Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

30 results

JavaSecLab

whgojp/javaseclab

Comprehensive Java vulnerability lab with vulnerable and fixed code, attack scenarios, source/sink audit notes, and secure coding guidance for…

code-analysisctfdevsecops+6

885

4 months ago

vuln4japi

nix-xin/vuln4japi

A vulnerable Java based REST API for demonstrating CVE-2021-44228 (log4shell).

educationexploitationlabs-practice+3

14 years ago

CVE-2026-29000

clayofgilgamesh/cve-2026-29000

CTF lab and exploit toolkit for CVE-2026-29000, a pac4j-jwt JWE authentication bypass. Includes vulnerable Flask target, token forging library,…

authenticationctfeducation+5

7 months ago

CVE-2026-22010-Android-Intent-Redirection-to-Exported-Component

george0papasotiriou/cve-2026-22010-android-intent-redirection-to-exported-component

Proof-of-concept for CVE-2026-22010 Android intent redirection: demonstrates an exported activity forwarding intents to attacker-controlled internal…

android-securityeducationexploitation+3

12 months ago

VulnerableGWTApp

bishopfox/vulnerablegwtapp

An intentionally-vulnerable GWT-based web application to test tooling and techniques

educationexploitationlabs-practice+4

52 years ago

svja

theronielanddaronpodcastshow/svja

The Super Vulnerable Java Application (SVJA), as demonstrated in the Roniel and DaRon Podcast Show, is an Apache Struts application designed to…

api-security-testingauthentication-authorizationeducation+5

1310 months ago

damn-vulnerable-log4j-app

snapattack/damn-vulnerable-log4j-app

Vulnerable web application to test CVE-2021-44228 / log4shell and forensic artifacts from an example attack

digital-forensicseducationexploitation+3

54 years ago

vuln_spring_log4j2

recanavar/vuln_spring_log4j2

Simple Vulnerable Spring Boot Application to Test the CVE-2021-44228

educationexploitationlabs-practice+3

4 years ago

l4s-vulnapp

ktokkawu/l4s-vulnapp

This is a potentially vulnerable Java web application containing Log4j affected by log4shell(CVE-2021-44228).

educationexploitationlabs-practice+3

2 years ago

Log4J_Exploitation-Vulnerabiliy__CVE-2021-44228

lutzigoz/log4j_exploitation-vulnerabiliy__cve-2021-44228

Step-by-step tutorial for exploiting Log4j CVE-2021-44228 with Docker-based vulnerable app, JNDIExploit listener, and LDAP payload injection for…

educationexploitationlabs-practice+3

4 years ago

CVE-2021-44228_dockernize

qw3rtyou/cve-2021-44228_dockernize

Dockerized lab environment for safely practicing CVE-2021-44228 (Log4Shell) exploitation. Includes attacker LDAP server and vulnerable Java…

educationexploitationlabs-practice+3

11 year ago

CVE-2021-44228-docker-example

dicanio/cve-2021-44228-docker-example

Docker-based demonstration of CVE-2021-44228 (Log4Shell) exploitation, featuring a vulnerable Java server, malicious LDAP server, and data…

data-exfiltrationeducationexploitation+3

14 years ago

CVE-2017-7525-Jackson-Deserialization-Lab

ingenuity-fainting-goats/cve-2017-7525-jackson-deserialization-lab

Insecure Java Deserialization Lab

binary-exploitationeducationexploitation+3

62 years ago

zip4j

iris-sast/zip4j

CWE-Bench-Java CVE-2018-1002202 versions 1.3.2, 1.3.3

code-analysiseducationstatic-analysis+2

1 year ago

CVE-2015-7501

ianxtianxt/cve-2015-7501

Educational lab for understanding Java deserialization vulnerabilities with PoC exploits for JBoss CVEs, gadget chain analysis, and a vulnerable HTTP…

binary-exploitationeducationexploitation+5

226 years ago