Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

193 results

bytecode-viewer

konloch/bytecode-viewer

A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)

android-securitybinary-analysiscode-analysis+6

15.6k

1 month ago

semgrep-rules

trailofbits/semgrep-rules

Collection of Semgrep rules for static code analysis, detecting security vulnerabilities, and enforcing secure coding practices across multiple…

code-analysisdevsecopsmisconfiguration+2

5254 months ago

osv-scanner

google/osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

code-analysiscontainer-securitydevsecops+4

11.0k2 days ago

monty

pydantic/monty

A minimal, secure Python interpreter written in Rust for use by AI

ai-securitycode-analysiseducation+2

8.2k2h 59m ago

CVE-2025-57819-POC

neobee714/cve-2025-57819-poc

FreePBX 未认证SQL注入导致远程代码执行，FreePBX 15 (低于 15.0.66)、16 (低于 16.0.89)、17 (低于 17.0.3)。该漏洞位于商业化“endpoint”模块中，因对用户输入过滤不严，允许未认证的攻击者绕过管理员权限，执行SQL注入，并最终实现远程代码执行

code-analysiseducationexploitation+2

1 month ago

checkmk-log4j-scanner

inettgmbh/checkmk-log4j-scanner

Checkmk extension that scans JAR, WAR, EAR, and AAR files for Log4j versions vulnerable to CVE-2021-44228 by inspecting META-INF pom.properties…

code-analysislog-analysisstatic-analysis+2

42 years ago

blackhat-python3

eonraider/blackhat-python3

Source code for the book "Black Hat Python" by Justin Seitz. The code has been fully converted to Python 3, reformatted to comply with PEP8 standards…

code-analysiscryptographyeducation+8

2.4k3 years ago

CVE-2018-16370

snappyjack/cve-2018-16370

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a…

code-analysisexploitationpenetration-testing+2

8 years ago

CVE-2023-49606

d0rb/cve-2023-49606

Critical use-after-free vulnerability discovered in Tinyproxy

binary-exploitationcode-analysiseducation+3

42 years ago

SSLPinDetect

aancw/sslpindetect

SSLPinDetect is a tool for analyzing Android APKs to detect SSL pinning implementations by scanning for known patterns in decompiled code. It helps…

android-securitycode-analysismobile-security+4

871 year ago

CVE-2023-30533

benedridge/cve-2023-30533

There were no proper POCs for CVE-2023-30533 so I made one. (Reported by Vsevolod Kokorin)

code-analysisexploitationstatic-analysis+2

123 years ago

SkillSpector

nvidia/skillspector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and…

ai-securitycode-analysisdevsecops+8

16.3k5 days ago

ghidra

nationalsecurityagency/ghidra

Ghidra is a software reverse engineering (SRE) framework

ai-assisted-reversingandroid-securitybinary-analysis+17

74.4k4 days ago

Open-Source-Seal-Security

ronmadar/open-source-seal-security

Fix open source package uses tough-cookie 2.5.0 - CVE-2023-26136,

code-analysiseducationstatic-analysis+2

2 years ago

magento2-template-filter-patch

wubinworks/magento2-template-filter-patch

Magento 2 patch for CVE-2022-24086, CVE-2022-24087. Fix the RCE vulnerability and related bugs by performing deep template variable escaping. If you…

code-analysisexploitationmisconfiguration+3

1 year ago

CVE-2016-2098

3rg1s/cve-2016-2098

Proof-of-concept exploit for CVE-2016-2098, demonstrating remote Ruby code execution through Rails render method abuse; intended for security testing…

code-analysiseducationexploitation+2

6 years ago

MalEval

zhengxr930/maleval

Official code for the ISSTA 2026 paper: Is "Knowing It’s Malicious" Enough? Evaluating LLMs for Fine-Grained Malware Behavior Auditing

ai-securityandroid-securitycode-analysis+5

51 month ago

ApplicationInspector

microsoft/applicationinspector

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using…

code-analysisdevsecopsstatic-analysis+3

4.4k10 days ago

Previous12…11 Next