Sonicwall - Pre-Authentication Arbitrary File Read Detection

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

Apache HTTPD - Optionsbleed Detection (CVE-2017-9798)

Detects CVE-2017-9798 by sending repeated OPTIONS requests and looking for malformed Allow headers double commas / numeric garbage. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OPTIONS Allow header memory leak / Optionsbleed CVE-2017-9798.""" import re from kittysploit import from...

Pi-hole Reflected XSS in 404-Error Page Detection

Pi-hole Admin Interface = 6.2.1 contains a reflected XSS vulnerability on the 404 error page. The URL path is reflected unsanitized into the class attribute of the body tag, allowing attribute injection via a crafted URL to execute arbitrary JavaScript in victim browsers. !/usr/bin/env python3 --...

KubeOperator Foreground `kubeconfig` - File Download Detection

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used t...

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting Detection

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

Apache mod_userdir CRLF injection Detection

Apache CRLF injection allowing HTTP response splitting attacks on sites using moduserdir. !/usr/bin/env python3 -- coding: utf-8 -- """Apache CRLF injection allowing HTTP response splitting attacks on sites using moduserdir.""" import re from kittysploit import from lib.protocols.http.httpclient...

Hotel Druid 3.0.2 - Cross-Site Scripting Detection

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. !/usr/bin/env python3 -- coding: utf-8 -- """Hotel Druid 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect Detection

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. !/usr/bin/env python3 -- coding: utf-8 -- """In Apache HTTP server 2.""" impo...

Apache Tomcat Tribes EncryptInterceptor bypass (CVE-2026-34486)

Cleartext Tribes ChannelReceiver traffic may be deserialized after failed decryption EncryptInterceptor. Provide command CommonsCollections6, no JVM or serializedpath for a custom chain. Requires commons-collections 3.x on the target matching this gadget. !/usr/bin/env python3 -- coding: utf-8 --...

ThinkPHP 5.0.23 RCE (CVE-2018-20062)

Exploits CVE-2018-20062 in ThinkPHP 5.0.23 via calluserfuncarray in index/think\app/invokefunction for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.0.23 invokefunction RCE CVE-2018-20062.""" import re from kittysploit import from lib.protocols.http.httpclient...

Zerologon CVE-2020-1472 Detect

Detects CVE-2020-1472 Zerologon by attempting Netlogon NetrServerAuthenticate3 with all-zero credentials against the domain controller Netlogon RPC interface TCP/135 or 445. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zerologon Netlogon authentication bypass CVE-2020-1472.""" from...

Stage Verify (PowerShell)

Verify staged artifact SHA256 before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify PowerShell", "description": "Verify staged artifact SHA256 before callback",...

Miele Professional PG 8528 Path Traversal

Module exploits Miele Professional PG 8528 Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Miele Professional PG 8528 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

Home Assistant - Supervisor Auth Bypass Detection (CVE-2023-27482)

Home Assistant supervised installs are vulnerable to authentication bypass via path traversal under /api/hassio/app/ and /api/hassioingress/ CVE-2023-27482, exposing supervisor/core info without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Home Assistant Supervisor authentication...

Alert Manager - Unauthenticated Access Detection

Alert Manager was able to be accessed with no authentication requirements in place. !/usr/bin/env python3 -- coding: utf-8 -- """Alert Manager was able to be accessed with no authentication requirements in place.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Pega Infinity - Authentication Bypass Detection

Pega Infinity versions 8.2.1 through 8.5.2 contain an authentication bypass vulnerability because the password reset functionality for local accounts can be used to bypass local authentication checks. !/usr/bin/env python3 -- coding: utf-8 -- """Pega Infinity versions 8.""" from kittysploit impor...

Chyrp 2.x - Local File Inclusion Detection

A directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F encoded dot dot slash in the action parameter to the default URI. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in Chyrp...

Payment Gateway for Telcell < 2.0.4 - Open Redirect Detection

The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue !/usr/bin/env python3 -- coding: utf-8 -- """The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Ope.""" import re fr...

FUDForum 3.1.0 - Cross-Site Scripting Detection

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUDForum 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting Detection

A cross-site scripting vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in the...

Swim Team <= v1.44.10777 - Local File Inclusion Detection

The program /wp-swimteam/include/user/download.php allows unauthenticated attackers to retrieve arbitrary files from the system. !/usr/bin/env python3 -- coding: utf-8 -- """The program /wp-swimteam/include/user/download.""" import re from kittysploit import from lib.protocols.http.httpclient...

Eyou E-Mail <3.6 - Remote Code Execution Detection

Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/iploginset/diploginget.php via the getloginipconfigfile function. !/usr/bin/env python3 -- coding: utf-8 -- """Eyou Mail System before 3.""" import re...

Toshiba TopAccess Panel - Detect

Detects Toshiba TopAccess Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Toshiba TopAccess Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Toshiba TopAccess Panel - Detect',...

Msmtp - Config Exposure Detection

Msmtp configuration was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Msmtp configuration was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Msmtp - Config Exposure Detection', 'description':...

Zerologon DC Password Reset (CVE-2020-1472)

Exploits CVE-2020-1472 Zerologon: brute-forces NetrServerAuthenticate3 with all-zero credentials, then resets the domain controller machine account password to empty via NetrServerPasswordSet2. Enables DCSync with secretsdump using -hashes...

Stage Cache (PowerShell)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

OmniPCX - masterCGI RCE (CVE-2007-3010)

Exploits CVE-2007-3010 by injecting OS commands into the user parameter of /cgi-bin/masterCGI. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Alcatel-Lucent OmniPCX masterCGI RCE CVE-2007-3010 — execute session.""" from future import annotations import re from...

Linksys SMART WiFi Password Disclosure

Exploit implementation for Linksys SMART WiFi Password Disclosure vulnerability. If target is vulnerable administrator's MD5 passsword is retrieved. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys SMART WiFi Password Disclosure""" import re from kittysploit import from...

vsftpd - Compromised Package Backdoor Detection (CVE-2011-2523)

Detects CVE-2011-2523 by sending USER X: / PASS X then checking for a shell on TCP/6200 that responds to id. !/usr/bin/env python3 -- coding: utf-8 -- """vsftpd 2.3.4 backdoor CVE-2011-2523.""" import re import socket import time from kittysploit import from lib.protocols.tcp.tcpscannerclient...

vBulletin - decodeArguments RCE Detection (CVE-2015-7808)

Detects CVE-2015-7808 by sending a crafted serialized payload to /ajax/api/hook/decodeArguments that triggers phpinfo. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin 5.x pre-auth object injection RCE CVE-2015-7808.""" from urllib.parse import quote from kittysploit import from...

phpMyFAQ - Compromised Package Backdoor RCE (CVE-2010-4558)

Exploits CVE-2010-4558 by sending base64 PHP via phpmyfaqnew parameter. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ backdoor RCE CVE-2010-4558.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class...

MediaWiki CVE-2026-58025 Detect

Fingerprints MediaWiki and flags versions affected by CVE-2026-58025: LogEntryBase::extractParams called unserialize on user-controlled logparams from WikiImporter XML . Affected: Optionalbool: """Affected: 1 else 0 patch = parts2 if lenparts 2 else 0 if minor = 46: return False if minor == 45:...

ONVIF Client

Discovers an ONVIF device service, loads Media/PTZ/Events capabilities, and creates an interactive ONVIF shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ONVIF bind listener — opens an interactive ONVIF camera session.""" from kittysploit import from lib.protocols.onvif.client import...

Nginx HTTP Server Amazon Linux Detection

Detects Nginx HTTP Server Amazon Linux. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Nginx HTTP Server Amazon Linux.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx HTTP Server Amazon Linux Detection',...

Kube API Version Detection

Searches for exposed Kubernetes API servers which return version information unauthenticated !/usr/bin/env python3 -- coding: utf-8 -- """Searches for exposed Kubernetes API servers which return version information unauthenticated.""" from kittysploit import from lib.protocols.http.httpclient...

Reflected XSS Detection

Reflected cross-site scripting vulnerability was discovered via generic testing. Manual testing is needed to verify exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected cross-site scripting vulnerability was discovered via generic testing.""" from kittysploit import from...

DbGate Web Client Management - Panel Detect

The DbGate Web Client Management Panel is detected on the target system. !/usr/bin/env python3 -- coding: utf-8 -- """The DbGate Web Client Management Panel is detected on the target system.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Agent-Zero Application - Detect

Detected Agent-Zero AI agent framework installation. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Agent-Zero AI agent framework installation.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Agent-Zero...

Uncanny Toolkit for LearnDash - Open Redirection Detection

A vulnerability in the WordPress Uncanny Toolkit for LearnDash Plugin allowed malicious actors to redirect users, posing a potential risk of phishing incidents. The issue has been resolved in version 3.6.4.4, and users are urged to update for security. !/usr/bin/env python3 -- coding: utf-8 -- ""...

Netscaler Gateway Detection

Citrix NetScaler is an application delivery controller that improves the delivery speed and quality of applications to an end user. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix NetScaler is an application delivery controller that improves the delivery speed and quality of applica.""" from...

NocoBase - Detect

NocoBase is an open source, extensibility-first, low-code platform for building business applications and enterprise solutions. !/usr/bin/env python3 -- coding: utf-8 -- """NocoBase is an open source, extensibility-first, low-code platform for building business applications and ente.""" from...

Qualys Cloud Platform Login Panel - Detect

Qualys Cloud Platform login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Qualys Cloud Platform login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Qualys Cloud Platform Login...

FreshRSS - Installation Detection

FreshRSS Installation panel has been exposed. !/usr/bin/env python3 -- coding: utf-8 -- """FreshRSS Installation panel has been exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FreshRSS - Installation...

ChurchCRM Panel - Detect

ChurchCRM panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """ChurchCRM panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ChurchCRM Panel - Detect', 'description': 'ChurchCRM panel...

Joomla! Component com_rokdownloads - Local File Inclusion Detection

A directory traversal vulnerability in the RokDownloads comrokdownloads component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory...

Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion Detection

A directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. dot dot in the skin parameter. This can be leveraged to execute arbitrary code by obtaining LDAP...

WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure Detection

WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. !/usr/bin/env python3 -- coding: utf-8 -- """WordPres...

OX Appsuite - Cross-Site Scripting Detection

OX App Suite through 7.10.4 allows XSS via the app loading mechanism the PATHINFO to the /appsuite URI. !/usr/bin/env python3 -- coding: utf-8 -- """OX App Suite through 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

OpenEMR < 7.0.1 - Cross-Site Scripting Detection

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.""" from kittysploit import from lib.protocols.http.httpclient import...

Microsoft FTP Service - Detect

The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a client and server on a computer network. !/usr/bin/env python3 -- coding: utf-8 -- """The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a...