Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

81 results

vibe-coding-security

boxed-dev/vibe-coding-security

Pre-launch security checklist for AI-generated apps (Lovable, v0, Bolt, Cursor). 69 checks covering Supabase RLS, exposed keys, and prompt injection.…

ai-securityapi-securityauthentication+9

1 month ago

CVE-2024-32113-POC

racerz-fighting/cve-2024-32113-poc

Apache OfBiz vulns

authenticationexploitationpayload-generation+3

72 years ago

CVE-2022-29593

9lyph/cve-2022-29593

Proof-of-concept exploit for authentication bypass via capture-replay in Dingtian DT-R002 relay, allowing unauthorized control of relays through HTTP…

authenticationexploitationfuzzing+8

81 year ago

some-tweak-to-hide-jwt-payload-values

password123456/some-tweak-to-hide-jwt-payload-values

Lightweight Python library for obfuscating JWT payload values using XOR encryption with timestamp-based keys, preventing plaintext decoding of…

api-securityauthenticationeducation+1

102 years ago

the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

hunt-benito/the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass

Exploit and PoC for CVE-2026-67602, an authentication bypass in phpIPAM REST API via object-cache key collision, including a logic-level PoC and…

api-securityauthenticationexploitation+3

1 month ago

CVE-2026-44351-poc

isaca0315/cve-2026-44351-poc

Proof-of-concept for CVE-2026-44351, an authentication bypass in fast-jwt <6.2.4 where an empty HMAC key lets attackers forge arbitrary JWTs accepted…

api-securityauthenticationcryptography+6

13 days ago

inference-gateway-PoC

squeeze440/inference-gateway-poc

PoC — cross-origin requests reuse the configured provider API key in inference-gateway (GHSA-5293-fcm6-fh8v, CVE-2026-87009, CVSS 5.4).

api-securityauthenticationexploitation+3

18 days ago

CVE-2026-20079-checker

diegoarias008/cve-2026-20079-checker

Read-only Python checker that validates CVE-2026-20079 Cisco FMC authentication-bypass behavior by comparing unauthenticated and csm_processes…

authenticationdefensive-toolsinformation-gathering+5

14 days ago

CVE-2026-51954

envincion1991-cmyk/cve-2026-51954

Vulnerability Research

api-securityauthenticationexploitation+2

1 month ago

CVE-2026-58231

wildandeveloper/cve-2026-58231

Non-destructive detection and precondition-verification tool for CVE-2026-58231, probing SAP Commerce Cloud Data Hub endpoints, default OAuth…

api-securityauthenticationinformation-gathering+4

7 days ago

CVE-2025-6514

cyberency/cve-2025-6514

mcp-remote exposed to OS command injection

api-securityauthenticationcommand-and-control+3

710 months ago

Galdralag-firmware

supermagnum/galdralag-firmware

A cryptographic framework for Baochip-1x .

authenticationcryptographyembedded-systems-security+4

31 month ago

cve-2026-33032-scanner

twinson333/cve-2026-33032-scanner

Non-destructive vulnerability scanner for Nginx-UI MCP Endpoint Authentication Bypass (CVE-2026-33032)

api-securityauthenticationexploitation+3

35 months ago

CVE-2026-76460

s3v3n-jg/cve-2026-76460

Educational Flask lab simulating CVE-2026-76460 authentication bypass, with vulnerable, secure, and strict modes plus a PoC exploit script and…

api-securityauthenticationdefensive-tools+5

110 days ago

cve-2021-21994_POC

mreza-en/cve-2021-21994_poc

Validates and exploits VMware ESXi SFCB authentication bypass (CVE-2021-21994) via a probe/fuzz harness, enabling unauthenticated CIM-XML enumeration.

authenticationexploitationfuzzing+3

1 month ago