#1Tools for identifying, assessing, and prioritizing security weaknesses in systems and applications.
Kitploit recommended
jumpserver/jumpserverJumpServer is an open-source Privileged Access Management (PAM) platform that provides DevOps and IT teams with on-demand and secure access to SSH,…
itm4n/privesccheckPrivilege Escalation Enumeration Script for Windows
sqlmapproject/sqlmapAutomatic SQL injection and database takeover tool
anchore/grypeA vulnerability scanner for container images and filesystems
ccp-p/ghostlock-cve-2026-43499-4.19-k40Android kernel LPE PoC for CVE-2026-43499, an rtmutex use-after-free in 4.19 Qualcomm kernels, adapted for Redmi K40 with LD_PRELOAD root payload.
nvidia/openshellSandboxed runtime for autonomous AI agents with declarative YAML policies enforcing filesystem, network, and process constraints, plus endpoint-bound…
trufflesecurity/trufflehogFind, verify, and analyze leaked credentials
tihanyin/rex-skillREx@Skill - Agentic Reverse Engineering eXecution Skill for binary vulnerability discovery
kubescape/kubescapeOpen-source Kubernetes security platform scanning clusters, manifests, and images for misconfigurations, vulnerabilities, and compliance against NSA,…
promptfoo/promptfooTest your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and…
awarexone/agentic-bug-hunterAI-powered bug bounty hunting toolkit that works with or without subscription.
oopnv70-lab/ghostlock-aak-apkGhostLock AAK Launcher - CVE-2026-43499 Linux kernel rtmutex stack UAF local privilege escalation trigger (GPLv3)
akha-security/akcaEvidence-oriented DAST scanner in Go that crawls web apps and APIs, then runs adaptive SQLi, XSS, RCE, SSRF, and auth checks with replayable proof.
ffuf/ffufFast web fuzzer written in Go
projectdiscovery/nuclei-templatesCommunity curated list of templates for the nuclei engine to find security vulnerabilities.
jonaschen0103/cve-2026-33439-pocPython PoC exploiting CVE-2026-33439, a pre-auth RCE in OpenAM via Java deserialization of the jato.clientSession parameter, with interactive and…
ghosttroops/topTOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things
