QSAN Storage Manager <3.3.3 - Cross-Site Scripting Detection

QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability. Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data. !/usr/bin/env python3 -- coding: utf-8 -- """QSAN Storage Manager before...

Apache Detection

Some Apache servers have the version on the response header. The OpenSSL version can be also obtained !/usr/bin/env python3 -- coding: utf-8 -- """Some Apache servers have the version on the response header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Akamai Cache Detection

Sends a HEAD request with a Pragma header value of "akamai-x-cache-on" and looks for an akamai-specific response header value. !/usr/bin/env python3 -- coding: utf-8 -- """Sends a HEAD request with a Pragma header value of "akamai-x-cache-on" and looks for an akamai-specific respon.""" import re...

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage Detection

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. !/usr/bin/env python3 -- coding: utf-8 -- """Eclipse Jetty before 9.""" from kittysploit import from lib.protocols.http.httpclient import...

Apache Struts2 S2-008 RCE Detection

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. !/usr/bin/env python3 -- coding: utf-8...

CherryPy Web Server - Detect

Detects servers running the CherryPy web server by identifying the Server header in HTTP responses. !/usr/bin/env python3 -- coding: utf-8 -- """Detects servers running the CherryPy web server by identifying the Server header in HTTP responses.""" from kittysploit import from...

AspNetMvc Version - Detect

Detects version disclosed via 'X-AspNetMvc-Version' header. !/usr/bin/env python3 -- coding: utf-8 -- """Detects version disclosed via 'X-AspNetMvc-Version' header.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Ruby on Rails - Accept Header LFI Detection (CVE-2019-5418)

Detects CVE-2019-5418 by sending Accept: ../../../../../../../../etc/passwd and looking for passwd contents in the response. !/usr/bin/env python3 -- coding: utf-8 -- """Rails File Content Disclosure via Accept header CVE-2019-5418.""" import re from kittysploit import from...

Sercomm VD625 Smart Modems - CRLF Injection Detection

Sercomm AGCOMBO VD625 Smart Modems with firmware version AGSOT2.1.0 are vulnerable to Carriage Return Line Feed CRLF injection via the Content-Disposition header. !/usr/bin/env python3 -- coding: utf-8 -- """Sercomm AGCOMBO VD625 Smart Modems with firmware version AGSOT2.""" from kittysploit impo...

Deprecated Feature-Policy Header - Detection

Detected the presence of the deprecated Feature-Policy HTTP response header. The Feature-Policy header has been deprecated and replaced by the Permissions-Policy header. While Feature-Policy is still supported in some browsers for backward compatibility, it is recommended to migrate to...

JumpServer - Open Redirect via Referer Header Detection

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. !/usr/bin/env...

Zimbra Collaboration - Cross-Site Scripting (XSS) Detection

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...

Spring Boot `X-Application-Context` Header Exposure Detection

Detected the presence of the X-Application-Context header in HTTP responses, which can expose sensitive application context information. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of the X-Application-Context header in HTTP responses, which can expose sensitive applic."""...

Monstra CMS 3.0.4 - HTTP Header Injection Detection

Monstra CMS 3.0.4 is susceptible to HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter. An attacker can potentially supply invalid input and cause the server to allow redirects to attacker-controlled domains, perform cache poisoning, and/or allow improper access to...

Joomla HTTP Header Unauthenticated - Remote Code Execution Detection

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015 !/usr/bin/env python3 -- coding: utf-8 -- """Joomla! 1.""" from kittysploit import from...

x-amz-meta-s3cmd-attrs Header Username Disclosure Detection

Detected exposure of the x-amz-meta-s3cmd-attrs header in S3 objects, which can disclose sensitive information including the username uname, user ID uid, group name gname, and group ID gid of the user who uploaded the file using s3cmd. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposur...

MiniUPnPd - Detect

Detected servers using the MiniUPnPd service through the Server header. !/usr/bin/env python3 -- coding: utf-8 -- """Detected servers using the MiniUPnPd service through the Server header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Weak HTTP Strict-Transport-Security - Detect

Detected HTTP Strict-Transport-Security header with a weak max-age value less than one year. A low max-age reduces the effectiveness of HSTS, leaving users vulnerable to protocol downgrade attacks and cookie hijacking during the gap period. !/usr/bin/env python3 -- coding: utf-8 -- """Detected HT...

Winstone Servlet Engine Detection

Detected servers running the Winstone Servlet Engine via the Server or X-Powered-By headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detected servers running the Winstone Servlet Engine via the Server or X-Powered-By headers.""" import re from kittysploit import from...

IBM WebSphere Application Server Detection

Detects servers running IBM WebSphere Application Server via the Server header. !/usr/bin/env python3 -- coding: utf-8 -- """Detects servers running IBM WebSphere Application Server via the Server header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...