#1Tools specifically designed to exploit common web application vulnerabilities (e.g., SQL injection, XSS).
Kitploit recommended
klezvirus/cve-2021-40444CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit
funnywolf/pystingerBypass firewall for traffic forwarding using webshell
ejpir/cve-2025-55182-researchTechnical proof-of-concept and deep-dive analysis of CVE-2025-55182, a critical RCE vulnerability in React's Flight Protocol via path traversal, fake…
capture0x/xss-loaderXss Payload Generator ~ Xss Scanner ~ Xss Dork Finder
stamparm/dsxsDamn Small XSS Scanner
bishopfox/h2csmugglerHTTP Request Smuggling over HTTP/2 Cleartext (h2c)
blackarch/webshellsVarious webshells. We accept pull requests for additions to this collection.
schira4396/vcenterkiller一款针对Vcenter的综合利用工具，包含目前最主流的CVE-2021-21972、CVE-2021-21985以及CVE-2021-22005、One Access的CVE-2022-22954、CVE-2022-22972/31656以及log4j，提供一键上传webshell，命令执行或者上传…
fs0c131y/esfileexploreropenportvulnES File Explorer Open Port Vulnerability - CVE-2019-6447
synacktiv/php_filter_chain_generatorCLI to generate PHP filter chains for remote code execution via controlled include/require parameters. Produces complex iconv-based filter bypasses…
elkokc/reflectorBurp plugin able to find reflected XSS on page in real-time while browsing on site
liveoverflow/pwnadventure3PwnAdventure3 Server
xaitax/cve-2024-21413-microsoft-outlook-remote-code-execution-vulnerabilityMicrosoft-Outlook-Remote-Code-Execution-Vulnerability
whitewinterwolf/wwwolf-php-webshellWhiteWinterWolf's PHP web shell
gal-nagli/shockwave-ossCurated collection of bug bounty tips, one-liners, and automation workflows for recon, fuzzing, and web exploitation, with private nuclei templates…
saelo/pwn2own2018A Pwn2Own exploit chain
dreadlocked/drupalgeddon2Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600 / SA-CORE-2018-002)
jas502n/cve-2020-5902Proof-of-concept exploit for CVE-2020-5902, a directory traversal and remote code execution vulnerability in F5 BIG-IP TMUI. Includes file read,…
