#1Tools for testing, exploiting, and securing web applications and APIs.
Kitploit recommended
testanull/ms-sharepoint-july-patch-rce-pocProof-of-concept exploits for critical SharePoint RCE vulnerabilities (CVE-2024-38094, CVE-2024-38024, CVE-2024-38023) with demonstration video.
tuhinshubhra/shellstackA PHP Based Tool That Helps You To Manage All Your Backdoored Websites Efficiently.
static-flow/burpsuite-team-extensionThis Burpsuite plugin allows for multiple web app testers to share their proxy history with each other in real time. Requests that comes through your…
cytopia/urlbusterPowerful mutable web directory fuzzer to bruteforce existing and/or hidden files or directories.
mindpatch/lorsrfFast CLI tool to find the parameters that can be used to find SSRF or Out-of-band resource load :artificial_satellite: :crab:
metnew/write-upsCurated collection of technical write-ups detailing RCE vulnerabilities in GitHub Desktop, GitHub CLI, and Claude Code, with CVE references and…
bhavsec/autopentest-aiAgentic Pentesting MCP server that discovers, exploits, and reports web application vulnerabilities.
alexandre-lavoie/python-log4rceAn All-In-One Pure Python PoC for CVE-2021-44228
n1k0la-t/cve-2023-36745Proof-of-concept exploit for Microsoft Exchange Server RCE vulnerability CVE-2023-36745, enabling remote code execution via authenticated PowerShell…
qmf0c3uk/cve-2021-21972-vcenter-6.5-7.0-rce-pocProof-of-concept for CVE-2021-21972, a remote code execution vulnerability in vCenter Server 6.5-7.0. Verifies vulnerable paths without exploitation.
dontpanico/jwtxploiterAutomated JWT security testing tool that exploits known CVEs, tampers with payloads, performs JKU/X5U injection, key confusion attacks, and verifies…
rafabd1/cve-2026-75604-pocProof-of-concept exploit for CVE-2026-75604, an unauthenticated remote code execution in Windows-hosted Next.js apps, with callback-based command…
saelo/cve-2018-4233Exploit for CVE-2018-4233, a WebKit JIT optimization bug used during Pwn2Own 2018
jas502n/cve-2019-2618Exploit script for CVE-2019-2618, a Weblogic arbitrary file upload vulnerability, with JSP webshell deployment and encrypted credential decryption.
themiddleblue/cve-2019-11043(PoC) Python version of CVE-2019-11043 exploit by neex
pimps/cve-2018-7600Exploit for Drupal 7 <= 7.57 CVE-2018-7600
ynsmroztas/keysniper**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow.
irsdl/burpsuitejsbeautifierBurp Suite JS Beautifier
