View dumpscan on Snyk Open Source Advisor

Package Health Score

57 / 100

security
No known security issues
popularity
Small
maintenance
Inactive
community
Sustainable

Popularity

Small

GitHub Stars: 2.71K
Forks: 461
Contributors: 70

Direct Usage Popularity

Based on project statistics from the GitHub repository for the PyPI package dumpscan, we found that it has been starred 2,705 times.

Security

No known security issues

Security and license risk for latest version

Release Date: Jul 15, 2022
Direct Vulnerabilities: 0
C
0
H
0
M
0
L
Indirect Vulnerabilities: 0
C
0
H
0
M
0
L
License Risk: 0
H
0
M
0
L

All security vulnerabilities belong to production dependencies of direct and indirect packages.

License

MIT

Security Policy

We found a way for you to contribute to the project! Looks like dumpscan is missing a security policy.

You can connect your project's repository to Snyk to stay up to date on security alerts and receive automatic fix pull requests.

Keep your project free of vulnerabilities with Snyk

Maintenance

Inactive

Commit Frequency

Open Issues: 85
Open PR: 59
Last Release: 2 years ago
Last Commit: 6 days ago

Further analysis of the maintenance status of dumpscan based on released PyPI versions cadence, the repository activity, and other data points determined that its maintenance is Inactive.

An important project maintenance signal to consider for dumpscan is that it hasn't seen any new versions released to PyPI in the past 12 months, and could be considered as a discontinued project, or that which receives low attention from its maintainers.

As a healthy sign for on-going project maintenance, we found that the GitHub repository had at least 1 pull request or issue interacted with by the community.

Community

Sustainable

Readme: Yes
Contributing.md: No
Code of Conduct: No
Contributors: 70
Funding: No

With more than 10 contributors for the dumpscan repository, this is possibly a sign for a growing and inviting community.

We found a way for you to contribute to the project! Looks like dumpscan is missing a Code of Conduct.

Embed Package Health Score Badge

Keep your project healthy

Check your requirements.txt

Ensure all the packages you're using are healthy and well-maintained

Snyk Vulnerability Scanner

Get health score & security insights directly in your IDE

Package

Python Versions Compatibility: >=3.9,<4.0

Age: 2 years
Latest Release: 2 years ago
Dependencies: 11 Direct
Versions: 2
Maintainers: 1
Wheels: OS Independent

Readme

Dumpscan is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by volatility3.

Features

x509 Public and Private key (PKCS #8/PKCS #1) parsing
SymCrypt parsing
- Supported structures
  - SYMCRYPT_RSAKEY - Determines if the key structure also has a private key
- Matching to public certificates found in the same process
- More SymCrypt structures to come
Environment variables
Command line arguments

Note: Testing has only been performed on Windows 10 and 11 64-bit hosts and processes. Feel free to file an issue for additional versions. Linux testing TBD.

Installation

As a command-line tool, installation is recommended using pipx. This allows for easy updates and well and ensuring it is installed in its own virtual environment.

pipx install dumpscan
pipx inject dumpscan git+https://github.com/volatilityfoundation/volatility3#39e812a

Usage

 Usage: dumpscan [OPTIONS] COMMAND [ARGS]...

 Scan memory dumps for secrets and keys

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  --help         Show this message and exit.                                                      │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  kernel     Scan kernel dump using volatility                                                    │
│  minidump   Scan a user-mode minidump                                                            │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯

In the case for subcommands that extract certificates, you can provide --output/-o <dir> to output any discovered certificates to disk.

Kernel Mode

As mentioned, kernel analysis is performed by Volatility3. cmdline, envar, and pslist are direct calls to the Volatility3 plugins, while symcrypt and x509 are custom plugins.

 Usage: dumpscan kernel [OPTIONS] COMMAND [ARGS]...

 Scan kernel dump using volatility

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  --help         Show this message and exit.                                                      │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  cmdline    List command line for processes (Only for Windows)                                   │
│  envar      List process environment variables (Only for Windows)                                │
│  pslist     List all the processes and their command line arguments                              │
│  symcrypt   Scan a kernel-mode dump for symcrypt objects                                         │
│  x509       Scan a kernel-mode dump for x509 certificates                                        │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯

Minidump Mode

Supports Windows Minidump format.

Note: This has only been tested on 64-bit processes on Windows 10+. 32-bit processes requires additional work but isn't a priority.

 Usage: dumpscan minidump [OPTIONS] COMMAND [ARGS]...

 Scan a user-mode minidump

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  --help         Show this message and exit.                                                      │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│  cmdline    Dump the command line string                                                         │
│  envar      Dump the environment variables in a minidump                                         │
│  symcrypt   Scan a minidump for symcrypt objects                                                 │
│  x509       Scan a minidump for x509 objects                                                     │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯

Built With

Acknowledgements

Thanks to F-Secure and the physmem2profit project for providing the idea to use construct for parsing minidumps.
Thanks to Skelsec and his minidump project which helped me figure out to parse minidumps.

To-Do

Verify use against 32-bit minidumps
Create a coredump parser for Linux process dumps
Verify volatility plugins work against Linux kernel dumps
Add an HTML report that shows all plugins
Code refactoring to make more extensible
MORE SECRETS

dumpscan dependencies

arrow capstone cffi construct cryptography jsonschema pefile pycryptodome rich typer yara-python

FAQs

What is dumpscan?

Scanning memory dumps for secrets using volatility and yara. Visit Snyk Advisor to see a full health score report for dumpscan, including popularity, security, maintenance & community analysis.

Is dumpscan popular?

The python package dumpscan receives a total of 39 weekly downloads. As such, dumpscan popularity was classified as small. Visit the popularity section on Snyk Advisor to see the full health analysis.

Is dumpscan well maintained?

We found indications that dumpscan is an Inactive project. See the full package health analysis to learn more about the package maintenance status.

Is dumpscan safe to use?

The python package dumpscan was scanned for known vulnerabilities and missing license, and no issues were found. Thus the package was deemed as safe to use. See the full health analysis review.

Last updated on 24 November-2024, at 06:19 (UTC).

Build a secure application checklist

Select a recommended open source package

Minimize your risk by selecting secure & well maintained open source packages

DONE

Scan your app for vulnerabilities

Scan your application to find vulnerabilities in your: source code, open source dependencies, containers and configuration files

SCAN NOW

Fix identified vulnerabilities

Easily fix your code by leveraging automatically generated PRs

AUTO FIX

Monitor for new issues

New vulnerabilities are discovered every day. Get notified if your application is affected

MONITOR APP

dumpscan

Scanning memory dumps for secrets using volatility and yara For more information about how to use this package see README

Ensure you're using the healthiest python packages

Package Health Score

Popularity

Direct Usage Popularity

Security

Security and license risk for latest version

Maintenance

Commit Frequency

Community

Embed Package Health Score Badge

Keep your project healthy

Check your requirements.txt

Snyk Vulnerability Scanner

Package

Readme

Features

Installation

Usage

Kernel Mode

Minidump Mode

Built With

Acknowledgements

To-Do

dumpscan dependencies

FAQs

What is dumpscan?

Is dumpscan popular?

Is dumpscan well maintained?

Is dumpscan safe to use?

Build a secure application checklist

Select a recommended open source package

Scan your app for vulnerabilities

Fix identified vulnerabilities

Monitor for new issues

Package Health Score

Direct Usage Popularity

Security and license risk for latest version

Commit Frequency

Embed Package Health Score Badge

Keep your project healthy

Check your requirements.txt

Snyk Vulnerability Scanner

Readme

Features

Installation

Usage

Kernel Mode

Minidump Mode

Built With

Acknowledgements

To-Do

dumpscan dependencies

FAQs

What is dumpscan?

Is dumpscan popular?

Is dumpscan well maintained?

Is dumpscan safe to use?

Build a secure application checklist

Select a recommended open source package

Scan your app for vulnerabilities

Source Code

Open Source

Container

Config

Fix identified vulnerabilities

Monitor for new issues