#1Tools for identifying, assessing, and prioritizing security weaknesses in systems and applications.
Kitploit recommended
glen-testing/low-int-cert-monitorMonitor Certificate Transparency logs for certificates with trivially small EC private keys (the eMudhra weak-key class). P-256/384/521.
aix567/c-a-sC.A.S-Exploit — Python-based security research and proof-of-concept toolkit for CVE-2017-5689 (Intel AMT authentication bypass), featuring Shodan…
endrazine/rocq-cve-poc-12155CVE-2020-37268 — Rocq/Coq Print Assumptions Omits Unsafe Universe Checking via Parameter Inline
endrazine/rocq-cve-poc-22287CVE-2026-72714 — Rocq Universe Checking State Desynchronised After Module Close
endrazine/rocq-cve-poc-21683CVE-2026-72705 — Rocq Guard Checker Accepts Fixpoint Passed as Higher-Order Argument
endrazine/rocq-cve-poc-22024CVE-2026-72704 — Rocq Guard Checker Trusts Corrupted Recursive Tree After Transport
endrazine/rocq-cve-poc-21682CVE-2026-72703 — Rocq Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls
endrazine/lean-cve-poc-14484CVE-2026-72711 — Lean 4 Kernel Soundness Bug: Inference Cache Poisoning
affolter-engineering/hvtRust CLI that probes HTTP methods (including WebDAV and DeltaV verbs) against a target URL to surface verb tampering, access-control bypasses, and…
apaonum/brotli-cve-checkAgent skill + script to scan projects for CVE-2026-111497 (Brotli), rate criticality and suggest fixes
ardakocadoru/xss-cheatsheetComprehensive XSS reference covering reflected, stored, DOM and blind payloads, filter bypass, WAF evasion, CSP bypass, mXSS, and real-world CVE case…
lotus6/confluencememshellConfluence CVE 2021，2022，2023 利用工具，支持命令执行，哥斯拉，冰蝎 内存马注入
csenox/gitlab-exiftool-rcePython exploit achieving remote code execution on GitLab versions before 13.10.3 by abusing ExifTool DjVu parsing through GitLab Workhorse image…
brentmartinmiller/php2shell-checkRead-only triage script for WordPress sites after PHP2Shell (CVE-2026-109618, CVE-2026-109619). Checks for signs of compromise and writes a report…
foxcornlab/thc-bloodmiamiAI chat-box pentesting tool in C: fires language (SQLi/NoSQL/XSS/SSTI) and prompt injection payloads at chat interfaces and flags the ones that bite
owasp/agentic-vulnerability-discovery-and-validation-harnessAgentic harness that automates vulnerability discovery and validation, orchestrating AI-driven analysis workflows to confirm exploitable findings.
owasp/robotics-security-testing-guideOWASP guide defining a standardized penetration testing methodology for humanoid, industrial, and autonomous robots, covering ROS/ROS2, DDS, CAN bus,…
akamor2800/php-5.4-cve-2026-php2shell-patchProduction-ready backported .patch for EOL PHP 5.4,.23 custom 5.x to fix the critical PHP2Shell (OOM) vulnerability (CVE-2026-109618 /…
