OllySocketTrace - OllySocketTrace is a plugin for OllyDbg to trace the socket operations being performed by a process, recording all buffers being sent and received.
OllyHeapTrace - OllyHeapTrace is a plugin for OllyDbg to trace the heap operations being performed by a process. It will monitor heap allocations and frees for multiple heaps, as well as operations such as creating or destroying heaps and reallocations.
OllyCallTrace - OllyCallTrace is a plugin for OllyDbg to trace the call chain of a thread allowing you to monitor it for irregularities to aid in the debugging of stack based buffer overflows as well as to quickly plot the execution flow of a program you are reversing.
Exploit Research
Kungfoo -
The kungfoo projects aim is to discover and implement the most generic Win32 shellcode that may exist and run in a system independent way, free of hardcoded API addresses and payload specific functionality.
Janus -
Janus is a non blind TCP/IP connection spoofer. It allows you to forge a fully open connection masquerading as another active host on the LAN or segment. To avoid interference from the active host being spoofed, janus implements ARP cache poisioning.
Utilities
fhash -
fhash is a command line tool for computing the digital hashes of the contents of files. A number of different hashing algorithms are supported, currently md5, md4, sha1, crc32 and crc32b. It is possible to hash either a single file or the contents of a directory and optionally all its sub directories.
viewtoken -
viewtoken is a command line tool for viewing the access token associated with a process. It will output information about the security identifier (SID) for the User, Owner and Groups associated with the token.
rver -
rver is a command line tool to query the windows version of a remote windows machine. It uses RPC to fingerprint the host and determine its windows version.
Cryptography
IntFactor - IntFactor is a command line java tool for finding the small factors of a composite integer. It utilises Pollards rho factoring algorithm in order to do this.
