Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

203 results

ludus_crushftp_cve-2025-31161_sim

rufflabs/ludus_crushftp_cve-2025-31161_sim

Ansible role that simulates a realistic CrushFTP CVE-2025-31161 exploitation scenario with rotating sensitive data files and automated defender…

ctfeducationexploitation+5

4 months ago

CVE-2025-11262-Lab

rootdirective-sec/cve-2025-11262-lab

Docker lab for reproducing CVE-2025-11262, an unauthenticated stored blind XSS in Link Whisper Free WordPress plugin. Includes vulnerable and patched…

ctfeducationlabs-practice+3

4 months ago

CVE-2025-26794

oscarbataille/cve-2025-26794

CVE-2025-26794: Blind SQL injection in Exim 4.98 (SQLite DBM)- exploit writeup

database-securityeducationexploitation+4

141 year ago

CVE-2025-48734

h3raklez/cve-2025-48734

CVE-2025-48734 - Affects Apache Commons BeanUtils in versions prior to 1.11.0 (and the 2.x branch before 2.0.0-M2).

educationexploitationlabs-practice+5

7 months ago

CVE-2025-24813

loufa0/cve-2025-24813

right payload for java CVE

ctfeducationexploitation+3

4 months ago

cve-2025-29927-lab

swapnildeshpande/cve-2025-29927-lab

Reproduction lab for CVE-2025-29927 — Next.js middleware authorization bypass (CVSS 9.1)

authenticationeducationlabs-practice+3

4 months ago

CVE-2025-6218_WinRAR

speinador/cve-2025-6218_winrar

Educational lab demonstrating CVE-2025-6218 path traversal in WinRAR. Includes a malicious RAR file and step-by-step guide to observe file overwrite…

binary-exploitationeducationexploitation+3

161 year ago

CVE-2025-2304-exploit

jeanback1/cve-2025-2304-exploit

Python exploit script for CVE-2025-2304, a mass assignment privilege escalation in Camaleon CMS. Automates CSRF token parsing and role parameter…

educationexploitationlabs-practice+5

6 months ago

CVE-2025-29927

0xnxt1me/cve-2025-29927

Proof-of-concept exploit for CVE-2025-29927 that adds x-middleware-subrequest to bypass Next.js middleware authentication checks.

authentication-authorizationeducationlabs-practice+3

11 year ago

CVE-2025-5548

x3nt4ur0/cve-2025-5548

Laboratorio para el análisis y explotación del CVE-2025-5548

binary-exploitationdebuggerseducation+7

7 months ago

zero-click-exploit-analysis

danielw98/zero-click-exploit-analysis

CVE-2025-55177 + CVE-2025-43300: reverse-engineering the WhatsApp-ImageIO zero-click iOS chain, with interactive labs.

binary-exploitationeducationexploitation+7

65 months ago

CVE-2025-54918-POC

wh0am123/cve-2025-54918-poc

POC for CVE-2025-54918 and a technical demonstration.

authenticationeducationexploitation+5

659 months ago

CVE-2025-24813

x1ongsec/cve-2025-24813

tomcat CVE-2025-24813 反序列化RCE环境

educationexploitationlabs-practice+3

1 year ago

CVE-2025-0108

kso4more/cve-2025-0108

Reproduces CVE-2025-0108 path confusion vulnerability in Nginx/Apache stacks. Includes a vulnerable PoC and a patched implementation demonstrating…

authenticationeducationlabs-practice+3

7 months ago

CVE-2025-5548-POC

lorenzoporrasduque/cve-2025-5548-poc

Educational lab demonstrating a stack buffer overflow (CVE-2025-5548) in FreeFloat FTP Server. Covers full exploit development: vulnerability…

binary-exploitationdebuggerseducation+7

7 months ago

CVE-2025-3052

themalwareguardian/cve-2025-3052

Research on CVE-2025-3052, an Insyde firmware vulnerability that exposes an arbitrary write primitive capable of modifying security-critical pointers.

binary-analysiseducationembedded-systems-security+5

2 months ago

CVE-2025-24813-Apache-Tomcat-Partial-PUT-Deserialization-RCE-

dhananjayasj/cve-2025-24813-apache-tomcat-partial-put-deserialization-rce-

Proof-of-concept exploit for CVE-2025-24813, an unauthenticated RCE in Apache Tomcat via partial PUT and deserialization. Includes Docker lab for…

exploitationlabs-practicepayload-development+3

4 months ago

LetsDefend-SOC342-CVE-2025-53770-SharePoint-ToolShell-Auth-Bypass-andRCE-EventID-320

victormbogu1/letsdefend-soc342-cve-2025-53770-sharepoint-toolshell-auth-bypass-andrce-eventid-320

Step-by-step walkthrough of a LetsDefend SOC342 lab analyzing CVE-2025-53770 SharePoint ToolShell auth bypass and RCE, including attack chain,…

ctfeducationexploitation+6

1 year ago

Previous12…12 Next