Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories

Tools

AllAndroid SecurityAuthentication & AuthorizationCloud Infrastructure SecurityDefensive ToolsDisk ForensicsEmbedded Systems SecurityGeneral Purpose UtilitiesIndicator of Compromise (IOC) ManagementOSINT (Open Source Intelligence)Packet Sniffing & AnalysisPassword CrackingPenetration Testing FrameworksPhishing ToolsPrivilege EscalationReconnaissanceStatic AnalysisVulnerability ScannersWeb Vulnerability ScannersWi-Fi AuditingBluetooth SecurityContainer SecurityDynamic Analysis (Sandboxing)Encryption/Decryption ToolsExploit FrameworksIdentity ManagementiOS SecurityIoT SecurityMemory ForensicsNetwork MappingOSINT for Social EngineeringPassword AttacksPayload GenerationPersistence MechanismsPort ScanningStatic Code Analysis (SAST)Threat Feeds & AggregatorsVulnerability AnalysisWeb Proxies & InterceptionCode AnalysisDNS & Subdomain EnumerationDynamic Code Analysis (DAST)ExploitationHash AnalysisIDS/IPS EvasionImpersonation ToolsLateral MovementMobile App PentestingNetwork ForensicsReverse EngineeringRFID/NFC ToolsSCADA/ICS SecurityScripting & AutomationServerless SecurityShellcodeWeb Application ExploitationAPI Security TestingConfiguration AuditingData ExfiltrationDebuggersForensicsInformation GatheringMobile ForensicsNetwork Access ControlPost-ExploitationSecurity VirtualizationPhishingWAF BypassWeb SecurityFuzzingNetwork SecuritySteganographyWireless SecurityData RecoveryMalware AnalysisDigital ForensicsHardware HackingCryptographyCTFPenetration TestingCloud SecurityDevSecOpsMobile SecurityPrivacyCommand and ControlSocial EngineeringHardware SecurityUtilities & FrameworksHardware & IoT SecuritySecret DetectionBinary AnalysisThreat IntelligenceIdentity & Access Management (IAM)Supply Chain SecurityAuthenticationMachine LearningIntrusion DetectionPapers & ResearchMisconfigurationSubdomain EnumerationEmail HarvestingLearning & EducationAI-Assisted ReversingDNS FuzzingRed TeamingIncident ResponseCrawlerCurated ResourcesRemote Access ToolShellcode GenerationPayload DevelopmentRemote Access TrojanAPI SecurityAnti-BotFingerprint SpoofingCAPTCHA BypassEmail SecurityDNS AnalysisChaos EngineeringLearning Paths & CoursesContainer EscapeAI SecurityDatabase SecurityFirmware AnalysisAnomaly DetectionLog AnalysisAdversarial AttackBinary ExploitationLabs & Practice
NewestRelevanceMost popularRecently updated
868 results
CVE-2026-97859-CYB-Analysis preview

CVE-2026-97859-CYB-Analysis

GitHubahiamaduuche-sys/cve-2026-97859-cyb-analysis

Cybersecurity assignment on CVE-2026-97859, severity analysis, patching, and the Cyber Kill Chain.

authentication-authorizationeducationincident-response+3
14 days ago
cve-2026-9618-Patch preview

cve-2026-9618-Patch

GitHubsleepthegod/cve-2026-9618-patch

Hardened PHP replacement handlers for PeachPay Stripe capture and void AJAX endpoints, adding nonce verification, capability checks, and strict order…

authentication-authorizationcode-analysisdefensive-tools+3
14 days ago
KeycloakESC preview

KeycloakESC

GitHubsecfathy/keycloakesc

Reproducible Docker lab + PoC: Keycloak manage-users -> realm-admin escalation via composite roles (CVE-2026-94000 variant). Validated on 26.8.1.

authentication-authorizationexploitationidentity-access-management+5
313 days ago
cve-2026-93328-gate preview

cve-2026-93328-gate

GitHubsustilliano/cve-2026-93328-gate

The authorization layer CVE-2026-93328 was missing: scoped grants, path confinement, and signed receipts in front of MCP storage tools. CVE…

authentication-authorizationcloud-securitydefensive-tools+2
18 days ago
CVE-2026-90907 preview

CVE-2026-90907

GitHubaorozco-sys/cve-2026-90907

Python CLI that detects and exploits CVE-2026-90907, a Joomla! com_users authorization bypass enabling unauthenticated account creation;…

authentication-authorizationexploitationpenetration-testing+4
11 month ago
keycloak-manage-users-composite preview

keycloak-manage-users-composite

GitHubabraxas/keycloak-manage-users-composite

Keycloak 26.8.1 Medium 6.6 Remote authenticated auth leftover. A help-desk admin with manage-users can pin a pre-built composite of manage-realm onto…

authentication-authorizationexploitationidentity-access-management+4
21 day ago
vaultwarden preview

vaultwarden

GitHubdani-garcia/vaultwarden

Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

authenticationauthentication-authorizationcontainer-security+5
69.9k7 days ago
vulnerability-Checklist preview

vulnerability-Checklist

GitHubaz0x7/vulnerability-checklist

Curated collection of web and API vulnerability checklists covering XSS, SQLi, CSRF, IDOR, authentication bypass, file upload, and bug bounty testing…

api-securityauthentication-authorizationcurated-resources+6
3.7k2 years ago
work1-secure-api preview

work1-secure-api

GitHubght657/work1-secure-api

HDU IS Work 1 - Secure REST API (Flask) with CI/CD (pytest + bandit + pip-audit) and CVE-2018-17246 analysis

api-securityauthentication-authorizationdevsecops+7
7 days ago
ats-authproxy-prefix preview

ats-authproxy-prefix

GitHubabraxas/ats-authproxy-prefix

Apache Traffic Server 10.2.0 - High - Remote - Privilege leftover - authproxy prefix

authentication-authorizationexploitationlabs-practice+3
7 days ago
ats-realip-plugin-acl preview

ats-realip-plugin-acl

GitHubabraxas/ats-realip-plugin-acl

Apache Traffic Server 10.2.0 - High - Remote - Privilege leftover - realip PLUGIN ACL fail-open

authentication-authorizationlabs-practicemisconfiguration+4
7 days ago
SudoStamp preview

SudoStamp

GitLabritwick7/sudostamp

Approve sudo on a Linux workstation with a fingerprint on your Android phone. LAN only; the ECDSA key never leaves the phone's TEE and speaks the…

android-securityauthenticationauthentication-authorization+5
10 days ago
Windows-LPE-Auditor preview

Windows-LPE-Auditor

GitHub0xby7eme/windows-lpe-auditor

A small Windows local-privilege-escalation (LPE) misconfiguration auditor with a terminal UI, built with C++20 and FTXUI

authentication-authorizationconfiguration-auditingdefensive-tools+5
2512 days ago
sudp preview

sudp

GitHubxhyumiracle/sudp

Secret-Use Delegation Protocol — protocol-level secret use for agentic systems

ai-securityauthentication-authorizationcryptography+5
62 months ago
enterprise-abac-gateway preview

enterprise-abac-gateway

GitLabkavryxdev-group/enterprise-abac-gateway

Zero-trust reverse proxy and ABAC authorization gateway in Go with embedded OPA policy evaluation and distributed token revocation.

authentication-authorizationcloud-securitydefensive-tools+3
14 days ago
AuthorizationBench preview

AuthorizationBench

GitHubpeach-research-lab/authorizationbench

[🎖️ Honorable Mention in HAIPS @COLM'26] The first benchmark to evaluate how well do LLM agents act in alignment with their assigned authorization…

ai-securityauthentication-authorizationdynamic-analysis-sandboxing+5
32 days ago
superset-g3-v0-import-sql-plant preview

superset-g3-v0-import-sql-plant

GitHubabraxas/superset-g3-v0-import-sql-plant

Proof-of-concept lab for an Apache Superset 6.1.0 authorization flaw where a Gamma dashboard editor plants dataset SQL via unversioned v0 dashboard…

authentication-authorizationexploitationlabs-practice+5
115 days ago
nextjs-supabase-stripe-security-checker preview

nextjs-supabase-stripe-security-checker

GitHubedtrackai/nextjs-supabase-stripe-security-checker

Local static security scanner for Next.js, Supabase and Stripe apps: 24 AST-based checks for leaked keys, missing RLS and grants, unsafe webhooks.…

authentication-authorizationcloud-securitycode-analysis+7
18 days ago
Previous12…49Next