
Easy-to-use live forensics toolbox for Linux endpoints with various capabilities such as process inspection, memory analysis, and YARA scanning.

Easy-to-use live forensics toolbox for Linux endpoints with various capabilities such as process inspection, memory analysis, and YARA scanning.
Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask. Capabilities: - View full process list - Inspect process memory map & fetch memory strings easily - Dump process memory in one click - Automatically search hash in public services (VirusTotal, Intezer, Analyze AlienVault OTX, MalShare) - Users list find - Search for suspicious files by name/regex - netstat - Whois - Logs: syslog, auth.log (user authentication log), ufw.log (firewall log), bash history - Anti-rootkit chkrootkit - YARA: Scan a file or directory using YARA signatures by @Neo23x0, Scan a running process memory address space, Upload your own YARA signature Requirements: Python 3.6 Installation: - wget https://github.com/intezer/linux-explorer/archive/master.zip -O master.zip - unzip master.zip - cd linux-explorer-master - ./deploy.sh Usage: Start your browser firefox http://127.0.0.1:8080 Configure API keys (optional): - nano config.py - Edit following lines: INTEZER_APIKEY = '<key>', VT_APIKEY = '<key>', OTX_APIKEY = '<key>', MALSHARE_APIKEY = '<key>' Notes: We recommend using NGINX reverse proxy with basic http auth & ssl for secure remote access. Tested with Ubuntu 16.04 Misc: "How to"
Common questions about Linux Expl0rer including features, pricing, alternatives, and user reviews.
Linux Expl0rer is Easy-to-use live forensics toolbox for Linux endpoints with various capabilities such as process inspection, memory analysis, and YARA scanning. It is a Security Operations solution designed to help security teams with Linux, Memory Forensics.
LiME is a Linux Memory Extractor tool for acquiring volatile memory from Linux and Linux-based devices, including Android, with features like full memory captures and minimal process footprint.
AMExtractor is an Android memory acquisition tool that dumps physical device memory using /dev/kmem without requiring kernel source code.
Python tool for remotely or locally dumping RAM of a Linux client for digital forensics analysis.
A portable Rust-based tool for acquiring volatile memory from Linux systems without requiring prior knowledge of the target OS distribution or kernel.
Margarita Shotgun is a Python tool that enables remote memory acquisition from target systems through command line interface, supporting Linux distributions and other operating systems via Docker containers.