Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools for testing, exploiting, and securing web applications and APIs.

Newest Relevance Most popular Recently updated

17040 results

Archived

purpleteam-s2-containers

purpleteam-labs/purpleteam-s2-containers

Stage two containers

vulnerability-scannerscontainer-securitydynamic-analysis-sandboxing+5

5 years ago

Archived

purpleteam-tls-checker

purpleteam-labs/purpleteam-tls-checker

TLS checking component of purpleteam

vulnerability-scannersweb-securitynetwork-security+2

15 years ago

Archived

purpleteam-server-scanner

purpleteam-labs/purpleteam-server-scanner

Server scanning component of purpleteam

vulnerability-scannersapi-security-testingweb-security+3

15 years ago

Archived

purpleteam-app-scanner

purpleteam-labs/purpleteam-app-scanner

Application scanning component of purpleteam

vulnerability-scannersweb-vulnerability-scannersapi-security-testing+4

15 years ago

XSS2Shell

g0d150ne/xss2shell

Exploits WordPress pre-auth XSS (CVE-2026-64638) to achieve remote code execution, installing an AES-encrypted backdoor webshell with persistence,…

persistence-mechanismsexploitationweb-application-exploitation+6

10 days ago

milvus-auth-audit

qianlijaingshan/milvus-auth-audit

Milvus 认证安全检测脚本：CVE-2025-64513 (sourceid后门) / CVE-2026-26190 (/expr弱token) / 内部端口53100

authentication-authorizationvulnerability-scannersexploitation+4

16 days ago

CVE-2019-10068-PoC

cianananan/cve-2019-10068-poc

Proof-of-concept exploit for CVE-2019-10068, a deserialization RCE in Kentico CMS, that uploads an ASP.NET webshell for authorized security testing.

exploitationweb-application-exploitationweb-security+2

5 months ago

CVE-2026-49049

jenderal92/cve-2026-49049

Mass scanner for Joomla Helix3 CVE-2026-49049 that uploads PHP test payloads via com_ajax and detects executed (RCE) or raw PHP responses.

vulnerability-scannersweb-vulnerability-scannerspayload-generation+4

19 days ago

Shocker-TJNULL-OSCP-

r3fr4kt/shocker-tjnull-oscp-

Structured HTB walkthrough demonstrating Shellshock (CVE-2014-6271) exploitation via CGI directory fuzzing and privilege escalation through…

privilege-escalationreconnaissancevulnerability-analysis+6

2 months ago

Archived

CVE-2021-46398

laliea/cve-2021-46398

A Proof of Concept for the CVE-2021-46398 flaw exploitation

vulnerability-analysisexploitationweb-application-exploitation+3

2 years ago

Archived

cve-2023-28771-demo

jinparkmida/cve-2023-28771-demo

reconnaissancevulnerability-analysisexploitation+2

1 year ago

CVE-2025-44203

ivant7d3/cve-2025-44203

Exploit for CVE-2025-44203 targeting a race condition in HotelDruid 3.0.0/3.0.7 that leaks admin credentials and causes denial of service. Includes a…

password-crackingvulnerability-analysisexploitation+2

1 month ago