Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

82 results

CVE-2025-50754-PoC

furk4nyildiz/cve-2025-50754-poc

Stored XSS in a CMS platform leads to remote code execution (CVE-2025-50754)

exploitationpayload-developmentpenetration-testing+3

1 year ago

CVE-2026-25769

njeru-codes/cve-2026-25769

POC for deserialization of untrusted data in wazuh leading to RCE

exploitationpenetration-testingvulnerability-analysis+1

5 months ago

CVE-2025-24813

muhammadwaseem29/cve-2025-24813

Apache Tomcat is vulnerable to a Path Equivalence / Path Traversal issue due to improper handling of ../ sequences in paths.

educationexploitationpenetration-testing+3

21 year ago

CVE-2026-25769

hakaioffsec/cve-2026-25769

Remote Code Execution via Insecure Deserialization in Wazuh Cluster

educationexploitationpenetration-testing+2

416 months ago

CVE-2017-12635

assalielmehdi/cve-2017-12635

Case study and POC of CVE-2017-12635: Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation

database-securityeducationexploitation+4

106 years ago

React2Shell-CVE-2025-55182

adityabhatt3010/react2shell-cve-2025-55182

React2Shell CVE-2025-55182: unauthenticated unsafe deserialization in React Server Components leading to reliable remote code execution via the…

code-analysisctfeducation+6

72 months ago

CVE-2025-64446-PoC---FortiWeb-Path-Traversal

fevar54/cve-2025-64446-poc---fortiweb-path-traversal

Proof-of-concept exploit and detection scanner for CVE-2025-64446, a critical path traversal vulnerability in Fortinet FortiWeb allowing remote…

educationexploitationpenetration-testing+3

710 months ago

mgo3-rce

alicealys/mgo3-rce

Proof-of-concept remote code execution exploit for CVE-2026-19874 in Metal Gear Online 3, with documentation and video demo for academic research.

educationexploitationvulnerability-analysis+1

31 month ago

CVE-2026-38526-KrayinCRM

ish3ng0m4/cve-2026-38526-krayincrm

Authenticated Arbitrary File Upload leading to Remote Code Execution Technical analysis and controlled reproduction of CVE-2026-38526 in Webkul…

educationexploitationpapers-research+5

10 days ago

CVE-2026-19912-CVE-2026-19913-CVE-2026-19914

horkimhab/cve-2026-19912-cve-2026-19913-cve-2026-19914

Proof-of-concept exploits for CVE-2026-19912, CVE-2026-19913, and CVE-2026-19914, demonstrating file read and remote code execution in Kaltura,…

educationexploitationpenetration-testing+3

1 month ago

CVE-2026-3844

dinosn/cve-2026-3844

Proof-of-concept exploit for CVE-2026-3844, an unauthenticated arbitrary file upload leading to remote code execution in Breeze Cache <= 2.4.4.…

educationexploitationpenetration-testing+3

55 months ago

CVE-2026-63223-POC

imbas007/cve-2026-63223-poc

CVE-2026-63223 PoC — CodeIgniter 4 is_image/mime_in File Upload RCE (CVSS 9.8). Unauthenticated remote code execution via unrestricted file upload…

educationexploitationlabs-practice+5

31 month ago

wp2shell-Wordpress-TOWN

lucifer0xf/wp2shell-wordpress-town

Unauthenticated Remote Code Execution (RCE) in WordPress Core allows attackers to execute arbitrary code without logging in by chaining…

code-analysisctfeducation+3

22 months ago

CVE-2025-33053-WebDAV-RCE-PoC-and-C2-Concept

kra1t0/cve-2025-33053-webdav-rce-poc-and-c2-concept

Proof-of-Concept for CVE-2025-33053 Exploiting WebDAV with .url file delivery to demonstrate realistic remote code execution. Includes a decoy PDF…

command-and-controleducationexploitation+5

31 year ago

CVE-2026-5029-Exploit

0x00phantom-hat/cve-2026-5029-exploit

Proof-of-concept exploit for CVE-2026-5029, delivering unauthenticated remote code execution via the run-code MCP tool on exposed HTTP endpoints.…

code-analysiseducationexploitation+3

2 months ago

CVE-2026-11104-Python-SSTI-via-Jinja2-attr-Filter-Bypass

george0papasotiriou/cve-2026-11104-python-ssti-via-jinja2-attr-filter-bypass

PoC exploit for CVE-2026-11104 demonstrating Jinja2 attr filter bypass in Flask, enabling server-side template injection and remote code execution.

educationexploitationpenetration-testing+3

1 month ago

CVE-2026-33937

eqstlab/cve-2026-33937

Handlebars.js AST Injection Remote Code Execution Vulnerability

educationexploitationlabs-practice+5

25 months ago

CVE-2026-45806

0xmrma/cve-2026-45806

Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin SSRF because…

educationexploitationpapers-research+3

3 months ago

Previous12 3 4 5 Next