Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

554 results

ldap_shell

pshlyundin/ldap_shell

Interactive shell for Active Directory enumeration and ACL abuse via LDAP/LDAPS. Supports DCSync, RBCD, Shadow Credentials, password changes, and…

privilege-escalationinformation-gatheringpenetration-testing+1

404

1 month ago

ADReaper

m0n1x90/adreaper

A fast enumeration tool for Windows Active Directory Pentesting written in Go

reconnaissanceinformation-gatheringpenetration-testing+1

2863 years ago

ssh3

francoismichel/ssh3

Fast, secure shell protocol built on HTTP/3, QUIC, and TLS 1.3. Supports OAuth2, OpenID Connect, and classical SSH authentication with UDP port…

encryption-decryption-toolsnetwork-securityutilities-frameworks+1

5.0k2 years ago

about-hmac

password123456/about-hmac

HMAC Implementation Example and Explanation

cryptographyauthenticationeducation+1

22 years ago

some-tweak-to-hide-jwt-payload-values

password123456/some-tweak-to-hide-jwt-payload-values

Lightweight Python library for obfuscating JWT payload values using XOR encryption with timestamp-based keys, preventing plaintext decoding of…

encryption-decryption-toolsauthenticationeducation+1

102 years ago

SharpADWS

wh0amitz/sharpadws

Active Directory reconnaissance and exploitation for Red Teams via the Active Directory Web Services (ADWS).

privilege-escalationreconnaissancepersistence-mechanisms+6

6022 years ago

Tritium

aahmad097/tritium

Kerberos-based password spraying framework for Active Directory with built-in lockout prevention, user enumeration integration, recursive password…

password-attackspenetration-testingauthentication

644 years ago

ShadowSpray

dec0ne/shadowspray

A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other objects in the…

privilege-escalationvulnerability-analysisexploitation+3

4904 years ago

ldapnomnom

lkarlslund/ldapnomnom

Quietly and anonymously bruteforce Active Directory usernames at insane speeds from Domain Controllers by (ab)using LDAP Ping requests (cLDAP)

reconnaissancepassword-attacksinformation-gathering+1

1.1k1 year ago

DavRelayUp

dec0ne/davrelayup

Automates local privilege escalation to SYSTEM on domain-joined Windows workstations by relaying NTLM authentication from WebDAV to LDAP, leveraging…

privilege-escalationexploitationlateral-movement+2

5753 years ago

ADCSync

jpg0mez/adcsync

Use ESC1 to perform a makeshift DCSync and dump hashes

password-crackingexploitationpenetration-testing+1

2122 years ago

gssapi-abuse

ccob/gssapi-abuse

A tool for enumerating potential hosts that are open to GSSAPI abuse within Active Directory networks

reconnaissancevulnerability-analysisinformation-gathering+5

1881 year ago

route-detect

mschwager/route-detect

Find authentication (authn) and authorization (authz) security bugs in web application routes.

static-analysisvulnerability-analysisweb-security+1

2801 year ago

MSSqlPwner

scorpioneslabs/mssqlpwner

Advanced MSSQL penetration testing tool for lateral movement, command execution, NTLM relay, and brute-force attacks via linked servers and multiple…

password-attacksexploitationlateral-movement+5

45812 days ago

NTLMRecon

praetorian-inc/ntlmrecon

A tool for performing light brute-forcing of HTTP servers to identify commonly accessible NTLM authentication endpoints.

reconnaissanceinformation-gatheringweb-security+2

1186 months ago

evilqr

kgretzky/evilqr

Proof-of-concept to demonstrate dynamic QR swap phishing attacks in practice.

phishing-toolsweb-application-exploitationphishing+4

3823 years ago

certsync

zblurx/certsync

Dump NTDS with golden certificates and UnPAC the hash

privilege-escalationvulnerability-analysisexploitation+4

6492 years ago

KRBUACBypass

wh0amitz/krbuacbypass

Abuses Kerberos tickets to bypass Windows UAC and gain SYSTEM privileges by injecting a fake MachineID into service tickets, leveraging the tgtdeleg…

privilege-escalationexploitationpenetration-testing+2

5133 years ago

Previous 1…262728…31 Next