Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

108 results

Invoke-LinkSpray

kevinjclark/invoke-linkspray

Powershell script to create malicious SMB or WebDAV links to steal NTLM authentication

authenticationpenetration-testingphishing+2

6 years ago

Invoke-RunAsWithCert

synacktiv/invoke-runaswithcert

A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine.

authenticationlateral-movementpenetration-testing+2

1792 years ago

Invoke-BadSuccessor.ps1

b5null/invoke-badsuccessor.ps1

PowerShell Script to automatically abuse the BadSuccessor vulnerability (CVE-2025-53779)

authenticationexploitationpenetration-testing+4

472 months ago

CVE-2019-1619

cipolone95/cve-2019-1619

Powershell Script to build token for CVE-2019-1619

authenticationexploitationpenetration-testing+3

1 year ago

MFASweep

dafthack/mfasweep

A tool for checking if MFA is enabled on multiple Microsoft Services

authenticationcloud-securitypenetration-testing+2

1.7k4 months ago

BARK

bloodhoundad/bark

BloodHound Attack Research Kit

authenticationcloud-securityexploitation+6

6081 year ago

Maestro

mayyhem/maestro

Abusing Azure services over C2

authenticationcloud-securitycommand-and-control+4

3817 months ago

Sharp-SMBExec

checkymander/sharp-smbexec

C# implementation of SMBExec for remote command execution on Windows targets using NTLM password hashes, enabling lateral movement and pass-the-hash…

authenticationexploitationlateral-movement+1

2176 years ago

Coercer

p0dalirius/coercer

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

authenticationexploitationfuzzing+3

2.3k4 months ago

MSOLSpray

dafthack/msolspray

A password spraying tool for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a…

authenticationcloud-securityinformation-gathering+3

1.1k3 years ago

kerbrute

tarlogicsecurity/kerbrute

An script to perform kerberos bruteforcing by using impacket

authenticationpassword-attackspenetration-testing

4576 years ago

adfsbrute

ricardojoserf/adfsbrute

A script to test credentials against Active Directory Federation Services (ADFS), allowing password spraying or bruteforce attacks.

authenticationpassword-attackspenetration-testing+1

1825 years ago

Microsoft365_devicePhish

optiv/microsoft365_devicephish

A proof-of-concept script to conduct a phishing attack abusing Microsoft 365 OAuth Authorization Flow

authenticationemail-securitypenetration-testing+4

1075 years ago

Invoke-CleverSpray

wavestone-cdt/invoke-cleverspray

Password Spraying Script detecting current and previous passwords of Active Directory User

authenticationpassword-attackspenetration-testing

657 years ago

zerologon

zeronetworks/zerologon

Test script for CVE-2020-1472 for both RPC/TCP and RPC/SMB

authenticationexploitationids-ips-evasion+2

613 years ago

ShuckNT

yanncam/shucknt

ShuckNT is the script of Shuck.sh online service for on-premise use. It is design to dowgrade, convert, dissect and shuck authentication token based…

authenticationcryptographyhash-analysis+3

781 year ago

dcpwn

qax-a-team/dcpwn

an impacket-dependent script exploiting CVE-2019-1040

authenticationexploitationpenetration-testing+2

735 years ago

fortios-auth-bypass-check-CVE-2024-55591

watchtowrlabs/fortios-auth-bypass-check-cve-2024-55591

Python script to detect FortiOS authentication bypass (CVE-2024-55591) by probing WebSocket connections to the management interface, identifying…

authenticationexploitationpenetration-testing+3

661 year ago

Previous12 3 4 5 6 Next