Netmaker - Hardcoded DNS Secret Key Detection

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Netmaker makes networks with WireGuard.""" from kittysploit import...

Firebase Cloud Messaging - Server Key Disclosure Detection

Detected Firebase Cloud Messaging FCM legacy server keys were identified in client-side files. These keys can be used to send push notifications to any device. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Firebase Cloud Messaging FCM legacy server keys were identified in client-side...

Google Api Private Key Detection

Google API private keys are exposed in files. !/usr/bin/env python3 -- coding: utf-8 -- """Google API private keys are exposed in files.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Google Api Private Key...

Jotform API Key Detection

Detects Jotform API Key. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jotform API Key.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jotform API Key Detection', 'description': 'Detects Jotform API...

Wpmudev Dashboard Pub Key Detection

Wpmudev Wordpress Plugin public key leaked. !/usr/bin/env python3 -- coding: utf-8 -- """Wpmudev Wordpress Plugin public key leaked.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wpmudev Dashboard Pub Key Detection...

SABnzbd - Unauthenticated Web Interface Access Detection

Detected SABnzbd found with the web interface accessible without authentication. The config page is exposed without login, leaking the API key, config file path, server parameters, and system information to unauthenticated users. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SABnzbd found...

TileServer GL <=3.0.0 - Cross-Site Scripting Detection

TileServer GL through 3.0.0 is vulnerable to reflected cross-site scripting via server.js because the content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page. !/usr/bin/env python3 -- coding: utf-8 -- """TileServer GL through 3.""" from...

Grafana Snapshot - Authentication Bypass Detection

Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by...

DigitalOcean Key Exposure via Axiom Detection

Axiom is a dynamic infrastructure framework to efficiently work with multi-cloud environments. !/usr/bin/env python3 -- coding: utf-8 -- """Axiom is a dynamic infrastructure framework to efficiently work with multi-cloud environments.""" from kittysploit import from lib.protocols.http.httpclient...

WordPress Church Admin 0.33.2.1 - Local File Inclusion Detection

WordPress Church Admin 0.33.2.1 is vulnerable to local file inclusion via the "key" parameter of plugins/church-admin/display/download.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Church Admin 0.""" import re from kittysploit import from lib.protocols.http.httpclient import...

SugarCRM 3.5.1 - Cross-Site Scripting Detection

SugarCRM 3.5.1 is vulnerable to cross-site scripting via phprint.php and a parameter name in the query string aka a $key variable. !/usr/bin/env python3 -- coding: utf-8 -- """SugarCRM 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure Detection

Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key RSA disclosure vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Reolink E1 Zoom Camera versions 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation Detection

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. !/usr/bin/env python3 -- coding: utf-8 -- """Zoom WordPress plugin 4.""" from...

Pinata API Key - Expose Detection

Detects Pinata API Key - Expose. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Pinata API Key - Expose.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pinata API Key - Expose Detection', 'description': 'Detec...

JSON Web Key File - Exposure Detection

Searches for JSON Web Key JWK file. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for JSON Web Key JWK file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JSON Web Key File - Exposure Detection',...

GL.iNET SSID Key Disclosure Detection

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key. !/usr/bin/env python3 -- coding: utf-8 -- """An issue was discovered on GL.""" from kittysploit import from lib.protocols.http.httpclient import...

Weglot API Key - Exposed Detection

Detected Weglot API key was found exposed in a publicly accessible JavaScript file. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Weglot API key was found exposed in a publicly accessible JavaScript file.""" import re from kittysploit import from lib.protocols.http.httpclient import...

WordPress Custom Tables 3.4.4 - Cross-Site Scripting Detection

WordPress Custom Tables 3.4.4 plugin contains a cross-site scripting vulnerability via the key parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Custom Tables 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Azure Instrumentation Key - Exposure Detection

Detected exposed Azure Application Insights Instrumentation Keys classic ikey format in HTTP responses, which allowed anyone to send telemetry data and, in some older configurations, could enable read access via undocumented or legacy APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Detected...

Splunk <=7.0.1 - Information Disclosure Detection

Splunk through 7.0.1 is susceptible to information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key. !/usr/bin/env python3 -- coding: utf-8 -- """Splunk through 7.""" from kittysploit import from...