toolbox

-Significant%20AI%2C%20fully%20reviewed-1f77b4 MCP-based application security testing tools for your coding agent. Not a scanner — a collaborative workbench. Agents struggle with UI and stateful APIs; you're good at both. Sectool lets you explore an application through its proxy while an agent...

PhantomFS

Fake Files. Real Security. Virtual honeypot file system for Windows — lure attackers into a directory that looks real, then catch them in the act. What Is PhantomFS? PhantomFS uses the Windows Projected File System ProjFS to surface a virtual directory full of convincing decoy files — financial...

LSMS

Linux Security and Monitoring Scripts These are a collection of security and monitoring scripts you can use to monitor your Linux installation for security-related events or for an investigation. Each script works on its own and is independent of other scripts. The scripts can be set up to either...

hakrawler

Hakrawler Fast golang web crawler for gathering URLs and JavaScript file locations. This is basically a simple implementation of the awesome Gocolly library. Example usages Single URL: root@kitploit: echo https://google.com | hakrawler Multiple URLs: root@kitploit: cat urls.txt | hakrawler Timeou...

ublockdnsclient

uBlockDNS Client uBlockDNS Client is an independent project and is not affiliated with, endorsed by, or related to uBlock Origin or its maintainer. uBlockDNS Client brings DNS-level ad and tracker blocking to your entire device. It uses community-maintained filter lists such as EasyList and...

ipsw

ipsw iOS/macOS Research Swiss Army Knife What is ipsw 🤔 ipsw is a comprehensive command-line research framework for iOS and macOS. It provides an extensive toolkit for security researchers, reverse engineers, jailbreak developers, and iOS enthusiasts to download, parse, and analyze Apple firmware...

CVE-2026-87733

An issue was discovered in the mirage-crypto-ec function before 2.2.0...

CVE-2026-87735

An issue was discovered in the mirage-crypto-pk package before 2.3.0 f...

CVE-2026-87736

An issue was discovered in the mirage-crypto-ec package before 2.3.0 f...

CVE-2026-87732

An issue was discovered in the mirage-crypto package before 2.2.0 for...

PT-2026-89257

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused...

PT-2026-89190

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils MergePatch of the file cJSON Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request t...

PT-2026-89256

BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product may be caused...

IServ Schoolserver User Enumeration

IServ Schoolserver suffers from a user enumeration vulnerability. The vendor does not feel this is an issue...

Microsoft Windows Cloud Files Mini Filter Driver CldiStreamPrepareRequestForMoreProcessing Type Confusion vulnerability

Summary A type confusion vulnerability exists in the CldiStreamPrepareRequestForMoreProcessing functionality of Windows Cloud Files Mini Filter Driver versions: 10.0.26100.8457 WinBuild.160101.0800 and 10.0.26100.8655 WinBuild.160101.0800. A specially crafted sequence of Cloud Filter API calls ca...

CVE-2026-39020

An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial...

CVE-2026-87737

An issue was discovered in the mirage-crypto-ec package before 2.4.0 f...

Hollow

Hollow hollow is a shellcode loader generator. You give it a raw shellcode binary and a profile, and it spits out a compiled Windows PE loader with your shellcode encrypted inside. Getting Started Binaries are available on the releases page, or build from source: root@kitploit: go build -o hollow...

btlejack

BtleJack: a new Bluetooth Low Energy swiss-army knife Btlejack provides everything you need to sniff, jam and hijack Bluetooth Low Energy devices. It relies on one or more BBC Micro:Bit . devices running a dedicated firmware. You may also want to use anAdafruit's Bluefruit LE sniffer or a nRF5182...

CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit

CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Guide 📋 Quick Exploitation Steps Step 1: Prepare XFS Image Local Machine root@kitploit: Create 300MB XFS image dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image Mount and install SUID bash mkdir mnt sudo mount -t xfs xfs.image mn...