Kittysploit-framework

KittySploit From recon to shell — in one console. Autonomous agent for web/API testing. 8,000+ modules. Built-in C2. Local LLM. Scope-aware. Automation-ready. Quick start · Docs · Website · Discord Web/API mission lab — one command, quick profile by default kittysploit agent https://lab.local...

Get Session Storage

Extract all data from sessionStorage on the hooked origin BeEF getsessionstorage from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Get Session Storage", "description": "Extract all data from sessionStorage on the hooked origin BeEF getsessionstorage", "author":...

Man In The Browser

Rewrite same-origin links and form actions to a chosen URL BeEF linkrewrite / MITB from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Man In The Browser", "description": "Rewrite same-origin links and form actions to a chosen URL BeEF linkrewrite / MITB", "author":...

Classic Remote Shellcode Injection

Build an injector EXE that decrypts shellcode and injects it into a remote process via VirtualAllocEx/WriteProcessMemory/CreateRemoteThread. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from...

No Sleep

Prevent the hooked tab from sleeping Wake Lock API + silent video fallback, BeEF nosleep from kittysploit import class ModuleBrowserAuxiliary: info = "name": "No Sleep", "description": "Prevent the hooked tab from sleeping Wake Lock API + silent video fallback, BeEF nosleep", "author": "KittySplo...

Hijack Opener

Redirect window.opener to the KittySploit hook page BeEF hijackopener from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Hijack Opener", "description": "Redirect window.opener to the KittySploit hook page BeEF hijackopener", "author": "KittySploit Team", "browser":...

Callback Execution Evasion

Run decrypted shellcode through a Windows callback API EnumWindows or CreateTimerQueueTimer instead of CreateThread. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from lib.compile.callbackexecution...

WPAD Proxy Discover

Load wpad.dat via the browser PAC resolver and extract PROXY/SOCKS entries BeEF getproxyserverswpad from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "WPAD Proxy Discover", "description": "Load wpad.dat via the browser PAC resolver and extract PROXY/SOCKS entries Be...

Capability Probe (Zig)

Detect OS, architecture, runtime, privileges, writable directory, and network capabilities before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "capabilityprobe" info = "name": "Capability Probe Zig",...

Check VM / Sandbox (Python)

Exit early when common VM or sandbox indicators are detected !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "checkvm" info = "name": "Check VM / Sandbox Python", "description": "Exit early when common VM or sandbox...

Check VM / Sandbox (PowerShell)

Exit early when common VM or sandbox indicators are detected !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "checkvm" info = "name": "Check VM / Sandbox PowerShell", "description": "Exit early when common VM or...

Daemonize Process (Python)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Python", "description": "Detach from the controlling terminal on...

Daemonize / Hide Console (PowerShell)

Hide console window and lower process priority before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize / Hide Console PowerShell", "description": "Hide console window an...

LLM Prompt Injection Surface Detection

Probes OpenAI-compatible /v1/chat/completions, Ollama, and generic /api/chat endpoints for unauthenticated inference — prompt injection and tool abuse entry points. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed LLM chat/completion endpoints prompt injection surface.""" from...

gRPC-Web Method Enumeration

Probes gRPC-Web and HTTP-transported gRPC paths for reflection, health checks, and service/method routes embedded in JS bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate gRPC-Web services and methods over HTTP.""" from kittysploit import from lib.protocols.http.httpclient import...

Serverless Function URL Detection

Finds AWS Lambda Function URLs, GCP Cloud Functions, and Azure Functions references in page source and probes common /api paths for unauthenticated invoke. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed serverless function URLs and unauthenticated invoke endpoints.""" from kittysploi...

Reverse ICMP Listener

Receives ICMP Echo Request packets from pythonreverseicmp agents. Requires scapy and CAPNETRAW / Administrator. Sends commands via ICMP Echo Reply payloads CMD:, PING, EXIT. !/usr/bin/env python3 -- coding: utf-8 -- """ICMP covert reverse shell listener pairs with pythonreverseicmp payload."""...

GCP Compute SSH BIND

BIND payload for listeners/gcp/computessh. Operator connects to a Compute Engine VM via gcloud compute ssh or direct Paramiko. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: info = "name": "GCP Compute SSH BIND", "description": "BIND payload for...

SSH Client BIND

BIND payload for listeners/multi/sshclient !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "SSH Client BIND", "description": "BIND payload for listeners/multi/sshclient", "category":...

SAML Metadata Exposure & Misconfiguration Detection

Probes common SAML metadata paths for exposed EntityDescriptor XML, unsigned assertions, and embedded X509 certificates. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed SAML metadata and weak signing configuration.""" from kittysploit import from lib.protocols.http.httpclient import...