Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

26 results

OWASP-Hunting

owasp/owasp-hunting

Curated collection of payloads for ethical security testing and bug bounty hunting, covering common web vulnerabilities and attack vectors.

curated-resourcespayload-generationpenetration-testing+2

5 days ago

CVE-2025-20260

keyuraghao/cve-2025-20260

Python-based exploit for CVE-2025-20260 that generates a malicious PDF file and includes core dump analysis capabilities for vulnerability…

binary-exploitationexploitationforensics+2

1 month ago

harpyTools

jssngc/harpytools

Automated Active Directory post-exploitation toolkit for Kerberos ticket extraction, NTLM relay attacks, and lateral movement via NetExec, Impacket,…

command-and-controlexploitationlateral-movement+6

192 months ago

PAYLOAD-LISTS

nu11secur1ty/payload-lists

Curated collection of injection payloads for web application security testing, covering SSTI, XXE, XSS, SSRF, SQLi, NoSQLi, LDAP, command injection,…

curated-resourceseducationpayload-generation+3

42 months ago

Certi-Bhai

incredibleindishell/certi-bhai

AD CS exploitation related stuff goes here

authenticationexploitationpayload-generation+4

417 months ago

ProtectMyTooling

mgeeky/protectmytooling

Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking,…

binary-analysisexploit-frameworksioc-management+5

1.1k1 year ago

js2py-Sandbox-Escape-CVE-2024-28397-RCE

0xdtc/js2py-sandbox-escape-cve-2024-28397-rce

Exploit scripts for CVE-2024-28397, a js2py sandbox escape that executes arbitrary Python code to spawn a reverse shell on a target endpoint.

educationexploitationpayload-generation+3

1 year ago

img-payloads

coffinxp/img-payloads

Curated collection of image-based payloads for authorized red-team testing and security education, with HTML examples for generating or embedding web…

curated-resourceseducationexploitation+3

1841 year ago

Tiny-XSS-Payloads

terjanq/tiny-xss-payloads

A collection of tiny XSS Payloads that can be used in different contexts. https://tinyxss.terjanq.me

ctfcurated-resourcespayload-generation+1

2.4k1 year ago

AwesomeXSS

s0md3v/awesomexss

Awesome XSS stuff

ctfcurated-resourceseducation+6

5.1k2 years ago

Open-Redirect-Payloads

cujanovic/open-redirect-payloads

Curated collection of open redirect payloads sourced from bug bounty reports, with a shell script to substitute a target whitelisted domain for…

curated-resourcespayload-generationpenetration-testing+3

6712 years ago

CRLF-Injection-Payloads

cujanovic/crlf-injection-payloads

Collection of CRLF injection payloads gathered from bug bounty reports, used as a reference for testing HTTP header and response splitting…

curated-resourcespayload-generationpenetration-testing+3

2272 years ago

BurpCrypto

whwlsfb/burpcrypto

BurpSuite plugin for encrypting payloads with AES, RSA, DES, or custom JS code, enabling automated decryption of front-end encrypted traffic during…

encryption-decryption-toolsfuzzingpayload-generation+1

1.6k3 years ago

AggressorScripts

harleyqu1nn/aggressorscripts

Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

command-and-controlinformation-gatheringpayload-generation+5

1.5k3 years ago

MalQR.github.io

malqr/malqr.github.io

MalQR is a collection of malicious QR Codes and Barcodes you can use to test the security of your scanners.

fuzzingpayload-generationpenetration-testing+1

1274 years ago

PayloadAutomation

emcghee/payloadautomation

Automates Cobalt Strike payload development, testing, and deployment via a Python-to-Sleep bridge; includes artifact inspection, IoC tracking, and…

command-and-controlioc-managementpayload-development+3

1204 years ago

Archived

Citadel

redcode-labs/citadel

Collection of pentesting scripts

dns-analysisexploitationinformation-gathering+6

4384 years ago

CVE-2021-44228-Log4j-Payloads

crackercat/cve-2021-44228-log4j-payloads

Collection of payloads for exploiting the Log4j remote code execution vulnerability (CVE-2021-44228), including JNDI injection strings and bypass…

exploitationpayload-generationpenetration-testing+2

34 years ago

Previous12 Next