#1Custom payload crafting, obfuscation, AV evasion, and delivery mechanism tools.
Kitploit recommended
beefproject/beefThe Browser Exploitation Framework Project
kamalx06/tornadoc2Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, ECDSA-signed tasking, and a multi-operator team server with…
p3nt4/nuagesA modular C2 framework
jm33-m0/emp3r0rSelf‑healing Gossip Mesh C2 with Assisted Peer Discovery, Cross-Platform BOF Execution, and Scriptable Agents.
sk4r4b/ntdll-reconstructionA technique that mixes NTDLL unhooking and hellsgate gate varients
nicetop1027/cve-2026-pending-claude-desktop-rce
racoten/reflectivepluginloaderReflective PE mapper and evasion-hardened module stomping engine for Windows x64
dimamend/cve-2022-42889-text4shellDocker-based lab environment to reproduce and test CVE-2022-42889 (Text4Shell) remote code execution vulnerability in Apache Commons Text.
zenyxx-xd/rootmyvivoOne-click root for vivo/iQOO devices on locked bootloader | CVE-2026-43499 + KernelSU
xiaohj233/ghostlock-x200-appvivo X200 设备端一键 root App（Shizuku 授权 shell 域执行，CVE-2026-43499）
abraxas/pfsense-timezone-phpinipfSense CE 2.9.0-DEVELOPMENT - High - Remote - RCE - timezone php.ini prepend
ne0nd0g/merlinMerlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
i-am-shodan/usbarmyknifeUSB Army Knife – the ultimate close access tool for penetration testers and red teamers.
tc4dy/cve-2026-24061-poc-exploitRemote authentication bypass exploit for GNU inetutils-telnetd (CVE-2026-24061) using CRLF injection to gain instant root shell. Supports single/mass…
horizon3ai/ahsaycbs-auth-bypass-rceA proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS
zenyxx-xd/rootmyvivo-exploitGhostLock (CVE-2026-43499) exploit fork for RootMyVivo Neo — iQOO Neo 11 (PD2520, SM8750, 6.6.89). For authorized research on own devices only.
showy-headteacher114/cve-2025-66398Demonstrate exploitation of Signal K Server CVE-2025-66398 allowing unauthenticated attackers to inject backdoor and enable remote code execution.
