DFIR & security toolkit
Scanners, decoders, forensic parsers, lookups and frameworks that run entirely in your browser. Sub-200ms IOC checks across 22 sources, no signup, no key.
122 tools · client-side · build 2026-06-13
Searches 122 tools by name, path, description, and use-case. ↑↓ to navigate, Enter to open.Power-user shortcut: ⌘K opens the same search as an overlay from anywhere on the site.
Start here
Three picks, one prescribed sequence. Skip the grid below if any of these match what's on your screen right now.
Pick a workbench
recent lookupsTriage & analysis — IOC checks, malware triage, file analysis, artifact parsers.
Infrastructure & identity — domain/network, assets, email security, vulnerabilities.
Detection & standards — rule converters, STIX/TAXII, IR playbooks, hunting tools.
Identity, network intel, image analysis, dark web, privacy checks.
AI security, cloud, API, data security, GRC, case management, deception, platform.
Compliance, maturity assessments, tabletop exercises, kill chain, OWASP.
LLM red-teaming, prompt injection, MCP audit, agent attack surface, ATLAS.
Used in real cases (4)
- Phishing program at scale (250+ incidents, −25% FPs)/projects/phishing-program-at-scale
Cross-source consensus on the IOC checker is what re-classified ~12% of "suspicious, escalate" cases as single-feed false alarms. Email Defense pre-filtered the SPF/DKIM/DMARC posture of new vendor domains before any reply went out.
- DMARC enforcement across 1,300+ domains/projects/dmarc-enforcement-1300-domains
The audit rules in Email Defense came directly from the failure modes seen in this rollout. Same code paths now live as the public scanner.
- Building the toolkit itself: lab → converter loop/projects/dfir-toolkit-design
The lab and converter are not independent tools; they are one detection-engineering loop. Author in the lab, prove the rule fires, export to the SIEM dialect you actually run. This is the pairing that justified shipping both.
- Autonomous CTI pipeline (layer-1 + layer-2 IOC defence)/projects/threat-intel-platform-build
The same VT / AbuseIPDB / abuse.ch validators that power the public IOC checker also gate every IOC the autonomous case-study pipeline emits before it reaches a draft. The defence layer is shared, not duplicated.
Utilities & converters (6). Encoders, hashes, timestamps
- DecoderBase64 · URL · multi-pass
- EncoderReverse of Decoder. base64 / url / hex / binary / rot13 with chain builder + round-trip
- Hash CalculatorMD5 · SHA-1/256/384/512 for text or a dropped file · client-side
- Timestamp ConverterUnix s/ms/µs · Windows FILETIME · WebKit/Chrome · Apple Cocoa · ISO 8601. all at once
- Plist & Protobuf DecoderApple binary/XML plists + schema-less protobuf · hand-rolled parsers · client-side
- Homograph DetectorIDN · mixed scripts · brand lookalikes · paste a domain to inspect