Tools

Scripts, parsers, and browser-based utilities. In-browser tools run entirely client-side, so anything you paste stays on your machine.

Featured

IOC Recon : Triaging indicators usually means the same tedious loop: copy an IP, paste it into VirusTotal, copy it again, paste it into your next source, then do the same for each domain, hash, and URL you're chasing. IOC Recon collapses that loop into a single right-click. [ view → ]
CBS Forensic Toolkit : Parser for the Windows 11 Start Menu's CBS subsystem. Extracts forensic artifacts from the MicrosoftWindows.Client.CBS package: Start Menu search history, cached Bing queries, and application launch counts. [ view → ]
File Entropy Calculator : Drop a file to compute Shannon entropy. High-entropy regions suggest compression or encryption. Useful for spotting packed sections or encrypted payloads inside documents. [ view → ]
Timestamp Converter : Convert between Unix, Windows FILETIME, Chrome/WebKit, Mac Cocoa, HFS+, OLE, DOS, and ISO 8601 timestamps. Bidirectional and timezone-aware. [ view → ]
URL Decomposer : Break a URL into scheme, host, path, query parameters, and fragment. Decodes percent-encoding per part and refangs defanged forms automatically. [ view → ]

All tools

CBS Forensic Toolkit

Parser for the Windows 11 Start Menu's CBS subsystem. Extracts forensic artifacts from the MicrosoftWindows.Client.CBS package: Start Menu search history, cached Bing queries, and application launch counts.

Forensics

File Entropy Calculator

Drop a file to compute Shannon entropy. High-entropy regions suggest compression or encryption. Useful for spotting packed sections or encrypted payloads inside documents.

Malware

File Hex Viewer

Drop a file into your browser and view it as a classic offset, hex, and ASCII dump.

Malware

Indicator Parser

Paste a blob of text (log lines, email body, report) and extract IPs, domains, URLs, email addresses, and common file hashes. Defanged indicators are refanged automatically.

Malware

IOC Recon

Triaging indicators usually means the same tedious loop: copy an IP, paste it into VirusTotal, copy it again, paste it into your next source, then do the same for each domain, hash, and URL you're chasing. IOC Recon collapses that loop into a single right-click.

Threat Intel

Timestamp Converter

Convert between Unix, Windows FILETIME, Chrome/WebKit, Mac Cocoa, HFS+, OLE, DOS, and ISO 8601 timestamps. Bidirectional and timezone-aware.

Forensics

URL Decomposer

Break a URL into scheme, host, path, query parameters, and fragment. Decodes percent-encoding per part and refangs defanged forms automatically.

Web