Ignite Realtime Openfire <4.42 - Local File Inclusion Detection

Ignite Realtime Openfire through 4.4.2 is vulnerable to local file inclusion via PluginServlet.java. It does not ensure that retrieved files are located under the Openfire home directory. !/usr/bin/env python3 -- coding: utf-8 -- """Ignite Realtime Openfire through 4.""" from kittysploit import...

Dell OpenManage Switch Administrator Login Panel - Detect

Dell OpenManage Switch Administrator login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dell OpenManage Switch Administrator login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE) Detection

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """cgi-bin/xmlstatus.""" import re from kittysploit import from lib.protocols.http.httpclient...

SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization Detection

SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce...

D-Link DIR-600M - Authentication Bypass Detection

D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-600M...

MajorDoMo - Unauthenticated RCE Detection

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo contains a remote...

Saia PCD Web-Server Configuration Page - Detect

Saia PCD Web-Server configuration page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Saia PCD Web-Server configuration page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Saia PCD Web-Serv...

SAPControl GetEnvironment - Disclosure Detection

Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP web service exposes the GetEnvironment web method without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP web service exposes the...

VMware Authentication Daemon Detection

vmauthd is the VMWare authentication daemon that is included with many VMWare products, including ESXi, and Workstation. !/usr/bin/env python3 -- coding: utf-8 -- """vmauthd is the VMWare authentication daemon that is included with many VMWare products, including ESXi, and .""" import socket from...

ShokoServer System - Local File Inclusion (LFI) Detection

ShokoServer is a media server which specializes in organizing anime. In affected versions the /api/Image/WithPath endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter serverImagePath, which is not sanitized in any way...

Sangfor Application sys_user.conf Account Password Leakage Detection

Sangfor application delivery management system file sysuser.conf can be directly accessed without authorization, resulting in leakage of account and password !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor application delivery management system file sysuser.""" from kittysploit import from...

DotNetNuke 07.04.00 - Administration Authentication Bypass Detection

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx. !/usr/bin/env python3 -- coding: utf-8 -- """The installation wizard in DotNetNuke DNN before 7.""" from...

Ampache Update Page Exposure Detection

Ampache update page is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Ampache update page is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ampache Update Page Exposure Detection', 'description':...

Dell EMC RecoverPoint Panel - Detect

Dell EMC RecoverPoint management panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dell EMC RecoverPoint management panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dell EMC...

Kae's File Manager <=1.4.7 - Cross-Site Scripting Detection

Kae's File Manager through 1.4.7 contains a cross-site scripting vulnerability via a crafted GET request to /kfm/index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Joomla! Component Online Market 2.x - Local File Inclusion Detection

A directory traversal vulnerability in the Online Market commarket component 2.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Froxlor Server Management - Installer Detection

Detects the Froxlor Server Management Panel installation page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the Froxlor Server Management Panel installation page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

OneDev < 4.0.3 - User Access Token Leak Detection

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. !/usr/bin/env pytho...

Accela Civic Platform <=21.1 - Cross-Site Scripting Detection

Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via ssoAdapter/logoutAction.do successURL. !/usr/bin/env python3 -- coding: utf-8 -- """Accela Civic Platform through 21.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Versa FlexVNF Server Detection

Versa FlexVNF Server Detection magic request params exposes Server signature/version !/usr/bin/env python3 -- coding: utf-8 -- """Versa FlexVNF Server Detection magic request params exposes Server signature/version.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Caucho Resin - Information Disclosure Detection

Caucho Resin contains an information disclosure vulnerability. The application does not properly sanitize user-supplied input. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site...

DSS Download - Local File Inclusion Detection

DSS Download is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """DSS Download is vulnerable to local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DSS...

SMF Installer Detection

SMF is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """SMF is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ACME Challenge Path - Reflected Cross-Site Scripting Detection

Detects XSS vulnerabilities in ACME http-01 challenge implementations where hosting providers reflect the challenge key from the URL without proper sanitization !/usr/bin/env python3 -- coding: utf-8 -- """Detects XSS vulnerabilities in ACME http-01 challenge implementations where hosting provide...

IceWarp Mail Server ≤11.4.0 - Open Redirect Detection

IceWarp Mail Server version 11.4.0 and below contains an open redirect vulnerability that allows attackers to redirect users to arbitrary external domains through malicious URLs. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp Mail Server version 11.""" import re from kittysploit import from...

Ubiquiti EdgeRouter - Login Panel Detection

Ubiquiti EdgeRouter is an enterprise-grade router with advanced routing capabilities and VPN features, running EdgeOS Ubiquiti's Vyatta-based firmware. !/usr/bin/env python3 -- coding: utf-8 -- """Ubiquiti EdgeRouter is an enterprise-grade router with advanced routing capabilities and VPN feature...

HedgeDoc Collaborative Editor - Detect

HedgeDoc is an open-source, collaborative markdown editor for teams to share and co-edit notes in real time. This template detects publicly reachable HedgeDoc instances by fingerprinting unique branding markers and the dedicated Hedgedoc-Version response header. !/usr/bin/env python3 -- coding:...

Palo Alto Networks GlobalProtect Login Panel - Detect

Palo Alto Networks GlobalProtect login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Palo Alto Networks GlobalProtect login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Palo...

Node ecstatic Directory Listing Detection

Directiory listing enabled in Node ecstatic. !/usr/bin/env python3 -- coding: utf-8 -- """Directiory listing enabled in Node ecstatic.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Node ecstatic Directory Listing...

Cyber Stealer C2 Panel - Detect

Cyber Stealer C2 Login Panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Cyber Stealer C2 Login Panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cyber Stealer C2 Panel - Detect',...

Moleculer Microservices Project Detection

Moleculer microservice was able to be accessed with no required authentication in place. !/usr/bin/env python3 -- coding: utf-8 -- """Moleculer microservice was able to be accessed with no required authentication in place.""" from kittysploit import from lib.protocols.http.httpclient import...

Wordpress Plugin Issuu Panel Remote/Local File Inclusion Detection

The WordPress Issuu Plugin includes an arbitrary file disclosure vulnerability that allows unauthenticated attackers to disclose the content of local and remote files. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Issuu Plugin includes an arbitrary file disclosure vulnerability that...

Submitty Login Panel - Detect

Submitty login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Submitty login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Submitty Login Panel - Detect', 'description':...

XWiki - Detection

XWiki Platform was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XWiki - Detection', 'description': 'XWiki Platform was...

Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion Detection

Zeta Producer Desktop CMS before 14.2.1 is vulnerable to local file inclusion if the plugin "filebrowser" is installed because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Zeta Producer Desktop CMS before 14.""" import r...

cPanel Mailman - Cross-Site Scripting Detection

cPanel Mailman listinfo reflects the mpidentity query parameter into the HTML response without proper output encoding, resulting in reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """cPanel Mailman listinfo reflects the mpidentity query parameter into the HTML response...

Tox Configuration File - Detect

Tox configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Tox configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tox Configuration File - Detect', 'description':...

Spring Boot Status Actuator Panel - Detect

Spring Boot Status Actuator panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Status Actuator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Spring Boot Status Actuator...

PacsOne Server <7.1.1 - Cross-Site Scripting Detection

PacsOne Server PACS Server In One Box below 7.1.1 is vulnerable to cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """PacsOne Server PACS Server In One Box below 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

iTop - User Enumeration via REST Endpoint Detection

From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is doresetpwd, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided. !/usr/bin/env python3 -- coding: utf-8 --...

Jolokia Java Heap Information Disclosure Detection

Detects Jolokia Java Heap Information Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jolokia Java Heap Information Disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jolokia Java Heap...

Moodle Jmol Filter 6.1 - Local File Inclusion Detection

Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server. !/usr/bin/env python3 -- coding: utf-8 -- """Moodle Jmol Filter 6.""" import re from kittysploit import from lib.protocols.http.httpclient import...

User Registration & Membership WordPress plugin - Open Redirect Detection

User Registration & Membership WordPress plugin = 5.1.4 contains an open redirect caused by insufficient validation of 'redirecttoonlogout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL. !/usr/bin/env python3 -- coding: utf-8 --...

XWiki Platform - Information Disclosure Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform is a generic wiki platform...

Apache Tomcat Example Scripts - Detect

Multiple Apache Tomcat example scripts were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple Apache Tomcat example scripts were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache Tomcat...

AceNet AceReporter Report Panel - Detect

Detects AceNet AceReporter Report Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AceNet AceReporter Report Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AceNet AceReporter Repo...

XDS-AMR Status Login Panel - Detect

XDS-AMR Status login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """XDS-AMR Status login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XDS-AMR Status Login Panel - Detect',...

Wing FTP Service - Detect

The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a client and server on a computer network. !/usr/bin/env python3 -- coding: utf-8 -- """The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a...

SmokePing Latency Page for Network Latency Grapher Detection

SmokePing Latency Page is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """SmokePing Latency Page is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SmokePing Latency Page for Network Latency Grapher...

Scrutinizer Config - Detect

Scrutinizer configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Scrutinizer configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Scrutinizer Config ...