Laravel Ignition RCE (CVE-2021-3129)

Exploits CVE-2021-3129 in Laravel Ignition via log poisoning and PHPGGC deserialization chains to execute arbitrary system commands. !/usr/bin/env python3 -- coding: utf-8 -- from pathlib import Path from kittysploit import from lib.exploits.laravel.ignition import buildsolutionpayload,...

WiFi Probe Request Scanner

Capture 802.11 probe requests on a monitor-mode interface to reveal SSID names including hidden networks and client MAC addresses. !/usr/bin/env python3 -- coding: utf-8 -- """Sniff 802.11 probe requests to discover SSIDs and probing clients.""" from future import annotations from typing import...

Check PostgreSQL Hardening

Audit common PostgreSQL security misconfigurations from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Check PostgreSQL Hardening", "description": "Audit common PostgreSQL security misconfigurations",...

NocoBase Workflow Script Node VM Sandbox Escape RCE

Exploits CVE-2026-34156 in NocoBase Workflow Script Node. The module leverages an exposed host-realm WritableWorkerStdio stream object console.stdout / console.stderr to traverse the prototype chain, obtain the host-realm's Function constructor, and execute arbitrary commands bypassing the Node.j...

Breach Exposure Score

Estimate exposure risk for a domain/email using passive public breach signals. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Breach Exposure Score", "author":...

x64 Polymorphic XOR Encoder

A fully polymorphic XOR encoder that generates a randomized, dependency-free decoder stub on the fly to bypass static signatures. !/usr/bin/env python3 -- coding: utf-8 -- import os import random from kittysploit import from lib.compile.minix64 import MiniX64 class ModuleEncoder, MiniX64: info =...

Generex CS141 CVE-2022-47187 - XSS via File Upload

Generex UPS CS141 below 2.06 allows unauthenticated upload of HTML content into the upload directory, enabling stored XSS when a victim opens the uploaded file. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.cs141 import CS141 class...

Jumbo Website Manager v1.3.7 Authenticated RCE (PHAR upload)

Authenticated RCE via backup manager upload PK + PHP in PHAR. Logs in, uploads the payload, then issues HTTP GET requests to likely paths under backupmanager/fileupload/uploads/ so the PHAR runs and the PHP reverse payload can connect back — use with payloads/singles/cmd/php/reversetcp and the...

Server banner detection

Detects revealing Server or X-Powered-By headers version disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Détection bannières serveur / versions exposées.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Serve...

AWS CloudFront detection

Detects AWS CloudFront CDN X-Amz-Cf- headers or CloudFront error pages. !/usr/bin/env python3 -- coding: utf-8 -- """Détection AWS CloudFront / CDN Amazon.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AWS CloudFro...

HTTP Methods Enumeration

Enumerates allowed HTTP methods via OPTIONS Allow header and active probes of basic methods. Flags risky methods PUT/DELETE/TRACE/CONNECT/PATCH. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate allowed HTTP methods OPTIONS Allow header + active probes.""" from kittysploit import from...

IP Reverse DNS

Retrieves PTR reverse DNS hostnames for an IP address. from kittysploit import import dns.resolver import dns.reversename import ipaddress class ModuleAuxiliary: info = 'name': 'IP Reverse DNS', 'author': 'KittySploit Team', 'description': 'Retrieves PTR reverse DNS hostnames for an IP address.',...

Install Python for Windows

Downloads and extracts an embeddable Python3 distribution onto the target !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.post.windows.session import wincompatfailuretype, winprobepowershell import os import...

Windows UAC Bypass

Bypasses User Account Control UAC using various techniques to obtain administrator privileges !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import os import tempfile import time class ModulePost: info = "name": "Windows UAC Bypass", "description": "Bypasses User Account Contro...

AlchemyCMS Authenticated eval() RCE

Authenticated Remote Code Execution RCE via unsafe eval in resourceurlproxy helper. The helper method Alchemy::ResourcesHelperresourceurlproxy in app/helpers/alchemy/resourceshelper.rb insecurely processes the enginename attribute from a resourcehandler object, passing it directly to Ruby eval...

PowerShell Command Shell, Reverse TCP

Connect back and create a command shell via PowerShell !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 from lib.c2.stagerevasion import powershellprelude from lib.c2.tcpresilience import buildpowershellreconnectwrapper, parsecoverendpoints class ModulePayload:...

WordPress MySQL Connection

Extract MySQL credentials from wp-config.php and create MySQL session from kittysploit import import re class ModulePost: info = "name": "WordPress MySQL Connection", "description": "Extract MySQL credentials from wp-config.php and create MySQL session", "author": "KittySploit Team", "sessiontype...

FTP Delete File

Deletes files or directories from the FTP server !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os class ModulePost, FTPClientMixin: """FTP File Deletion Module""" info = "name": "FTP Delete File", "description":...

Keylogger

Log keystrokes from browser victim and receive them in real-time from kittysploit import import time class ModuleBrowserAuxiliary: info = "name": "Keylogger", "description": "Log keystrokes from browser victim and receive them in real-time", "author": "KittySploit Team", "browser": Browser.ALL,...

Linux Gather Configurations

Linux Gather Configurations with enumeration of configuration files from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Gather Configurations", "description": "Linu...

Windows Gather System Information

Enumerates Windows system information including OS details, users, processes, services, network configuration, and security settings !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re class ModulePost: """Windows System Enumeration Module""" info = "name": "Windows Gather...

Linux Port Forwarding

Create port forwards through a compromised Linux session for network pivoting from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import socket import threading import time class ModulePost, System, LinuxSessionMixin: info = "name"...

Windows WSL Alpine Relay

Reuses existing WSL distributions when possible, otherwise installs Alpine, then deploys a resilient reverse relay with persistence. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 import textwrap import time class ModulePost: """Deploy and persist a reverse relay...

FTP Gather System Information

Gathers detailed system information from FTP server including version, features, and capabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import socket import re class ModulePost, FTPClientMixin: """FTP System...

FTP Server Enumeration Scanner

Connect to FTP server and enumerate files, directories and server information Direct mode - no session required !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPOptions, FTPClientMixin class ModuleAuxiliary, FTPClientMixin: """ FTP Serve...

Android Extract Contact

Extract contacts from an Android device from kittysploit import import re class ModulePost: info = 'name': 'Android Extract Contact', 'description': 'Extract contacts from an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects'...

Android Reboot

Reboot an Android device from kittysploit import class ModulePost: info = 'name': 'Android Reboot', 'description': 'Reboot an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2,...

Drupal Vulnerability Scanner

Scans for Drupal-specific vulnerabilities, version information, exposed files, and security misconfigurations !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re import urllib.parse class ModuleAuxiliary, Httpclient: inf...

API Fuzzer

Fuzzes API endpoints to discover vulnerabilities, misconfigurations, exposed endpoints, and test various HTTP methods !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import...

Joomla RCE

Remote Code Execution exploit for Joomla vulnerabilities including template injection and file upload vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse class ModuleExploit, Httpclient: info =...

PHP RCE

Remote Code Execution exploit for PHP applications including code injection, command injection, and file inclusion vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse import base64 class...

Apache Vulnerability Scanner

Scans for Apache-specific vulnerabilities, version information, misconfigurations, and exposed sensitive files !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re import urllib.parse class ModuleAuxiliary, Httpclient: in...

404 bypass tester

Try to bypass 404 on a web resource. Candidates that merely collapse to the homepage e.g. /admin/../ are discarded. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.bypassconfirm import isconfirmedbypass...

Fortinet FortiWeb CVE-2025-64446 Authentication Bypass

FortiWeb v8.0.0 - Authentication bypass via CGI parsing vulnerability allowing unauthorized admin access CVE-2025-64446 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import json import base64 import random import string clas...

Enumerate AWS EC2

Enumerate EC2 instances, security groups, and related resources !/usr/bin/env python3 -- coding: utf-8 -- """ AWS EC2 Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates EC2 instances, security groups, and related resources. """ from kittysploit import import json fr...

JavaScript CharCode Encoder

Encodes JavaScript using String.fromCharCode with numeric ASCII values from kittysploit import class ModuleEncoder: info = "name": "JavaScript CharCode Encoder", "description": "Encodes JavaScript using String.fromCharCode with numeric ASCII values", "author": "KittySploit Team", "platform":...

Adive Framework 2.0.7

Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users editor or developer to create an administrator account via admin/user/add from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.httplogin import Httplogin class...

D-Link DIR-605 CSRF

D-Link DIR-605 router - Change admin password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DIR-605 CSRF", "description": "D-Link DIR-605 router - Change admin password via CSRF POST", "author": "KittySplo...

WordPress Plugin Backdoor

Generate a WordPress plugin backdoor that can be installed in wp-content/plugins/ from kittysploit import import zipfile import os class ModuleBackdoor: info = 'name': 'WordPress Plugin Backdoor', 'description': 'Generate a WordPress plugin backdoor that can be installed in wp-content/plugins/',...

PHP 8.1.0-dev (backdoor)

PHP 8.1.0-dev backdoor from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = 'name': 'PHP 8.1.0-dev backdoor', 'description': 'PHP 8.1.0-dev backdoor', 'cve': '', 'platform': Platform.ALL, 'arch': Arch.X64, Arch.X86, 'payload':...

Wordpress Plugin Ajax Multi Upload 1.1 - Shell Upload

WordPress Plugin Ajax Multi Upload is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context o...

Wordpress plugin - 1 Flash Gallery

1 Flash Gallery Wordpress Plugin File Upload Exploit from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = "name": "Wordpress plugin - 1 Flash Gallery", "description": "1 Flash Gallery Wordpress Plugin File Upload Exploit", "cve": "",...

Unix Command Shell, Reverse TCP (via Python)

Connect back and create a command shell via Python Linux/Unix only; use singles/cmd/windows/pythonreversetcp on Windows from kittysploit import from lib.shell.ptyruntime import buildunixptyscript class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Unix Command Shell, Reverse TCP via...

PHP 7.0-7.3 disable_functions bypass

PHP 7.0-7.3 disablefunctions bypass using UAF vulnerability from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.0-7.3 disablefunctions bypass", "description": "PHP 7.0-7.3 disablefunctions bypass using UAF...

Enumerate AWS Secrets

Enumerate secrets from AWS Secrets Manager and Systems Manager Parameter Store !/usr/bin/env python3 -- coding: utf-8 -- """ AWS Secrets Manager Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates secrets from AWS Secrets Manager and Parameter Store. """ from...

DVWA - Damn Vulnerable Web Application

Start a Docker environment containing DVWA for security web tests !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = 'name': 'DVWA - Damn Vulnerable Web Application', 'description': 'Start a Docker environment containing DVWA for security web...

TBK DVR Auth Bypass (CVE-2018-9995)

Exploits CVE-2018-9995 in TBK/rebranded DVRs: Cookie uid=admin bypasses auth and /device.rsp?opt=user&cmd=list returns all user credentials in JSON. !/usr/bin/env python3 -- coding: utf-8 -- """TBK DVR cookie auth bypass credential leak CVE-2018-9995.""" import json from kittysploit import from...

WAVLINK Router Credential Leak (CVE-2022-31847)

Exploits CVE-2022-31847 in WAVLINK WN579: unauthenticated GET to /cgi-bin/ExportAllSettings.sh exposes admin Login/Password and Wi-Fi keys. !/usr/bin/env python3 -- coding: utf-8 -- """WAVLINK ExportAllSettings credential leak CVE-2022-31847.""" from kittysploit import from...

XiongMai uc-httpd Overflow (CVE-2018-10088)

Exploits CVE-2018-10088 in XiongMai uc-httpd 1.0.0 used in many IP cameras/DVRs: stack buffer overflow via oversized HTTP headers. Verifies uc-httpd surface and sends the canonical overflow trigger arch-specific shellcode may be required. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai...

Apache Struts2 Content-Type OGNL RCE (CVE-2017-5638)

Exploits CVE-2017-5638 in Apache Struts 2.3.x/2.5.x via OGNL injection in the Content-Type header Jakarta multipart parser. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 Jakarta multipart OGNL RCE CVE-2017-5638.""" import re from kittysploit...