socid-extractor

socidextractor Turn any public profile page into a structured account record — usernames, display names, bios, avatars, locations, joined-at dates, follower counts, external links, and the stable internal identifiers that uniquely pin an account across renames, redesigns, and deletions...

CVE-2018-8097

CVE-2018-8097 PoC This is a simple python Proof of Concept script demonstrating the CVE-2018-8097, affecting the PyEve library for versions 0.7.5 Usage root@kitploit: usage: cve20188097.py -h -u URL -c COMMAND options: -h, --help show this help message and exit -u URL, --url URL Target URL where...

wappalyzer-next

Wappalyzer Next This project is a command line tool and python library that uses the Wappalyzer browser extension and its fingerprints to detect technologies. Other projects that emerged after the discontinuation of the official open-source project are using outdated fingerprints and lack accurac...

taser

Taser TASER Testing and Security Resource is an abstraction library used to simplify the process of creating offensive security tooling. The various protocols and classes help streamline development of custom tooling during engagements. The examples directory contains a number of scripts...

plecost

Plecost Professional WordPress Security Scanner Async-first, library-friendly, no external API required. Table of Contents What is Plecost? Plecost vs WPScan Quick Start Installation CVE Database CVE Detection Engine Scanning Detection Modules WooCommerce Security WP eCommerce Security...

wxpath

wxpath - declarative web graph traversal with XPath NEW: TUI - Interactive terminal interface powered by Textual for testing wxpath expressions and exporting data. Install Requires Python 3.10+. root@kitploit: pip install wxpath For TUI support: pip install "wxpathtui" Immediately launch the TUI...

fses

fses Fucking Search Engines Scraper - python library to scrap url's from search engines Search Engines we scrap root@kitploit: Ask Bing DuckDuck GO UOL Yahoo Install root@kitploit: git clone https://github.com/mthbernardes/fses.git cd fses pip install -r requeriments.txt Usage Simple search using...

Steganography

Steganography Table of Contents Installation Byte Sequence Manipulation WavSteg LSBSteg StegDetect If you are unfamiliar with steganography techniques, I have also written a basic overview of the field in Steganography: Hiding Data Inside Data. Installation This project is on PyPI and can be...

webtech

WebTech Identify technologies used on websites. More info on the release's blogpost. CLI Installation WebTech is available on pip: root@kitploit: pip install webtech It can be also installed via setup.py: root@kitploit: python setup.py install --user Burp Integration Download Jython 2.7.0...

CVE-2024-28397-RCE

CVE-2024-28397 RCE Script Default reverse shell payload and optional command argument allowed exploit works for js2py = v0.74 Requirements Python 3.x requests library pip install requests Netcat listener for reverse shell Example usage Reverse shell: root@kitploit: python exploit.py 10.129.227.10...

aco-prompt-shield

aco-prompt-shield 🛡️ Stop prompt injection attacks before they reach your LLM — zero API costs, runs entirely locally, integrates in 2 minutes. Prompt injection is the 1 security risk for LLM applications. aco-prompt-shield catches known jailbreak patterns, understands semantic intent via ML, and...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

pyshark

pyshark Python wrapper for tshark, allowing python packet parsing using wireshark dissectors. Extended documentation: http://kiminewt.github.io/pyshark Looking for contributors - for various reasons I have a hard time finding time to maintain and enhance the package at the moment. Any...

strot

Reverse-engineer any website's internal API with natural language The Problem Modern websites load data through hidden AJAX calls: Data isn't in the HTML - it's fetched via internal APIs You have to manually inspect network requests Complex pagination logic buried in JavaScript APIs change...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

yaraast

yaraast Parse, analyze, and transform YARA rules with a Python AST toolkit Overview...

bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

sqlsure

sqlsure AI writes your SQL. sqlsure makes sure it's right. A query can be perfectly valid, run without error, and return a number that's silently wrong — revenue double-counted by a join, an average summed, a patient identifier exposed. Databases don't catch this. Linters don't catch this. LLMs...

SecML

SecML: A library for Secure and Explainable Machine Learning SecML is an open-source Python library for the security evaluation of Machine Learning ML algorithms. It comes with a set of powerful features: Wide range of supported ML algorithms. All supervised learning algorithms supported by...

securesystemslib

securesystemslib Securesystemslib is a cryptography interface for signing and verifying digital signatures. It is developed for the TUF and in-toto projects: the key and signature containers are compatible with metadata formats from those projects. Under the hood, Securesystemslib can use various...