Cr3dOv3r

Cr3dOv3r Your best friend in credential reuse attacks. You give Cr3dOv3r an email then it does two simple useful jobs with it: Search for public leaks for the email and returns the result with the most useful details about the leak Using haveibeenpwned API and tries to get the plain text password...

CVE-2015-7501

Lab for Java Deserialization Vulnerabilities This content is related to the paper written for the 12th edition of H2HC magazine. See full paper in: https://www.h2hc.com.br/revista/ Slides and video of the talk will be available soon. Um overview sobre as bases das falhas de desserialização nativa...

black-widow

description: - black-widow is one of the most useful, powerful and complete offensive penetration testing tool black-widow Offensive penetration testing tool Open Source black-widow provides easy ways to execute many kinds of information gatherings and attacks. Fully Open Source Written in Python...

juice-shop

OWASP Juice Shop...

FUSE

FUSE FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload UEFU vulnerabilities. The details of the testing strategy is in our paper, "FUSE: Finding File Upload Bugs via Penetration Testing", which appeared in NDSS 2020. To see how to configure and execute...

pcc

PHP Secure Configuration Checker Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful...

metateta

Metateta Metateta Automated Tool For Scanning And Exploiting Network Protocols Using Metasploit For faster pen testing for large networks What You Can Do Scanning with all metasploit modules for specific network Protocol like smb,smtp,snmp Run all Auxiliary modules against specific network Protoc...

ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

SimplesApachePathTraversal

SimplesApachePathTraversal Simples Apache Path Traversal It's a simple tool for test vulnerability Apache Path Traversal https://blog.mrcl0wn.com/2021/10/uma-simples-tool-para-apache-path.html root@kitploit: Autor: MrCl0wn Blog: https://blog.mrcl0wn.com GitHub: https://github.com/MrCl0wnLab...

aimap

AIMap Internet-scale discovery and security testing platform for exposed AI agent infrastructure. AIMap finds, fingerprints, and security-tests publicly exposed AI endpoints — MCP servers, Ollama instances, vLLM/LiteLLM proxies, LangServe chains, Gradio apps, ComfyUI nodes, and more. Think Shodan...

SecLists

About SecLists SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to...

authz0

Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials. URLs and Roles are managed as YAML-based templates, which can be automatically created and added through authz0. You can also test based on multiple authentication headers...

gitjacker

gitjacker Gitjacker downloads git repositories and extracts their contents from sites where the .git directory has been mistakenly uploaded. It will still manage to recover a significant portion of a repository even where directory listings are disabled. For educational/penetration testing use...

CyberStrike

English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी The first open-source AI agent built for offensive security. Automated...

CVE-2026-48907

CVE-2026-48907 TODO Init own cve ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone cd Project use python follow below...

ludus-defender-lab

Ludus Defender Lab Ludus range config and Ansible roles for a Windows security lab pre-staged for MDE and MDI, with a fully misconfigured ADCS installation for detection coverage testing. Config| VMs| Purpose ---|---|--- zsec-mde-mdi-lab.yml| DC01 + WKS01| MDE/MDI detection lab with ADCS ESC1–ESC...

pulsexploit

pulsexploit Automated script for Pulse Secure SSL VPN exploit CVE-2019-11510 using hosts retrieved from Shodan API. You must have a Shodan account to use this script. Click here if you don't have Shodan account. Installation 1. Install dependencies. root@kitploit: CentOS & Fedora yum install git...

Modlishka

..Modlishka.. Modlishka is an open-source penetration testing tool that acts as a man-in-the-middle proxy. It introduced a new technical approach to handling browser-based HTTP traffic flow, which allows it to transparently proxy multi-domain destination traffic, both TLS and non-TLS, over a sing...

WEF

WiFi Exploitation Framework Coded with 💙 by D3Ext Introduction • Attacks • Features • Installation • Usage README in spanish Introduction This tool is designed for security researchers and penetration testers to analyze and exploit vulnerabilities in Wi-Fi networks. It provides an intuitive...

tactical-exploitation

tactical-exploitation "The Other Way to Pen-Test" -- HD Moore & Valsmith I've always been a big proponent of a tactical approach to penetration testing that does not focus on exploiting known software vulnerabilities, but relies on old school techniques such as information gathering and brute...