Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

151 results

CVE-2025-24813

shivshantp/cve-2025-24813

Apache Tomcat PUT JSP RCE - CVE-2025-24813 - Exploit & PoC

educationexploitationlabs-practice+5

61 year ago

reverse-shell-generator

0dayctf/reverse-shell-generator

Hosted Reverse Shell generator with a ton of functionality. -- (Great for CTFs)

ctfexploitationpayload-development+6

4.1k5 months ago

pocsuite3

knownsec/pocsuite3

pocsuite3 is an open-sourced remote vulnerability testing framework developed by the Knownsec 404 Team.

exploit-frameworkspayload-developmentpenetration-testing+2

3.9k1 year ago

metasploit_in_termux

gushmazuko/metasploit_in_termux

Install and run Metasploit Framework 6 on Android via Termux with automated setup, payload generation (msfvenom), and full msfconsole access for…

android-securityexploit-frameworksmobile-security+2

2.1k1 year ago

Spring4Shell-POC

lunasec-io/spring4shell-poc

This is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965).

exploitationlabs-practicepayload-development+4

1064 years ago

CVE-2013-2028-Exploit

vanivamshi/cve-2013-2028-exploit

Docker-based lab and Python exploit for CVE-2013-2028, an Nginx 1.3.9 chunked-parser integer overflow, covering canary recovery, mprotect, and…

binary-exploitationeducationexploitation+6

16 days ago

CVE-2026-60137-and-CVE-2026-63030

ivanesk315/cve-2026-60137-and-cve-2026-63030

Docker-based WordPress lab reproducing CVE-2026-60137 and CVE-2026-63030 pre-auth RCE, with a Python PoC exploit for SQLi, privilege escalation, and…

educationexploitationlabs-practice+6

19 days ago

cpiopwn

fangqyi/cpiopwn

ACE poc exploit for glibc cpio 2.13 through mmap chunk metadata curruption (CVE-2021-38185)

binary-exploitationeducationexploitation+3

55 years ago

Cerberus-React2Shell-Scanner-Exploit

cerberusmrxi/cerberus-react2shell-scanner-exploit

Elite exploitation toolkit for CVE-2025-55182 (React Server Components RCE). Async polymorphic payloads, advanced WAF/CDN bypass, proxy rotation,…

command-and-controleducationexploit-frameworks+9

21 month ago

CVE-2025-33053-WebDAV-RCE-PoC-and-C2-Concept

kra1t0/cve-2025-33053-webdav-rce-poc-and-c2-concept

Proof-of-Concept for CVE-2025-33053 Exploiting WebDAV with .url file delivery to demonstrate realistic remote code execution. Includes a decoy PDF…

command-and-controleducationexploitation+5

31 year ago

CVE-2022-22965-Spring4Shell

jakabakos/cve-2022-22965-spring4shell

PoC and exploit for CVE-2022-22965 Spring4Shell

educationexploitationpayload-development+3

23 years ago

metabase-cve-2023-38646

kushiro45/metabase-cve-2023-38646

Repo contains the PoC and steps to reproduce cve 2023-38646

exploitationpayload-developmentpenetration-testing+3

2 months ago

CVE-2024-37054-MLflow-RCE

niteeshpujari/cve-2024-37054-mlflow-rce

NiteeshPujari/CVE-2024-37054, This repository contains a Proof of Concept (PoC) a critical deserialization vulnerability in MLflow that allows for…

educationexploitationpayload-development+3

31 year ago

CVE-2025-55182-Dockerized

clevernyyyy/cve-2025-55182-dockerized

Dockerized proof-of-concept for CVE-2025-55182, a critical RCE in React Server Components via prototype pollution, with automated exploit scripts and…

educationexploitationlabs-practice+3

17 months ago

cve-2026-87902-wordpress-lfi-lab

dinosn/cve-2026-87902-wordpress-lfi-lab

Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional…

educationexploitationlabs-practice+7

36 days ago