Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

3105 results

CVE-2026-33937

eqstlab/cve-2026-33937

Handlebars.js AST Injection Remote Code Execution Vulnerability

educationexploitationlabs-practice+5

4 months ago

cve-2019-11707

flabbergastedbd/cve-2019-11707

https://bugs.chromium.org/p/project-zero/issues/detail?id=1820

binary-exploitationexploitationpayload-development+4

26 years ago

CVE-2024-1813-POC

mobetasec/cve-2024-1813-poc

PoC exploit for CVE-2024-1813: PHP object injection in Simple Job Board WordPress plugin, achieving unauthenticated RCE via gadget chain. Includes…

ctfeducationlabs-practice+4

1 month ago

CVE-2025-63408

s-vx/cve-2025-63408

Path Traversal in AgentDVR

exploitationpayload-developmentpenetration-testing+2

1 month ago

CVE-2026-59734-POC

cybertechajju/cve-2026-59734-poc

OS Command Injection in Health Check → Remote Code Execution

command-and-controleducationexploitation+4

1 month ago

CVE-2025-55449-AstrBot-RCE

marven11/cve-2025-55449-astrbot-rce

AstrBot老版本RCE

exploitationpayload-developmentpenetration-testing+2

29 months ago

Dirty-Pipe

rabomen/dirty-pipe

exp of CVE-2022-0847

binary-exploitationexploitationpayload-development+3

24 years ago

CVE-2022-22965_Spring4Shell

ludovicpatho/cve-2022-22965_spring4shell

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit…

code-analysisexploitationpayload-development+3

24 years ago

CVE-2025-49132-Pterodactyl-Panel-Unauthenticated-Remote-Code-Execution-RCE-

dollarboysushil/cve-2025-49132-pterodactyl-panel-unauthenticated-remote-code-execution-rce-

PoC exploit for CVE-2025-49132 (GHSA-24wv-6c99-f843) – Unauthenticated Remote Code Execution in Pterodactyl Panel ≤ 1.11.10

exploitationpayload-developmentpenetration-testing+3

36 months ago

cve-2025-3248-exploit

drackyjr/cve-2025-3248-exploit

A comprehensive Python exploitation framework for testing and demonstrating CVE-2025-3248, a critical unauthenticated remote code execution…

code-analysiscommand-and-controleducation+8

39 months ago

CVE-2025-8110

xdezen/cve-2025-8110

Python proof-of-concept for CVE-2025-8110, demonstrating arbitrary file write to RCE in Gogs via symlink and API, with educational lab usage.

educationexploitationlabs-practice+3

1 month ago

CVE-2026-48908

bayu06802/cve-2026-48908

Proof-of-concept exploit for CVE-2026-48908, an unauthenticated RCE in Joomla SP Page Builder via arbitrary file upload, with adaptive payload…

ctfeducationexploitation+4

1 month ago

CVE-2026-13001

ghostpels/cve-2026-13001

Exploit for CVE-2026-13001: Unauthenticated RCE in Podlove Podcast Publisher via extension confusion. Includes mass scanning, interactive shell, and…

educationexploitationpayload-development+3

1 month ago

CVE-2026-40859

oscerd/cve-2026-40859

Reproducer for CVE-2026-40859 — Apache Camel camel-netty-http / camel-vertx-http producer-side unsafe deserialization of HTTP response bodies (RCE)

binary-exploitationcode-analysiseducation+5

1 month ago

CVE_2026_7515

izxci/cve_2026_7515

Unauthenticated Local File Inclusion to Remote Code Execution exploit for BetterDocs Pro <= 3.8.0. Provides proof-of-concept for CVE-2026-7515…

exploitationpayload-developmentpenetration-testing+2

2 months ago

CVE-2025-55182

cc3305/cve-2025-55182

Pre-authentication RCE exploit for React Server Components (CVE-2025-55182). Targets unsafe deserialization in react-server-dom packages across…

exploitationpayload-developmentpenetration-testing+2

2 months ago

CVE-2026-55168

kovachvl/cve-2026-55168

Proof-of-concept exploit for CVE-2026-55168 demonstrating authenticated arbitrary file write via symlink planting during backup restore in Runtipi.

educationexploitationpayload-development+3

2 months ago

CVE-2026-25860

partywavesec/cve-2026-25860

CVE-2026-25860 POC git

exploitationpayload-developmentpenetration-testing+3

2 months ago

Previous 1…959697…100 Next