Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

293 results

CVE-2026-55200

xd20111/cve-2026-55200

Detailed analysis of a critical pre-authentication out-of-bounds write vulnerability in libssh2 leading to remote code execution, with root cause,…

binary-analysiseducationexploitation+3

1 month ago

vulnerable-mcp-servers-lab

appsecco/vulnerable-mcp-servers-lab

A collection of servers which are deliberately vulnerable to learn Pentesting MCP Servers.

ai-securitycode-analysiseducation+7

2768 months ago

react-cve-2025-55182

amir-malek/react-cve-2025-55182

code-analysisdevsecopseducation+3

8 months ago

PHP-8.1.0-dev-Backdoor

k3ystr0k3r/php-8.1.0-dev-backdoor

PHP 8.1.0-dev User-Agentt Backdoor Remote Code Execution (RCE)

exploitationpayload-developmentsupply-chain-security+3

11 month ago

CVE-2018-6574

devang-solanki/cve-2018-6574

Exploit for remote command execution in Golang go get command.

binary-exploitationexploitationpayload-development+3

14 years ago

CVE-2026-23001-Hugging-Face-Transformers-Model-Deserialization-Arbitrary-Code-via-Pickle-

george0papasotiriou/cve-2026-23001-hugging-face-transformers-model-deserialization-arbitrary-code-via-pickle-

ai-securityexploitationpayload-generation+1

14 days ago

react2shell-scanner

nxgn-kd01/react2shell-scanner

Detect CVE-2025-55182 (React2Shell) RCE vulnerability in React Server Components. Fast, accurate scanner with zero false positives.

code-analysisdevsecopsexploitation+3

37 months ago

CVE-2024-5082

h4mr3r/cve-2024-5082

Sonatype Nexus 2 - Authorized RCE POC

exploitationpayload-developmentpenetration-testing+3

1 month ago

jsonorg-fn1

scabench/jsonorg-fn1

simple application with a CVE-2022-45688 vulnerability

code-analysiseducationmisconfiguration+3

12 years ago

jsonorg-tp1

scabench/jsonorg-tp1

simple application with a CVE-2022-45688 vulnerability

code-analysiseducationstatic-analysis+2

2 years ago

guarddog

datadog/guarddog

🐍 🔍 GuardDog is a CLI tool to Identify malicious PyPI and npm packages

code-analysisdevsecopsdynamic-analysis-sandboxing+6

1.2k1 day ago

packj

ossillate-inc/packj

Static and dynamic analysis tool that audits open-source packages for malicious, vulnerable, and risky attributes, with sandboxed installation to…

devsecopsdynamic-analysis-sandboxingmalware-analysis+3

6914 months ago

hotpatch-for-apache-log4j2

corretto/hotpatch-for-apache-log4j2

An agent to hotpatch the log4j RCE from CVE-2021-44228.

defensive-toolsexploitationincident-response+2

4973 years ago

ElfDoor-gcc

matheuzsecurity/elfdoor-gcc

LD_PRELOAD-based tool that hijacks gcc to inject malicious code into binaries during linking, enabling stealthy backdoor deployment without source…

binary-exploitationpersistence-mechanismssupply-chain-security

1331 year ago

Creosote

advanced-threat-research/creosote

Creosote is our solution to searching for the tarfile vulnerability described by CVE-2007-4559.

code-analysismisconfigurationstatic-code-analysis+3

823 years ago

log4noshell

winnpixie/log4noshell

A Java Agent that disables Apache Log4J's JNDI Lookup to mitigate CVE-2021-44228 ("Log4Shell").

defensive-toolsexploitationincident-response+2

513 days ago

SafeForge

roxanne_ardary/safeforge

SafeForge is an open-source mobile app hub built on GitLab that enables developers to build, upload, and share applications in a secure, AI-verified…

ai-securitydynamic-analysis-sandboxingeducation+8

10 days ago

CVE-2024-24590

junnythemarksman/cve-2024-24590

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously…

exploitationpayload-generationpenetration-testing+3

12 years ago

Previous12…17 Next