mail-security-tester

Mail Security Testing Framework A testing framework for mail security and filtering solutions. IMPORTANT: Don't do anything evil with this! Tests of cloud or otherwise hosted solutions should always be approved by the tested provider. Only use your own test accounts and don't annoy anyone with a...

WAES

WAES - Web Auto Enum & Scanner Version 1.2.77 WAES is a professional-grade bash-based web enumeration and reconnaissance platform designed for Capture The Flag CTF competitions, Bug Bounty hunting, and Penetration Testing. It automates the complex workflow of security scanning by orchestrating...

Setup IPsec VPN

English | 简体中文 | 繁體中文 | 日本語 | Русский IPsec VPN Server Auto Setup Scripts Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. An IPsec VPN encrypts your network traffic, so that nobody between you and the VPN server can eavesdrop on your data as it...

SharpToken

SharpToken During red team lateral movement, we often need to steal the permissions of other users. Under the defense of modern EDR, it is difficult for us to use Mimikatz to obtain other user permissions, and if the target user has no process alive, we have no way to use "OpenProcessToken" to...

IPBan

IPBan - Free software to block out attackers quickly and easily on Linux and Windows Helpful Links Get a discount on IPBan Pro by visiting https://ipban.com/upgrade-to-ipban-pro/. Integrate IPBan with IPThreat, a 100% free to use website and service of community submitted bad ip addresses. Help...

t14m4t

t14m4t t14m4t is an automated brute-forcing attack tool, wrapper of THC-Hydra and Nmap Security Scanner. t14m4t is scanning an user defined target or a document containing targets for open ports of services supported by t14m4t , and then starting brute-forcing attack against the services running ...

XSStrike

XSStrike Advanced XSS Detection Suite XSStrike Wiki • Usage • FAQ • For Developers • Compatibility • Gallery XSStrike is a Cross Site Scripting detection suite equipped with four hand written parsers, an intelligent payload generator, a powerful fuzzing engine and an incredibly fast crawler...

RogueAssemblyHunter

. . \ / \ | | | .. | // \ / | | / \ / / \ \ / // // \ / | | | // | /\ / / | \ \ \ /| Y Y \ \ \ | | || // /|/ | / || / // | / // / / / / / / / / / | \ / | / \ | / \ / \ Y / | / | \ | \ /| | / | /|/|| /| | / / / Rogue Assembly Hunter Rogue Assembly Hunter is a utility for discovering 'interesting'...

qsreplace

qsreplace Accept URLs on stdin, replace all query string values with a user-supplied value, only output each combination of query string parameters once per host and path. Usage Example input file: root@kitploit: ▶ cat urls.txt https://example.com/path?one=1&two=2...

Invoke-SessionHunter

Invoke-SessionHunter Retrieve and display information about active user sessions on remote computers. No admin privileges required. The tool leverages the remote registry service to query the HKEYUSERS registry hive on the remote computers. It identifies and extracts Security Identifiers SIDs...

DSSS

Damn Small SQLi Scanner Damn Small SQLi Scanner DSSS is a fully functional SQL injection vulnerability scanner supporting GET and POST parameters written in under 100 lines of code. As of optional settings it supports HTTP proxy together with HTTP header values User-Agent, Referer and Cookie...

CVE-2026-18056 HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...

CVE-2026-16310 MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress...

CVE-2026-18056

HivePress Authentication is a WordPress plugin vulnerable to unauthenticated authentication bypass in all versions up to and including 1.1.4 . The root cause lies in the authenticate_user function's Facebook authenticator, which forwards an attacker-supplied access_token to the Facebook Graph API...

CVE-2026-16310

The MemberDash plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in all versions up to and including 1.8.5 . The flaw resides in the 'id' parameter , where missing validation on a user-controlled key allows unauthenticated attackers to change the password of any Wor...

ATTACKdatamap

ATTACKdatamap A datasource assessment on an event level to show potential coverage of the "MITRE ATT&CK" framework. This tool is developed by me and has no affiliation with "MITRE" nor with its great "ATT&CK" team, it is developed with the intention to ease the mapping of data sources to assess...

RsWindowsThingies

RsWindowsThingies Windows Thingies... but in Rust Tools listenmft Watch an entries' values change. root@kitploit: listenmft 0.2.0 Matthew Seyer See the differences in MFT attirbues. USAGE: listenmft.exe OPTIONS FLAGS: -h, --help Prints help information -V, --version Prints version information...

Pegasus---Forbidden-Buster

Pegasus - Forbidden Buster Author: Letda Kes dr. Sobri, S.Kom. A penetration testing tool for bypassing HTTP 401/403 responses using various header manipulation techniques and path fuzzing. Features Tests various header manipulations X-Forwarded-For, X-Original-URL, X-Rewrite-URL, etc. Unicode pa...

google-dorks-bug-bounty

Google Dorks for Bug Bounty A list of Google Dorks for Bug Bounty, Web Application Security, and Pentesting Live Tool Broad domain search w/ negative search root@kitploit: site:example.com -www -shop -share -ir -mfa PHP extension w/ parameters root@kitploit: site:example.com ext:php inurl:? API...

filtron

Filtron Reverse HTTP proxy to filter requests by different rules. Can be used between production webserver and the application server to prevent abuse of the application backend. The original purpose of this program was to defend searx, but it can be used to guard any web application. Installatio...