Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools for analyzing application behavior during runtime to find security vulnerabilities.

Kitploit recommended

Top tools

10 selected

zaproxy

zaproxy/zaproxy

15.6k4 days ago

nuclei

projectdiscovery/nuclei

30.4k3 days ago

wapiti

wapiti-scanner/wapiti

1.9k1 month ago

nikto

sullo/nikto

10.6k1 month ago

sqlmap

sqlmapproject/sqlmap

38.2k1 day ago

XSStrike

s0md3v/xsstrike

15.1k1 year ago

wpscan

wpscanteam/wpscan

9.7k2 days ago

Nettacker

owasp/nettacker

5.5k7 days ago

ffuf

ffuf/ffuf

16.5k11 days ago

#10

dirsearch

maurosoria/dirsearch

14.6k3 days ago

Newest Relevance Most popular Recently updated

128 results

MaFrida

theshinigami/mafrida

A Magisk module that simplifies running the Frida server on Android, with easy management commands to download specific versions, enable or disable…

android-securitydynamic-analysis-sandboxingdynamic-code-analysis+5

382 months ago

ifuncd-up

robertdfrench/ifuncd-up

GNU IFUNC is the real culprit behind CVE-2024-3094

vulnerability-analysisdynamic-code-analysisexploitation+5

604 months ago

ida_bochs_windows

therealdreg/ida_bochs_windows

Helper script for Windows kernel debugging with IDA Pro on native Bochs debugger (including PDB symbols)

dynamic-code-analysisreverse-engineeringdebuggers+1

623 years ago

FIASSE

owasp/fiasse

A Framework for Integrating Application Security into Software Engineering (FIASSE) using the Securable Software Engineering Model (SSEM)

static-analysisvulnerability-analysiscode-analysis+7

101 month ago

slides

0x3c3e/slides

CodeQL + DTrace = Memory Disclosure Vulnerabilities in XNU

static-code-analysisvulnerability-analysisdynamic-code-analysis+2

493 years ago

ctxdebug

ddudle/ctxdebug

MCP-powered reverse engineering platform connecting WinDbg, IDA Pro & x64dbg with 160+ AI-accessible debugging and analysis tools.

static-analysisdynamic-code-analysisreverse-engineering+4

223 days ago

ICSFuzz

momalab/icsfuzz

Instrumented fuzzer for PLC-based ICS control applications, targeting Codesys runtime on Wago controllers to uncover memory corruption and…

embedded-systems-securityvulnerability-analysisdynamic-code-analysis+3

304 years ago

ExportHider

frkngksl/exporthider

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

dynamic-code-analysisexploitationreverse-engineering+4

335 months ago

apatchy

0xbigshaq/apatchy

Fuzzing Framework for Modules in Apache HTTPD Server

vulnerability-analysiscode-analysisdynamic-code-analysis+2

223 months ago

dapr

nccgroup/dapr

Driver Attack Platform for Linux

android-securityembedded-systems-securityexploit-frameworks+5

186 years ago

ghidra_stack_strings

zxgio/ghidra_stack_strings

A script to detect stack-strings by using emulation (leveraging Unicorn)

dynamic-code-analysisreverse-engineeringmalware-analysis+1

359 months ago

pesieve-go

hasherezade/pesieve-go

Golang bindings for PE-sieve

memory-forensicsdynamic-code-analysismalware-analysis+1

432 years ago

apiscope

kaisonox/apiscope

An API hooking framework for intercepting and monitoring Windows applications

dynamic-analysis-sandboxingdynamic-code-analysisreverse-engineering+4

203 months ago

zairo

iamavu/zairo

Scans code diffs with context to build an impact graph and uses LLMs to find vulnerabilities, supporting multi-repo scans and CI gating with SARIF…

static-analysisvulnerability-analysiscode-analysis+3

820 days ago

CVE-2026-56848

open-flaw/cve-2026-56848

Exploit PoC for CVE-2026-56848, a Node.js HTTP/2 heap-use-after-free that allows remote unauthenticated DoS. Includes raw-socket trigger, ASan build…

vulnerability-analysisdynamic-code-analysisexploitation+2

1 month ago

android_demystification_toolbox

nccgroup/android_demystification_toolbox

ADT is a toolset designed to help model application behavior, research and test security vulnerabilities, and facilitate reversing hostile code.

android-securityvulnerability-analysiscode-analysis+5

82 years ago

one-multiply-too-many-cve-2026-70638-llama-cpp-android-jni-integer-overflow

hunt-benito/one-multiply-too-many-cve-2026-70638-llama-cpp-android-jni-integer-overflow

Reproduces the CVE-2026-70638 integer overflow in llama.cpp Android JNI with a safe arithmetic demo, malicious GGUF generator, and Frida hook for…

android-securitypayload-generationvulnerability-analysis+3