Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

112 results

EntraGoat

semperis/entragoat

A deliberately vulnerable Microsoft Entra ID environment. Learn identity security through hands-on, realistic attack challenges.

authenticationcloud-securityctf+7

981

4 months ago

AzureGoat

ine-labs/azuregoat

AzureGoat : A Damn Vulnerable Azure Infrastructure

cloud-infrastructure-securitycloud-securityeducation+5

9641 year ago

SecureCodingDojo

owasp/securecodingdojo

The Secure Coding Dojo is a platform for delivering secure coding knowledge.

authenticationcode-analysisctf+6

6099 months ago

multi-juicer

juice-shop/multi-juicer

Host and manage multiple Juice Shop instances for security trainings and Capture The Flags

ctfeducationlabs-practice+1

3227 days ago

TerraformGoat

hxsecurity/terraformgoat

Multi-cloud vulnerable-by-design deployment tool using Terraform to provision intentionally insecure cloud infrastructure for security training and…

cloud-infrastructure-securitycloud-securityeducation+2

6373 years ago

Adaz

christophetd/adaz

:wrench: Deploy customizable Active Directory labs in Azure - automatically.

cloud-securityeducationlabs-practice

4291 year ago

GCPGoat

ine-labs/gcpgoat

GCPGoat : A Damn Vulnerable GCP Infrastructure

cloud-infrastructure-securitycloud-securityeducation+5

4531 year ago

PurpleCloud

iknowjason/purplecloud

A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-1…

cloud-infrastructure-securitycloud-securityeducation+4

6581 year ago

pwnspoof

punk-security/pwnspoof

Pwnspoof repository

ctfeducationincident-response+4

2663 years ago

cnappgoat

tenable/cnappgoat

CNAPPgoat is an open source project designed to modularly provision vulnerable-by-design components in cloud environments.

cloud-infrastructure-securitycloud-securityctf+5

2962 years ago

Serverless-Goat

owasp/serverless-goat

OWASP ServerlessGoat: a serverless application demonstrating common serverless security flaws

cloud-securityeducationlabs-practice+3

3317 years ago

Cybersecurity-Handbook

priyanshu-rawa/cybersecurity-handbook

Open-source cybersecurity knowledge base with 400+ notes, labs, and cheat sheets covering offense, defense, cryptography, cloud, and forensics.

cloud-securitycryptographycurated-resources+7

657 days ago

Owasp-top-10-k8s-2025

hac01/owasp-top-10-k8s-2025

Hands-on capture-the-flag lab for the OWASP Kubernetes Top 10 (2025). Exploit 11 real-world cluster weaknesses, capture flags, then apply fixes and…

cloud-securitycontainer-securityctf+8

492 months ago

private-landing

vhscom/private-landing

🔐 Learn authentication by building it right. An extensible, standards-compliant reference implementation for Cloudflare Workers with Hono, Turso,…

api-securityauthenticationauthentication-authorization+8

794 months ago

nimbostratus-target

andresriancho/nimbostratus-target

This repository holds a target infrastructure you can use for running the nimbostratus tools.

cloud-infrastructure-securitycloud-securityeducation+4

2411 years ago

LabS4U2Self

otterhacker/labs4u2self

Deployable AWS-hosted Active Directory pentest lab with domain controller and vulnerable MSSQL; practice S4U2Self abuse, SQL brute force, and RCE.

authentication-authorizationdatabase-securityeducation+5

313 years ago

cve-2026-82329-jfrog-artifactory

dinosn/cve-2026-82329-jfrog-artifactory

Reproducible Docker lab and Python PoC for CVE-2026-82329, an unauthenticated auth-bypass in JFrog Artifactory leading to admin takeover, with…

authenticationcloud-securityexploitation+5

118 days ago

specterops-k8s-red-teamers-libvirt-patch

gregdurys/specterops-k8s-red-teamers-libvirt-patch

Unofficial libvirt patch for the free SpecterOps Kubernetes for Red Teamers lab

cloud-securityeducationlabs-practice+1

1311 days ago

Previous 1 2 345 6 7 Next