Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Custom payload crafting, obfuscation, AV evasion, and delivery mechanism tools.

Newest Relevance Most popular Recently updated

3296 results

TangledWinExec

daem0nc0re/tangledwinexec

PoCs and tools for investigation of Windows process execution techniques

ids-ips-evasionreverse-engineeringshellcode+6

9586 months ago

Payload Development

Custom payload crafting, obfuscation, AV evasion, and delivery mechanism tools.

Newest Relevance Most popular Recently updated

3296 results

TangledWinExec

daem0nc0re/tangledwinexec

PoCs and tools for investigation of Windows process execution techniques

ids-ips-evasionreverse-engineeringshellcode+6

9586 months ago

NiCOFF

frkngksl/nicoff

COFF and BOF Loader written in Nim

post-exploitationpenetration-testingred-teaming+1

1774 months ago

POC-CVE-2017-8464-OpenCalculator

playboisk8/poc-cve-2017-8464-opencalculator

Exploiting the .lnk vulnerability and operating system handling mechanisms regarding explorer.exe and USB drives.

vulnerability-analysisexploitationbinary-analysis+2

12 days ago

Shellcrypt

iilegacyyii/shellcrypt

A QoL tool to obfuscate shellcode. In the future will be able to chain encoding/encryption/compression methods.

encryption-decryption-toolspayload-generationshellcode+3

2163 years ago

CVE-2026-64638

dungsocool/cve-2026-64638

Proof-of-concept exploit for CVE-2026-64638: reflected XSS in WordPress login chained with DOM clobbering to achieve admin account takeover and…

phishing-toolsvulnerability-analysiscode-analysis+4

12 days ago

XSS2Shell-CVE-2026-64638

jendmaoul/xss2shell-cve-2026-64638

CVE-2026-64638 — WordPress Pre-Auth Reflected XSS → RCE via DOM Clobbering + Application Password Theft + REST API Plugin Activation. Dual-mode PoC…

exploitationweb-application-exploitationpost-exploitation+4

113 days ago

log4j-shell-poc

jiahong-guan/log4j-shell-poc

A Proof-Of-Concept for the CVE-2021-44228 vulnerability.

payload-generationexploitationweb-application-exploitation+3

112 days ago

Root-My-Galaxy

ruik-tech/root-my-galaxy

KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499

android-securityprivilege-escalationexploitation+2

12 days ago

CVE-2026-63077

anggatechi/cve-2026-63077

Proof-of-concept exploit for JetBrains TeamCity that performs unauthenticated remote code execution via agent polling protocol deserialization,…

exploitationweb-application-exploitationweb-security+2

13 days ago

FlavorTown

wra7h/flavortown

Various ways to execute shellcode

shellcodepost-exploitationred-teaming+1

5132 years ago

NoFaxGiven

hackerhouse-opensource/nofaxgiven

Code Execution & Persistence in NETWORK SERVICE FAX Service

privilege-escalationpersistence-mechanismsexploitation+3

376 months ago

CVE-2026-64638

4minx/cve-2026-64638

Single-file HTML proof-of-concept for WordPress pre-auth reflected XSS (CVE-2026-64638), demonstrating unauthenticated JavaScript execution and an…

vulnerability-analysisexploitationweb-application-exploitation+3

113 days ago

CVE-2026-3844

anggatechi/cve-2026-3844

CVE-2026-3844 — Unauthenticated Arbitrary File Upload to RCE in Breeze Cache (WordPress). CVSS 9.8 CRITICAL. Mass scanner + auto shell injector with…

vulnerability-scannersexploitationweb-application-exploitation+3

213 days ago

PowerSploit

zerodaylab/powersploit

PowerSploit - A PowerShell Post-Exploitation Framework

penetration-testing-frameworksprivilege-escalationreconnaissance+7

2394 years ago

rust_syscalls

janoglezcampos/rust_syscalls

Single stub direct and indirect syscalling with runtime SSN resolving for windows.

ids-ips-evasionpost-exploitationred-teaming+1

2403 years ago

Heroinn

b23r0/heroinn

A cross platform C2/post-exploitation framework.

penetration-testing-frameworkspost-exploitationcommand-and-control+4

7123 years ago

SharpWhispers

secforce/sharpwhispers

C# porting of SysWhispers2. It uses SharpASM to find the code caves for executing the system call stub.

ids-ips-evasionshellcodepost-exploitation+2

1123 years ago

GwisinMsi

choisg/gwisinmsi

PoC MSI payload based on ASEC/AhnLab's blog post

malware-analysisred-teamingpayload-development+1

253 years ago

Previous 1…567…184 Next