LogonTracer alternatives
Looking for an alternative tool to replace LogonTracer? During the review of LogonTracer we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.
Top 3
- Bitscout (remote forensics meta tool)
- FIR (fast incident response tool)
- GRR Rapid Response (remote live forensics for incident response)
These tools are ranked as the best alternatives to LogonTracer.
Alternatives (by score)
Bitscout
Introduction
Bitscout contains a set of popular tools to acquire and analyze disk images onsite. It saves engineers from traveling to the physical location. In other words, it is providing the option to do remote forensics. The project claims that everything is correctly implemented when it comes to digital forensics. One of these requirements is that no data is altered. For example, the remote security professional can obtain a disk image clone, but not alter the machine state.
Project details
Bitscout is written in shell script.
Strengths and weaknesses
- + Used language is shell script
- + The source code of this software is available
Typical usage
- Digital forensics
FIR (Fast Incident Response)
Introduction
FIR is an incident response tool written in the Django framework. It provides a web interface to deal with the creation and management of security-related incidents.Project details
Strengths and weaknesses
- + More than 10 contributors
- + The source code of this software is available
Typical usage
- Incident response
- Security monitoring
GRR Rapid Response
Introduction
The goal of the GRR tooling is to support digital forensics and investigations. By using a fast and scalable model, analysts can quickly perform their analysis. One of the main features is the ability to search for particular information or details. This process is called hunting.
Project details
GRR Rapid Response is written in Python.
Strengths and weaknesses
- + More than 25 contributors
- + More than 3000 GitHub stars
- + The source code of this software is available
- + Supported by a large company
Typical usage
- Digital forensics
- Intrusion detection
- Threat hunting
Loki
Introduction
Loki is security tool to find so-called indicators of compromise (IOC). It does this by scanning files and then uses pattern matching.Project details
Loki is written in Python.
Strengths and weaknesses
- + More than 10 contributors
- + Commercial support available
- + More than 500 GitHub stars
- + The source code of this software is available
Typical usage
- Digital forensics
- Intrusion detection
- Security monitoring
MIG (Mozilla InvestiGator)
Introduction
MIG provides a platform to perform investigative analysis on remote systems. By using the right queries, information can be obtained from these systems. This all happens in parallel, making intrusion detection, investigation, and follow-up easier.
Project details
Strengths and weaknesses
- + More than 25 contributors
- + More than 1000 GitHub stars
- + The source code of this software is available
- + Supported by a large company
Typical usage
- Digital forensics
- Intrusion detection
The Sleuth Kit
Introduction
The Sleuth Kit is a forensics tool to analyze volume and file system data on disk images. With its modular design, it can be used to carve out the right data, find evidence, and use it for digital forensics.
Project details
The Sleuth Kit is written in C.
Strengths and weaknesses
- + More than 50 contributors
- + More than 1000 GitHub stars
- + The source code of this software is available
- + Well-known tool
Typical usage
- Criminal investigations
- Digital forensics
- File system analysis
Volatility
Introduction
Volatility is a well-known tool to analyze memory dumps. Interesting about this project is that the founders of this project decided to create a foundation around the project. This foundation is an independent 501(c) (3) non-profit organization that maintains and promotes open source memory forensics with The Volatility Framework.
Project details
Volatility is written in Python.
Strengths and weaknesses
- + More than 2000 GitHub stars
- + The source code of this software is available
- + Project is supported by a foundation
Typical usage
- Digital forensics
dfis (Digital Forensic Investigative Scripts)
Introduction
This toolkit of scripts are made by Hal to help in forensic assignments. They make several parts of the job easier, like converting data to another format for further processing.
Project details
dfis is written in Perl.
Strengths and weaknesses
- + The source code of this software is available
- + Well-known author
- - No updates for a while
Typical usage
- Digital forensics
libewf
Introduction
The libewf toolkit is useful for those who need to create a disk image or perform disk forensics.
Project details
libewf is written in C.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Digital forensics
r2frida
Introduction
Both Radare2 and Frida have their own area of expertise. This project combines both, to allow a more extensive analysis of files and processes.
Project details
r2frida is written in C, JavaScript.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Application testing
- Binary analysis
- Memory analysis
radare2
Introduction
Radare2 is a popular framework to perform reverse engineering on many different file types. It can be used to analyze malware, firmware, or any other type of binary files. Besides reverse engineering, it can be used for forensics on filesystems and do data carving. Tasks can be scripted and support languages like JavaScript, Go, and Python. Even software exploitation is one of the functions it can be used in.
Project details
radare2 is written in C.
Strengths and weaknesses
- + More than 500 contributors
- + More than 8000 GitHub stars
- + Many releases available
- + The source code of this software is available
Typical usage
- Digital forensics
- Reverse engineering
- Software exploitation
- Troubleshooting
shellbags
Introduction
Typically this tool will be used to gather information from a compromised system or to track traces from a system to find evidence. Shellbags can provide some insight on browsed directories on the system via Explorer on Microsoft Windows systems.
Project details
shellbags is written in Python.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Digital forensics
Fail2ban
Introduction
Fail2Ban is an intrusion prevention software framework that protects computer servers from brute-force attacksProject details
Fail2ban is written in Python.
Strengths and weaknesses
- + More than 2000 GitHub stars
- + The source code of this software is available
Typical usage
- Network traffic filtering
- Security monitoring
Yosai
Introduction
Yosai is a security framework for Python applications and adds authentication, authorization, and session management capabilities. Features include Role-Based Access Control (RBAC), two-factor authentication, and Time-based One-Time Passwords (TOTP). Besides a focus on the authentication and authorization, Yosai enables an audit trail of all relevant events.
As each framework comes with some overhead, Yosai aims to leverage caching and serialization where possible.
Project details
Yosai is written in Python.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Application security
- Audit logging
- Identity and access management
django-two-factor-auth (Django Two-Factor Authentication)
Introduction
A complete Two-Factor Authentication for Django. It leverages the django-otp tooling together with Django's authentication framework.Project details
eapmd5pass
Introduction
A tool like this would be most likely used to show the weakness of old authentication protocols, including penetration testing.
Project details
eapmd5pass is written in C.
Strengths and weaknesses
- + The source code of this software is available
Typical usage
- Network analysis
- Password discovery
- Penetration testing
Some relevant tool missing as an alternative to LogonTracer? Please contact us with your suggestion.