Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

API key scanning, credential leak detection, and secret management tools.

Kitploit recommended

Top tools

10 selected

gitleaks

gitleaks/gitleaks

28.6k3 months ago

trufflehog

trufflesecurity/trufflehog

27.4k8h 59m ago

detect-secrets

yelp/detect-secrets

4.6k6 months ago

git-secrets

awslabs/git-secrets

13.4k1 year ago

ggshield

gitguardian/ggshield

2.0k1 day ago

talisman

thoughtworks/talisman

2.1k11 months ago

teller

tellerops/teller

3.2k8 months ago

trivy

aquasecurity/trivy

37.4k11h 43m ago

#10

semgrep

semgrep/semgrep

16.2k2 days ago

#11

horusec

zupit/horusec

1.3k3 years ago

Newest Relevance Most popular Recently updated

404 results

medusa

pantheon-security/medusa

AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an…

vulnerability-scannerscontainer-securitystatic-code-analysis+8

9573 months ago

Shockwave-OSS

gal-nagli/shockwave-oss

Curated collection of bug bounty tips, one-liners, and automation workflows for recon, fuzzing, and web exploitation, with private nuclei templates…

reconnaissancevulnerability-analysisweb-application-exploitation+9

7532 years ago

renovate-operator

mogenius/renovate-operator

Operator to streamline renovate executions in Kubernetes

vulnerability-scannerscontainer-securityconfiguration-auditing+4

5392 days ago

pmg

safedep/pmg

PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.

vulnerability-scannerscontainer-securitydynamic-analysis-sandboxing+6

46622h 56m ago

tartufo

godaddy/tartufo

Searches through git repositories for high entropy strings and secrets, digging deep into commit history

vulnerability-scannerscode-analysisdevsecops+1

51622 days ago

huskyCI

globocom/huskyci

Performing security tests inside your CI

static-analysisvulnerability-scannerscode-analysis+2

5972 years ago

JShunter

cc1a2b/jshunter

jshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive…

reconnaissancestatic-code-analysisvulnerability-analysis+6

5291 month ago

sast-scan

shiftleftsecurity/sast-scan

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and…

static-analysisvulnerability-scannerscontainer-security+6

8793 years ago

prismor

prismorsec/prismor

Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt…

defensive-toolscontainer-securitydevsecops+5

28320h 14m ago

jackhammer

olacabs/jackhammer

Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.

penetration-testing-frameworksvulnerability-scannersdynamic-analysis-sandboxing+9

7397 years ago

secret-regex-list

h33tlit/secret-regex-list

List of regex for scraping secret API keys and juicy information.

reconnaissanceinformation-gatheringweb-security+3

7294 years ago

keyFinder

momenbasel/keyfinder

Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.

osintreconnaissanceinformation-gathering+2

6963 months ago

rusty-hog

newrelic/rusty-hog

Multi-source secret scanner detecting API keys, passwords, and PII across Git repos, S3 buckets, filesystems, Confluence, JIRA, Slack, and Google…

code-analysiscloud-securitydevsecops+1

5552 months ago

shotlooter

utkusen/shotlooter

a recon tool that finds sensitive data inside the screenshots uploaded to prnt.sc

osintreconnaissancedata-exfiltration+2

6481 year ago

mantra

brosck/mantra

「🔑」A tool used to hunt down API key leaks in JS files and pages

vulnerability-scannersinformation-gatheringweb-security+1

9237 months ago

s3crets_scanner

eilonh/s3crets_scanner

Automated scanner that hunts for secrets (API keys, credentials) accidentally uploaded to public S3 buckets, using truffleHog3 for detection and…

cloud-infrastructure-securityvulnerability-scannerscloud-security+1

5713 years ago

bramble

flythenimbus/bramble

Local-first password manager with direct device-to-device sync

osintpassword-crackingencryption-decryption-tools+7

3032 days ago

matchlock

jingkaihe/matchlock

Ephemeral microVM sandbox for AI agents with network allowlisting, secret injection via MITM proxy, and VM-level isolation. Boots in under a second,…

container-securitysecurity-virtualizationnetwork-security+5

6112 months ago

Previous 1…567…23 Next