Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

339 results

CVE-2026-3395-Lab

rootdirective-sec/cve-2026-3395-lab

Educational Docker lab demonstrating CVE-2026-3395, an unauthenticated RCE in MaxSite CMS via the run_php plugin, with vulnerable and patched…

educationexploitationlabs-practice+2

5 months ago

CVE-2018-16763_fuel_cms_exploit

gh0stuncle/cve-2018-16763_fuel_cms_exploit

A fuel CMS exploit based on Python for RCE mentioned in CVE-2018-16763.

ctfeducationexploitation+3

3 days ago

CVE-2026-25099

yahiahamza/cve-2026-25099

Python exploit for Bludit CMS API unrestricted file upload leading to remote code execution, providing command execution and interactive shell for…

exploitationpayload-developmentpenetration-testing+3

5 months ago

CVE-2026-29053

rootxran/cve-2026-29053

Proof-of-concept exploit for Ghost CMS remote code execution via prototype pollution in jsonpath and static-eval, with a vulnerable environment setup…

exploitationpayload-developmentpenetration-testing+2

5 months ago

CVE-2026-29598

padayali-jd/cve-2026-29598

Proof-of-concept for a stored XSS vulnerability in cm3 Acora CMS 10.7.1, demonstrating script injection via user management endpoints.

exploitationpenetration-testingvulnerability-analysis+2

5 months ago

CVE-2026-29597

padayali-jd/cve-2026-29597

Demonstrates an improper access control vulnerability in DDSN Interactive cm3 Acora CMS 10.7.1, allowing editor-privileged users to retrieve…

exploitationinformation-gatheringpenetration-testing+2

5 months ago

CVE-2026-3395-MaxSite-CMS-Unauthenticated-RCE

mbanyamer/cve-2026-3395-maxsite-cms-unauthenticated-rce

Proof-of-concept exploit for unauthenticated remote code execution in MaxSite CMS <= 109.1 via MarkItUp editor AJAX endpoints, with detection and…

educationexploitationpenetration-testing+3

56 months ago

CVE-2025-10353-POC

ivansmc/cve-2025-10353-poc

Exploit for CVE-2025-10353. Unauthenticated File Upload on Melis Platform Framework that leads to RCE

exploitationpayload-generationpenetration-testing+2

110 months ago

CVE-2026-31891

ffasterss/cve-2026-31891

SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()

database-securityexploitationpenetration-testing+3

5 months ago

ghost-cve-2026-26980

dinosn/ghost-cve-2026-26980

CVE-2026-26980 — Ghost CMS Content API SQL Injection Lab (unauthenticated blind SQLi via slug filter ordering)

database-securityeducationexploitation+5

164 months ago

CVE-2026-1953

dewaguard-red-team/cve-2026-1953

Stored cross-site scripting (XSS) vulnerability in the edit profile feature at Nukegraphic CMS V3.1.2

exploitationpenetration-testingvulnerability-analysis+2

26 months ago

CVE-2026-41177-Squidex-CMS

turkios/cve-2026-41177-squidex-cms

CVE-2026-41177, a Blind SSRF vulnerability in Squidex CMS (prior to v7.23.0). Includes root cause analysis, reproduction steps, and impact assessment…

educationexploitationvulnerability-analysis+1

4 months ago