21 matches found
Citrix Bleed Session Token Steal (CVE-2023-4966)
Auxiliary module for CVE-2023-4966 Citrix Bleed: sends an oversized Host header to NetScaler OAuth endpoints to trigger an out-of-bounds memory read and capture leaked session cookies/tokens from the response body. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix Bleed session token leak...
Eaton IPM LFI (CVE-2018-12031)
Exploits CVE-2018-12031 in Eaton Intelligent Power Manager 1.6: directory traversal via nodeupgradesrv.js downloadFirmware reads /etc/passwd and more. !/usr/bin/env python3 -- coding: utf-8 -- """Eaton Intelligent Power Manager traversal LFI CVE-2018-12031.""" import re from kittysploit import fr...
ConnectWise ScreenConnect Guest Transfer (CVE-2026-84869)
Targets CVE-2026-84869 in ScreenConnect before 26.6.5.9742: guest file transfer without Host confirmation during active sessions. Validates vulnerable build markers and probes guest-accessible transfer endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """ConnectWise ScreenConnect guest file...
TP-Link Router LFI (CVE-2015-3035)
Exploits CVE-2015-3035 in TP-Link Archer/TL-WR routers: path traversal via /login/../../../ reads arbitrary local files including password stores. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link Archer local file inclusion CVE-2015-3035.""" import re from kittysploit import from...
D-Link DAP-1620 LFI (CVE-2021-46381)
Exploits CVE-2021-46381 in D-Link DAP-1620: path traversal via htmlresponsepage in POST /apply.cgi reads /etc/passwd and /etc/shadow without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-1620 apply.cgi traversal LFI CVE-2021-46381.""" import re from kittysploit import fr...
TVT NVMS-1000 Path Traversal (CVE-2019-20085)
Exploits CVE-2019-20085 in TVT NVMS-1000: GET /..%2F traversal reads arbitrary files from the DVR/NVR host. !/usr/bin/env python3 -- coding: utf-8 -- """TVT NVMS-1000 path traversal LFI CVE-2019-20085.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...
Misfortune Cookie
Exploit implementation for Misfortune Cookie Authentication Bypass vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Misfortune Cookie""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Misfortune...
TP-Link WDR842ND configure Disclosure
Module exploits TP-Link WDR842ND configure disclosure vulnerability which allows fetching configure. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR842ND configure Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...
routeros_jailbreak
routerosjailbreak !/usr/bin/env python3 -- coding: utf-8 -- """routerosjailbreak""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'routerosjailbreak', 'description': 'routerosjailbreak', 'author': 'KittySploit Team',...
Zyxel ZyWALL USG Extract Hashes
Exploit implementation for ZyWall USG 20 Authentication Bypass In Configuration Import/Export. If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations. !/usr/bin/env python3 ...
Zyxel Device - Export_Log File Read (CVE-2023-28770)
Reads arbitrary files via /ExportLog?/ on vulnerable Zyxel devices CVE-2023-28770. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel ExportLog unauthenticated file read CVE-2023-28770.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...
ARRIS Router - Arbitrary File Read (CVE-2022-31793)
Reads arbitrary files from ARRIS routers via GET /a/ CVE-2022-31793. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ARRIS router arbitrary file read via /a/ CVE-2022-31793.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...
Accellion FTA - statecode File Read (CVE-2015-2856)
Reads arbitrary files via CVE-2015-2856 statecode cookie LFI on /intermediatelogin.html. !/usr/bin/env python3 -- coding: utf-8 -- """Accellion FTA statecode cookie file disclosure CVE-2015-2856.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...
Turso / Upstash API Enumeration
Uses leaked Turso API tokens to list databases and Upstash Redis REST URL/token pairs to verify live cache access. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate Turso databases and Upstash Redis REST using leaked tokens. Follow-up for scanner/http/vibestacksecretsdetect. """ from...
Clerk / Auth0 Management API Enumeration
Uses leaked Clerk secret keys or Auth0 client credentials to enumerate users via Management APIs. Auto-discovers credentials from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate Clerk and Auth0 Management APIs using leaked secret keys. Follow-up for...
Convex / Appwrite / PocketBase API Enumeration
Enumerates PocketBase /api/collections, Appwrite /v1 databases, and Convex deployments discovered in client bundles. Auto-scrapes credentials when omitted. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate Convex, Appwrite, and PocketBase APIs from discovered credentials. Follow-up for...
Resend Email API Enumeration
Uses leaked Resend API keys re to list verified domains, sent emails, and API keys. Auto-discovers from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Resend domains, sent emails, and API keys using leaked re keys.""" from kittysploit import from lib.protocols.http.httpclient...
Strapi GraphQL Abuse
Probes Strapi GraphQL endpoints for open introspection and unauthenticated usersPermissionsUsers / users queries exposing emails. !/usr/bin/env python3 -- coding: utf-8 -- """Strapi GraphQL introspection and user enumeration.""" from kittysploit import from lib.protocols.http.httpclient import...
MAL-2026-13277 Malicious code in dlab_workshop (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 452b525d6d3fc409e081d5f8a6f052c7b3b9899d1f088a24d93e4be4de65c9cf The package's index.js reads installer-owned secret files from the home directory /.ssh/idrsa, /.ssh/ided25519, /.ssh/config, /.aws/credentials,...
