NoEyes

NoEyes 🔒 Secure Terminal Chat End-to-end encrypted group chat, private messages, and file transfer in your terminal. The server is a blind forwarder: it cannot read your messages, does not know your username, does not know the room you are in, and cannot link any two messages to the same person,...

chronix

Chronix Self-hosted collaborative workspace for pentesters and red team operators. Captures notes, commands, outputs, and operational context during security engagements. Quick Start root@kitploit: Install pipx install git+https://github.com/IceCubeSandwich/chronix Initialize creates account and...

zitadel

The Identity Infrastructure for Developers ZITADEL...

Samuraizer

Samuraizer — Cyber‑Security Knowledge Base Engine NotebookLM on steroids — purpose-built for security researchers. 💡 Why Samuraizer? Every security researcher knows the feeling — you find an interesting GitHub repo, a fresh CVE writeup, a blog post about a new exploitation technique. You forward ...

xalgorix

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

WhoAmIMailBot

Who Am I Mail Bot What is it? Who Am I Mail Bot is a service to mask your e-mails. It was inspired by Blur, where you can create an alias for your e-mail and use it to signup on applications. The problem with Blur is that all e-mails pass trough their infraestructure and I don't need/want anybody...

kubestriker

A Blazing fast Security Auditing tool for kubernetes!!...

clickfix-simulator-2025

ClickFix Training Tool A lightweight, self-hosted simulation tool for "ClickFix" type social engineering attacks. Disclaimer This tool is for AUTHORIZED SECURITY AWARENESS TRAINING ONLY. Unauthorized use of this tool to target systems or users without explicit permission is illegal and unethical...

rustdesk

Build • Docker • Structure • Snapshot Українська | česky | 中文 | Magyar | Español | فارسی | Français | Deutsch | Polski | Indonesian | Suomi | മലയാളം | 日本語 | Nederlands | Italiano | Русский | Português Brasil | Esperanto | 한국어 | العربي | Tiếng Việt | Dansk | Ελληνικά | Türkçe | Norsk | Română We...

kviklet

Kviklet Kviklet.dev | Release Notes | Discord Secure access to production environments without impairing developer productivity. Kviklet pronounced Quick-let embraces the Four-Eyes Principle and a high level of configurability to allow a Pull Request-like Review and Approval flow for individual S...

caos-os

CAOS — Customer Assurance Operating System Answer the security questionnaires your customers send you, once. Every company that handles customer data gets the same requests over and over: security questionnaires, privacy assessments, vendor risk reviews, procurement due diligence, evidence...

phone-deck

phone-deck Turn a spare Android phone or any device with a browser into a self-hosted control deck and remote desktop for your Linux workstation — over your private Tailscale network, with no third-party apps. It started as "what do I do with an old phone?" and became a control plane for a Hyprla...

exocomp

Exocomp Self-hosted multi-agent environment tailored to Golang. Features Attention, profit-seekers and visionaries! Are organics costing you time, wages, and - worst of all - benefits? Then upgrade your operation today with the all new Exocomp adaptive repair unit, the smartest investment this si...

lowkey

Self-Hosted AI Coding Agents on AWS — OpenClaw, Claude Code, Codex, Kiro, NemoClaw, Hermes ▶️ Watch the full walkthrough on YouTube 📝 Read the blog post: "I Gave My Agent Its Own AWS Account" TL;DR — deploy Lowkey: root@kitploit: curl -sfL install.lowkey.run | bash Works in bash , zsh , and AWS...

Kimai-CVE-2026-49865-POC

Kimai CVE-2026-52824 — Default APPSECRET Authentication Bypass Note: The repository URL contains an outdated CVE ID CVE-2026-49865. The correct and current CVE tracked in this repository is CVE-2026-52824 GHSA-jr9p-4h4j-6c58. Proof-of-concept exploit toolkit for the hardcoded default APPSECRET...

LitterBox

LitterBox A self-hosted payload-analysis sandbox for red teams. Upload a sample, run static / dynamic / EDR analysis against it, get a Detection Score and a triggering-indicators breakdown — decide whether the payload is field-ready before it leaves the lab. LitterBox can also dispatch payloads t...

ogi

OpenGraph Intel OGI Open-source visual link analysis and OSINT framework. Free, self-hostable, and community-driven. Features • Screenshots • Quick Start • Docker • Transform Hub • Architecture • Contributing Heads up: This project is actively evolving. It has solid core capabilities and test...

knocker

Knocker is a self-hosted service that provides an HTTP based "knock-knock" single-packet authorization SPA gateway for your Homelab with web, cli + gnome and android clients. it can be used as authentication for your reverse proxy like Caddy, or even on the firewall level using the FirewallD...

SafeLine

SafeLine - Make your web apps secure 🏠 Website | 📖 Docs | 🔍 Live Demo | 🙋‍♂️ Discord | 中文版 👋 INTRODUCTION SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and monitoring HTTP...

nextssrf

root@kitploit: ╔══════════════════════════════════════════════════════════════╗ ║ NextSSRF — CVE-2026-44578 Scanner & Exploit ║ ║ Next.js WebSocket Upgrade Handler SSRF ║ ║ Affected: 13.4.13 → 15.5.15, 16.0.0 → 16.2.4 ║ ║ @mitsec / ynsmroztas — Bug Bounty Tooling ║...