Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories

Tools

AllAndroid SecurityAuthentication & AuthorizationCloud Infrastructure SecurityDefensive ToolsDisk ForensicsEmbedded Systems SecurityGeneral Purpose UtilitiesIndicator of Compromise (IOC) ManagementOSINT (Open Source Intelligence)Packet Sniffing & AnalysisPassword CrackingPenetration Testing FrameworksPhishing ToolsPrivilege EscalationReconnaissanceStatic AnalysisVulnerability ScannersWeb Vulnerability ScannersWi-Fi AuditingBluetooth SecurityContainer SecurityDynamic Analysis (Sandboxing)Encryption/Decryption ToolsExploit FrameworksIdentity ManagementiOS SecurityIoT SecurityMemory ForensicsNetwork MappingOSINT for Social EngineeringPassword AttacksPayload GenerationPersistence MechanismsPort ScanningStatic Code Analysis (SAST)Threat Feeds & AggregatorsVulnerability AnalysisWeb Proxies & InterceptionCode AnalysisDNS & Subdomain EnumerationDynamic Code Analysis (DAST)ExploitationHash AnalysisIDS/IPS EvasionImpersonation ToolsLateral MovementMobile App PentestingNetwork ForensicsReverse EngineeringRFID/NFC ToolsSCADA/ICS SecurityScripting & AutomationServerless SecurityShellcodeWeb Application ExploitationAPI Security TestingConfiguration AuditingData ExfiltrationDebuggersForensicsInformation GatheringMobile ForensicsNetwork Access ControlPost-ExploitationSecurity VirtualizationPhishingWAF BypassWeb SecurityFuzzingNetwork SecuritySteganographyWireless SecurityData RecoveryMalware AnalysisDigital ForensicsHardware HackingCryptographyCTFPenetration TestingCloud SecurityDevSecOpsMobile SecurityPrivacyCommand and ControlSocial EngineeringHardware SecurityUtilities & FrameworksHardware & IoT SecuritySecret DetectionBinary AnalysisThreat IntelligenceIdentity & Access Management (IAM)Supply Chain SecurityAuthenticationMachine LearningIntrusion DetectionPapers & ResearchMisconfigurationSubdomain EnumerationEmail HarvestingLearning & EducationAI-Assisted ReversingDNS FuzzingRed TeamingIncident ResponseCrawlerCurated ResourcesRemote Access ToolShellcode GenerationPayload DevelopmentRemote Access TrojanAPI SecurityAnti-BotFingerprint SpoofingCAPTCHA BypassEmail SecurityDNS AnalysisChaos EngineeringLearning Paths & CoursesContainer EscapeAI SecurityDatabase SecurityFirmware AnalysisAnomaly DetectionLog AnalysisAdversarial AttackBinary ExploitationLabs & Practice
NewestRelevanceMost popularRecently updated
416 results
Vega preview

Vega

GitHubsubgraph/vega

Open-source web application security scanner with automated vulnerability detection, proxy interception, and SSL/TLS testing for penetration testers…

api-security-testingdynamic-analysis-sandboxingpenetration-testing+3
362
10 years ago
BurpSuite_Pro_v1.7.37 preview

BurpSuite_Pro_v1.7.37

GitHubjas502n/burpsuite_pro_v1.7.37

Comprehensive web application security testing platform featuring advanced scanning engine, intercepting proxy, and automated vulnerability detection…

api-security-testinginformation-gatheringpenetration-testing+4
567 years ago
Moxy preview

Moxy

GitHubmatank001/moxy

Open-source DAST proxy with agentic AI for intercepting, modifying, and replaying HTTP/HTTPS traffic. Automates web application security testing via…

ai-securityapi-security-testingdynamic-analysis-sandboxing+9
1197 months ago
WhatWeb preview

WhatWeb

GitHuburbanadventurer/whatweb

Web technology identification scanner with 1800+ plugins for detecting CMS, servers, JS libraries, and embedded devices. Supports stealthy to…

crawlerdynamic-code-analysisinformation-gathering+9
6.8k4 months ago
CVE-2018-19131 preview

CVE-2018-19131

GitHubjonathanwilbur/cve-2018-19131

Proof-of-concept exploit demonstrating cross-site scripting (XSS) in Squid Proxy 3.5.27 via malicious X.509 certificate commonName field, with Docker…

exploitationvulnerability-analysisweb-application-exploitation+1
187 years ago
nikto preview

nikto

GitHubsullo/nikto

Perl-based web server scanner that performs comprehensive vulnerability checks, CGI scanning, and server fingerprinting with customizable plugins and…

crawlerdynamic-code-analysisinformation-gathering+6
10.7k10 days ago
coraza preview

coraza

GitHubcorazawaf/coraza

Go-based Web Application Firewall library compatible with ModSecurity SecLang rules and OWASP Core Rule Set v4, providing real-time HTTP traffic…

api-securityapi-security-testingdefensive-tools+7
3.8k1h 9m ago
XSStrike preview

XSStrike

GitHubs0md3v/xsstrike

Advanced XSS detection suite with context-aware payload generation, multi-threaded crawling, WAF evasion, and DOM scanning for automated web security…

crawlerdynamic-code-analysisfuzzing+8
15.1k1 year ago
wafw00f preview

wafw00f

GitHubenablesecurity/wafw00f

Automated Web Application Firewall fingerprinting tool that identifies and detects over 200 WAF products by analyzing HTTP responses to normal and…

crawlerdynamic-code-analysisinformation-gathering+6
6.5k4 months ago
waf-checker preview

waf-checker

GitHubpapamica/waf-checker

Web application firewall testing tool with 344+ attack payloads, auto WAF detection, bypass techniques, and full reconnaissance including DNS,…

api-security-testingdns-analysisids-ips-evasion+8
5535 months ago
DVSA preview

DVSA

GitHubowasp/dvsa

a Damn Vulnerable Serverless Application

api-security-testingcloud-infrastructure-securitycloud-security+6
5452 years ago
Tiredful-API preview

Tiredful-API

GitHubpayatu/tiredful-api

An intentionally designed broken web application based on REST API.

api-security-testingeducationlabs-practice+2
5845 years ago
dvcsharp-api preview

dvcsharp-api

GitHubappsecco/dvcsharp-api

Deliberately vulnerable C# API application for practicing web application security testing, exploitation techniques, and vulnerability analysis in a…

api-security-testingeducationlabs-practice+3
852 years ago
BurpSentinel preview

BurpSentinel

GitHubdobin/burpsentinel

GUI Burp Plugin to ease discovering of security holes in web applications

dynamic-code-analysispenetration-testingvulnerability-analysis+3
1539 years ago
toolbox preview

toolbox

GitHubgo-appsec/toolbox

Collaborative application security testing between humans and agents via CLI and MCP

api-security-testingcrawlerdynamic-analysis-sandboxing+8
412 days ago
svja preview

svja

GitHubtheronielanddaronpodcastshow/svja

Apache Struts application intentionally packed with realistic, complex vulnerabilities for security training and penetration testing practice,…

api-security-testingauthentication-authorizationeducation+5
137 months ago
CVE-2015-9251 preview

CVE-2015-9251

GitHubhalkichi0308/cve-2015-9251

Proof-of-concept exploit for CVE-2015-9251, demonstrating a specific web application vulnerability with minimal code for testing and verification.

exploitationvulnerability-analysisweb-application-exploitation
98 years ago
CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille- preview

CVE-2026-67181-HTTP-Request-Smuggling-via-Transfer-Encoding-Desynchronization-rouille-

GitHubtheopaid/cve-2026-67181-http-request-smuggling-via-transfer-encoding-desynchronization-rouille-

Security advisory and PoC for HTTP request smuggling (CVE-2026-67181) due to Transfer-Encoding desynchronization in rouille's proxy module.

exploitationvulnerability-analysisweb-application-exploitation+1
27 days ago
Previous12…24Next