#1Password cracking, brute-force, wordlists, and credential testing tools.
Kitploit recommended
roccoammon/active-directory-health-checkPowerShell GUI tool that runs 54 best-practice health and security checks against Active Directory, flagging Kerberoasting, DCSync, delegation and…
fl0ydsec/cve-2026-63030Python mass exploit and detector for the WordPress Core pre-auth RCE chain CVE-2026-63030 and CVE-2026-60137, chaining SQL injection into remote code…
qyvora/qyvora-toha3eeGo-based network exploitation and MITM framework for authorized penetration testing, network reconnaissance, traffic interception, wireless security…
adityatelange/evil-winrm-pyExecute commands interactively on remote Windows machines using the WinRM protocol (just faster)
affolter-engineering/ldapinCLI tool to perform basic LDAP task for security assessments
affolter-engineering/mqattackRust CLI for MQTT penetration testing: subscribe/publish, broker fingerprinting, ACL probing, topic enumeration, credential brute-force, and Last…
owasp/nettackerAutomated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
openwall/johnJohn the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems,…
insider77circle/ai-password-testing-agentAn intelligent agent for testing password strength, identifying vulnerabilities, and exploring patterns in password creation.
scorpioneslabs/mssqlpwnerAdvanced MSSQL penetration testing tool for lateral movement, command execution, NTLM relay, and brute-force attacks via linked servers and multiple…
abraxas/gofilexWordlist Bruteforcer for GoFile (gofile.io) Download Passwords
lcky00/impostorSMB1 server for NTLMv2 hash interception, written in C.
cloud-architekt/azuread-attack-defenseThis publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can…
suriyaboon/hackthebox-factsHTB Facts is a Easy Linux box featuring Camaleon CMS and MinIO. Gain admin access via open registration and a mass assignment vulnerability, then…
skelsec/aardwolfAsynchronous RDP client for Python (headless)
nxploited/cve-2026-96451WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
wapiti-scanner/wapitiWeb vulnerability scanner written in Python3
abraxas/vaultwarden-ip-header-spoofVaultwarden 1.37.3 default X-Real-IP trusted-local bypasses login rate limits on Docker NAT
