Sonicwall - Pre-Authentication Arbitrary File Read Detection

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

Hotel Druid 3.0.2 - Cross-Site Scripting Detection

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. !/usr/bin/env python3 -- coding: utf-8 -- """Hotel Druid 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Pi-hole Reflected XSS in 404-Error Page Detection

Pi-hole Admin Interface = 6.2.1 contains a reflected XSS vulnerability on the 404 error page. The URL path is reflected unsanitized into the class attribute of the body tag, allowing attribute injection via a crafted URL to execute arbitrary JavaScript in victim browsers. !/usr/bin/env python3 --...

KubeOperator Foreground `kubeconfig` - File Download Detection

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used t...

ThinkPHP 5.0.23 RCE (CVE-2018-20062)

Exploits CVE-2018-20062 in ThinkPHP 5.0.23 via calluserfuncarray in index/think\app/invokefunction for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.0.23 invokefunction RCE CVE-2018-20062.""" import re from kittysploit import from lib.protocols.http.httpclient...

Zerologon CVE-2020-1472 Detect

Detects CVE-2020-1472 Zerologon by attempting Netlogon NetrServerAuthenticate3 with all-zero credentials against the domain controller Netlogon RPC interface TCP/135 or 445. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zerologon Netlogon authentication bypass CVE-2020-1472.""" from...

Apache HTTPD - Optionsbleed Detection (CVE-2017-9798)

Detects CVE-2017-9798 by sending repeated OPTIONS requests and looking for malformed Allow headers double commas / numeric garbage. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OPTIONS Allow header memory leak / Optionsbleed CVE-2017-9798.""" import re from kittysploit import from...

Pega Infinity - Authentication Bypass Detection

Pega Infinity versions 8.2.1 through 8.5.2 contain an authentication bypass vulnerability because the password reset functionality for local accounts can be used to bypass local authentication checks. !/usr/bin/env python3 -- coding: utf-8 -- """Pega Infinity versions 8.""" from kittysploit impor...

Chyrp 2.x - Local File Inclusion Detection

A directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the action parameter to the default URI. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in Chyrp...

Payment Gateway for Telcell < 2.0.4 - Open Redirect Detection

The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue !/usr/bin/env python3 -- coding: utf-8 -- """The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Ope.""" import re fr...

FUDForum 3.1.0 - Cross-Site Scripting Detection

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUDForum 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting Detection

A cross-site scripting vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in the...

Swim Team <= v1.44.10777 - Local File Inclusion Detection

The program /wp-swimteam/include/user/download.php allows unauthenticated attackers to retrieve arbitrary files from the system. !/usr/bin/env python3 -- coding: utf-8 -- """The program /wp-swimteam/include/user/download.""" import re from kittysploit import from lib.protocols.http.httpclient...

Eyou E-Mail <3.6 - Remote Code Execution Detection

Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/iploginset/diploginget.php via the getloginipconfigfile function. !/usr/bin/env python3 -- coding: utf-8 -- """Eyou Mail System before 3.""" import re...

Toshiba TopAccess Panel - Detect

Detects Toshiba TopAccess Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Toshiba TopAccess Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Toshiba TopAccess Panel - Detect',...

Msmtp - Config Exposure Detection

Msmtp configuration was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Msmtp configuration was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Msmtp - Config Exposure Detection', 'description':...

Apache Tomcat Tribes EncryptInterceptor bypass (CVE-2026-34486)

Cleartext Tribes ChannelReceiver traffic may be deserialized after failed decryption EncryptInterceptor. Provide command CommonsCollections6, no JVM or serializedpath for a custom chain. Requires commons-collections 3.x on the target matching this gadget. !/usr/bin/env python3 -- coding: utf-8 --...

Zerologon DC Password Reset (CVE-2020-1472)

Exploits CVE-2020-1472 Zerologon: brute-forces NetrServerAuthenticate3 with all-zero credentials, then resets the domain controller machine account password to empty via NetrServerPasswordSet2. Enables DCSync with secretsdump using -hashes...

Stage Verify (PowerShell)

Verify staged artifact SHA256 before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify PowerShell", "description": "Verify staged artifact SHA256 before callback",...

OmniPCX - masterCGI RCE (CVE-2007-3010)

Exploits CVE-2007-3010 by injecting OS commands into the user parameter of /cgi-bin/masterCGI. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Alcatel-Lucent OmniPCX masterCGI RCE CVE-2007-3010 — execute session.""" from future import annotations import re from...

vsftpd - Compromised Package Backdoor Detection (CVE-2011-2523)

Detects CVE-2011-2523 by sending USER X: / PASS X then checking for a shell on TCP/6200 that responds to id. !/usr/bin/env python3 -- coding: utf-8 -- """vsftpd 2.3.4 backdoor CVE-2011-2523.""" import re import socket import time from kittysploit import from lib.protocols.tcp.tcpscannerclient...

vBulletin - decodeArguments RCE Detection (CVE-2015-7808)

Detects CVE-2015-7808 by sending a crafted serialized payload to /ajax/api/hook/decodeArguments that triggers phpinfo. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin 5.x pre-auth object injection RCE CVE-2015-7808.""" from urllib.parse import quote from kittysploit import from...

phpMyFAQ - Compromised Package Backdoor RCE (CVE-2010-4558)

Exploits CVE-2010-4558 by sending base64 PHP via phpmyfaqnew parameter. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ backdoor RCE CVE-2010-4558.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class...

MediaWiki CVE-2026-58025 Detect

Fingerprints MediaWiki and flags versions affected by CVE-2026-58025: LogEntryBase::extractParams called unserialize on user-controlled logparams from WikiImporter XML . Affected: Optionalbool: """Affected: 1 else 0 patch = parts2 if lenparts 2 else 0 if minor = 46: return False if minor == 45:...

Nginx HTTP Server Amazon Linux Detection

Detects Nginx HTTP Server Amazon Linux. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Nginx HTTP Server Amazon Linux.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx HTTP Server Amazon Linux Detection',...

Reflected XSS Detection

Reflected cross-site scripting vulnerability was discovered via generic testing. Manual testing is needed to verify exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected cross-site scripting vulnerability was discovered via generic testing.""" from kittysploit import from...

Uncanny Toolkit for LearnDash - Open Redirection Detection

A vulnerability in the WordPress Uncanny Toolkit for LearnDash Plugin allowed malicious actors to redirect users, posing a potential risk of phishing incidents. The issue has been resolved in version 3.6.4.4, and users are urged to update for security. !/usr/bin/env python3 -- coding: utf-8 -- ""...

Netscaler Gateway Detection

Citrix NetScaler is an application delivery controller that improves the delivery speed and quality of applications to an end user. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix NetScaler is an application delivery controller that improves the delivery speed and quality of applica.""" from...

NocoBase - Detect

NocoBase is an open source, extensibility-first, low-code platform for building business applications and enterprise solutions. !/usr/bin/env python3 -- coding: utf-8 -- """NocoBase is an open source, extensibility-first, low-code platform for building business applications and ente.""" from...

Apache mod_userdir CRLF injection Detection

Apache CRLF injection allowing HTTP response splitting attacks on sites using moduserdir. !/usr/bin/env python3 -- coding: utf-8 -- """Apache CRLF injection allowing HTTP response splitting attacks on sites using moduserdir.""" import re from kittysploit import from lib.protocols.http.httpclient...

Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect Detection

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. !/usr/bin/env python3 -- coding: utf-8 -- """In Apache HTTP server 2.""" impo...

DbGate Web Client Management - Panel Detect

The DbGate Web Client Management Panel is detected on the target system. !/usr/bin/env python3 -- coding: utf-8 -- """The DbGate Web Client Management Panel is detected on the target system.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

ChurchCRM Panel - Detect

ChurchCRM panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """ChurchCRM panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ChurchCRM Panel - Detect', 'description': 'ChurchCRM panel...

Joomla! Component com_rokdownloads - Local File Inclusion Detection

A directory traversal vulnerability in the RokDownloads comrokdownloads component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory...

Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion Detection

A directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. dot dot in the skin parameter. This can be leveraged to execute arbitrary code by obtaining LDAP...

WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure Detection

WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. !/usr/bin/env python3 -- coding: utf-8 -- """WordPres...

OX Appsuite - Cross-Site Scripting Detection

OX App Suite through 7.10.4 allows XSS via the app loading mechanism the PATHINFO to the /appsuite URI. !/usr/bin/env python3 -- coding: utf-8 -- """OX App Suite through 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

OpenEMR < 7.0.1 - Cross-Site Scripting Detection

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.""" from kittysploit import from lib.protocols.http.httpclient import...

Microsoft FTP Service - Detect

The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a client and server on a computer network. !/usr/bin/env python3 -- coding: utf-8 -- """The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a...

WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting Detection

WordPress Supsystic Ultimate Maps plugin before 1.2.5 contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of the tab parameter on the options page before outputting it in an attribute. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Supsyst...

Meteor.js Framework - Detect

Detects the presence of Meteor.js, an open-source isomorphic JavaScript web framework written using Node.js. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of Meteor.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

SysAid Login Panel - Detect

Detects the presence of a SysAid Help Desk Software login panel by identifying characteristic login pages, favicon hash, and system-specific content. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of a SysAid Help Desk Software login panel by identifying characteristic login...

Alert Manager - Unauthenticated Access Detection

Alert Manager was able to be accessed with no authentication requirements in place. !/usr/bin/env python3 -- coding: utf-8 -- """Alert Manager was able to be accessed with no authentication requirements in place.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Wallix Access Manager Panel - Detect

Wallix Access Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Wallix Access Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.osint.faviconhash import shodanmmh3 class ModuleScanner, Httpclient: info =...

SSH Authorized Keys File - Detect

SSH authorized keys file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SSH authorized keys file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SSH Authorized Keys File - Detect',...

Procfile Config - Detect

Procfile configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Procfile configuration information was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Procfile Config...

Ship Manager DNV - Panel Detection

Ship Manager DNV Login Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Ship Manager DNV Login Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ship Manager DNV - Panel Detection',...

Bitwarden Web Vault Detection

Detects Bitwarden Web Vault login panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Bitwarden Web Vault panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Bitwarden Web Vault Detection", "description":...

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting Detection

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

ETIC Telecom Device Login - Panel Detection

ETIC Telecom device login panel was discovered !/usr/bin/env python3 -- coding: utf-8 -- """ETIC Telecom device login panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ETIC Telecom Device Login -...