LDAP Add Service Principal Name

Add or remove an SPN on a target account to enable Kerberoast or RBCD prep chains from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient class ModulePost, LdapPostClient: info = "name": "LDAP Add Service Principal Name", "description": "Add or remove an SPN on a targ...

Enumerate MongoDB Collections

Enumerate MongoDB databases, collections, and optional document samples from kittysploit import from lib.protocols.mongodb.mongodbclient import MongoDBClient class ModulePost, MongoDBClient: info = "name": "Enumerate MongoDB Collections", "description": "Enumerate MongoDB databases, collections,...

PowerShell Stager Evasion

Writes a PowerShell backdoor with optional AMSI bypass and ETW patch. Supports reverse-shell mode or shellcode stager mode VirtualAlloc + CreateThread. !/usr/bin/env python3 -- coding: utf-8 -- """ PowerShell stager with AMSI/ETW evasion prelude. Generates a .ps1 script with optional in-process...

Windows Disable PowerShell Logging

Disable PowerShell Script Block, Module, and Transcription logging. Modes: registry admin GPO keys or sessioncache in-process cachedGroupPolicySettings + PS ETW provider — no admin required. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.stagerevasion import...

SharePoint Detection

Detects SharePoint REST API, layouts, and Microsoft 365 markers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft SharePoint and SharePoint Online.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

RDP Service Detection

Detects RDP service via TPKT/X.224 pre-auth handshake. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft Remote Desktop RDP service on TCP 3389.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.rdp.detectors import proberdp...

Search Engine Footprint

Run passive search-engine dorks site:, filetype:, inurl: and collect indexed URLs, titles, and sensitive path hints. !/usr/bin/env python3 -- coding: utf-8 -- """Passive search-engine footprinting via HTML search results.""" from future import annotations import json import re from typing import...

Username Search

Check social platforms for likely username existence using the cached WhatsMyName site catalog with trusted-site filtering. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate social-media accounts for a username via the WhatsMyName catalog.""" from future import annotations import json import...

SSL/TLS Configuration Audit

Audit a live TLS service: negotiated protocol and cipher, certificate chain metadata SAN, expiry, issuer, hostname coverage, weak/legacy TLS signals, and optional trust-store validation. !/usr/bin/env python3 -- coding: utf-8 -- """Live SSL/TLS configuration audit for TCP services.""" from future...

SNMP Community Probe

Tests common SNMP v1/v2c communities and collects basic system information. !/usr/bin/env python3 -- coding: utf-8 -- """Probe SNMP communities and enumerate basic system information.""" from future import annotations import json from kittysploit import from lib.protocols.snmp.snmpclient import...

Linux Debian Evasion Packaging

Generate an obfuscated .deb package whose postinst decodes and executes an embedded encrypted ELF loader. Extends debpackaging for stealth delivery. !/usr/bin/env python3 -- coding: utf-8 -- """ Obfuscated Debian package with embedded loader. Builds an encrypted ELF shellcode loader, embeds it...

Encrypted Shellcode Dropper Evasion

Generate a Windows x64 EXE that decrypts embedded shellcode in memory and executes it via VirtualAlloc/VirtualProtect/CreateThread. Uses ChaCha20 or RC4 encryption with optional pre-execution sleep. !/usr/bin/env python3 -- coding: utf-8 -- """ Encrypted shellcode dropper Win32 API. Minimal Windo...

Process Hollowing Evasion

Generate a Windows x64 EXE that hollows a suspended process default: notepad.exe, replaces its memory with decrypted shellcode, and resumes the primary thread. !/usr/bin/env python3 -- coding: utf-8 -- """ Process hollowing evasion loader. Creates a suspended child process, unmaps its original...

sRDI Reflective DLL Evasion

Generate a Windows x64 EXE that embeds sRDI-converted shellcode. Raw payload is wrapped in a minimal DLL, converted to reflective loader shellcode, encrypted ChaCha20/RC4, and executed in-process. !/usr/bin/env python3 -- coding: utf-8 -- """ Self-reflective DLL injection sRDI evasion loader. Wra...

Clipboard Monitor

Monitor clipboard copy/cut/paste events and poll readable clipboard text from the victim browser from kittysploit import import json import time import uuid class ModuleBrowserAuxiliary: info = "name": "Clipboard Monitor", "description": "Monitor clipboard copy/cut/paste events and poll readable...

History Dump

Collect navigation history signals available to JavaScript Performance API, referrer, history.length from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "History Dump", "description": "Collect navigation history signals available to JavaScript Performance API, referre...

IndexedDB Dump

Extract databases, object stores and records from IndexedDB from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "IndexedDB Dump", "description": "Extract databases, object stores and records from IndexedDB", "author": "KittySploit Team", "browser": Browser.ALL,...

WebAuthn Probe

Detect WebAuthn / passkey support and platform authenticator availability from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "WebAuthn Probe", "description": "Detect WebAuthn / passkey support and platform authenticator availability", "author": "KittySploit Team",...

S7comm Client

Connects to a Siemens S7 PLC and creates an interactive S7comm shell session !/usr/bin/env python3 -- coding: utf-8 -- """S7comm bind listener — opens an ISO-on-TCP session to a Siemens PLC.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Reverse QUIC C2 Listener

Reverse QUIC/TLS 1.3 listener for KittySploit implants ALPN kitty-quic. Supports shell commands, file upload/download, and shellcode execution. !/usr/bin/env python3 -- coding: utf-8 -- """Reverse QUIC C2 listener for compatible implants ALPN kitty-quic.""" from kittysploit import import asyncio...