Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

95 results

ysoserial

frohoff/ysoserial

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

educationexploit-frameworkspayload-generation+3

9.1k10 months ago

JYso

qi4l/jyso

Dual-purpose JNDI injection and Java deserialization exploitation framework with advanced bypass capabilities for WAF, RASP, and high JDK versions.…

command-and-controlctfexploit-frameworks+5

1.8k4 months ago

godofwar

kingsabri/godofwar

GodOfWar - Malicious Java WAR builder with built-in payloads

exploitationpayload-developmentpayload-generation+3

1257 years ago

Archived

sAINT

tiagorlampert/saint

👁️ (s)AINT is a Spyware Generator for Windows systems written in Java. [Discontinued]

data-exfiltrationpayload-generationpersistence-mechanisms+1

7556 years ago

GadgetProbe

bishopfox/gadgetprobe

Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.

payload-generationpenetration-testingreconnaissance+2

6195 years ago

NebulaPulsar

iss4cf0ng/nebulapulsar

NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally developed as part of…

dynamic-code-analysiseducationencryption-decryption-tools+7

473 months ago

jexboss

joaomatosf/jexboss

JexBoss: Jboss (and Java Deserialization Vulnerabilities) verify and EXploitation Tool

exploitationpayload-generationpenetration-testing+2

2.5k9 years ago

MemShellParty

reajason/memshellparty

一款专注于 Java 主流 Web 中间件的内存马快速生成工具，致力于简化安全研究人员和红队成员的工作流程，提升攻防效率

exploit-frameworkspayload-generationpenetration-testing+3

1.6k1 month ago

CVE-2021-44228-PoC-log4j-bypass-words

puliczek/cve-2021-44228-poc-log4j-bypass-words

🐱‍💻 ✂️ 🤬 CVE-2021-44228 - LOG4J Java exploit - WAF bypass tricks

educationexploitationids-ips-evasion+6

9524 years ago

JavaUnserializeExploits

foxglovesec/javaunserializeexploits

Exploit toolkit for Java deserialization vulnerabilities in WebLogic, WebSphere, JBoss, Jenkins, and OpenNMS. Generates crafted serialized payloads…

exploitationpayload-generationpenetration-testing+3

50310 years ago

Java-Deserialization-Scanner

federicodotta/java-deserialization-scanner

All-in-one plugin for Burp Suite for the detection and the exploitation of Java deserialization vulnerabilities

exploit-frameworkspayload-generationpenetration-testing+2

8054 years ago

zkar

phith0n/zkar

Go-based Java serialization protocol analyzer that parses, dumps, and generates deserialization payloads with ysoserial gadget support and a library…

binary-analysisexploitationpayload-generation+1

6556 months ago

msmap

hosch3n/msmap

Modular memory webshell generator supporting Java containers (Tomcat, Spring, WebLogic) with multiple shell types, encoders, and automatic…

exploit-frameworkspayload-generationpenetration-testing+1

5813 years ago

java-stager

cornerpirate/java-stager

A PoC Java Stager which can download, compile, and execute a Java file in memory.

command-and-controldynamic-code-analysiseducation+7

1078 years ago

mjet

mogwaisec/mjet

Mogwai Java Management Extensions (JMX) Exploitation Toolkit

exploitationexploit-frameworksmisconfiguration+3

17310 years ago

CVE-2026-34486

striga-ai/cve-2026-34486

EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.

exploitationpayload-generationpenetration-testing+3

705 months ago

CVE-2018-2380

erpscanteam/cve-2018-2380

PoC of Remote Command Execution via Log injection on SAP NetWeaver AS JAVA CRM

command-and-controlexploitationpayload-generation+3

528 years ago

ermir

hakivvi/ermir

Rogue RMI Registry exploiting unsecure Java deserialization via list/lookup/bind methods. Generates and delivers Ysoserial gadgets to trigger remote…

exploitationpayload-generationpenetration-testing+1

503 years ago

Previous12 3 4 5 6 Next