Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

52 results

CVE-2024-51324

devianntsec/cve-2024-51324

Master's Thesis research on CVE-2024-51324 (BYOVD). Advanced exploit with 4 operational modes (SCANNER, LOADER, KILLER, CLEANUP), SHA-256 driver…

binary-exploitationdefensive-toolseducation+7

4 months ago

CVE-2025-55182

devianntsec/cve-2025-55182

Master's thesis research on CVE-2025-55182 (React2Shell). Modular exploitation framework with 6 attack scenarios (RCE, exfiltration, defacement),…

educationexploitationexploit-frameworks+8

14 months ago

CVE-2025-60791

smarttfoxx/cve-2025-60791

Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound…

debuggerseducationexploitation+3

210 months ago

CVE-2023-34836

sahiloj/cve-2023-34836

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Microworld Technologies eScan Management Console v14.0.1400.2281. The vulnerable…

educationpapers-researchpenetration-testing+2

16 months ago

CVE-2023-34838

sahiloj/cve-2023-34838

Microworld Technologies eScan Management Console version 14.0.1400.2281 is vulnerable to a Stored Cross-Site Scripting (XSS) attack.

educationpapers-researchpenetration-testing+2

16 months ago

exploit-CVE-2025-55182-poc

pa2sw0rd/exploit-cve-2025-55182-poc

This POC demonstrates CVE-2025-55182 using actual `[email protected]` vulnerable code.

code-analysiseducationexploitation+5

18 months ago

Tarmageddon-CVE-2025-62518-

airineiandrei/tarmageddon-cve-2025-62518-

PoC for CVE-2025-62518 demonstrating tar archive smuggling via tokio-tar PAX header parsing, creating malicious payloads and a vulnerable extractor…

educationexploitationmalware-analysis+3

7 months ago

CVE-2021-38297-Go-wasm-Replication

paras98/cve-2021-38297-go-wasm-replication

Educational proof-of-concept replicating CVE-2021-38297, a Go WASM buffer overflow leading to stored XSS. Includes vulnerable app setup, exploit…

binary-exploitationctfeducation+6

2 years ago

CVE-2025-31033

nxploited/cve-2025-31033

WordPress Buddypress Humanity Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

educationexploitationpapers-research+3

1 year ago

Metasploit-Attack-Report

sampatdhakal/metasploit-attack-report

Technical Analysis of the SMB vulnerability (CVE-2017-0143) & its impact on the vulnerable system

educationexploitationpapers-research+2

4 years ago

fastjson-cve

ipisav/fastjson-cve

Reproduction project for CVE-2026-16723, a critical RCE in fastjson 1.2.68-1.2.83. Demonstrates AutoType bypass, JNDI injection, and TemplatesImpl…

educationexploitationpapers-research+2

2 days ago

CVE-2025-11391

r3db34rdh4x/cve-2025-11391

WordPress PPOM for WooCommerce Plugin <= 33.0.15 is vulnerable to SQL Injection

educationexploitationpapers-research+2

10 months ago

CVE-2026-3494_Verfication

kelnor/cve-2026-3494_verfication

Reproduces and analyzes CVE-2026-3494, an audit logging bypass in MariaDB server_audit plugin, using Docker-based multi-version testing to compare…

database-securityeducationexploitation+2

3 months ago

htb-machine-ringdown

raajgupta01/htb-machine-ringdown

Detailed design & exploitation writeup for Ringdown—an original Debian/Asterisk vulnerable machine featuring CVE-2024-42365 (AMI), PJSIP pre-hash…

ctfeducationexploitation+5

5h 27m ago

CVE-2026-33017-Lab

rootdirective-sec/cve-2026-33017-lab

Reproducible lab for CVE-2026-33017, an unauthenticated RCE in Langflow. Includes a Dockerized vulnerable service and a least-harm PoC that…

educationexploitationlabs-practice+3

5 months ago

DIRTYFAIL

karazajac/dirtyfail

Detector + PoC for Linux page-cache write vulnerabilities: Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284/43500). Authorized security…

binary-exploitationcontainer-escapeeducation+7

283 months ago

CVE-2026-33017

eqstlab/cve-2026-33017

Langflow RCE

code-analysiseducationexploitation+3

811 days ago

CVE-2021-3345

mlgradish/cve-2021-3345

POC exploit of CVE-2021-3345, a vulnerability in libgcrypt version 1.9.0

binary-exploitationcryptographyexploitation+2

95 years ago

Previous 123 Next