#1General purpose tools for collecting various types of information about targets.
Kitploit recommended
veereshgadige/aziot-cctv-cve-2025-50777CVE-2025-50777: Root Access and Plaintext Credential Exposure in AZIOT Smart CCTV
87achrafg-stack/cve-2026-48907Exploits CVE-2025-9209 in WordPress by querying /wp-json/wp/v2/users, harvesting user keys, tokens, and cookies, bypassing Defender/Imunify360, and…
opfour/coeus-ciCompetitive Intelligence from public data sources. Named after Coeus, the Greek Titan of the inquisitive mind.
olbat/nvdcveDaily-updated JSON repository of NVD/CVE vulnerability data, enabling easy retrieval and git-based exploration of CVE modification history for…
gmh5225/mcp-god-modeDid you ever just want it to do everything? 148 POWERFUL Infosec/Admin tools on a single MCP server.
radkawar/aws-firmware-dumpAcquires the EBS disks of an AWS AMI you can launch, streaming snapshots via EBS direct APIs to a private S3 bucket with sha256 manifests and…
abraxas/cve-2026-87902Proof-of-concept and disclosure pack for CVE-2026-87902, an unauthenticated local file inclusion in WordPress Core via locate_template(), with a…
murrez/hp-hplip-mass-cve-checker-2026-09-Mass check/research exploit for HP HPLIP CVE-2026-91097–91106 (<3.26.6), PAPPL :8000 IPP probes + hpssd templates
plur1bu5/gitreadCVE-2026-85706 · GitLab CE/EE unauthenticated file read · research PoC with oracle mode, fd enumeration, and tiered loot targeting
guneykabel/cve-2026-85706Python PoC exploit for CVE-2026-85706, an unauthenticated arbitrary file read in GitLab CE/EE via Workhorse path-encoding bypass, with writeup and…
sec-dan/wp2shell-scannerRead-only CLI to check whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 / CVE-2026-60137)
maxprog-svg/citrixbleedcve-2026-8452-2025-5777CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session…
mbanyamer/llama-stack-0.4.0rc3-local-cve-2026-25211Local proof-of-concept scanner that detects plaintext database passwords in llama-stack initialization logs, using regex pattern matching to identify…
byt3bl33d3r/sprayingtoolkitScripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficient
renzi25031469/cve-2026-19478Detects CVE-2026-19478 in GitLab CE/EE with a non-destructive Nuclei template that triggers the GraphQL fallback-field method invocation via touch…
0xterror/cve-2023-22047-oracle-peoplesoft-lfiCVE-2023-22047 is a critical unauthenticated Local File Inclusion (LFI) vulnerability in Oracle PeopleSoft Enterprise PeopleTools. This exploit…
bishopfox/unredacterNever ever ever use pixelation as a redaction technique
oros42/imsi-catcherThis program show you IMSI numbers of cellphones around you.
