Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

API key scanning, credential leak detection, and secret management tools.

Kitploit recommended

Top tools

10 selected

gitleaks

gitleaks/gitleaks

28.6k3 months ago

trufflehog

trufflesecurity/trufflehog

27.4k17h 47m ago

detect-secrets

yelp/detect-secrets

4.6k6 months ago

git-secrets

awslabs/git-secrets

13.4k1 year ago

ggshield

gitguardian/ggshield

2.0k13h 10m ago

talisman

thoughtworks/talisman

2.1k11 months ago

teller

tellerops/teller

3.2k8 months ago

trivy

aquasecurity/trivy

37.4k20h 31m ago

#10

semgrep

semgrep/semgrep

16.2k10h 55m ago

#11

horusec

zupit/horusec

1.3k3 years ago

Newest Relevance Most popular Recently updated

404 results

eviltree

t3l3machus/eviltree

A python3 remake of the classic "tree" command with the additional feature of searching for user provided keywords/regex in files, highlighting those…

privilege-escalationreconnaissanceinformation-gathering+3

4111 year ago

sec-af

agent-field/sec-af

AI-native code security auditor on AgentField that proves exploitability with verdicts, traces, and actionable evidence.

static-analysisvulnerability-scannerscode-analysis+7

1942 months ago

dora

sdushantha/dora

Find exposed API keys based on RegEx and get exploitation methods for some of keys that are found

vulnerability-analysisinformation-gatheringpenetration-testing+1

3434 years ago

git-wild-hunt

josehelps/git-wild-hunt

A tool to hunt for credentials in github wild AKA git*hunt

osintcode-analysisinformation-gathering+1

2974 years ago

BucketLoot

redhuntlabs/bucketloot

BucketLoot is an automated S3-compatible bucket inspector that can help users extract assets, flag secret exposures and even search for custom…

cloud-infrastructure-securityosintreconnaissance+4

4469 months ago

JSScanner

dark-warlord14/jsscanner

You can read the writeup on this script here

osintinformation-gatheringweb-security+1

2726 years ago

aura

sourcecode-ai/aura

Python source code auditing and static analysis on a large scale

static-analysisvulnerability-analysiscode-analysis+4

4933 years ago

secure-agent-playbook

owasp/secure-agent-playbook

OWASP Secure Agent Playbook Project

static-analysisvulnerability-analysiscode-analysis+9

1416 days ago

jsubfinder

threatunknown/jsubfinder

Go-based tool that scans webpages and JavaScript files to discover hidden subdomains and secrets, with optional crawling and real-time proxy analysis…

osintreconnaissanceinformation-gathering+3

2831 year ago

Pinkerton

0xdsm/pinkerton

🕵️ Python project to crawl for JavaScript files and search for secrets like API keys, authorization tokens, hardcoded credentials, etc.

information-gatheringweb-securitysecret-detection+1

4406 months ago

depx

projectdiscovery/depx

Malicious package & supply-chain intelligence

vulnerability-analysisdevsecopssecret-detection+2

1829 days ago

gryph

safedep/gryph

Security layer for AI coding agents. Works with Claude Code, Cursor, Windsurf, Gemini CLI, OpenCode, Pi Agent and more.

defensive-toolsscripting-automationconfiguration-auditing+6

1795 days ago

trajan

praetorian-inc/trajan

A multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations.

static-analysisvulnerability-scannerscode-analysis+7

1763 days ago

node9-proxy

node9-ai/node9-proxy

Access control for AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run,…

vulnerability-scannerscontainer-securitycloud-security+7

2103 days ago