documents, books and other cool stuff — maintained by the community in the spirit of awesome-php and awesome-python.
- web-security
- malware-analysis
- firewall
- network-security
15
binwalk
14.5KReFirmLabs/binwalk · Rust
Binwalk is a firmware analysis tool that can identify, and optionally extract, files and data that have been embedded inside other files.
- binary-analysis
- embedded-systems
- hacking-tool
- firmware
16
awesome-malware-analysis
14.3Krshipp/awesome-malware-analysis
A curated 'awesome list' of malware analysis tools and resources, covering sample collection, sandboxes, detection tools, threat intelligence feeds, reverse engineering, and forensics.
- dynamic-analysis
- chinese-translation
- threat-intelligence
- malware-analysis
17
hexstrike-ai
12.9K0x4m4/hexstrike-ai · Python
HexStrike AI MCP Agents is an MCP server that lets AI agents like Claude, GPT, or Copilot autonomously run 150+ real cybersecurity tools for automated pentesting, bug bounty hunting, CTF challenges, and vulnerability discovery.
- ai-hacking
- ctf-tools
- ai-penetration-testing
- ai-security-tool
18
awesome-ctf
11.9Kapsdehal/awesome-ctf · JavaScript
A curated list of frameworks, libraries, tools, and resources for Capture The Flag (CTF) competitions, covering everything from building challenges to solving them.
- ctf-tools
- ctf
- exploit
- cryptography
19
Detect-It-Easy
11.7Khorsicq/Detect-It-Easy · JavaScript
Detect It Easy (DiE) is a cross-platform tool that identifies file types and inspects executables (PE, ELF, Mach-O) for malware analysts, reverse engineers, and cybersecurity researchers, combining signature-based detection with a deep heuristic engine.
- hacktoberfest2023
- disassembler
- scanner
- pentest
20
awesome-honeypots
10.6Kparalax/awesome-honeypots · Python
A curated, categorized list of honeypot software and related tools used by security researchers to deceive attackers, log their behavior, and study exploitation attempts.
- incident-response
- threat-intelligence
- malware
- awesome-lists
21
reverse-engineering
10.6KwtsxDev/reverse-engineering
A curated list of reverse engineering resources: books, courses, practice grounds, and a big toolbox section spanning hex editors, disassemblers, debuggers, and dynamic analysis tools.
- disassembler
- malware
- decompiler
- malware-analysis
22
Claude-Red
7.6KSnailSploit/Claude-Red · Python
claude-red is a curated library of offensive security skills for the Claude Skills system: structured SKILL.md files that prime Claude with expert-level methodology for one attack surface each, from SQLi to shellcode.
- vulnerability-research
- phishing
- post-exploitation
- pentesting-tools
23
reverse-SynthID
5Kaloshdenny/reverse-SynthID · Python
reverse-SynthID reverse-engineers Google's SynthID watermark embedded in Gemini-generated images using signal processing and spectral analysis, and ships tools that detect and surgically bypass that watermark without any access to Google's proprietary encoder/decoder.
- adversarial-attacks
- image-manipulation
- bypass
- security-research
24
wcdb-key-tool
652TANGandXUE/wcdb-key-tool · Python
A single-purpose Python tool that pulls the encryption keys out of WeChat's local WCDB/SQLCipher4 chat databases on Linux, macOS and Windows, so you can decrypt your own chat history.
- data-extraction
- binary-analysis
- cryptography
- low-level
25
awesome-reverse-engineering
628morluto/awesome-reverse-engineering
A curated list of reverse-engineering tools and learning resources covering binaries, applications, firmware, file formats, and protocols, organized by the task you need to do rather than alphabetically.
- dynamic-analysis
- disassembler
- decompiler
- assembly
26
Stuxnet
588Sadpainy/Stuxnet · C
This is a reconstructed source code of Stuxnet, the famous 2010 worm that sabotaged Siemens industrial control systems, rebuilt by the author from reverse-engineering research for educational and malware-analysis purposes.
- threat-intelligence
- malware
- driver
- malware-analysis
27
vol-rs
197daffainfo/vol-rs · Rust
'vol-rs' is a line-by-line port of the Volatility 3 memory forensics framework from Python to Rust. It reads the same memory images, runs the same plugins with the same options, and prints byte-for-byte identical output, just much faster.
- incident-response
- disassembler
- malware-analysis
- binary-analysis