OpenVPN Access Server 2.1.4 - CRLF Injection Detection

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently conduct session fixation attacks and possibly HTTP response splitting attacks via "%0A" characters in the PATHINFO to sessionstart/...

Server Status Disclosure Detection

Apache Server Status page is exposed, which may contain information about pages visited by the users, their IPs or sensitive information such as session tokens. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Server Status page is exposed, which may contain information about pages visited by...

EvilGinx - Detect

Evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies which in turn allows bypassing 2-factor authentication protection. !/usr/bin/env python3 -- coding: utf-8 -- """Evilginx2 is a man-in-the-middle attack framework used for phishing logi...

FullStory RUM - Detect

Detects FullStory Session Replay & Digital Experience Intelligence artifacts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FullStory Session Replay & Digital Experience Intelligence artifacts.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Hotjar RUM - Detect

Detects Hotjar Web Analytics & Session Recording artifacts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Hotjar Web Analytics & Session Recording artifacts.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Laravel Sessions Folder Exposure Detection

Detected unauthenticated access to the Laravel session storage directory, allowing attackers to browse and download session files that may contain active authentication tokens, CSRF tokens, and serialized user data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected unauthenticated access to t...

LogRocket RUM - Detect

Detects LogRocket Session Replay & Frontend Monitoring artifacts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects LogRocket Session Replay & Frontend Monitoring artifacts.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Qlik Sense Enterprise - Path Traversal Detection

A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous...

Zhiyuan OA Session Leak Detection

A vulnerability in Zhiyuan OA allows remote unauthenticated users access to sensitive session information via the 'getSessionList.jsp' endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Zhiyuan OA allows remote unauthenticated users access to sensitive session information v...

WordPress Adivaha Travel Plugin 2.3 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing a...

RentEquip Multipurpose Rental 1.0 - Cross Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

Joomla JoomBri Careers 3.3.0 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

News Script Pro 2.4 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

Bitrix Site Manager - Log File Disclosure Detection

Detected Bitrix Site Manager log files, potentially exposing sensitive information including database credentials, file paths, SQL queries, and user session data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Bitrix Site Manager log files, potentially exposing sensitive information...

Wpdm-Cache Session Detection

Leaked session of Wpdm Cache wordpress plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Leaked session of Wpdm Cache wordpress plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wpdm-Cache Session Detection'...

OpenReplay RUM - Tech Detect

Detects OpenReplay formerly Asayer Session Replay & RUM SDK implementation. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenReplay formerly Asayer Session Replay & RUM SDK implementation.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Nortek Linear eMerge E3-Series - Cross-Site Scripting Detection

There is a local session fixation vulnerability that, when chained with cross-site scripting, leads to account take over of admin or a lower privileged user. !/usr/bin/env python3 -- coding: utf-8 -- """There is a local session fixation vulnerability that, when chained with cross-site scripting,...

ClinicCases 7.3.3 Cross-Site Scripting Detection

ClinicCases 7.3.3 is susceptible to multiple reflected cross-site scripting vulnerabilities that could allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft. !/usr/bin/env python3 -- coding: utf-8...

Webkul QloApps 1.6.0 - Cross-site Scripting Detection

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. !/usr/bin/env python3 -- coding: utf-8 -- """An unauthenticated Cross-Site Scripting XSS...

Sharp Multifunction Printers - Cookie Exposure Detection

It was observed that Sharp printers are vulnerable to a listing of session cookies without authentication. Any attacker can list valid cookies by visiting a backdoor webpage and use them to authenticate to the printers. !/usr/bin/env python3 -- coding: utf-8 -- """It was observed that Sharp...