Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

121 results

CVE-2026-29053

k3ystr0k3r/cve-2026-29053

Python PoC and version scanner for CVE-2026-29053, an authenticated RCE in Ghost CMS below 6.19.1 via malicious Handlebars theme templates.

exploitationpayload-developmentpenetration-testing+5

6 days ago

CVE-2023-4762

zined/cve-2023-4762

Proof-of-concept exploit for CVE-2023-4762, a Chromium V8 type confusion vulnerability enabling remote code execution via crafted JavaScript.

exploitationpenetration-testingvulnerability-analysis+2

3 years ago

CVE-2025-58434

r3vpwnx/cve-2025-58434

Exploit chain for Flowise 3.0.5: unauthenticated account takeover via password-reset token disclosure (CVE-2025-58434) chained to CustomMCP…

authenticationexploitationpenetration-testing+3

24 days ago

CVE-2026-30251

venablee/cve-2026-30251

Reflected XSS vulnerability disclosure for ZenShare Suite login_newpwd.php, allowing arbitrary JavaScript execution via crafted URL in codice_azienda…

exploitationpenetration-testingvulnerability-analysis+2

1 month ago

CVE-2026-27574-OneUptime-RCE

mbanyamer/cve-2026-27574-oneuptime-rce

Proof-of-concept exploit for CVE-2026-27574, a critical code injection in OneUptime enabling remote code execution and environment variable leakage.

exploitationpayload-developmentpenetration-testing+3

17 months ago

cve-2024-21683-rce

r3db34rdh4x/cve-2024-21683-rce

Exploit for CVE-2024-21683, a post-authentication remote code execution vulnerability in Atlassian Confluence Server and Data Center, allowing…

exploitationpenetration-testingred-teaming+2

1 year ago

CVE-2026-23830-SandBreak

galaxy-sc/cve-2026-23830-sandbreak

Generates and delivers exploit payloads for CVE-2026-23830, a SandboxJS escape, with modes for blind OOB exfiltration and local calc PoC. Supports…

exploitationpayload-generationpenetration-testing+3

17 months ago

CVE-2026-22444

bfdfhdsfdd-crypto/cve-2026-22444

Exploit for Apache Solr CVE-2026-22444, leveraging UNC path injection and SMB server to achieve remote code execution via malicious configset and…

exploitationpenetration-testingred-teaming+3

8 months ago

Wildfire

defineid/wildfire

CVE-2026-39154, Stored XSS in CometChat JS SDK

api-securityexploitationpayload-development+4

1 month ago

CVEX2SHEL

alixploit22/cvex2shel

CVE-2026-64638 adalah kerentanan Pre-Auth Reflected Cross-Site Scripting (XSS) di WordPress yang ditemukan pada tahun 2026. Kerentanan ini…

exploitationpenetration-testingvulnerability-analysis+2

1 month ago

Injection-vulnerability-in-Paradox-Security-Systems-IPR512-CVE-2023-24709-PoC

darknesschieftain/injection-vulnerability-in-paradox-security-systems-ipr512-cve-2023-24709-poc

In Paradox Security System IPR512 Web console login form page, attacker can input JavaScript string, such as "</script>" that will overwrite…

exploitationiot-securitypenetration-testing+3

3 years ago

XSSFire

seifelsallamy/xssfire

A standalone Blind XSS Script.

data-exfiltrationexploitationinformation-gathering+3

471 year ago

CVE-2026-67340_exploit

0xdak/cve-2026-67340_exploit

Post-auth RCE exploit for ArcadeDB via JavaScript trigger GraalVM sandbox escape, executing OS commands over HTTP API with reverse shell or blind…

database-securityexploitationpenetration-testing+1

1 month ago

nodejsshell

h3x0v3rl0rd/nodejsshell

Node.js reverse shell payload generator for penetration testing. Creates bind and reverse shells in JavaScript.

exploitationpayload-generationpenetration-testing+4

1 year ago

Nextjs_Exploit_Tool

se1zer/nextjs_exploit_tool

Next.js RSC RCE Exploit Tool (CVE-2025-55182)

command-and-controlexploitationpayload-generation+5

52 months ago

wp2shell-poc-fulljs

raphy76/wp2shell-poc-fulljs

full javascript reproduction of CVE-2026-63030 (author_exclude, author__not_in and misalignment between validations and matches)

exploitationpayload-generationpenetration-testing+2

2 months ago

CVE-2025-44998

l8bl/cve-2025-44998

Proof-of-concept exploit for a stored XSS vulnerability in TinyFileManager v2.4.7, enabling arbitrary JavaScript execution and session cookie…

exploitationinformation-gatheringpenetration-testing+3

1 year ago

CVE-2023-34599

maddsec/cve-2023-34599

Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript…

exploitationpenetration-testingvulnerability-analysis+2

33 years ago

Previous12 3 4 5 6 7 Next