Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

205 results

TokenMan

secureworks/tokenman

Post-exploitation toolkit for Azure AD: fetch/search Microsoft Graph data, swap FOCI refresh tokens, and generate Azure CLI auth files from tokens.

authenticationcloud-securityinformation-gathering+2

103

3 years ago

EntraPassTheCert

temp43487580/entrapassthecert

tool for requesting Entra ID's P2P certificate and authenticating to a remote Entra joinned devices with it

authenticationcloud-securityidentity-access-management+4

1351 year ago

CVE-2023-34039

sinsinology/cve-2023-34039

VMWare Aria Operations for Networks (vRealize Network Insight) Static SSH key RCE (CVE-2023-34039)

cloud-securityexploitationpenetration-testing+3

953 years ago

stratum-c2

lame-projects/stratum-c2

Cloud dead-drop C2 framework — RSA-4096 + AES-256-GCM, 5 cloud providers, Rust-only agents, P2P mesh, persistence engine, credential harvesting

cloud-securitycommand-and-controlencryption-decryption-tools+6

4110 days ago

AzTokenFinder

hackmichnet/aztokenfinder

Offensive token-harvesting utility that searches x64 process memory and TokenBroker cache files for Azure AD/O365 JWT tokens across Office, Edge,…

authenticationcloud-securitymemory-forensics+3

1093 years ago

SQLC2

netspi/sqlc2

SQLC2 is a PowerShell script for deploying and managing a command and control system that uses SQL Server as both the control server and the agent.

cloud-securitycommand-and-controldatabase-security+3

763 years ago

scour

grines/scour

Module-based AWS exploitation framework for red team testing and blue team analysis. Emulates attack patterns in the AWS control plane with unique UA…

cloud-securityexploitationlateral-movement+4

1272 years ago

h3-cli

horizon3ai/h3-cli

CLI tool for the Horizon3.ai API

cloud-securitydevsecopspenetration-testing-frameworks+3

2516 days ago

DEFCON-CICD-pipelines-workshop

wavestone-cdt/defcon-cicd-pipelines-workshop

Hands-on CI/CD pipeline security workshop with Terraform lab, AWS exploitation, Kubernetes escape, and artifact backdooring exercises for offensive…

cloud-securitycontainer-escapecontainer-security+8

933 years ago

faraday_agent_dispatcher

infobyte/faraday_agent_dispatcher

Faraday Agent Dispatcher launches any security tools and send results to Faradaysec Platform.

cloud-securitydevsecopsinformation-gathering+5

497 months ago

CloudSec

eshlomo1/cloudsec

Master the art of cloud exploitation. A specialized resource for offensive security researchers and red teamers focused on weaponizing…

anti-botcloud-securitycontainer-escape+8

3014 days ago

latma

silverfort-open-source/latma

Collects and analyzes AD and Azure AD authentication logs to detect lateral movement attacks using graph-based anomaly detection, visualizing…

anomaly-detectioncloud-securityincident-response+5

803 years ago

Owasp-top-10-k8s-2025

hac01/owasp-top-10-k8s-2025

Hands-on capture-the-flag lab for the OWASP Kubernetes Top 10 (2025). Exploit 11 real-world cluster weaknesses, capture flags, then apply fixes and…

cloud-securitycontainer-securityctf+8

492 months ago

SCOPE

tayontech/scope

AI agent set for cloud security purple teaming, runs inside Claude Code, Gemini CLI, and Codex.

ai-securitycloud-infrastructure-securitycloud-security+8

543 months ago

azbelt

daddycocoaman/azbelt

AAD related enumeration in Nim

authenticationcloud-securityidentity-access-management+5

1323 years ago

CloudPrivs

abstractclass/cloudprivs

Determine privileges from cloud credentials via brute-force testing.

cloud-securityinformation-gatheringpenetration-testing+2

691 month ago

fawkes

galoryber/fawkes

Fawkes is a golang Mythic C2 Agent exclusively written by AI.

cloud-securitycommand-and-controlcontainer-escape+7

372 months ago

CVE-2020-8559

tdwyer/cve-2020-8559

This is a PoC exploit for CVE-2020-8559 Kubernetes Vulnerability

cloud-securitycontainer-securityexploitation+5

546 years ago

Previous 1…567…12 Next