KitPloit - PenTest Tools!

WebGoat v2026.5

Kitploit — Mon, 12 Oct 2026 22:08:20 +0000

Deliberately vulnerable web application with interactive lessons and challenges for learning web application security and penetration testing techniques.

mvt v2026.10.12

Kitploit — Mon, 12 Oct 2026 18:07:47 +0000

Forensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private indicators of compromise.

hermes-agent v0.21.7

Kitploit — Mon, 12 Oct 2026 14:07:41 +0000

The agent that grows with you

osv-scanner v2.7.0

Kitploit — Mon, 12 Oct 2026 10:07:12 +0000

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

chisel v1.13.0

Kitploit — Mon, 12 Oct 2026 06:06:42 +0000

Fast TCP/UDP tunnel over HTTP with SSH encryption, supporting reverse port forwarding, SOCKS5 proxy, and client authentication for secure network traversal and firewall evasion.

invisible_playwright v0.33.1

Kitploit — Mon, 12 Oct 2026 02:06:30 +0000

Playwright that anti-bots cannot see, so no captchas: same API, anti-detect stealth headless Firefox, undetected fingerprint, bypass bot detection, Python web scraping and browser automation.

awesome-osint — Updated!

Kitploit — Sun, 11 Oct 2026 22:06:02 +0000

😱 A curated list of amazingly awesome OSINT

ecapture v2.8.0

Kitploit — Sun, 11 Oct 2026 18:05:48 +0000

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.

ipsw v3.1.736

Kitploit — Sun, 11 Oct 2026 14:05:21 +0000

iOS/macOS Research Swiss Army Knife

Scrapling — Updated!

Kitploit — Sun, 11 Oct 2026 10:05:14 +0000

Adaptive web scraping framework with anti-bot bypass, automatic element relocation, concurrent crawling, proxy rotation, and browser automation for resilient data extraction.

afrog v3.5.8

Kitploit — Sun, 11 Oct 2026 06:04:51 +0000

A Security Tool for Bug Bounty, Pentest and Red Teaming.

facedancer

Kitploit — Sun, 11 Oct 2026 03:05:43 +0000

Implement your own USB device in Python, supported by a hardware peripheral such as Cynthion or GreatFET

MISP v2.5.50

Kitploit — Sun, 11 Oct 2026 02:05:05 +0000

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

Pentest-Windows

Kitploit — Sun, 11 Oct 2026 01:49:52 +0000

Collection of Windows internals research and exploitation techniques covering privilege escalation, token abuse, and post-exploitation tricks for red teamers and pentesters.

wstrace

Kitploit — Sun, 11 Oct 2026 00:49:33 +0000

Standalone zero-driver Windows system and API monitor in Rust

kingfisher

Kitploit — Sat, 10 Oct 2026 23:49:22 +0000

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

sast

Kitploit — Sat, 10 Oct 2026 22:49:57 +0000

Free offline SAST engine for CI/CD: AST and cross-file taint analysis, secret detection with live validation, SCA/CVE, IaC misconfiguration, and web-shell scanning with SARIF output.

web-check — Updated!

Kitploit — Sat, 10 Oct 2026 22:03:58 +0000

🕵️‍♂️ All-in-one OSINT tool for analysing any website

-LogicSentry-AI

Kitploit — Sat, 10 Oct 2026 21:48:53 +0000

Offline SAST/DAST triage engine that parses source code and replays HAR traffic to detect business-logic flaws, BOLA, race conditions, and privilege issues with local LLM triage.

CloudGarrison

Kitploit — Sat, 10 Oct 2026 20:48:00 +0000

Offline browser-based multi-cloud posture workbench that simulates attack paths, audits IaC compliance, analyzes identity graphs, and maps audit logs locally via WebAssembly.

severitas

Kitploit — Sat, 10 Oct 2026 19:48:09 +0000

Authorized social-engineering simulation framework with an isolated loopback lab, synthetic audience generation, pre-flight authorization checks, and offline HTML/Markdown/JSON/CSV reporting.

SearchPhone

Kitploit — Sat, 10 Oct 2026 18:47:59 +0000

Phone number OSINT toolkit with multi-API search (Google, GitHub, Numverify, Reddit, DuckDuckGo), Hudson Rock infostealer intelligence, and automatic report generation.

Arkari

Kitploit — Sat, 10 Oct 2026 17:47:37 +0000

Yet another llvm based obfuscator based on goron.

Overthrone

Kitploit — Sat, 10 Oct 2026 16:47:08 +0000

All-Rust Active Directory exploitation framework: LDAP/SMB/Kerberos enumeration, attack-graph pathfinding, Kerberoasting, NTLM relay, ticket forging, DCSync, and reporting in one static binary.

darkroute

Kitploit — Sat, 10 Oct 2026 15:47:03 +0000

Anti-ALPR-surveillance PWA. The camera archive lives on the device.

ESP32-BlueJammer

Kitploit — Sat, 10 Oct 2026 14:46:41 +0000

ESP32 and nRF24 based 2.4GHz jammer that disrupts Bluetooth, BLE, WiFi, and RC channels via noise and packet flooding for controlled security testing.

webhacklist

Kitploit — Sat, 10 Oct 2026 13:46:22 +0000

Archive of the Top 10 Web Hacking Techniques - every nominee since 2006, preserved

ad_attack_architecture

Kitploit — Sat, 10 Oct 2026 12:45:53 +0000

Active Directory Attack Architecture Map Comprehensive Pentest Reference — From Recon to Domain Dominance

red-team-map

Kitploit — Sat, 10 Oct 2026 11:45:21 +0000

Red Team Operations Architecture Map Comprehensive Operator Reference — From Infrastructure to Impact

phantom-grid

Kitploit — Sat, 10 Oct 2026 10:45:12 +0000

Free Burp Collaborator alternative- OOB interaction capture (HTTP/HTTPS/DNS) with SQLite & exfil reassembly

BurpIA

Kitploit — Sat, 10 Oct 2026 09:44:52 +0000

Extensión de Burp Suite que incorpora detección pasiva de vulnerabilidades mediante inteligencia artificial.

tanuki

Kitploit — Sat, 10 Oct 2026 08:44:20 +0000

Tactical Identity Operator for Linux & Hybrid Active Directory

EBurst

Kitploit — Sat, 10 Oct 2026 07:44:00 +0000

This script mainly provides account brute-forcing functionality for Exchange mail servers, integrating the brute-forcing methods of existing mainstream interfaces.

gobalance-patch

Kitploit — Sat, 10 Oct 2026 06:43:58 +0000

Security patch and proof-of-concept for GoBalance onion load balancer, covering master key recovery via blindedSign and forged descriptor acceptance, with regression tests.

oss-scanner

Kitploit — Sat, 10 Oct 2026 05:43:42 +0000

Service that builds enrolled open-source repositories in isolated offline VMs and scans them for security vulnerabilities, emailing findings with reproducers and proposed patches.

geo-sleuth

Kitploit — Sat, 10 Oct 2026 04:43:41 +0000

An agent skill that finds where a photo was taken — OpenStreetMap geometry, elevation skylines, satellite imagery and street view — and shows its work. Works with Claude Code, Codex, Cursor, Gemini CLI, OpenCode and GitHub Copilot.

CVE-2026-Wordpress

Kitploit — Sat, 10 Oct 2026 03:48:10 +0000

Educational CVE proof-of-concept collection targeting WordPress vulnerabilities, with setup scripts and lab guidance for authorized security research and testing.

hqc-x86-simd

Kitploit — Sat, 10 Oct 2026 02:52:48 +0000

Optimized HQC post-quantum KEM implementations for AVX2 and AVX-512 with GFNI, plus a unified benchmarking and NIST KAT suite for x86 IoT gateways.

opencti v7.261008.0

Kitploit — Sat, 10 Oct 2026 02:02:26 +0000

Open Cyber Threat Intelligence Platform

EpiReal-Bench

Kitploit — Sat, 10 Oct 2026 01:24:11 +0000

Red-teaming benchmark and black-box attack framework for evaluating visual misinformation risks in commercial image generators, with 10k false-claim prompts and scoring scripts.

FS-attack

Kitploit — Sat, 10 Oct 2026 00:28:47 +0000

Implementation of the paper "Rethinking Latency Denial-of-Service: Attack the LLM Serving Framework, Not the Model"

ToBAC

Kitploit — Fri, 09 Oct 2026 23:33:35 +0000

Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models (NeurIPS'26)

kev-data

Kitploit — Fri, 09 Oct 2026 22:43:10 +0000

Mirrors CISA's Known Exploited Vulnerabilities (KEV) catalog as CSV and JSON with a JSON schema, enabling programmatic access and commit-history tracking of KEV updates.

garble

Kitploit — Fri, 09 Oct 2026 21:52:59 +0000

Obfuscates Go builds by wrapping the Go toolchain, replacing identifiers, package paths, and position data with hashes and stripping debug and build information.

GoBfuscator

Kitploit — Fri, 09 Oct 2026 21:07:27 +0000

Obfuscates Go source code via AES-256 string encryption with runtime decryption, identifier renaming, and comment removal to hinder reverse engineering while preserving runtime behavior.

kernel-research

Kitploit — Fri, 09 Oct 2026 20:22:15 +0000

Linux kernel exploitation toolkit providing an exploit-building library, ROP chain and stack pivot generators, kernel image runners, and a target database for developing kernel exploits.

msynth

Kitploit — Fri, 09 Oct 2026 19:36:55 +0000

Code deobfuscation framework to simplify Mixed Boolean-Arithmetic (MBA) expressions

p0tools

Kitploit — Fri, 09 Oct 2026 18:42:56 +0000

Collection of Google Project Zero vulnerability research documents and small standalone security tools, including exploitation and virtualization-based analysis utilities.

wolfssh

Kitploit — Fri, 09 Oct 2026 17:42:42 +0000

Small, portable embeddable SSHv2 client and server library in C with SCP, SFTP, port forwarding, and post-quantum key exchange for embedded and IoT systems.

cyclepatrol

Kitploit — Fri, 09 Oct 2026 16:42:08 +0000

Bash tool for on-foot Wi-Fi security checks in a loop, with evidence reports.