D-Link DWR - /uir Path Traversal Detection (CVE-2017-6190)

Detects CVE-2017-6190 by requesting /uir/../../../../../../etc/passwd ../ traversal after /uir/, distinct from CVE-2018-10822 // style. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR /uir path traversal CVE-2017-6190.""" import re from kittysploit import from lib.protocols.http.httpclien...

QNAP - pingping.cgi Command Injection (CVE-2013-0143)

Exploits CVE-2013-0143 via /cgi-bin/pingping.cgi?pingip=1;;. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP pingping.cgi RCE CVE-2013-0143 — opens execute session.""" import base64 import re from urllib.parse import quote from kittysploit import from...

phpMyAdmin - server_sync.php Backdoor Detection (CVE-2012-5159)

Detects CVE-2012-5159 by POSTing c=phpinfo; to /serversync.php. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin serversync.php backdoor CVE-2012-5159.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpMyAdmi...

PTZOptics Camera - Unauth System Config / Password Leak (CVE-2024-8956)

PTZOptics cameras expose /cgi-bin/param.cgi?getsystemconf without authentication, leaking userpasswd hashes CVE-2024-8956. Presence also indicates the related OS command injection CVE-2024-8957. !/usr/bin/env python3 -- coding: utf-8 -- """PTZOptics camera insufficient auth leaking password hash...

NUUO NVRmini 2 - Unauth handle_import_user Detection (CVE-2022-23227)

NUUO NVRmini 2 devices expose /handleimportuser.php without authentication CVE-2022-23227 / related CVE-2011-5325 upload surface. Detection matches the Greenbone active check response fingerprint. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini 2 unauthenticated handleimportuser.php...

TerraMaster TOS - makecvs.php RCE Detection (CVE-2020-28187)

Detects CVE-2020-28187 by injecting via /include/makecvs.php?Event= to write a PHP webshell under /usr/www/.php and executing id. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS makecvs.php Event RCE CVE-2020-28187.""" import re import secrets from kittysploit import from...

Zabbix - locales.php RCE Detection

Detects Zabbix = 1.6.2 RCE via /locales.php?download=1&langTo=1&extlang".system'id'."=1. !/usr/bin/env python3 -- coding: utf-8 -- """Zabbix locales.php RCE = 1.6.2.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

TCExam - Unauthenticated File Upload RCE Detection (CVE-2010-2153)

Detects CVE-2010-2153 by uploading a phpinfo shell via tcefunctionstcecodeeditor.php. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-2153 by uploading a phpinfo shell via tcefunctionstcecodeeditor.""" import re from kittysploit import from lib.protocols.http.httpclient import...

GitLab - ExifTool RCE Unpatched Fingerprint (CVE-2021-22205)

Detects unpatched GitLab instances vulnerable to CVE-2021-22205 by POSTing a multipart JPEG upload to a random path and looking for HTTP 422 with "The change you requested was rejected" Greenbone active check. !/usr/bin/env python3 -- coding: utf-8 -- """GitLab CE/EE ExifTool RCE unpatched...

ManageEngine Desktop Central - FileUploadServlet Detection (CVE-2015-8249)

Detects CVE-2015-8249 by uploading a JSP via FileUploadServlet connectionId path traversal into jspf/ and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central FileUploadServlet path traversal CVE-2015-8249.""" from kittysploit import from...

vtiger CRM - graph.php OrganizationConfig Auth Bypass Detection

Detects vtiger = 5.2.1 auth bypass by requesting graph.php?module=Settings&action=OrganizationConfig and matching Company Details. !/usr/bin/env python3 -- coding: utf-8 -- """Detects vtiger = 5.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

A2Billing - Unauth SQL Dump Detection

Detects A2Billing backup abuse by triggering A2Bentitybackup.php dump to a guessable .sql path and downloading it. !/usr/bin/env python3 -- coding: utf-8 -- """A2Billing unauthenticated SQL dump via A2Bentitybackup.php.""" import time from kittysploit import from lib.protocols.http.httpclient...

OpenMRS - dataexchange export.form Disclosure Detection (CVE-2020-5732)

Detects OpenMRS unauthenticated data export by POSTing conceptIds=1 to /module/dataexchange/export.form and looking for HTTP 201 with conceptdatatypeid. !/usr/bin/env python3 -- coding: utf-8 -- """OpenMRS dataexchange export.form unauthenticated access CVE-2020-5732...""" from kittysploit import...

Kyocera Printer - Address Book Disclosure Detection (CVE-2022-1026)

Kyocera printers exposing gSOAP allow unauthenticated SOAP calls to /ws/km-wsdl/setting/addressbook to export the personal address book CVE-2022-1026. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera printer address book disclosure via gSOAP CVE-2022-1026.""" import re import time from...

Synology DSM Drive Server - Auth Bypass Token Leak (CVE-2024-50630)

Synology Drive Server on DSM allows unauthenticated attackers to read Drive logs via RedirectURI and obtain user access tokens via SYNO.SynologyDrive.Authentication CVE-2024-50630 / SA-24:21. Also indicates CVE-2024-50631 SQLi in sync daemon. !/usr/bin/env python3 -- coding: utf-8 -- """Synology...

KVM x86 Zapscape Guest Escape (CVE-2026-64561)

Runs the Zapscape PoC KVM/x86 mmupagezappte recursive-zap UAF with KASLR bypass on a KVM/AMD hypervisor host via /dev/kvm. Default payload starts a reverse TCP shell as root on the host new KittySploit session. Marker-only mode creates /Zapscape for lab verification. !/usr/bin/env python3 --...

Railway / Render / Fly.io Production Secrets Detection

Classifies Railway, Render, and Fly.io deploy contexts and flags production-grade API keys, database URLs, and Supabase servicerole tokens in client bundles. !/usr/bin/env python3 -- coding: utf-8 -- """ Detect production secrets on Railway, Render, and Fly.io deployments. Complements...

Magic Link / Passwordless Auth Surface Detection

Probes common magic-link and passwordless paths NextAuth, custom APIs for exposed email submission endpoints and sign-in link flows. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed magic link and passwordless authentication endpoints.""" from kittysploit import from...

Python PostgreSQL NOTIFY Reverse Agent

C2 agent over PostgreSQL LISTEN/NOTIFY. Pairs with listeners/database/postgresqlnotifyshell. Requires psycopg2 on target and network access to PostgreSQL. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.postgresqlnotifyagent import buildpostgresqlnotifyagentscript...

Sanity / Directus Token Abuse

Uses leaked Sanity sk tokens for GROQ queries and Directus static tokens to list users. Auto-discovers credentials from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Abuse leaked Sanity and Directus API tokens.""" from kittysploit import from lib.protocols.http.httpclient import...

Supabase PostgREST / Storage Enumeration

Uses a Supabase project ref and JWT API key anon or servicerole to enumerate PostgREST tables via OpenAPI, sample readable rows, list Storage buckets/objects, and probe common public bucket paths. Can auto-discover credentials from the target SPA when PROJECTREF / APIKEY are omitted. !/usr/bin/en...

osTicket CVE-2026-18363 Reset Token Detect

Detects CVE-2026-18363 in osTicket 1.17.8 and 1.18.0–1.18.3: PasswordResetTokenBackend accepts reset tokens forever because the expiry check never runs for existing tokens. Requires a victim reset token out-of-band. !/usr/bin/env python3 -- coding: utf-8 -- """Detect osTicket CVE-2026-18363 expir...

Trilium Notes Safe Import RCE (CVE-2026-45668)

Exploits CVE-2026-45668 in Trilium Notes TriliumNext = 0.102.1: a malicious export ZIP imported with safeImport=true keeps a code-note XSS payload, a docName label with path traversal, and a '' noteId preserved verbatim. Opening the trigger doc loads the payload via jQuery into a nodeIntegration...

OpenCTI CVE-2026-27960 Auth Bypass Detect

Detects CVE-2026-27960 in OpenCTI 6.6.0 through 6.9.12: authenticateUserByTokenOrUserId looks up users by bearer token without verifying it equals apitoken. The admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f is identical across deployments and authenticates as admin when sent as a bearer...

Snipe-IT View-Only File Upload Bypass (CVE-2026-37709)

CVE-2026-37709 in Snipe-IT ≤ 8.4.0 fixed in 8.4.1: the file upload endpoint POST /api/v1/objecttype/id/files checks the view permission gate instead of update. Any API user with view-only access can upload arbitrary files to any visible object. On misconfigured servers PHP execution under...

Node-RED CVE-2026-71269 Library DoS Detect

Detects Node-RED 3.0.0–5.0.4 admin library API exposure for CVE-2026-71269: GET /library/local/flows on the httpAdminRoot surface. A reachable library endpoint indicates the target may be affected by the unauthenticated DoS via POST /library/local//%2e%2e discarded write promise crash on Node.js ...

Ollama GGUF Heap OOB Read (CVE-2026-7482)

CVE-2026-7482 in ollama/ollama then triggers model creation. Success leaks heap memory into the stored Q80 layer. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-7482 — Ollama GGUF heap out-of-bounds read info disclosure.""" import hashlib import json import struct import requests from...

WordPress Instant Appointment RCE (CVE-2026-15282)

Exploits CVE-2026-15282 in Instant Appointment = 1.2: unauthenticated addservicefront AJAX passes imageurl/imagename to filegetcontents and fileputcontents. Delivers the configured framework PHP payload via data:// base64 primary or a local HTTP server fallback, writes under wp-content/uploads/,...

WordPress Podlove Podcast Publisher RCE (CVE-2026-13001)

Exploits CVE-2026-13001 in Podlove Podcast Publisher = 4.5.1: serves a GIF89a polyglot built from the configured framework payload, triggers the image-cache fetch shell.php?.gif bypass, then executes the cached PHP via HTTP reversetcp connects back through the normal listener. !/usr/bin/env pytho...

Livewire PowerGrid CVE-2026-65971 Detect

Detects CVE-2026-65971: time-based SQL injection via sortDirection in power-components/livewire-powergrid 6.10.4 when a column uses naturalSorttrue. Empty sortField bypasses Laravel direction validation. !/usr/bin/env python3 -- coding: utf-8 -- """Detect CVE-2026-65971 Livewire PowerGrid...

ONVIF Media Streams

List ONVIF media profiles and resolve GetSnapshotUri + GetStreamUri RTSP for RTSP handoff. Uses an ONVIF session or rhost. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate ONVIF media profiles, snapshot URIs, and RTSP stream URIs.""" from kittysploit import from lib.protocols.onvif.session...

UPnP IGD Port Map Dump

Call IGD GetExternalIPAddress / GetStatusInfo / GetGenericPortMappingEntry to inventory NAT port forwards exposed by the gateway. !/usr/bin/env python3 -- coding: utf-8 -- """Dump IGD external IP and port mappings via UPnP WANIP/WANPPP actions.""" from kittysploit import from...

UPnP Device Inventory

Dump UPnP device identity and service list from an SSDP session or direct LOCATION/rhost discover. !/usr/bin/env python3 -- coding: utf-8 -- """Inventory UPnP device description and services.""" from kittysploit import from lib.protocols.upnp.client import SSDPPORT from lib.protocols.upnp.session...

IEC 61850 MMS Client

Connects to an IEC 61850 MMS server ISO-on-TCP, completes COTP + Initiate, and creates an interactive MMS shell session. !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS bind listener — opens an MMS session for identify / directory.""" from kittysploit import from...

DNP3 integrity dump

Integrity poll class 0–3 plus binary/analog sample counts session preferred !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import integritypolldnp3 from lib.protocols.ics.icsscannerclient...

DNP3 TCP Client

Connects to a DNP3 outstation and creates an interactive DNP3 shell session !/usr/bin/env python3 -- coding: utf-8 -- """DNP3 TCP bind listener — opens a DNP3 session for interactive polling.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

OpenWrt / BusyBox Network Recon

Enumerate interfaces, routes, ARP/neighbors, DNS, and listening sockets on an embedded Linux shell for LAN/WAN pivot planning. !/usr/bin/env python3 -- coding: utf-8 -- """Network / pivot recon for OpenWrt / BusyBox shells.""" from kittysploit import from lib.post.linux.session import...

Windows x64 Meterpreter/Stage Reverse TCP Stager

x64 reverse TCP stager: connect, read 4-byte LE size + stage, VirtualAlloc RWX and jump. Use with a stage pusher or pair stagemode=shell for embedded cmd.exe stage. Listener: listeners/multi/meterpreterreversetcp or reversetcp for shell mode. from kittysploit import import base64 import struct...

PowerShell DNS Reverse Shell

Poll DNS TXT for commands and exfil output via result subdomain queries raw UDP DNS — custom nameserver IP:port. Pairs with listeners/covert/dns. from kittysploit import import base64 from lib.c2.dnsreverseagent import buildpowershelldnsagentscript class ModulePayload: """PowerShell DNS TXT polli...

Lua / awk Reverse TCP

Reverse TCP shell via Lua or awk minimal hosts / CTF / constrained Unix from kittysploit import class ModulePayload: CLIENTLANGUAGE = "lua" info = "name": "Lua / awk Reverse TCP", "description": "Reverse TCP shell via Lua or awk minimal hosts / CTF / constrained Unix", "category":...

Windows x64 Reverse TCP Stager

Position-independent x64 reverse TCP shellcode that connects back and spawns cmd.exe from kittysploit import class ModulePayload: """Windows x64 reverse TCP stager cmd.exe. Compatible with listeners/multi/reversetcp.""" info = "name": "Windows x64 Reverse TCP Stager", "description":...

ADFS Detect

Detects ADFS with forms-based authentication enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ADFS with forms-based authentication enabled.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ADFS Detect',...

IIS Windows Server Default Page Detection

Detects IIS Windows Server Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects IIS Windows Server Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IIS Windows Server Default Page Detection...

phpCollab Login Panel - Detect

phpCollab login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """phpCollab login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpCollab Login Panel - Detect', 'description':...

PHPUnit Result Cache File Exposure Detection

PHPUnit cache file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """PHPUnit cache file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHPUnit Result Cache File Exposure Detection', 'description':...

Bottle debug mode enabled Detection

Detects Bottle debug mode enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Bottle debug mode enabled.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bottle debug mode enabled Detection', 'description':...

Kubernetes Dashboard <1.10.1 - Authentication Bypass Detection

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. !/usr/bin/env python3 -- coding: utf-8 -- """Kubernetes Dashboard before 1.""" from kittysploit import from lib.protocols.http.httpclient import...

Prometheus Config API Endpoint Discovery Detection

A Prometheus config API endpoint was discovered. The config endpoint returns the loaded Prometheus configuration file along with the addresses of targets and alerting/discovery services alongside the credentials required to access them. Usually, Prometheus replaces the passwords in the credential...

Tenable Nessus Panel - Detect

Tenable Nessus panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Tenable Nessus panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tenable Nessus Panel - Detect', 'description': 'Tenab...

Totemomail SMTP Server Detection

Totemomail is a comprehensive email solution designed to address all aspects of digital communication security. !/usr/bin/env python3 -- coding: utf-8 -- """Totemomail is a comprehensive email solution designed to address all aspects of digital communication security.""" import socket from...