PDF Phone-Home Full Suite

Generate the full KittySploit PDF phone-home suite 70 files with phone-home callbacks for upload-scanner and red-team validation. Covers URI actions, JavaScript, XFA, XXE, UNC/NTLM, and viewer-specific CVE PoCs. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf import...

BACnet Who-Is discovery

Sends BACnet/IP Who-Is requests UDP/47808 and collects I-Am responses for BMS / building controller discovery. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import whois from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

CouchDB Detection

Detects CouchDB REST API and Fauxton UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed CouchDB/Fauxton endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "CouchDB Detection",...

InfluxDB Detection

Detects InfluxDB ping and health endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed InfluxDB HTTP API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "InfluxDB Detection", "description": "Detects...

S7 program transfer detect

Actively probes whether Siemens S7 program-transfer jobs appear reachable upload/download channel. Complements passive sniffer detections. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

OpenAPI Schema Abuse

Discovers exposed OpenAPI/Swagger documents and probes documented GET endpoints for unauthenticated access to sensitive routes. !/usr/bin/env python3 -- coding: utf-8 -- """Probe exposed OpenAPI/Swagger specs for unauthenticated sensitive endpoints.""" from future import annotations import json...

SMB session acquire

Chains SMB recon null session, guest, credentials or wordlists and opens an authenticated SMB session when access is obtained. !/usr/bin/env python3 -- coding: utf-8 -- """ Probe SMB authentication profiles and open an interactive SMB session. Workflow: 1. Check null session / guest / supplied...

Citrix Gateway Detection

Detects Citrix ADC/Gateway VPN and logon pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Citrix ADC / Gateway login surfaces.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

ClickHouse Detection

Detects ClickHouse /ping and HTTP query interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ClickHouse HTTP interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "ClickHouse Detection", "description":...

Graylog Detection

Detects Graylog system and cluster API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Graylog log management API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

ICS engagement report

Builds a consolidated OT/ICS engagement report from passive JSON, workspace services, and optional active findings. Exports JSON and HTML. !/usr/bin/env python3 -- coding: utf-8 -- import json import os from kittysploit import from lib.protocols.ics.report import buildengagementreport, savereport...

Person to Usernames

Generate likely username candidates from a person's full name, structured name fields, display name, and aliases. !/usr/bin/env python3 -- coding: utf-8 -- """Generate likely usernames from a person's name and aliases.""" from future import annotations import json import os from kittysploit impor...

Reverse WHOIS Org Mapper

Find related domains from a registrant organization/email string using passive reverse WHOIS sources. !/usr/bin/env python3 -- coding: utf-8 -- """Reverse WHOIS pivot by organization, email, or registrant string.""" from future import annotations import json from urllib.parse import urlparse from...

Sleep Obfuscation Evasion

Generate a Windows x64 EXE that obfuscates shellcode in memory during Sleep XOR/RC4 + PAGENOACCESS, Ekko/Foliage-style before execution. !/usr/bin/env python3 -- coding: utf-8 -- """ Sleep memory obfuscation evasion loader Ekko/Foliage-style. Encrypts the shellcode region in memory, sets pages to...

Service Worker Register

Register a persistent service worker that re-injects the KittySploit hook on HTML navigations from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Service Worker Register", "description": "Register a persistent service worker that re-injects the KittySploit hook on HT...

LDAP Delegation Audit

Audit unconstrained, constrained, and resource-based constrained delegation from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient from lib.protocols.ldap.adhelpers import UACTRUSTEDFORDELEGATION, UACTRUSTEDTOAUTHFORDELEGATION, class ModulePost, LdapPostClient: info ...

QUIC Download File

Download a remote file from the implant via an active QUIC C2 session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin class ModulePost,...

Purple Team Detection Export

Generate Sigma/EDR detection packs for post-exploitation modules Windows & Linux using the post telemetry registry. !/usr/bin/env python3 -- coding: utf-8 -- """Generate detection packs for post-ex modules purple team.""" from kittysploit import import os from core.detection import...

Windows External Tool Runner

Upload a local binary or script to the target, execute it with operator-supplied arguments, and optionally download a remote output file. !/usr/bin/env python3 -- coding: utf-8 -- """ Upload a local operator tool to the target, execute it, and optionally pull an output artifact back through the...

HTTP SQLi Shell

Read-only SQL extraction via confirmed HTTP SQLi: union-based scalar or boolean-blind oracle. Starts Sqli pseudo-shell or runs singlesql. !/usr/bin/env python3 -- coding: utf-8 -- """ Generic HTTP SQL injection post-exploitation authorized testing only. After confirming SQLi scanner / manual,...