#1General purpose tools for collecting various types of information about targets.
Kitploit recommended
cbx216/cve-newgen-software-advisoriesAdvisory for CVE-2025-65742 — Newgen OmniDocs LDAP Admin BFLA
mr-r3b00t/crime-mapperA tool for mapping cyber crime
smeegesec/hashtagPassword Hash Identification
vonuyvicoo/nextploiterNextJS exploiter for CVE-2025-55182 and more.
indoushka/context-aware-offensive-intelligenceResearch framework redefining post-exploitation through decision intelligence.
cr0wld3r/cve-2025-69612A path traversal vulnerability exists in TMS Management Console
hackingyseguridad/smbShell script collection for SMB protocol auditing, vulnerability detection (EternalBlue, SMBGhost), null session enumeration, credential brute-force,…
hackhermind-pixel/vulnerable-lab-exploitationA hands-on project demonstrating the setup of virtual security lab, network reconnaissance, and exploitation of CVE-2012-1823.
keraattin/mongobleed-detector-cve-2025-14847Mongobleed Detector CVE-2025-14847
matank001/moxyMoxy is an open-source DAST tool designed for modern web application security testing. It provides an easy-to-use interface with agentic capabilities…
logisek/baconsamplerSniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.
samael0x4/cve-2026-21962Unauthenticated vulnerability that may allow remote attackers to compromise confidentiality and integrity, potentially leading to full system…
sohelyousef/js-secret-hunterAutomated Python scanner to detect hardcoded secrets (Private Keys, API Tokens) in client-side JavaScript files.
fin3ss3g0d/cypherhoundYour template-based BloodHound terminal companion tool
saaydmr/hikvision-exploiterCVE-2017-7921, CVE-2021-36260 updated 21/01/2026
sohelyousef/cve-2024-58290-xhibiter-sqliProof of Concept (PoC) for SQL Injection in Xhibiter NFT Marketplace 1.10.2 (Collections Endpoint). Discovered by Sohel Yousef.
projectdiscovery/shufflednsMassDNS wrapper written in go to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard filtering and easy…
mayyhem/maestroAbusing Azure services over C2
