#1Tools for creating and customizing malicious code or instructions to execute after exploitation.
Kitploit recommended

CVE-2026-63223 — CI4RCE: CodeIgniter 4 is_image/mime_in File Upload RCE. Magic bytes bypass (getExtension vs getClientExtension). CVSS 9.8 | CWE-434…

Generate SSRF payloads

CVE-2026-56164 is a critical missing-authentication vulnerability affecting on-premises Microsoft SharePoint Server. It allows unauthenticated,…

pgAdmin Proof of Concept

Passive security checker for CVE-2026-48908 affecting SP Page Builder.

Proof-of-concept exploit for CVE-2025-66034 in the fontTools variable font generation pipeline. A crafted .designspace file allows control of the…

CVE-2014-6287

High CVE-2024-4761 Exploit

CVE-2022-24990 exploit tool with POC detection and EXP WebShell upload for TerraMaster NAS devices. Supports URL-based targeting and dual-mode…

Graphical detection tool for CVE-2022-22965 (Spring4Shell) with one-click reverse shell generation, command execution, and multi-server shell path…

Python exploit for CVE-2020-14008 in ManageEngine Applications Manager delivering a SYSTEM-level reverse shell via authenticated remote code…

Proof-of-concept exploit for CVE-2020-2555, demonstrating remote code execution via deserialization in Oracle WebLogic Server.

ZIP Bomb Creator is a tool used to create a ZIP file that is small in size but drastically expands when extracted.

Tomcat 远程代码执行漏洞 Exploit

Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could…

Proof-of-concept exploit for CVE-2020-0688 providing remote code execution and reverse bind shell against Microsoft Exchange servers.

⭐️The famous XWorm RAT, version 2.1. Educational purposes only

MySQL-Fu is a Ruby based MySQL Client Script I wrote. It does most of the stuff a normal MySQL client might do: SQL Shell, Update/Delete/Drop…