NagaScan

NagaScan NagaScan is a distributed passive vulnerability scanner for Web application...

ssj

SSJ - Your everyday Linux distribution gone Super Saiyan. Introduction SSJ is a silly little script that makes use of Docker installed on your everyday Linux distribution Ubuntu, Debian, etc. and magically arms it with hundreds of penetration testing and forensic tools. Technical Details SSJ pull...

CVE-2014-8609-POC

CVE-2014-8609-POC -pendingintent vulnerability Explanation of how the vulnerability works with exploitation method. It is one of the most common vulnerabilities in Android applications, and you can use it to access more vulnerabilities in a professional way. POC...

Passhunt

Passhunt Passhunt is a simple tool for searching of default credentials for network devices, web applications and more. Search through 523 vendors and their 2084 default passwords. Screenshot Pre-requisites Make sure you have installed the following: root@kitploit: - Python 3.0 or later. - pip3...

cve-2020-14008

CVE-2020-14008 ManageEngine Exploit What is this? This script exploits CVE-2020-14008 in ManageEngine Applications Manager to get a reverse shell with SYSTEM privileges. Requirements root@kitploit: pip3 install requests urllib3 How to use it 1. Start a listener root@kitploit: nc -nlvp 9001 2. Run...

creepy

creepy Current Version 1.1 Author Yiannis Kakavas Homepage http://www.geocreepy.com Installation Instructions See http://www.geocreepy.com Description Geolocation OSINT tool. Creepy is a geolocation OSINT tool. Gathers geolocation related information from online sources, and allows for presentati...

burp-dom-scanner

Burp DOM Scanner It's a Burp Suite's extension to allow for recursive crawling and scanning of Single Page Applications. It runs a Chromium browser to scan the webpage for DOM-based XSS. It can also collect all the requests XHR, fetch, websockets, etc issued during the crawling allowing them to b...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

xcrawl3r

xcrawl3r xcrawl3r is a command-line utility designed to recursively spider webpages for URLs. It works by actively traversing websites - following links embedded in webpages, and parsing files including sitemaps & robots.txt - to uncover every URL. Unlike xurlfind3r that doesn't interact directly...

BADministration

BADministration What is BADministration? BADministration is a tool which interfaces with management or administration applications from an offensive standpoint. It attempts to provide offsec personnel a tool with the ability to identify and leverage these non-technical vulnerabilities. As always:...

OWASPBugBounty

OWASP Bug Bounty for Projects Introduction Many developers and companies looking to implement security are turning towards OWASP to use Defender libraries that they can implement to secure their critical applications. Since this implies a form of trust in OWASP, many users of these projects might...

CVE-2023-4966

CVE-2023-4966 CitrixBleed Programm to exploit Citrix Applications with a range of ip adresses here is how you compile it for windows, macOS, or Linux root@kitploit: GOOS=windows GOARCH=amd64 go build -o citrix citrix.go GOOS=darwin GOARCH=amd64 go build -o citrix.exe citrix.go GOOS=linux...

bento

This software is exprimental but we accept suggestions and contributions Bento Toolkit for PT and CTF A bento 弁当, bentō is a single-portion take-out or home-packed meal of Japanese origin. Bento Toolkit is a simple and minimal docker container for penetration testers and CTF players. It has the...

CVE-2021-44228

CVE-2021-44228 Scripts de servicio profesional para ayudar en la identificación de aplicaciones Java afectadas en TeamServer...

CVE-2006-2842

Badges License MIT Installation Install cve-2006-2842 with npm root@kitploit: npm install cve-2006-2842 -g Usage Example for single url root@kitploit: cve-2006-2842 -u http://example.com Usage Example for list of urls root@kitploit: cve-2006-2842 -l urls.txt -o out.txt Screenshots Help menu Get a...

CVE-2025-3248

CVE-2025-3248 — Langflow RCE Exploit Remote Code Execution RCE exploit for Langflow applications vulnerable to CVE-2025-3248. Affected Endpoint: /api/v1/validate/code 🚀 Exploit Features 🔓 Remote & unauthenticated RCE 🔐 No authentication required 🐍 Python3 one-liner script 🎨 Colorized terminal...

hackbox

HackB0x v2.0 HackBox es la combinación de herramientas y técnicas increíbles. HackBox es una herramienta completa y potente que combina una variedad de técnicas de vanguardia para capacitar a los profesionales de la seguridad en su misión de identificar y corregir vulnerabilidades en aplicaciones...

CVE-2021-31589

Badges License MIT Installation Install cve-2021-31589 with npm root@kitploit: npm install cve-2021-31589 -g Usage Example for single url root@kitploit: cve-2021-31589 -u http://example.com Usage Example for list of urls root@kitploit: cve-2021-31589 -l urls.txt -o out.txt Screenshots Help menu G...

aegis-latent-core

Aegis Latent Core AI Governance and Cryptographic Evidence Gateway Aegis sits between your application and your model provider. For every governed call it applies policy, forwards the request, and commits a signed, hash-linked evidence record before the response reaches your caller — together wit...

Twisted - Open Redirect & XSS

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The Twisted web framework's redirectTo function is vulnerable to reflected XSS if an attacker can control the redirect URL. This template tests for an open redirect and XSS vulnerability in the URL parameter...