#1Tools for creating fake identities, spoofing communications, and impersonating targets for social engineering.
Kitploit recommended
bettercap/bettercapThe Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
sfewer-r7/cve-2026-55040Proof-of-concept exploit for Microsoft SharePoint CVE-2026-55040 that forges JWT tokens, bypasses authentication, auto-discovers metadata, and…
sam00/poc-cve-2026-54121-certighostExploit toolkit for AD CS CVE-2026-54121: low-privileged domain users impersonate a Domain Controller, forge certificates, and compromise the domain…
henriksb/extensionspooferSpoof file icons and extensions in Windows
eliangonzi00/pockeycloakcve-2023-0264Proof-of-concept exploit for CVE-2023-0264 (Keycloak OIDC session hijacking) with a frontend for session_id substitution and an agent that detects…
0x574r/darkcloakLinux process identity cloaking tool that spoofs comm, argv, cmdline, environ, exe path, and VMAs via an 11-phase prctl pipeline to impersonate…
kgretzky/evilginx2Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor…
synacktiv/prox-ezHTTP/HTTPS interception proxy for testing Windows authentication mechanisms, supporting NTLM, Kerberos, pass-the-hash, pass-the-ticket and relay…
trustedsec/social-engineer-toolkitThe Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
wifiphisher/wifiphisherRogue Access Point framework for red team engagements and Wi-Fi security testing. Performs Evil Twin, KARMA, and Known Beacons attacks to achieve…
x48ps/cve-2026-8181This vulnerability allows unauthenticated attackers who know a valid administrator username to impersonate that admin during REST API requests by…
undeadsec/socialfishModern dynamic phishing toolkit for authorized red team exercises. Clones login pages, captures credentials, cookies, and 2FA codes with a live…
sanupl/cve-2021-46067CVE-2021-46067 - In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover.
crimsonforge-io/king-phisherSimulate realistic phishing campaigns with credential harvesting, email tracking, and landing page cloning for security awareness training and…
quinnbast/malicious-mcpA Proof-of-concept repository showing how an untrusted MCP server can steal literally everything...
h4lpy/toastfix-demoProof-of-concept security demo illustrating how PowerShell can create trusted-looking Windows toast notifications chained together with…
mzhmo/powershellkerberosSome scripts to abuse kerberos using Powershell
