Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

254 results

CVE-2024-4157-SSRF-RCE-Reverse-Shell

ch4os1/cve-2024-4157-ssrf-rce-reverse-shell

Chaining Havoc C2 SSRF with RCE to get reverse shell on Havoc C2 Server.

command-and-controlexploitationpayload-development+3

1 year ago

CVE-2025-26244

jarm222/cve-2025-26244

The graph functionality of DeimosC2 v1.1.0-Beta is vulnerable to Stored Cross-Site Scripting (XSS), allowing the theft of session cookie and…

command-and-controlexploitationpayload-development+4

1 year ago

CVE-2026-34621

azefzafyoussef/cve-2026-34621

Research PoC demonstrating a prototype pollution and JavaScript injection chain in Adobe Acrobat Reader, enabling privileged JavaScript execution and…

binary-exploitationeducationexploitation+5

265 months ago

CVE-2022-30190

yrkuo/cve-2022-30190

Step-by-step reproduction guide for CVE-2022-30190 (Follina) MSDT remote code execution vulnerability, including malicious document creation and C2…

educationexploitationlabs-practice+3

3 years ago

Cerberus-React2Shell-Scanner-Exploit

cerberusmrxi/cerberus-react2shell-scanner-exploit

Elite exploitation toolkit for CVE-2025-55182 (React Server Components RCE). Async polymorphic payloads, advanced WAF/CDN bypass, proxy rotation,…

command-and-controleducationexploit-frameworks+9

22 months ago

Sandbox-Challenge-Spring4Shell-CVE-2022-22965-

felisha-elmer/sandbox-challenge-spring4shell-cve-2022-22965-

Step-by-step walkthrough of exploiting CVE-2022-22965 (Spring4Shell) with Metasploit, deploying a C2 listener, and mitigating the vulnerability by…

command-and-controlctfeducation+6

5 months ago

msdt-follina

johnhammond/msdt-follina

Generates a malicious Microsoft Word document exploiting the MS-MSDT 'Follina' vulnerability to execute arbitrary commands or stage payloads via an…

command-and-controlexploitationpayload-development+2

1.6k4 years ago

CVE-2022-30190-follina-Office-MSDT-Fixed

komomon/cve-2022-30190-follina-office-msdt-fixed

Modified CVE-2022-30190 exploit tool for MS-MSDT Office RCE with custom docx template support, binary/command execution modes, and embedded HTTP…

command-and-controlexploitationpayload-generation+3

3903 years ago

CVE-2021-36260

aiminsun/cve-2021-36260

command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the…

command-and-controlexploitationpenetration-testing+3

3054 years ago

POC-CVE-2025-24813

absholi7ly/poc-cve-2025-24813

his repository contains an automated Proof of Concept (PoC) script for exploiting **CVE-2025-24813**, a Remote Code Execution (RCE) vulnerability in…

exploitationpayload-developmentpenetration-testing+3

1951 year ago

webhandler

lnxg33k/webhandler

Bash simulator to control a server using PHP system functions.

command-and-controlids-ips-evasionpayload-generation+3

1005 years ago

CVE-2023-36745

n1k0la-t/cve-2023-36745

Proof-of-concept exploit for Microsoft Exchange Server RCE vulnerability CVE-2023-36745, enabling remote code execution via authenticated PowerShell…

command-and-controlexploitationpayload-generation+3

1682 years ago

CVE-2018-3191

jas502n/cve-2018-3191

Exploit for CVE-2018-3191 targeting Oracle WebLogic Server via T3 protocol, enabling unauthenticated remote code execution with JNDI payload…

command-and-controlexploitationpayload-generation+3

687 years ago

CVE-2024-22120-RCE

w01fh4cker/cve-2024-22120-rce

Time Based SQL Injection in Zabbix Server Audit Log --> RCE

exploitationpenetration-testingred-teaming+2

1372 years ago

CVE-2020-2551

jas502n/cve-2020-2551

Proof-of-concept exploit for CVE-2020-2551, demonstrating remote code execution in Oracle WebLogic Server via the IIOP protocol. Includes default…

exploitationpenetration-testingred-teaming+2

806 years ago

CVE-2021-26084

dinhbaouit/cve-2021-26084

Exploit for CVE-2021-26084 targeting Confluence Server OGNL injection vulnerability for unauthenticated remote code execution.

exploitationpenetration-testingred-teaming+2

535 years ago

CVE-2024-27348

zeyad-azima/cve-2024-27348

Apache HugeGraph Server RCE Scanner ( CVE-2024-27348 )

command-and-controlexploitationpenetration-testing+3

602 years ago

CVE-2025-55182-scanner

fatguru/cve-2025-55182-scanner

A non-intrusive surface scanner for CVE-2025-55182 (React Server Components RCE). Detects exposed RSC endpoints in React 19 and Next.js applications

exploitationpenetration-testingred-teaming+4

11010 months ago

Previous12…15 Next