Loading…
Every routable page in the DFIR / security-toolkit area - 138 pages across 20 hubs. Search by name, route, or keyword, or filter by category. New pages are added to the home page and the sidebar automatically.
?q=...&cat=...Catalog and entry points for the DFIR / security toolkit area.
Check, extract, and track indicators across 24+ sources - IP, domain, URL, hash pivots with cross-source consensus.
Cross-source investigation hub — paste any indicator type and pivot across all sources.
/dfir/ioc-investigateopen Pull IOCs from any text blob — refang-aware.
/dfir/extractopen Track an IOC from collection to enrichment to retirement.
/dfir/ioc-lifecycleopen Watch CT logs for new certificates matching your watchlist.
/dfir/ct-monitoropen Cross-source reputation: AbuseIPDB, Spamhaus, OTX, URLhaus.
/dfir/abuse-repopen Streaming verdicts from X (Twitter) intelligence feeds.
/dfir/x-verdiktopen Search the ORKL open-source threat intelligence library — reports, actors, CVEs from hundreds of sources.
/dfir/orklopen Triage, parse, and deobfuscate samples - stealer logs, packed binaries, malicious documents, and PCAPs.
PE / ELF / Mach-O static analysis with import hashing + section entropy.
/dfir/malware-analyzeropen Parse RedLine / Raccoon / Vidar / LummaC stealer logs — credentials, system, browser data.
/dfir/stealer-parseropen Membership-test against a corpus of known-bad indicators.
/dfir/bloomopen Decode, hash, and inspect binaries, encoded payloads, and document formats - runs entirely in the browser.
base64 — hex — url — rot13 — zlib — gzip — chained auto-detection.
/dfir/decodeopen Reverse of Decoder — encode any text to any of the supported formats.
/dfir/encoderopen MD5 — SHA1 — SHA256 — SHA512 — SSDEEP — TLSH — drag a file in.
/dfir/hash-calcopen Epoch — Windows FILETIME — Unix — human — bidirectional.
/dfir/timestampopen Sections, imports, exports, version info — 0x12 lite profile.
/dfir/peopen Manifest + permissions + signing certs + native libs.
/dfir/apk-analyzeropen EXIF — IPTC — XMP — MakerNotes — camera, GPS, software fingerprints.
/dfir/exifopen Apple binary plist + protobuf human-readable view.
/dfir/plist-protobufopen Visualise IDN homograph attacks — Cyrillic vs Latin lookalikes.
/dfir/punycodeopen Unroll encoded / base64 / invoke-expression chains — step by step.
/dfir/powershell-deobfopen Endpoint forensic artifacts - PCAP, registry, EVTX, SQLite, browser, mobile, and web logs.
Protocol breakdown — top talkers — DNS / HTTP / TLS summaries.
/dfir/pcap-triageopen Browse — search — diff Windows registry hives offline.
/dfir/registry-hiveopen Parse Windows Event Log files — event IDs, channels, time-range filter.
/dfir/evtxopen Browser profile — chat history — mobile backups — query in-browser via WASM.
/dfir/sqliteopen Manifest.db — plists — SQLite artifacts from a local iTunes backup.
/dfir/ios-backupopen Apache — nginx — IIS access logs — anomaly detection + pivots.
/dfir/web-logopen Parse Windows Prefetch files — execution evidence, run count, last run time.
/dfir/prefetchopen Multi-hive registry scope: persistence, autoruns, services, scheduled tasks.
/dfir/regscopeopen WHOIS, DNS, reputation, certificates, and infrastructure pivots - passive reconnaissance, no active scanning.
Cross-source domain investigation hub — 6 aliases route here (domain-rep, webcheck, etc.).
/dfir/domain-investigatoropen Historical WHOIS pivots — registrant, nameserver, status changes.
/dfir/whois-historyopen ASN details — prefix ranges — peer relationships.
/dfir/asnopen crt.sh-style CT log search for a domain — subdomains — cert chain.
/dfir/cert-searchopen Detect dangling DNS records vulnerable to subdomain takeover.
/dfir/takeoveropen Graph view of a domain's nameservers, mail servers, and cross-delegations
/dfir/dnscopeopen Graph of related domains, IPs, and ASNs for a target.
/dfir/host-graphopen Search historical snapshots for a URL — changes over time.
/dfir/waybackopen IP — country / city / ASN / org / hosting type.
/dfir/ip-geoopen Historical DNS resolution data for infrastructure tracking — migrations + fast-flux detection.
/dfir/passive-dnsopen Exposed-host analysis, asset intelligence, and web vulnerability scanning - see what an attacker would see.
Aggregate asset inventory — domains, subdomains, services, certificates.
/dfir/asset-intelopen Per-host exposure score and evidence — services, versions, CVEs.
/dfir/exposed-hostopen Detect misconfigured web servers exposing file listings.
/dfir/open-directoryopen Safe, sandboxed preview of a URL — headers, redirects, screenshot.
/dfir/url-previewopen Phishing analysis, BEC defense, and email authentication audits - SPF / DKIM / DMARC / BIMI without sending data off-host.
SPF / DKIM / DMARC / BIMI audit with failure modes called out.
/dfir/email-defenseopen URL + sender + header analysis with risk score.
/dfir/phishingopen Parse a DMARC aggregate report (RUA) — alignment, volume, failures.
/dfir/dmarc-analyzeropen Headers — body — attachments — URL / hash extraction from a .eml file.
/dfir/emlopen Paste or upload a raw .eml to get spam score, SPF/DKIM/DMARC alignment, and inbox-placement suggestions.
/dfir/email-deliverabilityopen Sender domain + IP reputation with deliverability signals.
/dfir/email-repopen Build digital identity from email — GitHub, Gravatar, breach, reputation, DNS, PGP.
/dfir/email-osnitopen Curated playbook of phishing patterns, lures, and IOCs.
/dfir/phishbookopen Phishing-as-a-service operator catalog and tracking.
/dfir/phishopsopen Cross-source URL reputation — PhishTank, OpenPhish, Google Safe Browsing.
/dfir/url-repopen Username, email, phone, image, and social reconnaissance - cross-platform pivots for a single subject.
Alias of /dfir/username — the canonical page.
/dfir/username-investigatoropen Phone number — carrier, country, line type, breach presence.
/dfir/phone-osintopen AI-powered OSINT dashboard — phone/URL scanner with risk scoring.
/dfir/phone-intelopen Wireless network — BSSID vendor lookup, SSID analysis, security flags.
/dfir/wifi-investigationopen Reverse geocoding + historical weather for a timestamp + coordinates.
/dfir/weather-osintopen Social-media intelligence — X / Reddit / Telegram / Mastodon pivots.
/dfir/socmintopen Build a mind-map of an investigation — nodes are entities, edges are pivots.
/dfir/osint-mapperopen Email / username / domain — cross-correlate public breach corpora.
/dfir/breachopen Multi-engine reverse image — Google, Yandex, TinEye, Bing.
/dfir/reverse-imageopen Detect typosquats / look-alike domains targeting your brand.
/dfir/brand-impersonationopen Perceptual hash (pHash, dHash) for image clustering & de-duplication.
/dfir/image-fingerprintopen Extract text + URLs + indicators from a screenshot — OCR pipeline.
/dfir/screenshot-intelopen Real-time OSINT command center — alerts, flights, strikes, markets, satellite thermal.
/dfir/ironsightopen CVE lookup, prioritisation, exploit intel, and dependency scanning - know what to patch first.
Single-CVE detail — NVD, KEV, EPSS, exploit availability.
/dfir/cveopen CVSS + EPSS + KEV + ransomware-use — single patch-priority call.
/dfir/cve-prioritizeropen Curated list of CVE databases, exploit trackers, vendor PSIRTs.
/dfir/vuln-toolkitopen Paste a manifest.json / package-lock / requirements.txt — known vulns.
/dfir/osv-scanopen Author, convert, and test detection rules - Sigma, KQL, SPL, YARA, ATT&CK mapping, hunting queries.
Sigma — KQL — SPL — YARA via one canonical IR.
/dfir/rule-converteropen Collaborative YARA editor with malware test corpus.
/dfir/yara-workbenchopen Indicator — relationship graph — visual pivot from any node.
/dfir/threat-graphopen AI-assisted mapping of detection rules to ATT&CK techniques.
/dfir/attmap-aiopen AI-assisted KQL / SPL / Lucene generation from a hypothesis.
/dfir/hunting-query-generatoropen Generate a Sigma/YARA rule from a natural-language description.
/dfir/ai-rule-generatoropen False-positive analyst — score a detection against historical FPs.
/dfir/fp-lensopen Step-by-step playbooks for common incident types.
/dfir/ir-playbooksopen About the DFIR toolkit — principles, design, and feature flags.
/dfir/tools/aboutopen Trace a rule back to its source intel — coverage and lineage.
/dfir/tracerulesopen STIX 2.1 bundle builder, TAXII server, and viewable graph - interoperable CTI artefacts.
IAM, network, secrets, and configuration analysis for AWS, GCP, Azure, and Kubernetes.
Parse a downloaded IAM policy — find privilege escalation paths.
/dfir/iam-analyzeropen GCP IAM policy + role analyzer.
/dfir/gcp-iamopen Azure RBAC role assignments — least-privilege check.
/dfir/azure-rbacopen AWS security group visualizer — 0.0.0.0/0 + port exposure heatmap.
/dfir/sg-analyzeropen Filter CloudTrail logs for an incident timeframe — IAM, EC2, S3, KMS.
/dfir/cloudtrail-triageopen Kubernetes Role/ClusterRole analyzer — risky verbs, secrets access.
/dfir/k8s-rbacopen Static analysis of HCL — misconfigurations + drift.
/dfir/terraform-scanopen Catalogue service accounts, API keys, OAuth grants.
/dfir/nhiopen Verify identity + intent for autonomous agent actions.
/dfir/zero-trust-ai-agentsopen LLM red-teaming, prompt-injection defense, MCP audit, and agent attack-surface analysis.
Test a prompt against a curated set of injection payloads.
/dfir/prompt-injectionopen Arcanum Prompt Injection Taxonomy — 172 classified attack nodes.
/dfir/pi-taxonomyopen Audit a Model Context Protocol server for tool-poisoning vectors.
/dfir/mcp-auditopen Investigate an autonomous agent — tool calls, prompt history, exfil.
/dfir/agentopen Visualise an agent's reachable tools and data sources
/dfir/agent-mapopen AI-assisted incident summarisation and pattern detection.
/dfir/insight-aiopen AI-assisted KQL / SPL / Lucene generation.
/dfir/querycraft-aiopen AI-assisted timeline reconstruction from logs + reports.
/dfir/chrono-aiopen AI-assisted malware family briefing from sample + sandbox output.
/dfir/malbrief-aiopen AI-assisted IOC verdict — explain cross-source disagreement.
/dfir/verdikt-aiopen OpenAPI, GraphQL, JWT, secrets, and headers - application-layer security analysis.
Lint an OpenAPI spec — missing auth, schema issues, PII exposure.
/dfir/openapi-auditopen Introspection + query depth/complexity + authz analysis.
/dfir/graphql-auditopen Decode — verify — alg-confusion check — claim analysis.
/dfir/jwtopen CORS — CSP — HSTS — X-Frame-Options — graded report.
/dfir/sec-headersopen Third-party live HSTS/CSP/X-Frame-Options scan via IntoDNS.ai with ready-to-paste Nginx/Apache/Caddy/Cloudflare configs.
/dfir/sec-headers-liveopen Scan a text blob / repo for API keys, tokens, private keys.
/dfir/secret-scanopen AI-first security scanner — SAST (Python/JS/Go/Rust/PHP), secrets, prompt injection detection. 140+ rules, runs entirely in browser.
/dfir/medusa-scanopen Compose a Google dork for a target — site:, inurl:, filetype:.
/dfir/google-dorksopen Generic log parser — pattern detection + anomaly highlighting.
/dfir/log-parseropen Conversational copilots and AI-assisted investigation workbenches - natural-language pivots.
Conversational copilot — ask in plain English, get a runbook.
/dfir/copilotopen Query 30+ intel sources in parallel — paste an IOC or entity.
/dfir/multi-searchopen Cross-chain transaction tracer for AML and ransomware investigations.
/dfir/traceropen Real-time crypto flow monitor — alerts on suspicious wallet activity.
/dfir/tracepulseopen Quick lookup for a crypto address or transaction hash.
/dfir/quicktraceopen Pivot explorer — graph-style pivots from any entity.
/dfir/pivexopen Draft investigation reports, ingest external reports, and export IOCs to any standard format.
AI summary — IOC extraction — MITRE TTP mapping — STIX bundle.
/dfir/report-analyzeropen Cover — summary — findings — IOCs — sources — TLP — export to PDF/DOCX.
/dfir/report-composeropen Export IOCs to STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV.
/dfir/export-hubopen Generate network blocklists (pfSense, MikroTik, Cisco) from IOCs.
/dfir/blocklistsopen Persistent notes, IOC snapshots, and findings for DFIR investigations.
/dfir/notebooksopen PGP, Tor, and dark-web workbench - the on-ramp and off-ramp tooling for sensitive investigations.
Compliance, maturity, tabletop exercises, and reference frameworks - policy and posture.
Control mapping — risk register — vendor assessment.
/dfir/grcopen Living-off-the-land binaries — search by binary or behaviour.
/dfir/lolbinsopen Tag data with sensitivity + handling requirements.
/dfir/data-classificationopen GDPR / CCPA references, DPIA templates, privacy notice generator.
/dfir/privacy-hubopen OPSEC checklist — threat-modelling for individuals.
/dfir/personal-securityopen Data-loss-prevention scan for files + clipboard + screenshots.
/dfir/dlp-scanopen Bash one-liners for live Linux incident response.
/dfir/linux-triageopen Reference frameworks, attack models, and visual matrices analysts use to structure intrusions and security programs.
Layered ATT&CK matrix — coverage heatmap, gap analysis.
/dfir/attack-navigatoropen Visualise a multi-stage attack as a connected kill-chain.
/dfir/attack-chainopen Lockheed Martin 7-phase kill chain with ATT&CK cross-links.
/dfir/kill-chainopen Adversary — capability — infrastructure — victim — reference.
/dfir/diamondopen Web 2021 — API 2023 — LLM 2025 reference + checklist.
/dfir/owaspopen Static reference view of the MITRE ATT&CK matrix with tactic/technique lookup.
/dfir/mitre-matrixopen Scenario-driven tabletop exercises — pick a scenario, run it.
/dfir/tabletopopen