#1General purpose tools for collecting various types of information about targets.
Kitploit recommended
impostorkeanu/eavesarpAnalyze ARP requests to identify intercommunicating hosts and stale network address configurations (SNACs)
ank1036official/cloudcheckChecks using a test string if a Cloudflare DNS bypass is possible using CloudFail.
robertaitch/telegram-story-scraperA Python script that allows you to automatically scrape and download stories from your Telegram friends using the Telethon library. The script…
elmasy-com/columbus-serverAPI-first subdomain discovery service using Certificate Transparency logs for fast, passive enumeration of subdomains via a REST API with JSON or…
coldfusion39/vertxploitExploiting HID VertX and EDGE access control systems
zilbonn/owasp-wstg-ragOWASP Web Security Testing Guide RAG system with ChromaDB, MCP for Claude Code
mrtdlgc/goodoldsearch-ossLocal static query builder for precise search across web engines, Shodan, crt.sh, and Wayback Machine. Supports Google dorks, filetype filters, date…
logisek/baconsamplerSniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.
mindpatch/startpage-parserparsing search results from startpage search engine (based on google.com results)
srvaccount/cve-2021-26855-pocPoC exploit code for CVE-2021-26855
yottaiq/jok3rJok3r - Network and Web Pentest Framework
ottoyrocky/phantom-brainRed portatil de reconocimiento inteligente con IA offline
hawsec/gingerA security assessment tool for Hitachi Vantara's Pentaho Business Analytics platform.
aau-network-security/richkitDomain Enrichment Toolkit $ pip install richkit
shinthink/cve-2026-49049Read-only vulnerability scanner for CVE-2026-49049 — Helix3 Joomla plugin unauthenticated AJAX handler
nu11secur1ty/wssBlack-box WordPress vulnerability scanner that detects security issues, enumerates users, brute-forces logins via XMLRPC, and performs static PHP…
chocapikk/cve-2026-39912Xboard / V2Board Unauth Account Takeover - Magic Link Token Leak (CVE-2026-39912)
franckferman/cve-2025-67906MISP <= 2.5.27 - Stored Cross-Site Scripting via Workflow Engine (doT.js Template Injection).
