Nostromo Web Server Detection

Detected servers running the Nostromo web server by identifying the Server header in HTTP responses. !/usr/bin/env python3 -- coding: utf-8 -- """Detected servers running the Nostromo web server by identifying the Server header in HTTP responses.""" from kittysploit import from...

OpenConnect VPN Server (ocserv) - Detect

OpenConnect VPN Server ocserv is an open-source VPN server compatible with Cisco AnyConnect clients. It uses DTLS and TLS for secure connectivity and is commonly exposed on port 443 or 4443. The server header can expose OpenConnect or ocserv-specific markers. !/usr/bin/env python3 -- coding: utf-...

Spring Boot `X-Application-Context` Header Exposure Detection

Detected the presence of the X-Application-Context header in HTTP responses, which can expose sensitive application context information. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of the X-Application-Context header in HTTP responses, which can expose sensitive applic."""...

WordPress Header Footer Elementor - Full Path Disclosure Detection

WordPress Header Footer Elementor plugin also known as Ultimate Addons for Elementor - Lite contains PHP files that lack proper ABSPATH protection, allowing direct access that reveals sensitive server path information via PHP error messages. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...

XSS-Protection Header - Cross-Site Scripting Detection

Setting the XSS-Protection header is deprecated. Setting the header to anything other than 0 can actually introduce an XSS vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Setting the XSS-Protection header is deprecated.""" import re from kittysploit import from...

X-Backend-Server Header - Exposure Detection

Detected that the website returned the X-Backend-Server header, which included potentially internal or hidden IP addresses or hostnames. By exposing these values, attackers might have attempted to circumvent security proxies and access these hosts directly. !/usr/bin/env python3 -- coding: utf-8 ...

X-Recruiting Header Detection

Websites that advertise jobs via HTTP headers !/usr/bin/env python3 -- coding: utf-8 -- """Websites that advertise jobs via HTTP headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'X-Recruiting Header Detection'...

ZZcms - Cross-Site Scripting Detection

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks. !/usr/bin/env python3 -- coding: utf-8 --...

Weak HTTP Strict-Transport-Security - Detect

Detected HTTP Strict-Transport-Security header with a weak max-age value less than one year. A low max-age reduces the effectiveness of HSTS, leaving users vulnerable to protocol downgrade attacks and cookie hijacking during the gap period. !/usr/bin/env python3 -- coding: utf-8 -- """Detected HT...

Sercomm VD625 Smart Modems - CRLF Injection Detection

Sercomm AGCOMBO VD625 Smart Modems with firmware version AGSOT2.1.0 are vulnerable to Carriage Return Line Feed CRLF injection via the Content-Disposition header. !/usr/bin/env python3 -- coding: utf-8 -- """Sercomm AGCOMBO VD625 Smart Modems with firmware version AGSOT2.""" from kittysploit impo...

QSAN Storage Manager <3.3.3 - Cross-Site Scripting Detection

QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability. Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data. !/usr/bin/env python3 -- coding: utf-8 -- """QSAN Storage Manager before...

ExponentCMS <= 2.6 - Host Header Injection Detection

An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM. !/usr/bin/env python3 -- coding: utf-8 -- """An HTTP Host header attack exists in...

CherryPy Web Server - Detect

Detects servers running the CherryPy web server by identifying the Server header in HTTP responses. !/usr/bin/env python3 -- coding: utf-8 -- """Detects servers running the CherryPy web server by identifying the Server header in HTTP responses.""" from kittysploit import from...

Onion Website Supported via Onion-Location Header Detection

Identified websites that supported Tor network access through the Onion-Location HTTP response header, which pointed to a corresponding .onion service for enhanced privacy and anonymity. !/usr/bin/env python3 -- coding: utf-8 -- """Identified websites that supported Tor network access through the...

OpenVPN Host Header Injection Detection

A vulnerability in OpenVPN Access Server allows remote attackers to inject arbitrary redirection URLs by using the 'Host' HTTP header field. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in OpenVPN Access Server allows remote attackers to inject arbitrary redirection URLs by...

Host Header Injection Detection

HTTP header injection is a general class of web application security vulnerability which occurs when Hypertext Transfer Protocol headers are dynamically generated based on user input. !/usr/bin/env python3 -- coding: utf-8 -- """HTTP header injection is a general class of web application security...

Microsoft IIS version detect

Some Microsoft IIS servers have the version on the response header. Useful when you need to find specific CVEs on your targets. !/usr/bin/env python3 -- coding: utf-8 -- """Some Microsoft IIS servers have the version on the response header.""" from kittysploit import from...

MochiWeb - Detect

Detected servers using the MochiWeb framework through the Server header. !/usr/bin/env python3 -- coding: utf-8 -- """Detected servers using the MochiWeb framework through the Server header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

x-amz-meta-s3cmd-attrs Header Username Disclosure Detection

Detected exposure of the x-amz-meta-s3cmd-attrs header in S3 objects, which can disclose sensitive information including the username uname, user ID uid, group name gname, and group ID gid of the user who uploaded the file using s3cmd. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposur...

MiniUPnPd - Detect

Detected servers using the MiniUPnPd service through the Server header. !/usr/bin/env python3 -- coding: utf-8 -- """Detected servers using the MiniUPnPd service through the Server header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...