iTop - User Enumeration via REST Endpoint Detection

From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is doresetpwd, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided. !/usr/bin/env python3 -- coding: utf-8 --...

Jolokia Java Heap Information Disclosure Detection

Detects Jolokia Java Heap Information Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jolokia Java Heap Information Disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jolokia Java Heap...

Moodle Jmol Filter 6.1 - Local File Inclusion Detection

Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server. !/usr/bin/env python3 -- coding: utf-8 -- """Moodle Jmol Filter 6.""" import re from kittysploit import from lib.protocols.http.httpclient import...

User Registration & Membership WordPress plugin - Open Redirect Detection

User Registration & Membership WordPress plugin = 5.1.4 contains an open redirect caused by insufficient validation of 'redirecttoonlogout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL. !/usr/bin/env python3 -- coding: utf-8 --...

XWiki Platform - Information Disclosure Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform is a generic wiki platform...

Apache Tomcat Example Scripts - Detect

Multiple Apache Tomcat example scripts were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple Apache Tomcat example scripts were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache Tomcat...

AceNet AceReporter Report Panel - Detect

Detects AceNet AceReporter Report Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AceNet AceReporter Report Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AceNet AceReporter Repo...

XDS-AMR Status Login Panel - Detect

XDS-AMR Status login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """XDS-AMR Status login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XDS-AMR Status Login Panel - Detect',...

Wing FTP Service - Detect

The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a client and server on a computer network. !/usr/bin/env python3 -- coding: utf-8 -- """The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a...

SmokePing Latency Page for Network Latency Grapher Detection

SmokePing Latency Page is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """SmokePing Latency Page is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SmokePing Latency Page for Network Latency Grapher...

Scrutinizer Config - Detect

Scrutinizer configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Scrutinizer configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Scrutinizer Config ...

Apache Tomcat - Cross-Site Scripting Detection

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, fro...

The Events Calendar <= 6.15.2 - Information Disclosure Detection

The Events Calendar WordPress plugin = 6.15.2 contains an information disclosure vulnerability caused by REST endpoint exposure, letting unauthenticated attackers extract data about password-protected vendors or venues, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 --...

Juniper Web Device Manager - Cross-Site Scripting Detection

Juniper Web Device Manager J-Web in Junos OS contains a cross-site scripting vulnerability. This can allow an unauthenticated attacker to run malicious scripts reflected off J-Web to the victim's browser in the context of their session within J-Web, which can allow the attacker to steal...

Crocus system Service.do - Arbitrary File Read Detection

There is an arbitrary file reading vulnerability in the Service.do interface of Ruiming Technology's Crocus system. An unauthenticated remote attacker can use this vulnerability to read important system files such as database configuration files, system configuration files, database configuration...

Triofox - Improper Access Control Detection

The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely...

phpShowtime 2.0 - Directory Traversal Detection

A directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. dot dot in the r parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in phpShowtime 2.""" import re from...

Show all comments < 7.0.1 - Cross-Site Scripting Detection

The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin. !/usr/bin/env python3 -- coding: utf-8 --...

Jenzabar 9.2x-9.2.2 - Cross-Site Scripting Detection

Jenzabar 9.2.x through 9.2.2 contains a cross-site scripting vulnerability. It allows /ics?tool=search&query. !/usr/bin/env python3 -- coding: utf-8 -- """Jenzabar 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

myLittleAdmin Login Panel - Detect

myLittleAdmin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """myLittleAdmin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'myLittleAdmin Login Panel - Detect',...

WordPress WooCommerce <3.1.2 - Arbitrary Function Call Detection

WordPress WooCommerce plugin before 3.1.2 does not have authorisation and CSRF checks in the wptadminupdatenoticeoption AJAX action available to both unauthenticated and authenticated users, as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary...

Tomcat Stack Traces Enabled Detection

Examine whether Tomcat stack traces are turned on by employing a designated problematic pattern. !/usr/bin/env python3 -- coding: utf-8 -- """Examine whether Tomcat stack traces are turned on by employing a designated problematic pattern.""" from kittysploit import from...

WordPress FlagEm - Cross-Site Scripting Detection

WordPress FlagEm plugin contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks...

Zebra Printer Detect

Zebra Printer panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zebra Printer panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zebra Printer Detect', 'description': 'Zebra Printer...

BlackMoon FTP Chaos Edition Service - Detect

BlackMoon FTP Chaos Edition service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """BlackMoon FTP Chaos Edition service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info =...

NATS Messaging Server Detection

Detects NATS servers by reading the INFO greeting on TCP 4222. !/usr/bin/env python3 -- coding: utf-8 -- """Detect NATS messaging servers via INFO handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.nats.detectors import probenats...

STUN Service Detection

Detects STUN RFC 5389 servers with a Binding Request on UDP 3478. !/usr/bin/env python3 -- coding: utf-8 -- """Detect STUN servers via Binding Request.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.stun.detectors import probestun class...

WordPress Ivory Search - Full Path Disclosure Detection

WordPress Plugin Ivory Search plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Ivory Search plugin files are publicly...

Zhiyuan OA Arbitrary File Upload Vulnerability Detection

A vulnerability in Zhiyuan OA allows remote unauthenticated attackers to upload arbitrary files to the remote server and cause execute arbitrary code to be executed. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Zhiyuan OA allows remote unauthenticated attackers to upload...

GasPot Honeypot - Detect

A GasPot honeypot has been identified. The response to the '^AI21400' command differs from real installations, signaling a possible deceptive setup. !/usr/bin/env python3 -- coding: utf-8 -- """A GasPot honeypot has been identified.""" import socket from kittysploit import from...

ProFTPD Server Detect

The File Transfer Protocol FTP is a standard network protocol used to transfer computer files between a client and server on a computer network. !/usr/bin/env python3 -- coding: utf-8 -- """The File Transfer Protocol FTP is a standard network protocol used to transfer computer files between a...

Joomla! Component iF surfALERT 1.2 - Local File Inclusion Detection

A directory traversal vulnerability in the iF surfALERT comifsurfalert component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Spring Security OAuth2 Remote Command Execution Detection

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

Trend Micro Threat Discovery Appliance 2.6.1062r1 - Authentication Bypass Detection

Trend Micro Threat Discovery Appliance 2.6.1062r1 is vulnerable to a directory traversal vulnerability when processing a sessionid cookie, which allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS. !/usr/bin/env...

Node.js <8.6.0 - Directory Traversal Detection

Node.js before 8.6.0 allows remote attackers to access unintended files because a change to ".." handling is incompatible with the pathname validation used by unspecified community modules. !/usr/bin/env python3 -- coding: utf-8 -- """Node.""" import re from kittysploit import from...

AxxonSoft Axxon Next - Local File Inclusion Detection

AxxonSoft Axxon Next suffers from a local file inclusion vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """AxxonSoft Axxon Next suffers from a local file inclusion vulnerability.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Aptana Jaxer 1.0.3.4547 - Local File inclusion Detection

Aptana Jaxer 1.0.3.4547 is vulnerable to local file inclusion in the wikilite source code viewer. An attacker can read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI. !/usr/bin/env python3 -- coding: utf-8 -- """Aptana Jaxer 1.""" import re from kittysploit impo...

Gradio - Open Redirect Detection

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...

PrivateGPT < 0.5.0 - Open Redirect Detection

An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. !/usr/bin/env python3 -- codin...

AC Smart II - Authentication Bypass Detection

AC Smart II contains an authentication bypass caused by a hidden password reset form that can be manipulated to change the administrator password without verifying login or permissions, letting attackers change admin passwords without authorization. !/usr/bin/env python3 -- coding: utf-8 -- """AC...

FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosure Detection

FUXA v1.3.0 exposes full SCADA/HMI project configuration via GET /api/project without authentication, even when secureEnabled is true. The secureFnc middleware auto-generates a valid guest JWT when no token is provided, bypassing authentication. Exposed data includes server-side scripts, device...

Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect Detection

The plugin is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. !/usr/bin/env...

WordPress Simple Job Board - Unauthorized Data Access Detection

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

Docassemble - Local File Inclusion Detection

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the mast...

Sharp Multifunction Printers - Cookie Exposure Detection

It was observed that Sharp printers are vulnerable to a listing of session cookies without authentication. Any attacker can list valid cookies by visiting a backdoor webpage and use them to authenticate to the printers. !/usr/bin/env python3 -- coding: utf-8 -- """It was observed that Sharp...

DATAGERRY - REST API Auth Bypass Detection

Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests. !/usr/bin/env python3 -- coding: utf-8 -- """Incorrect access control in BECN DATAGERRY v2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

ZimaOS <= v1.2.4 - Sensitive Information Disclosure Detection

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:///v1/users/image?path=/var/lib/casaos/1/apporder.json and http:///v1/users/image?path=/var/lib/casaos/1/system.json,...

WP Popups - Information Disclosure Detection

WP Popups - WordPress Popup builder plugin for WordPress contains a full path disclosure caused by using mobiledetect without access restrictions, letting unauthenticated attackers retrieve server paths, exploit requires no specific conditions. !/usr/bin/env python3 -- coding: utf-8 -- """WP Popu...

DAEnetIP4 METO v1.25 - Session Hijacking Detection

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. !/usr/bin/env python3 -- coding: utf-8 -- """DAEnetIP4 METO v1.""" from kittysploit import from...

Frontend Post Submission Manager Lite <= 1.2.7 - Open Redirect Detection

The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requestedpage' POST parameter in the verifyusernamepassword function. This makes it possible for unauthenticated...