Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

89 results

CVE-2026-13001

byt3l0rd/cve-2026-13001

Exploit for CVE-2026-13001, an unauthenticated arbitrary file upload in Podlove Podcast Publisher WordPress plugin, enabling remote code execution…

exploitationpayload-developmentpenetration-testing+4

1 day ago

yLog4j

y-security/ylog4j

PortSwigger Burp Plugin for the Log4j (CVE-2021-44228)

api-security-testingexploitationpenetration-testing+2

24 years ago

CVE-2026-0740

xshadow-here/cve-2026-0740

Automated mass exploiter for CVE-2026-0740, an unauthenticated arbitrary file upload in Ninja Forms File Uploads plugin, enabling remote code…

exploitationpayload-generationpenetration-testing+3

34 months ago

Mass-CVE-2026-23550-Exploit

dzmind2312/mass-cve-2026-23550-exploit

Multi-threaded Python scanner for CVE-2026-23550, detecting unauthenticated admin takeover in WordPress Modular DS plugin with full wp-admin…

exploitationinformation-gatheringpenetration-testing+3

26 months ago

CYBERDUDEBIVASH-Modular-DS-CVE-2026-23550-Detector

cyberdudebivash/cyberdudebivash-modular-ds-cve-2026-23550-detector

authorized CYBERDUDEBIVASH ECOSYSTEM tool for detecting CVE-2026-23550 in WordPress Modular DS plugin

information-gatheringthreat-intelligencevulnerability-scanners+1

17 months ago

Ashwesker-CVE-2026-21962

boroeurnprach/ashwesker-cve-2026-21962

Exploit PoC and Nuclei template for CVE-2026-21962, a critical unauthenticated remote code execution in Oracle HTTP Server and WebLogic Proxy…

exploitationpayload-developmentpenetration-testing+3

57 months ago

CVE-2026-3228

null200ok/cve-2026-3228

Scans and exploits CVE-2026-3228, a stored XSS in NextScripts WordPress plugin, with pre-auth detection, authenticated checks, and payload injection…

exploitationpayload-developmentpenetration-testing+3

25 months ago

Exploit-CVE-2026-1357

itsismarcos/exploit-cve-2026-1357

Exploit for CVE-2026-1357 in WordPress WPVivid plugin, enabling remote code execution via crafted AES-encrypted payloads and directory traversal to…

exploitationpayload-developmentpenetration-testing+2

16 months ago

CVE-2026-1306

murrez/cve-2026-1306

Multi-target PoC runner for CVE-2026-1306 in WordPress midi-Synth plugin: fetches nonce, sends export AJAX request to upload files, and verifies…

exploitationpayload-generationpenetration-testing+3

4 months ago

CVE-2026-11961

johenlastgen-jlg/cve-2026-11961

CVE-2026-11961 — UserRegistration: WordPress User Registration <= 5.2.2 Privilege Escalation. Misconfigured Membership Roles → Unauthenticated Admin…

exploitationinformation-gatheringmisconfiguration+5

128 days ago

CVE-2026-49049

jenderal92/cve-2026-49049

Mass vulnerability scanner for CVE-2026-49049 – Unauthenticated Remote Code Execution in Joomla Helix3 plugin. Multi‑threaded, detects both executed…

exploitationpayload-generationpenetration-testing+4

11 month ago

super-secret-finder

randomrobbiebf/super-secret-finder

Burp Plugin for Secret Matching

api-securityinformation-gatheringpenetration-testing+3

63 years ago

AMFDSer-ngng

nccgroup/amfdser-ngng

A Burp Extender plugin, that will take deserialized AMF objects and encode them in XML using the Xtream library

api-security-testingdynamic-analysis-sandboxingpenetration-testing+3

2711 years ago

trivy-plugin-kubectl

aquasecurity/trivy-plugin-kubectl

A Trivy plugin that scans the images of a kubernetes resource

cloud-securitycontainer-securitydevsecops+1

252 years ago

CVE-2026-3584

yucaerin/cve-2026-3584

CVE-2026-3584

exploitationinformation-gatheringpayload-development+5

5 months ago

trivy-plugin-aqua

aquasecurity/trivy-plugin-aqua

Plugin for integrating Trivy with Aqua Security platform to scan IaC, pipelines, and dependencies for vulnerabilities and misconfigurations.

cloud-infrastructure-securityconfiguration-auditingdevsecops+2

1411 days ago

CVE-2026-4106

ef3tr/cve-2026-4106

WordPress HTMega Unauthenticated PII Disclosure Exploit (CVE-2026-4106)

educationexploitationinformation-gathering+6

14 months ago

CVE-2026-2942

xxconi/cve-2026-2942

Automated scanner for unauthenticated arbitrary file upload and remote code execution in ProSolution WP Client (CVE-2026-2942). Supports…

educationexploitationpayload-development+3

3 months ago

Previous12 3 4 5 Next