Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools for testing and securing serverless functions (e.g., AWS Lambda, Azure Functions) and their integrations.

Kitploit recommended

Top tools

10 selected

prowler

prowler-cloud/prowler

14.3k19h 10m ago

ScoutSuite

nccgroup/scoutsuite

7.8k2 years ago

pacu

rhinosecuritylabs/pacu

5.3k6 months ago

cloudfox

bishopfox/cloudfox

2.6k2 months ago

trivy

aquasecurity/trivy

37.4k1 day ago

checkov

bridgecrewio/checkov

8.9k6 days ago

kics

checkmarx/kics

2.7k1 day ago

cloud-custodian

cloud-custodian/cloud-custodian

6.0k10h 43m ago

#10

stratus-red-team

datadog/stratus-red-team

2.4k5 days ago

#11

Serverless-Goat

owasp/serverless-goat

3307 years ago

Newest Relevance Most popular Recently updated

40 results

CVE-2026-28496

ivanesk315/cve-2026-28496

Docker lab reproducing the FOSSBilling pre-auth RCE chain (CVE-2026-27604 auth bypass + CVE-2026-28496 Twig SSTI) with a Python PoC and patched…

vulnerability-scannersvulnerability-analysisexploitation+6

1 month ago

cloudfox

bishopfox/cloudfox

Automating situational awareness for cloud penetration tests.

cloud-infrastructure-securityprivilege-escalationreconnaissance+7

2.6k2 months ago

CVE-2026-23007-Serverless-Cold-Start-Memory-Remanence-Data-Leakage-

george0papasotiriou/cve-2026-23007-serverless-cold-start-memory-remanence-data-leakage-

Simulates CVE-2026-23007 serverless cold-start memory remanence; demonstrates how persistent global state across Lambda invocations can leak secrets…

vulnerability-analysisexploitationserverless-security+2

2 months ago

CVE-2026-22015-Serverless-Function-Environment-Variable-Injection-via-Event

george0papasotiriou/cve-2026-22015-serverless-function-environment-variable-injection-via-event

PoC for CVE-2026-22015: malicious event injects environment variables into serverless functions, overwriting secrets and enabling privilege…

privilege-escalationexploitationserverless-security+3

2 months ago

CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp

george0papasotiriou/cve-2026-21002-serverless-cold-start-credential-leakage-via-reused-tmp

PoC exploit for CVE-2026-21002 serverless cold-start credential leakage, demonstrating how reused Lambda /tmp directories expose AWS secrets to other…

cloud-infrastructure-securityvulnerability-analysisexploitation+4

2 months ago

CVE-2026-9999-Serverless-Event-Injection-to-Code-Overwrite

george0papasotiriou/cve-2026-9999-serverless-event-injection-to-code-overwrite

Proof-of-concept exploit for CVE-2026-9999, demonstrating path traversal in serverless object storage events that overwrites function source code to…

cloud-infrastructure-securityvulnerability-analysisexploitation+3

2 months ago

roninforge-hono

roninforge/roninforge-hono

Cursor plugin for Hono v4 (TypeScript edge web framework). 59 LLM regressions with BAD/CORRECT pairs. Pinned to hono ^4.12.19 (>= 4.9.7 for…

static-code-analysisvulnerability-analysiscode-analysis+8

4 months ago

pacu

rhinosecuritylabs/pacu

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

cloud-infrastructure-securitypenetration-testing-frameworksprivilege-escalation+7

5.3k6 months ago

CTT-Serverless-RCE-v1.0---Convergent-Time-Theory-Enhanced-MCP-Exploit

simoesctt/ctt-serverless-rce-v1.0---convergent-time-theory-enhanced-mcp-exploit

Serverless Framework MCP Server (CVE-2025-69256) Base Score: 9.4/10 → CTT Enhanced Score: 9.9/10 A critical command injection vulnerability in…

vulnerability-analysisexploitationids-ips-evasion+8

8 months ago

Awesome-CloudSec-Labs

iknowjason/awesome-cloudsec-labs

Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.

container-securityserverless-securityctf+7

2.2k1 year ago

serverless-prey

pumasecurity/serverless-prey

Serverless Functions for establishing Reverse Shells to Lambda, Azure Functions, and Google Cloud Functions

exploitationserverless-securitypost-exploitation+5

2481 year ago

ScoutSuite

nccgroup/scoutsuite

Multi-cloud security auditing tool that leverages cloud provider APIs to gather configuration data, assess security posture, and generate HTML…

cloud-infrastructure-securityvulnerability-scannersvulnerability-analysis+5

7.8k2 years ago

DVSA

owasp/dvsa

a Damn Vulnerable Serverless Application

cloud-infrastructure-securityvulnerability-analysisserverless-security+6

5443 years ago

contrast

contrastsecurity/contrast

SAST CLI for scanning Java, JavaScript, and .NET applications plus AWS Lambda functions, detecting code vulnerabilities and over-permissive IAM…

cloud-infrastructure-securityvulnerability-scannersstatic-code-analysis+6

203 years ago

Archived

LambdaGuard

skyscanner/lambdaguard

AWS Serverless Security

cloud-infrastructure-securityvulnerability-scannersstatic-code-analysis+3

4004 years ago

SyntheticSun

jonrau1/syntheticsun

Serverless AWS security automation framework that ingests threat intelligence, applies ML-based anomaly detection (RCF, IP Insights), and enriches…

serverless-securitycloud-securitythreat-intelligence+3

825 years ago

Serverless-Top-10-Project

owasp/serverless-top-10-project

OWASP Serverless Top 10

vulnerability-analysisserverless-securityweb-security+3

2176 years ago

Archived

AlertResponder

m-mizutani/alertresponder

Automatic security alert response framework by AWS Serverless Application Model

defensive-toolsserverless-securitycloud-security+2

146 years ago

Previous 123 Next