Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools for testing, exploiting, and securing web applications and APIs.

Kitploit recommended

Top tools

10 selected

zaproxy

zaproxy/zaproxy

15.6k14h 50m ago

nuclei

projectdiscovery/nuclei

30.4k13h 9m ago

sqlmap

sqlmapproject/sqlmap

38.2k1 day ago

ffuf

ffuf/ffuf

16.5k1 month ago

dirsearch

maurosoria/dirsearch

14.6k10 days ago

feroxbuster

epi052/feroxbuster

8.0k13 days ago

nikto

sullo/nikto

10.6k2 months ago

wpscan

wpscanteam/wpscan

9.7k1 day ago

XSStrike

s0md3v/xsstrike

15.1k1 year ago

#10

wapiti

wapiti-scanner/wapiti

1.9k25 days ago

Newest Relevance Most popular Recently updated

19068 results

BadKernel

secmob/badkernel

Full exploit of CVE-2016-6754(BadKernel) and slide of SyScan360 2016

vulnerability-analysisexploitationshellcode+3

1519 years ago

GitDump

ebryx/gitdump

A pentesting tool that dumps the source code from .git even when the directory traversal is disabled

information-gatheringweb-securitypenetration-testing

2325 years ago

docker-tor-hiddenservice-nginx

opsxcq/docker-tor-hiddenservice-nginx

Easily setup a hidden service inside the Tor network

web-securitynetwork-securityprivacy+2

1727 years ago

FUCK-CDN

0xshe/fuck-cdn

Automated CDN origin-IP discovery skill for Claude Code that runs 40+ prioritized OSINT methods, cross-validates candidates via SSL and HTTP…

osintreconnaissancenetwork-mapping+9

1693 months ago

IoT-Security-Verification-Standard-ISVS

owasp/iot-security-verification-standard-isvs

OWASP IoT Security Verification Standard (ISVS)

embedded-systems-securityiot-securityconfiguration-auditing+8

1574 months ago

ASST

owasp/asst

OWASP ASST (Automated Software Security Toolkit) | A Novel Open Source Web Security Scanner.

vulnerability-scannersweb-vulnerability-scannersstatic-code-analysis+2

1901 year ago

cve-2022-22947-godzilla-memshell

whwlsfb/cve-2022-22947-godzilla-memshell

CVE-2022-22947 注入Godzilla内存马

payload-generationvulnerability-analysisexploitation+2

2104 years ago

cve-2021-22005-exp

shmilylty/cve-2021-22005-exp

Exploit for CVE-2021-22005, a pre-auth arbitrary file upload vulnerability in VMware vCenter Server, enabling remote code execution via webshell…

vulnerability-analysisexploitationweb-application-exploitation+2

1964 years ago

white-deface

whxitte/white-deface

This is a simple python tool to automatically deface webdav vulnerable websites.

exploitationweb-application-exploitationinformation-gathering+1

1781 year ago

Oneliner-Bugbounty

daffainfo/oneliner-bugbounty

A collection oneliner scripts for bug bounty

vulnerability-scannersweb-application-exploitationinformation-gathering+6

1843 years ago

LLMMap

hellsender01/llmmap

Automated prompt injection testing framework for LLM-integrated applications with dual-LLM architecture.

vulnerability-scannersdynamic-analysis-sandboxingpayload-generation+6

2047 months ago

POC-CVE-2025-24813

absholi7ly/poc-cve-2025-24813

his repository contains an automated Proof of Concept (PoC) script for exploiting **CVE-2025-24813**, a Remote Code Execution (RCE) vulnerability in…

vulnerability-analysisexploitationweb-application-exploitation+3

1951 year ago

CookieCatcher

disk0nn3ct/cookiecatcher

CookieCatcher

phishing-toolsexploitationweb-security+1

14613 years ago

CVE-2019-0232

pyn3rd/cve-2019-0232

Apache Tomcat Remote Code Execution on Windows

vulnerability-analysisexploitationweb-application-exploitation+3

1906 years ago

tomcat-cluster-session-sync-exp

threedr3am/tomcat-cluster-session-sync-exp

tomcat使用了自带session同步功能时，不安全的配置（没有使用EncryptInterceptor）导致存在的反序列化漏洞，通过精心构造的数据包，可以对使用了tomcat自带session同步功能的服务器进行攻击。PS:这个不是CVE-2020-9484，9484是session持久化的洞…

vulnerability-analysisexploitationweb-application-exploitation+2

2146 years ago