Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

API testing, fuzzing, schema validation, authentication testing, and gateway security tools.

Kitploit recommended

Top tools

10 selected

kiterunner

assetnote/kiterunner

3.2k5 years ago

zaproxy

zaproxy/zaproxy

15.6k2h 12m ago

nuclei

projectdiscovery/nuclei

30.4k2 days ago

sqlmap

sqlmapproject/sqlmap

38.2k1 day ago

graphql-cop

dolevf/graphql-cop

68411 months ago

graphw00f

dolevf/graphw00f

8845 months ago

Arjun

s0md3v/arjun

6.4k1 year ago

jwt_tool

ticarpi/jwt_tool

6.7k1 year ago

crAPI

owasp/crapi

1.6k1 month ago

#10

automatic-api-attack-tool

imperva/automatic-api-attack-tool

4956 years ago

Newest Relevance Most popular Recently updated

496 results

Nest

owasp/nest

Your gateway to OWASP. Discover, engage, and help shape the future!

osintinformation-gatheringeducation+2

42115h 21m ago

tiny_tracer

hasherezade/tiny_tracer

Intel Pin-based tracer for API calls, syscalls, and instructions with anti-debug evasion, used for malware analysis and reverse engineering of packed…

dynamic-analysis-sandboxingreverse-engineeringmalware-analysis+2

1.7k4 months ago

pipelock

luckypipewrench/pipelock

Open-source AI agent firewall that scans HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, emitting verifiable…

vulnerability-scannersids-ips-evasiondata-exfiltration+8

7921 day ago

cve-mcp-server

mukul975/cve-mcp-server

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan,…

osintreconnaissancevulnerability-scanners+6

1.1k4 months ago

clawpatrol

denoland/clawpatrol

Wire-level proxy firewall for AI agents that intercepts and gates SQL, Kubernetes, and HTTP traffic using HCL rules, with per-process tunnel…

defensive-toolscontainer-securityweb-proxies-interception+6

97519 days ago

janusec

janusec/janusec

Unified application gateway providing reverse proxy, WAF, CC defense, OAuth2 authentication, ACME certificate automation, and GSLB for secure,…

vulnerability-scannerscontainer-securityids-ips-evasion+8

1.2k3 months ago

JSAnalyzer

jenish-sojitra/jsanalyzer

Burp Suite extension for JavaScript static analysis: extracts API endpoints, URLs, secrets, and emails with noise filtering for web security testing.

static-analysisinformation-gatheringweb-security+4

1.2k8 months ago

Damn-Vulnerable-GraphQL-Application

dolevf/damn-vulnerable-graphql-application

Damn Vulnerable GraphQL Application is an intentionally vulnerable GraphQL service implementation designed for learning about and practising GraphQL…

vulnerability-analysisapi-security-testingweb-security+5

1.7k1 year ago

lua-resty-waf

p0pr0ck5/lua-resty-waf

High-performance WAF built on the OpenResty stack

defensive-toolsweb-securityapi-security+1

1.3k5 years ago

VibeSec-Skill

behisecc/vibesec-skill

This skill helps Claude write secure code and prevent common vulnerabilities.

static-code-analysisvulnerability-analysiscode-analysis+8

1.1k8 months ago

vapi

roottusk/vapi

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.

vulnerability-scannersapi-security-testingweb-security+4

1.4k1 year ago

APTS

owasp/apts

OWASP Autonomous Penetration Testing Standard

penetration-testing-frameworksvulnerability-analysispenetration-testing+5

6871 month ago

OFFAT

owasp/offat

Automated API security testing tool that generates tests from OpenAPI specs, fuzzes inputs, and checks for OWASP API Top 10 vulnerabilities including…

vulnerability-scannersweb-application-exploitationapi-security-testing+2

6631 day ago