Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

15 results

chisel

jpillora/chisel

Fast TCP/UDP tunnel over HTTP with SSH encryption, supporting reverse port forwarding, SOCKS5 proxy, and client authentication for secure network…

command-and-controldata-exfiltrationgeneral-purpose-utilities+8

16.6k

19 days ago

forbidden

ivan-sincek/forbidden

Bypass 4xx HTTP response status codes and more. The tool is based on Python Requests, PycURL, and HTTP Client.

fuzzingids-ips-evasioninformation-gathering+5

2570 years ago

gori

hahwul/gori

A fast, keyboard-driven HTTP intercepting proxy and hacking & pentesting toolkit for the terminal.

api-security-testingfuzzinginformation-gathering+8

1002 days ago

wssip

nccgroup/wssip

Application for capturing, modifying and sending custom WebSocket data from client to server and vice versa.

fuzzingpenetration-testingweb-proxies-interception+1

4517 years ago

CVE-2019-17638-Jetty

forse01/cve-2019-17638-jetty

Exploit for CVE-2019-17638 targeting Jetty Java HTTP server, enabling remote code execution via crafted HTTP requests for security testing and…

exploitationpenetration-testingvulnerability-analysis+2

15 years ago

interactsh

projectdiscovery/interactsh

An OOB interaction gathering server and client library

dns-analysisinformation-gatheringpenetration-testing+2

4.5k6 months ago

ABPTTS

nccgroup/abptts

TCP tunneling over HTTP/HTTPS for web application servers

ids-ips-evasionpenetration-testingred-teaming+1

74410 years ago

slinger

emo-crab/slinger

An HTTP client specifically developed for security researchers

api-security-testingpenetration-testingvulnerability-analysis+2

2928 days ago

RustTLSX

d0rb/rusttlsx

🦀 Stealth HTTP client for Rust . mimics real browser TLS fingerprints for undetectable requests. Fast, type-safe, and built for precision networking.

anti-botcrawlerfingerprint-spoofing+5

10 months ago

CVE-2025-23048-POC

absholi7ly/cve-2025-23048-poc

Apache HTTP Server versions 2.4.35 – 2.4.63 are vulnerable to a client certificate authentication bypass when TLS 1.3 session resumption is used…

authenticationexploitationpenetration-testing+3

411 months ago

axios-CVE-2025-27152-PoC

davidblakecoe/axios-cve-2025-27152-poc

Proof-of-concept exploit for CVE-2025-27152 in Axios, demonstrating a server-side request forgery vulnerability in the popular HTTP client library.

exploitationpayload-developmentpenetration-testing+2

1 year ago

CVE-2026-66746-HTTP-Response-Splitting-via-Unvalidated-Response-Header-Values-rouille-

theopaid/cve-2026-66746-http-response-splitting-via-unvalidated-response-header-values-rouille-

Security Advisory: HTTP Response Splitting via Unvalidated Response Header Values (rouille)

code-analysispenetration-testingvulnerability-analysis+2

1 month ago

Qlik-View-12.60-Including-SR-Stored-Cross-Site-Scripting-CVE-2022-42248

ozozuz/qlik-view-12.60-including-sr-stored-cross-site-scripting-cve-2022-42248

Proof-of-concept exploit for CVE-2022-42248, a stored cross-site scripting vulnerability in QlikView Ajax Client allowing remote attackers to execute…

exploitationinformation-gatheringpenetration-testing+3

54 months ago

CVE-2026-49365

oscerd/cve-2026-49365

PoC reproducer for CVE-2026-49365 (Apache Camel camel-netty-http / camel-undertow): muteException defaults to false, so an uncaught exception's full…

educationexploitationinformation-gathering+3

1 month ago

CVE-2022-0155-PoC

coana-tech/cve-2022-0155-poc

Proof-of-concept demonstrating CVE-2022-0155 cookie theft via HTTP redirect in follow-redirects npm package, including Express server and client…

exploitationpayload-generationpenetration-testing+2

2 years ago