Spawn Reverse Shell Session

From the current session, open a reverse TCP listener lhost:lport and run a platform-appropriate one-liner so the target connects back; the new socket is registered as a separate shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ Spawn a second interactive shell session reverse TCP from...

GTP-U/GTP-C UDP detection

Detects GTP-U 2152 or GTP-C 2123 - 3GPP 4G/5G data/control plane. !/usr/bin/env python3 -- coding: utf-8 -- """Détection GTP-U / GTP-C UDP 2152 / 2123 - 3GPP 4G/5G user/control plane.""" import socket from kittysploit import from core.framework.option import OptPort from...

Telecom management interface detection

Detects telecom / 5G management UIs eNodeB, gNodeB, OSS, vendor panels. !/usr/bin/env python3 -- coding: utf-8 -- """Détection interfaces de gestion télécom eNodeB/gNodeB, OSS, équipementiers.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Server banner detection

Detects revealing Server or X-Powered-By headers version disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Détection bannières serveur / versions exposées.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Serve...

Kubernetes API detection

Detects exposed Kubernetes API version, namespaces, healthz. !/usr/bin/env python3 -- coding: utf-8 -- """Détection API Kubernetes exposée.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import lookslikekuberneteshealth,...

AWS S3 bucket detection

Detects S3 bucket or S3-style API ListBucketResult, NoSuchKey, AccessDenied XML. !/usr/bin/env python3 -- coding: utf-8 -- """Détection bucket S3 / API S3 exposée.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AWS ...

SMB null session

Detects if anonymous null SMB session is accepted. !/usr/bin/env python3 -- coding: utf-8 -- """Détection null session accès SMB anonyme.""" from kittysploit import from lib.protocols.smb.smbscannerclient import Smbscannerclient class ModuleScanner, Smbscannerclient: info = "name": "SMB null...

HTTP Methods Enumeration

Enumerates allowed HTTP methods via OPTIONS Allow header and active probes of basic methods. Flags risky methods PUT/DELETE/TRACE/CONNECT/PATCH. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate allowed HTTP methods OPTIONS Allow header + active probes.""" from kittysploit import from...

Directory listing detection

Detects if directory listing is enabled on the server. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHSTOCHECK = "/", "/images/", "/img/", "/assets/", "/static/", "/backup/", "/uploads/", "/files/", "/media/" class...

robots.txt / sitemap detection

Detects exposed robots.txt and sitemap references; reports interesting paths. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'robots.txt / sitemap detection', 'description':...

Security headers detection

Detects missing HTTP security headers X-Frame-Options, CSP, HSTS, etc.. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient Security headers that should ideally be present SECURITYHEADERS = "X-Frame-Options", "low", "Clickjacking...

Sensitive files detection

Detects exposed sensitive files .env, .git, backups, config, etc.. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient Paths to probe; path, validator. Validator: None = any 200, or callableresponse - bool SENSITIVEPATHS = ".env",...

AD foreign security principals in privileged groups

Detects FSPs from trusted domains in sensitive local groups. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Foreign Security Principals in privileged groups.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleScanner, Adclient: info = "name": "AD foreign...

AD shadow credentials

Detects accounts with msDS-KeyCredentialLink set PKINIT takeover possible. !/usr/bin/env python3 -- coding: utf-8 -- """Detect shadow credentials msDS-KeyCredentialLink on accounts.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleScanner, Adclient: info =...

AD unconstrained delegation

Detects computers and users trusted for unconstrained delegation. !/usr/bin/env python3 -- coding: utf-8 -- """Detect unconstrained delegation computers and users.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleScanner, Adclient: info = "name": "AD...

AD password policy

Detects weak domain password policy min length, lockout, history, reversible encryption. !/usr/bin/env python3 -- coding: utf-8 -- """Check AD password policy min length, lockout, history, reversible encryption.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from...

AD Kerberoastable accounts

Detects user accounts with SPNs Kerberoast targets. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Kerberoastable accounts users with SPNs.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from lib.protocols.ldap.adhelpers import UACDONTEXPIREPASSWD class...

Admin panel detection

Detects exposed admin or login panels. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient ADMINPATHS = "/admin", "/administrator", "/login", "/user/login", "/wp-admin", "/wp-login.php", "/manager", "/admin.php", "/backend",...

URL Headers & Tech

Fetches HTTP headers and detects server/tech hints from a URL. from kittysploit import import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'URL Headers & Tech', 'author': 'KittySploit Team',...

Detect Tor

Detect if the browser victim is behind Tor by loading an image from an onion URL BeEF-style -- coding: utf-8 -- from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Detect Tor", "description": "Detect if the browser victim is behind Tor by loading an image from an onion URL...