Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

50 results

CVE-2022-41401

ixsly/cve-2022-41401

Proof-of-concept exploit for CVE-2022-41401, a server-side request forgery (SSRF) vulnerability in OpenRefine <= v3.5.2, enabling unauthorized…

exploitationinformation-gatheringpenetration-testing+2

3 years ago

corsair_scan

santandersecurityresearch/corsair_scan

Automated CORS misconfiguration scanner that tests Origin header injection, wildcard reflection, and credential leakage across web applications and…

api-security-testingmisconfigurationvulnerability-scanners+1

1225 years ago

lorsrf

mindpatch/lorsrf

Fast CLI tool to find the parameters that can be used to find SSRF or Out-of-band resource load :artificial_satellite: :crab:

fuzzingpenetration-testingvulnerability-scanners+1

2972 years ago

Resources-for-Beginner-Bug-Bounty-Hunters

nahamsec/resources-for-beginner-bug-bounty-hunters

A list of resources for those interested in getting started in bug bounties

ctfcurated-resourceseducation+6

12.2k2 years ago

JShunter

cc1a2b/jshunter

jshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive…

api-securitydynamic-code-analysispenetration-testing+6

5291 month ago

Bug-Bounty-Beginner-Roadmap

bittentech/bug-bounty-beginner-roadmap

This is a resource factory for anyone looking forward to starting bug hunting and would require guidance as a beginner.

ctfcurated-resourceseducation+7

2.4k2 years ago

CVE-2026-72001-Pangolin-Cross-Org-Auth-Bypass

biitts/cve-2026-72001-pangolin-cross-org-auth-bypass

PoC for CVE-2026-72001 — Pangolin < 1.22.0 cross-organization resource authentication bypass via the share-link access-token endpoint (CWE-639, CVSS…

authenticationexploitationinformation-gathering+4

1 month ago

Project-CVE-2026-65351

e4zyy/project-cve-2026-65351

Browser resource exhaustion payload that crashes target systems via memory, GPU, audio, and rendering overload. Designed for authorized security…

exploitationred-teamingvulnerability-analysis+1

2 months ago

all-my-collection-repos

alphaseclab/all-my-collection-repos

All Security Resource Collections Repos That I Published.

curated-resourceseducationforensics+6

1336 years ago

CorsMe

shivangx01b/corsme

Cross Origin Resource Sharing MisConfiguration Scanner

misconfigurationpenetration-testingvulnerability-scanners+1

1705 years ago

Learn-Web-Hacking

lylemi/learn-web-hacking

Structured study notes covering web hacking fundamentals, common vulnerabilities, penetration testing techniques, and defensive security, with…

curated-resourceseducationlearning-paths-courses+2

5.5k2 months ago

CVE-2025-69848-security-advisories

alkimcoskun/cve-2025-69848-security-advisories

Security advisory for CVE-2025-69848 – Reflected XSS in NetBox ProtectedError handling

curated-resourcesvulnerability-analysisweb-security

9 months ago

CORStest

rub-nds/corstest

A simple CORS misconfiguration scanner

misconfigurationpenetration-testingvulnerability-scanners+1

4246 years ago

svg-sanitizer

borewit/svg-sanitizer

Java library that sanitizes SVG files by stripping JavaScript, inline event handlers, and script tags while blocking external resource loading to…

code-analysisdefensive-toolsstatic-analysis+2

27 days ago

theftfuzzer

lc/theftfuzzer

TheftFuzzer is a tool that fuzzes Cross-Origin Resource Sharing implementations for common misconfigurations.

fuzzingmisconfigurationvulnerability-scanners+1

3197 years ago

XSSight

nu11secur1ty/xssight

Educational resource on Cross-site Scripting (XSS) attack techniques, covering non-persistent, persistent, and DOM-based vectors with practical…

educationinformation-gatheringpenetration-testing+3

101 month ago

CVE-2024-27316_poc

aeyesec/cve-2024-27316_poc

Proof-of-concept exploit for CVE-2024-27316, an HTTP/2 CONTINUATION flood vulnerability in Apache httpd, demonstrating resource exhaustion via…

exploitationfuzzingvulnerability-analysis+1

22 years ago

CVE-2026-11118-HTTP-2-Rapid-Reset-DDoS

george0papasotiriou/cve-2026-11118-http-2-rapid-reset-ddos

Python PoC for CVE-2026-11118 demonstrating HTTP/2 Rapid Reset DDoS via RST_STREAM resource exhaustion; includes vulnerable server simulator and…

exploitationnetwork-securityvulnerability-analysis+1

3 months ago

Previous12 3 Next