Building 9 Zero-Dependency Cybersecurity & DFIR Tools in Pure Python and Win32 API
Hey DEV community! 👋 I'm Çınar, a high school student from Turkey studying low-level systems architecture, Windows internals, and Digital Forensics & Incident Response (DFIR). When an incident responder plugs a triage USB into a compromised enterprise workstation or an isolated host, they cannot run pip install psutil scapy cryptography . Furthermore, bundling third-party C-extension wheels…
A high school student from Turkey named Çınar has developed a suite of 9 open-source cybersecurity and Digital Forensics & Incident Response (DFIR) tools that require no external dependencies beyond Python's standard library and direct Win32/NT Kernel API calls. The tools include:
1. OmniTriage - a sub-second live incident response engine that captures volatile memory and network data in the order of volatility to preserve evidence. It completes a full host triage in just 0.88 seconds from a small USB drive.
2. ShadowTrace - a tool that decodes ROT13-obfuscated UserAssist keys in Windows registry hives to recover execution counts, duration, and timestamps of executed programs, even if the attacker deletes the executable.
3. GhostUSB - a utility that parses USBSTOR and USB registry hives to extract hardware identifiers and reconstruct a timeline of USB connections, helping investigate physical exfiltration attempts.
4. MemGuard - a credential dumper that queries the NT Kernel Handle Table directly to detect unauthorized processes holding read handles to the LSASS process, freezing that process to preserve volatile memory evidence instead of killing it.
5. CryptoClipGuard - a real-time clipboard monitor that detects and rolls back clipboard changes made by crypto-clipper malware, logging the offending process ID.
6. SpectralCovert - a covert channel and entropy leak detector that uses Shannon entropy and Sarle's Bimodality Coefficient to identify hidden data streams in ping packets and packet jitter, respectively.
7. ProxNet - a live network threat visualizer and intrusion detection system that combines ARP discovery, OUI vendor lookup, and OS fingerprinting, visualizing the network in a D3.js force-directed graph over WebSockets to flag anomalies like ARP spoofing and management port exposure.
8. PromptSentry - a deterministic AI prompt injection firewall that safeguards against AI prompt injection attacks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
