#1Tools for creating, managing, and analyzing fake login pages and email campaigns.
Kitploit recommended
unhackerencapital/pdfernetremoteloPoC - Prueba de Concepto de CVE-2024-4367 en conjunto al CVE-2023-38831 en un solo Script
trackflaw/cve-2023-23397Simple PoC of the CVE-2023-23397 vulnerability with the payload sent by email.
themehackers/cve-2024-21413CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC
tea-on/cve-2023-41425-rce-wondercms-4.3.2Automates creation and hosting of a JavaScript XSS payload to install a malicious theme module, triggering a reverse shell via Remote Code Execution…
secsys-fdu/cve-2025-51863Proof-of-concept for a Self-XSS vulnerability in ChatGPTUtil, demonstrating cookie theft and account hijacking via crafted SVG payloads pasted into…
sakurasamuraii/cve-2021-43032Post authenticated stored-xss in XenForo versions ≤ 2.2.7
elvira-alec/fractureFragAttacks WiFi penetration framework — CVE-2020-24586/87/88
bhatbhupendra/moniker-link--cve-2024-21413-Educational guide on CVE-2024-21413, the Outlook zero-click Moniker Link vulnerability, covering attack flow, NTLM credential capture, detection with…
jun2e0/cve-2025-26788Proof-of-concept exploit for CVE-2025-26788 demonstrating WebAuthn credential ID manipulation via JavaScript hooking to bypass authentication in…
f-bader/tokentacticsv2A fork of the great TokenTactics with support for CAE and token endpoint v2
dharmstm/cve-2026-30502-openkm-6.3.12-reflected-xssDocumentation and proof-of-concept for CVE-2026-30502, a reflected XSS vulnerability in OpenKM v6.3.12. Includes technical analysis, root cause,…
weswrench/cve-2026-36214Stored Cross-Site Scripting (XSS) in osTicket via Vulnerable Bootstrap Tooltip Component
0pts/cve-2023-0214Secure Web Gateway 10.2.11 - Cross-Site Scripting (XSS)
shacode/olyx🔗 Lightweight security orchestrator mobile application for URI vetting, providing a unified, multi-engine interface to aggregate and validate link…
ineesdv/tangledOpen-source offensive security platform for conducting phishing campaigns that weaponizes iCalendar automatic event processing.
7h30th3r0n3/evil-m5projectMulti-purpose WiFi penetration testing toolkit for M5Stack devices. Performs network scanning, evil-twin attacks, deauthentication, captive portal…
dedsec1121fk/dedsecEducational Android (Termux) toolkit for learning penetration testing, OSINT, social engineering, and network security through hands-on scripts,…
vincentkaufmann/noapi-google-search-mcpMCP server for Google search and page fetching using headless Chromium
