shellbags alternatives

Looking for an alternative tool to replace shellbags? During the review of shellbags we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. dfis (DFIR toolkit)
  2. Volatility (memory forensics framework)
  3. Bitscout (remote forensics meta tool)

These tools are ranked as the best alternatives to shellbags.

Alternatives (by score)

64

dfis (Digital Forensic Investigative Scripts)

Introduction

This toolkit of scripts are made by Hal to help in forensic assignments. They make several parts of the job easier, like converting data to another format for further processing.

Project details

dfis is written in Perl.

Strengths and weaknesses

  • + The source code of this software is available
  • + Well-known author
  • - No updates for a while

Typical usage

  • Digital forensics

dfis review

74

Volatility

Introduction

Volatility is a well-known tool to analyze memory dumps. Interesting about this project is that the founders of this project decided to create a foundation around the project. This foundation is an independent 501(c) (3) non-profit organization that maintains and promotes open source memory forensics with The Volatility Framework.

Project details

Volatility is written in Python.

Strengths and weaknesses

  • + More than 2000 GitHub stars
  • + The source code of this software is available
  • + Project is supported by a foundation

    Typical usage

    • Digital forensics

    Volatility review

    64

    Bitscout

    Introduction

    Bitscout contains a set of popular tools to acquire and analyze disk images onsite. It saves engineers from traveling to the physical location. In other words, it is providing the option to do remote forensics. The project claims that everything is correctly implemented when it comes to digital forensics. One of these requirements is that no data is altered. For example, the remote security professional can obtain a disk image clone, but not alter the machine state.

    Project details

    Bitscout is written in shell script.

    Strengths and weaknesses

    • + Used language is shell script
    • + The source code of this software is available

      Typical usage

      • Digital forensics

      Bitscout review

      64

      FIR (Fast Incident Response)

      Introduction

      FIR is an incident response tool written in the Django framework. It provides a web interface to deal with the creation and management of security-related incidents.

      Project details

      Strengths and weaknesses

      • + More than 10 contributors
      • + The source code of this software is available

        Typical usage

        • Incident response
        • Security monitoring

        FIR review

        100

        GRR Rapid Response

        Introduction

        The goal of the GRR tooling is to support digital forensics and investigations. By using a fast and scalable model, analysts can quickly perform their analysis. One of the main features is the ability to search for particular information or details. This process is called hunting.

        Project details

        GRR Rapid Response is written in Python.

        Strengths and weaknesses

        • + More than 25 contributors
        • + More than 3000 GitHub stars
        • + The source code of this software is available
        • + Supported by a large company

          Typical usage

          • Digital forensics
          • Intrusion detection
          • Threat hunting

          GRR Rapid Response review

          60

          libewf

          Introduction

          The libewf toolkit is useful for those who need to create a disk image or perform disk forensics.

          Project details

          libewf is written in C.

          Strengths and weaknesses

          • + The source code of this software is available

            Typical usage

            • Digital forensics

            libewf review

            76

            LogonTracer

            Introduction

            LogonTracer is a tool to investigate malicious logins from Windows event logs with visualization capabilities.

            Project details

            LogonTracer is written in Python.

            Strengths and weaknesses

            • + More than 500 contributors
            • + The source code of this software is available

              Typical usage

              • Criminal investigations
              • Digital forensics
              • Learning

              LogonTracer review

              93

              Loki

              Introduction

              Loki is security tool to find so-called indicators of compromise (IOC). It does this by scanning files and then uses pattern matching.

              Project details

              Loki is written in Python.

              Strengths and weaknesses

              • + More than 10 contributors
              • + Commercial support available
              • + More than 500 GitHub stars
              • + The source code of this software is available

                Typical usage

                • Digital forensics
                • Intrusion detection
                • Security monitoring

                Loki review

                74

                MIG (Mozilla InvestiGator)

                Introduction

                MIG provides a platform to perform investigative analysis on remote systems. By using the right queries, information can be obtained from these systems. This all happens in parallel, making intrusion detection, investigation, and follow-up easier.

                Project details

                Strengths and weaknesses

                • + More than 25 contributors
                • + More than 1000 GitHub stars
                • + The source code of this software is available
                • + Supported by a large company

                  Typical usage

                  • Digital forensics
                  • Intrusion detection

                  MIG review

                  89

                  r2frida

                  Introduction

                  Both Radare2 and Frida have their own area of expertise. This project combines both, to allow a more extensive analysis of files and processes.

                  Project details

                  r2frida is written in C, JavaScript.

                  Strengths and weaknesses

                  • + The source code of this software is available

                    Typical usage

                    • Application testing
                    • Binary analysis
                    • Memory analysis

                    r2frida review

                    100

                    radare2

                    Introduction

                    Radare2 is a popular framework to perform reverse engineering on many different file types. It can be used to analyze malware, firmware, or any other type of binary files. Besides reverse engineering, it can be used for forensics on filesystems and do data carving. Tasks can be scripted and support languages like JavaScript, Go, and Python. Even software exploitation is one of the functions it can be used in.

                    Project details

                    radare2 is written in C.

                    Strengths and weaknesses

                    • + More than 500 contributors
                    • + More than 8000 GitHub stars
                    • + Many releases available
                    • + The source code of this software is available

                      Typical usage

                      • Digital forensics
                      • Reverse engineering
                      • Software exploitation
                      • Troubleshooting

                      radare2 review

                      97

                      The Sleuth Kit

                      Introduction

                      The Sleuth Kit is a forensics tool to analyze volume and file system data on disk images. With its modular design, it can be used to carve out the right data, find evidence, and use it for digital forensics.

                      Project details

                      The Sleuth Kit is written in C.

                      Strengths and weaknesses

                      • + More than 50 contributors
                      • + More than 1000 GitHub stars
                      • + The source code of this software is available
                      • + Well-known tool

                        Typical usage

                        • Criminal investigations
                        • Digital forensics
                        • File system analysis

                        The Sleuth Kit review

                        Some relevant tool missing as an alternative to shellbags? Please contact us with your suggestion.