Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools for testing and securing serverless functions (e.g., AWS Lambda, Azure Functions) and their integrations.

Kitploit recommended

Top tools

10 selected

prowler

prowler-cloud/prowler

14.3k1 day ago

ScoutSuite

nccgroup/scoutsuite

7.8k2 years ago

pacu

rhinosecuritylabs/pacu

5.3k7 months ago

cloudfox

bishopfox/cloudfox

2.6k12 days ago

trivy

aquasecurity/trivy

37.4k1 day ago

checkov

bridgecrewio/checkov

8.9k1 day ago

kics

checkmarx/kics

2.7k5 days ago

cloud-custodian

cloud-custodian/cloud-custodian

6.0k2 days ago

#10

stratus-red-team

datadog/stratus-red-team

2.4k1 day ago

#11

Serverless-Goat

owasp/serverless-goat

3307 years ago

Newest Relevance Most popular Recently updated

41 results

DVSA

owasp/dvsa

a Damn Vulnerable Serverless Application

cloud-infrastructure-securityvulnerability-analysisserverless-security+6

5443 years ago

honeyLambda

0x4d31/honeylambda

honeyλ - a simple, serverless application designed to create and monitor fake HTTP endpoints (i.e. URL honeytokens) automatically, on top of AWS…

defensive-toolsserverless-securitycloud-security+2

5258 years ago

capsule

capsulerun/capsule

Secure runtime to sandbox AI agent tasks. Run untrusted code in isolated WebAssembly environments.

container-securitydynamic-analysis-sandboxingscripting-automation+5

2941 month ago

Serverless-Goat

owasp/serverless-goat

OWASP ServerlessGoat: a serverless application demonstrating common serverless security flaws

vulnerability-analysisserverless-securitycloud-security+3

3307 years ago

serverless-prey

pumasecurity/serverless-prey

Serverless Functions for establishing Reverse Shells to Lambda, Azure Functions, and Google Cloud Functions

exploitationserverless-securitypost-exploitation+5

2481 year ago

Serverless-Top-10-Project

owasp/serverless-top-10-project

OWASP Serverless Top 10

vulnerability-analysisserverless-securityweb-security+3

2176 years ago

DVFaaS-Damn-Vulnerable-Functions-as-a-Service

we45/dvfaas-damn-vulnerable-functions-as-a-service

Intentionally Vulnerable Serverless Functions to understand the specifics of Serverless Security Vulnerabilities

serverless-securitycloud-securityeducation+1

1407 years ago

SyntheticSun

jonrau1/syntheticsun

Serverless AWS security automation framework that ingests threat intelligence, applies ML-based anomaly detection (RCF, IP Insights), and enriches…

serverless-securitycloud-securitythreat-intelligence+3

825 years ago

adaptix-serverless-c2

stillbigjosh/adaptix-serverless-c2

Serverless C2 transport plugin for AdaptixC2 v1.2 using AWS Lambda + DynamoDB as the relay infrastructure.

cloud-infrastructure-securitypenetration-testing-frameworksexploit-frameworks+8

3416 days ago

pyrasp

rbidou/pyrasp

Runtime Application Self Protection for Python web servers, serverless functions and MCP servers, detecting attacks, prompt injection and data leaks…

defensive-toolsserverless-securityweb-security+6

4020 days ago

vsftpd

infrastructureservices/vsftpd

Security-focused FTP server daemon designed for resilience against attack, offering high performance and scalability with extensive configuration…

defensive-toolsgeneral-purpose-utilitiesserverless-security+3

284 years ago

contrast

contrastsecurity/contrast

SAST CLI for scanning Java, JavaScript, and .NET applications plus AWS Lambda functions, detecting code vulnerabilities and over-permissive IAM…

cloud-infrastructure-securityvulnerability-scannersstatic-code-analysis+6

204 years ago

CVE-2026-9999-Serverless-Event-Injection-to-Code-Overwrite

george0papasotiriou/cve-2026-9999-serverless-event-injection-to-code-overwrite

Proof-of-concept exploit for CVE-2026-9999, demonstrating path traversal in serverless object storage events that overwrites function source code to…

cloud-infrastructure-securityvulnerability-analysisexploitation+3

3 months ago

CVE-2026-86259

uziii2208/cve-2026-86259

OpenMAIC 1.0.0: Unauthenticated Outbound SSRF to Cloud Metadata Service via Fail-Open Middleware and Environment-Gated Validation Bypass

vulnerability-analysisexploitationserverless-security+6

2 months ago

CVE-2026-28496

ivanesk315/cve-2026-28496

Docker lab reproducing the FOSSBilling pre-auth RCE chain (CVE-2026-27604 auth bypass + CVE-2026-28496 Twig SSTI) with a Python PoC and patched…

vulnerability-scannersvulnerability-analysisexploitation+6

2 months ago

CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp

george0papasotiriou/cve-2026-21002-serverless-cold-start-credential-leakage-via-reused-tmp

PoC exploit for CVE-2026-21002 serverless cold-start credential leakage, demonstrating how reused Lambda /tmp directories expose AWS secrets to other…

cloud-infrastructure-securityvulnerability-analysisexploitation+4

3 months ago

CVE-2026-15583

abraxas/cve-2026-15583

Proof-of-concept client and Docker lab reproducing CVE-2026-15583, an unauthenticated confused-deputy SSRF in Grafana MCP Server that leaks…

vulnerability-analysisexploitationserverless-security+6

17 days ago

CVE-2026-22015-Serverless-Function-Environment-Variable-Injection-via-Event

george0papasotiriou/cve-2026-22015-serverless-function-environment-variable-injection-via-event

PoC for CVE-2026-22015: malicious event injects environment variables into serverless functions, overwriting secrets and enabling privilege…

privilege-escalationexploitationserverless-security+3

13 months ago

Previous 123 Next