Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

918 results

CVE-2024-3400

schooldropout1337/cve-2024-3400

Nuclei template and bash script for detecting and exploiting CVE-2024-3400 command injection in Palo Alto PAN-OS GlobalProtect, enabling…

command-and-controlexploitationpayload-generation+3

2 years ago

MSC-EvilTwin-Local-Privilege-Escalation

mbanyamer/msc-eviltwin-local-privilege-escalation

CVE-2025-26633 (CVSS 7.8) – Zero-day MMC .msc EvilTwin LPE actively exploited by Water Gamayun APT. PoC creates local admin via malicious MSC file on…

binary-exploitationexploitationpayload-generation+4

49 months ago

CVE-2026-48908

jenderal92/cve-2026-48908

CVE-2026-48908 — PoC exploit for unauthenticated RCE in SP Page Builder (Joomla) via arbitrary file upload. Multi‑threaded, case‑bypass, shell…

exploitationpayload-generationpenetration-testing+4

32 months ago

CVE-2026-63223-POC

imbas007/cve-2026-63223-poc

CVE-2026-63223 PoC — CodeIgniter 4 is_image/mime_in File Upload RCE (CVSS 9.8). Unauthenticated remote code execution via unrestricted file upload…

educationexploitationlabs-practice+5

31 month ago

CVE-2025-39436

nxploited/cve-2025-39436

WordPress I Draw Plugin <= 1.0 is vulnerable to Arbitrary File Upload

educationexploitationpayload-generation+3

31 year ago

log4j2-rce-poc

unlimitedsola/log4j2-rce-poc

A bare minimum proof-of-concept for Log4j2 JNDI RCE vulnerability (CVE-2021-44228/Log4Shell).

educationexploitationpayload-generation+3

34 years ago

CVE-2021-24307-all-in-one-seo-pack-admin-rce

darkpills/cve-2021-24307-all-in-one-seo-pack-admin-rce

Proof-of-concept exploit for CVE-2021-24307, an authenticated admin RCE in All in One SEO Pack <= 4.1.0.1 via PHP unserialization, enabling arbitrary…

exploitationpayload-generationpenetration-testing+3

44 years ago

laravel-filemanager-unrestricted-upload

jenderal92/laravel-filemanager-unrestricted-upload

PoC for CVE-2025-56399 - Unrestricted File Upload leading to RCE in alexusmai/laravel-file-manager (≤3.3.1). Automates detection, CSRF extraction,…

educationexploitationpayload-generation+3

22 months ago

CVE-2026-29000-PoC

dua2z3rr/cve-2026-29000-poc

CVE-2026-29000 - pac4j-jwt (< 4.5.9 / < 5.7.9 / < 6.3.3) JwtAuthenticator authentication bypass PoC

authenticationctfeducation+5

115 days ago

CVE-2023-50164-PoC

nikitapark/cve-2023-50164-poc

CVE-2023-50164 PoC Application & Exploit script

educationexploitationpayload-generation+3

128 days ago

langflow-exploit

preemware/langflow-exploit

PoC for CVE-2025-3248: unauthenticated RCE in Langflow < 1.3.0 via /api/v1/validate/code.

exploitationpayload-generationpenetration-testing+1

129 days ago

react2shell-CVE-2025-55182-full-rce-script

chrahman/react2shell-cve-2025-55182-full-rce-script

React2Shell vulnerability (CVE-2025-55182 / CVE-2025-66478) Full Script

command-and-controleducationexploitation+5

38 months ago

CVE-2020-0688

murataydemir/cve-2020-0688

[CVE-2020-0688] Microsoft Exchange Server Fixed Cryptographic Key Remote Code Execution (RCE)

code-analysisexploitationpayload-generation+3

46 years ago

aapanel

jenaye/aapanel

aapanel 6.6.6 - (Authenticated) Remote Code Execution

exploitationpayload-generationpenetration-testing+2

26 years ago

log4j-shell-poc

jiahong-guan/log4j-shell-poc

A Proof-Of-Concept for the CVE-2021-44228 vulnerability.

exploitationpayload-developmentpayload-generation+3

129 days ago

CVE-2022-26134

kh4sh3i/cve-2022-26134

Proof-of-concept exploit for CVE-2022-26134, an unauthenticated OGNL injection vulnerability in Atlassian Confluence Server and Data Center, enabling…

exploitationpayload-generationpenetration-testing+3

44 years ago

CVE-2026-70553-PoC

woshidashabi1126/cve-2026-70553-poc

Proof-of-concept exploit for CVE-2026-70553, enabling unauthenticated RCE in MaxSite CMS via persistent PHP injection into database.php through the…

educationexploitationpayload-generation+2

11 month ago

CVE-2025-13486-POC

0xanis/cve-2025-13486-poc

POC for CVE-2025-13486

educationexploitationpayload-generation+3

59 months ago

Previous 1…394041…51 Next