TP-Link Router LFI (CVE-2015-3035)

Exploits CVE-2015-3035 in TP-Link Archer/TL-WR routers: path traversal via /login/../../../ reads arbitrary local files including password stores. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link Archer local file inclusion CVE-2015-3035.""" import re from kittysploit import from...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

routeros_jailbreak

routerosjailbreak !/usr/bin/env python3 -- coding: utf-8 -- """routerosjailbreak""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'routerosjailbreak', 'description': 'routerosjailbreak', 'author': 'KittySploit Team',...

AD Shadow Credentials Auto

Runs Certipy shadow auto against an account and surfaces the resulting TGT/NT hash output. !/usr/bin/env python3 -- coding: utf-8 -- import os import shlex import shutil import subprocess from kittysploit import class ModulePost: info = "name": "AD Shadow Credentials Auto", "description": "Runs...

Kubernetes ServiceAccount Secret Reader

Reads a pod service-account token from a PHP session and uses it to query the Kubernetes API for secrets in a namespace. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import class ModulePost: info = "name": "Kubernetes ServiceAccount Secret Reader", "description": "Reads ...

GCP Cloud Run Env Vars Loot

Extract environment variables from Cloud Run services and jobs !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Run Env Vars Loot", "description": "Extract environment...

GCP Firestore Recursive Dump Loot

Recursively dump Firestore documents and nested subcollections from the default database !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firestore Recursive Dump Loot",...

GCP Cloud Build History Loot

Extract Cloud Build history, substitutions, images, and secret references !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Build History Loot", "description": "Extract Clou...