TileServer API - Cross Site Scripting Detection

tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting XSS vulnerability via the component /data/v3/?key. !/usr/bin/env python3 -- coding: utf-8 -- """tileserver-gl up to v4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

SugarCRM 3.5.1 - Cross-Site Scripting Detection

SugarCRM 3.5.1 is vulnerable to cross-site scripting via phprint.php and a parameter name in the query string aka a $key variable. !/usr/bin/env python3 -- coding: utf-8 -- """SugarCRM 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure Detection

Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key RSA disclosure vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Reolink E1 Zoom Camera versions 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation Detection

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. !/usr/bin/env python3 -- coding: utf-8 -- """Zoom WordPress plugin 4.""" from...

Pinata API Key - Expose Detection

Detects Pinata API Key - Expose. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Pinata API Key - Expose.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pinata API Key - Expose Detection', 'description': 'Detec...

JSON Web Key File - Exposure Detection

Searches for JSON Web Key JWK file. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for JSON Web Key JWK file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JSON Web Key File - Exposure Detection',...

Azure Instrumentation Key - Exposure Detection

Detected exposed Azure Application Insights Instrumentation Keys classic ikey format in HTTP responses, which allowed anyone to send telemetry data and, in some older configurations, could enable read access via undocumented or legacy APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Detected...

Splunk <=7.0.1 - Information Disclosure Detection

Splunk through 7.0.1 is susceptible to information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key. !/usr/bin/env python3 -- coding: utf-8 -- """Splunk through 7.""" from kittysploit import from...

AWS Secret Key Detection

Detects AWS Access Key ID + Secret Key co-occurring in HTTP responses. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AWS Secret Key.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWS Secret Key...

GL.iNET SSID Key Disclosure Detection

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key. !/usr/bin/env python3 -- coding: utf-8 -- """An issue was discovered on GL.""" from kittysploit import from lib.protocols.http.httpclient import...

Weglot API Key - Exposed Detection

Detected Weglot API key was found exposed in a publicly accessible JavaScript file. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Weglot API key was found exposed in a publicly accessible JavaScript file.""" import re from kittysploit import from lib.protocols.http.httpclient import...

WordPress Custom Tables 3.4.4 - Cross-Site Scripting Detection

WordPress Custom Tables 3.4.4 plugin contains a cross-site scripting vulnerability via the key parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Custom Tables 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Detect Private Key on STEM Audio Table

Private Key on STEM audio table was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Private Key on STEM audio table was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Detect Private Key on STEM Audi...

Cipher Secret Key Exposure Detection

Detects Cipher Secret Key Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Cipher Secret Key Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cipher Secret Key Exposure Detection', 'description...

UpdraftPlus Plugin Pem Key Detection

UpdraftPlus wordpress plugin private key leaked with directory listing. !/usr/bin/env python3 -- coding: utf-8 -- """UpdraftPlus wordpress plugin private key leaked with directory listing.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

WordPress Product Slider Pro - Supply Chain Backdoor RCE

Compromised Product Slider Pro builds execute attacker-controlled expressions via X-Cache-Status/X-Cache-Key headers. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Product Slider Pro for WooCommerce - Supply Chain Backdoor RCE""" import base64 import secrets from kittysploit import from...

Firebase / Google Browser API Key Analysis

Scrape exposed Google browser API keys AIza... from JS/HTML, then probe Identity Toolkit getProjectConfig to see if the key is live and which project it belongs to. Useful against SPAs that leak Firebase web configs. !/usr/bin/env python3 -- coding: utf-8 -- """Extract Google/Firebase browser API...

GoCd Encryption Key Detection

GoCd Encryption Key is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """GoCd Encryption Key is exposed.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GoCd Encryption Key Detection', 'description':...

Remita Merchant ID & API Key - Exposure Detection

Detected exposed Remita merchant IDs, API keys, and secret hashes in application source code, configuration files, or publicly accessible assets. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Remita merchant IDs, API keys, and secret hashes in application source code, configuratio...

Private key exposure via helper detector

Searches for private key exposure by attempting to query the helper endpoint on nodemodules !/usr/bin/env python3 -- coding: utf-8 -- """Searches for private key exposure by attempting to query the helper endpoint on nodemodules.""" from kittysploit import from lib.protocols.http.httpclient impor...