Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Categories

Web Application Exploitation

Tools specifically designed to exploit common web application vulnerabilities (e.g., SQL injection, XSS).

Kitploit recommended

Top tools

10 selected
sqlmap preview#1

sqlmap

GitHubsqlmapproject/sqlmap
38.2k2 days ago
beef preview#2

beef

GitHubbeefproject/beef
11.0k2 days ago
nuclei preview#3

nuclei

GitHubprojectdiscovery/nuclei
30.4k2 days ago
zaproxy preview#4

zaproxy

GitHubzaproxy/zaproxy
15.6k18h 52m ago
XSStrike preview#5

XSStrike

GitHubs0md3v/xsstrike
15.1k1 year ago
ffuf preview#6

ffuf

GitHubffuf/ffuf
16.5k1 month ago
dirsearch preview#7

dirsearch

GitHubmaurosoria/dirsearch
14.6k20h 34m ago
feroxbuster preview#8

feroxbuster

GitHubepi052/feroxbuster
8.0k1 day ago
nikto preview#9

nikto

GitHubsullo/nikto
10.6k2 months ago
wpscan preview#10

wpscan

GitHubwpscanteam/wpscan
9.7k5 days ago
NewestRelevanceMost popularRecently updated
14595 results
CVE-2021-30632 preview

CVE-2021-30632

GitHubcrackercat/cve-2021-30632

Chrome V8 RCE exploit for CVE-2021-30632 targeting Windows systems. Tested on Chrome 91-93. Includes JS POC and in-the-wild bug analysis reference.

vulnerability-analysisexploitationweb-application-exploitation+2
145 years ago
CVE-2019-11043-Docker preview

CVE-2019-11043-Docker

GitHubakamajoris/cve-2019-11043-docker

Dockerized vulnerable PHP-FPM environment for CVE-2019-11043, with instructions to build and run the phuip-fpizdam exploit to achieve remote code…

container-securityvulnerability-analysisexploitation+3
277 years ago
CVE-2025-64446 preview

CVE-2025-64446

GitHubsensepost/cve-2025-64446

A scanner for the FortiNet vulnerability CVE-2025-64446

vulnerability-scannersexploitationweb-application-exploitation+3
3111 months ago
FortiSandbox-RCE-Exploit-CVE-2026-39808 preview

FortiSandbox-RCE-Exploit-CVE-2026-39808

GitHubynsmroztas/fortisandbox-rce-exploit-cve-2026-39808

Unauthenticated RCE scanner for FortiSandbox CVE-2026-39808 with canary-based verification, command execution, and pipeline integration for mass…

reconnaissancevulnerability-scannersexploitation+3
266 months ago
CVE-2021-22005 preview

CVE-2021-22005

GitHubjun-5heng/cve-2021-22005

VMware vCenter Server任意文件上传漏洞 / Code By:Jun_sheng

payload-generationvulnerability-analysisexploitation+2
214 years ago
CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvuln preview

CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvuln

GitHubsweelg/cve-2023-1454-jeecg-boot-qurestsql-sqlvuln

jmreport/qurestSql 未授权SQL注入批量扫描poc Jeecg-Boot是一款基于Spring Boot和Jeecg-Boot-Plus的快速开发平台，最新的jeecg-boot 3.5.0 中被爆出多个SQL注入漏洞。

vulnerability-scannersvulnerability-analysisexploitation+3
213 years ago
CVE-2023-26067 preview

CVE-2023-26067

GitHubhorizon3ai/cve-2023-26067

Lexmark CVE-2023-26067

vulnerability-analysisexploitationweb-application-exploitation+4
283 years ago
CVE-2019-12949 preview

CVE-2019-12949

GitHubtarantula-team/cve-2019-12949

CVE-2019-12949

vulnerability-analysisexploitationweb-application-exploitation+3
257 years ago
cve-2019-2725 preview

cve-2019-2725

GitHublasensio/cve-2019-2725

Python exploit for Oracle WebLogic CVE-2019-2725, enabling unauthenticated remote code execution via crafted HTTP requests to vulnerable servers.

vulnerability-analysisexploitationweb-application-exploitation+2
217 years ago
CVE-2024-27348 preview

CVE-2024-27348

GitHubkljunowsky/cve-2024-27348

Proof-of-concept exploit for unauthenticated remote code execution in Apache HugeGraph Server via Groovy injection. Supports single and multi-target…

vulnerability-analysisexploitationweb-application-exploitation+3
192 years ago
CVE-2023-0297_Pre-auth_RCE_in_pyLoad preview

CVE-2023-0297_Pre-auth_RCE_in_pyLoad

GitHubbauh0lz/cve-2023-0297_pre-auth_rce_in_pyload

CVE-2023-0297: The Story of Finding Pre-auth RCE in pyLoad

vulnerability-analysiscode-analysisexploitation+3
283 years ago
CVE-2022-27925 preview

CVE-2022-27925

GitHubsh4den/cve-2022-27925

A loader for zimbra 2022 rce (cve-2022-27925)

reconnaissancevulnerability-analysisexploitation+2
183 months ago
watchTowr-vs-FreePBX-CVE-2025-57819 preview

watchTowr-vs-FreePBX-CVE-2025-57819

GitHubwatchtowrlabs/watchtowr-vs-freepbx-cve-2025-57819

Python-based detection artifact generator for CVE-2025-57819, exploiting FreePBX pre-auth RCE via SQL injection and auth bypass to deploy webshells…

vulnerability-scannerspayload-generationexploitation+3
281 year ago
CVE-2024-2879 preview

CVE-2024-2879

GitHubherculeszxc/cve-2024-2879

Proof-of-concept exploit for CVE-2024-2879: unauthenticated SQL injection in LayerSlider WordPress plugin (7.9.11-7.10.0). Includes scanner script…

vulnerability-analysisexploitationweb-application-exploitation+2
222 years ago
CVE-2025-55182-RCE-shell preview

CVE-2025-55182-RCE-shell

GitHubruoji6/cve-2025-55182-rce-shell

Burp Suite/antsword - Interactive shell (HTTP hijack + POST + AES-256-CBC/BASE64)

encryption-decryption-toolspayload-generationvulnerability-analysis+5
3110 months ago
CVE-2020-14882 preview

CVE-2020-14882

GitHubmilo2012/cve-2020-14882

CVE-2020-14882

vulnerability-analysisexploitationweb-application-exploitation+3
81 month ago
CVE-2022-44268 preview

CVE-2022-44268

GitHubkljunowsky/cve-2022-44268

Proof-of-concept exploit for CVE-2022-44268 enabling arbitrary file read via poisoned PNG images uploaded to vulnerable ImageMagick instances.…

payload-generationvulnerability-analysisexploitation+3
272 years ago
ACEDcup preview

ACEDcup

GitHubgrrrdog/acedcup

Payload generator for Java Binary Deserialization attack with Commons FileUpload (CVE-2013-2186)

payload-generationvulnerability-analysisexploitation+2
3710 years ago
Previous1…868788…100Next