EyouCMS - Installation Detection

EyouCMS installation is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """EyouCMS installation is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EyouCMS - Installation Detection', 'description': 'EyouCM...

NS ASG - Local File Inclusion Detection

NS ASG is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """NS ASG is vulnerable to local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NS ASG - Local File...

Bofamet Stealer C2 Panel - Detect

Bofamet Stealer C2 Login Panel was discovered !/usr/bin/env python3 -- coding: utf-8 -- """Bofamet Stealer C2 Login Panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bofamet Stealer C2 Panel -...

Boa 0.94.13 - Information Disclosure Detection

Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE- multiple third parties report that this is a site-specific issue because those files are not par...

Cisco Secure Firewall Management Center - Authentication Bypass Detection

Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests. !/usr/bin/env python3 -- coding: utf-8 --...

AWS Cloudfront service detection

Detect websites using AWS cloudfront service !/usr/bin/env python3 -- coding: utf-8 -- """Detect websites using AWS cloudfront service.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWS Cloudfront service detection...

XXLJOB Admin Login Panel - Detect

XXLJOB admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """XXLJOB admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XXLJOB Admin Login Panel - Detect',...

FastCGI Echo Endpoint Script - Detect

FastCGI echo endpoint script was detected, which lists several kinds of sensitive information such as port numbers, server software versions, port numbers, and IP addresses. !/usr/bin/env python3 -- coding: utf-8 -- """FastCGI echo endpoint script was detected, which lists several kinds of...

OpenReplay RUM - Tech Detect

Detects OpenReplay formerly Asayer Session Replay & RUM SDK implementation. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenReplay formerly Asayer Session Replay & RUM SDK implementation.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Integrate Google Drive <= 1.5.3 - Information Disclosure Detection

File Manager for Google Drive - Integrate Google Drive with WordPress plugin for WordPress = 1.5.3 contains sensitive information exposure caused by improper protection of the getlocalizedata function, letting unauthenticated attackers extract Google OAuth credentials and account email addresses,...

Microsoft SQL Server Reporting Services - Remote Code Execution Detection

Microsoft SQL Server Reporting Services is vulnerable to a remote code execution vulnerability because it incorrectly handles page requests. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft SQL Server Reporting Services is vulnerable to a remote code execution vulnerability because it...

Popup by Supsystic <1.10.5 - Cross-Site scripting Detection

WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Popup by Supsystic before 1.""" from kittysploit import...

Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control Detection

Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Apache...

Keystone 6 Login Page - Open Redirect and Cross-Site Scripting Detection

On the login page, there is a "from=" parameter in URL which is vulnerable to open redirect and can be escalated to reflected XSS. !/usr/bin/env python3 -- coding: utf-8 -- """On the login page, there is a "from=" parameter in URL which is vulnerable to open redirect and can be escalat.""" from...

Resourcespace - Cross-Site Scripting Detection

ResourceSpace before 9.6 rev 18290 is affected by a reflected cross-site scripting vulnerability in plugins/wordpresssso/pages/index.php via the wordpressuser parameter. !/usr/bin/env python3 -- coding: utf-8 -- """ResourceSpace before 9.""" from kittysploit import from...

Webmin Detection

Detects Webmin login and session endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Webmin server administration panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanner,...

SQLi Engine Scanner

Native SQLi engine: context-aware payloads, stable boolean oracles, ORDER BY column find + UNION marker, optional WAF tamper crawl-driven surface. !/usr/bin/env python3 -- coding: utf-8 -- """ SQL injection scanner powered by lib.protocols.http.sqliengine. Minimal-request, baseline-first detectio...

Apache Tomcat CVE-2026-43512 DIGEST authentication bypass

CVE-2026-43512: when DIGEST authentication is enabled, RealmBase.getDigest concatenates the literal string "null" for unknown usernames. A client digest computed with password="null" matches the server hash. Note: standard UserDatabaseRealm may still reject unknown users in getPrincipal;...

Cloud Misconfig Exposure Detector

Identify likely exposed AWS/Azure/GCP cloud resources from passive URL and naming signals. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Cloud Misconfig Exposu...

CKAN DataStore SQL Injection (CVE-2026-42031)

Exploits CVE-2026-42031 unauthenticated SQL injection in CKAN datastoresearchsql API via PostgreSQL tsrewrite primitives. !/usr/bin/env python3 -- coding: utf-8 -- """CKAN datastoresearchsql unauth SQLi CVE-2026-42031.""" import json import urllib.parse from kittysploit import from...

Citrix ShareFile File Read (CVE-2020-8982)

Exploits CVE-2020-8982 in Citrix ShareFile StorageZones str: depth = r'\..\' 8 target = re...

Netgear ProSafe RCE

Module exploits remote command execution vulnerability in Netgear ProSafe WC9500, WC7600, WC7520 devices. If the target is vulnerable command shell is invoked. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear ProSafe RCE""" import re import json from kittysploit import from...

Seo Panel 4.8.0 - Cross-Site Scripting Detection

Seo Panel 4.8.0 contains a reflected cross-site scripting vulnerability via the seo/seopanel/login.php?sec=forgot email parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Seo Panel 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

ASP.NET Core Development Environment - Exposure Detection

The ASP.NET Core application is running in Development mode, which could exposes detailed error messages and stack traces on the '/Error' page. !/usr/bin/env python3 -- coding: utf-8 -- """The ASP.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

Java FTP Proxy Service - Detect

Java FTP Proxy service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Java FTP Proxy service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'Java FTP Proxy...

Hotel Druid 3.0.2 - Cross-Site Scripting Detection

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. !/usr/bin/env python3 -- coding: utf-8 -- """Hotel Druid 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Glimpse Diagnostics - Sensitive Data Exposure Detection

Detected Glimpse diagnostics endpoint. Glimpse is a .NET diagnostics tool that reveals detailed request information, server configuration, SQL queries, connection strings, and session data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Glimpse diagnostics endpoint.""" from kittysploit...

GasPot Honeypot - Detect

A GasPot honeypot has been identified. The response to the '^AI21400' command differs from real installations, signaling a possible deceptive setup. !/usr/bin/env python3 -- coding: utf-8 -- """A GasPot honeypot has been identified.""" import socket from kittysploit import from...

Toshiba TopAccess Panel - Detect

Detects Toshiba TopAccess Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Toshiba TopAccess Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Toshiba TopAccess Panel - Detect',...

Open WebUI < 0.9.5 - Information Disclosure Detection

Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-...

x-amz-meta-s3cmd-attrs Header Username Disclosure Detection

Detected exposure of the x-amz-meta-s3cmd-attrs header in S3 objects, which can disclose sensitive information including the username uname, user ID uid, group name gname, and group ID gid of the user who uploaded the file using s3cmd. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposur...

Hikvision Springboot Env Actuator - Detect

The HIKVISION comprehensive security management platform has information leakage vulnerabilities, through which attackers can obtain sensitive information such as environment env for further attacks !/usr/bin/env python3 -- coding: utf-8 -- """The HIKVISION comprehensive security management...

OpenStack User Secrets Exposure Detection

Internal usersecrets.yml file is exposed in OpenStack. !/usr/bin/env python3 -- coding: utf-8 -- """Internal usersecrets.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenStack User Secrets Exposure Detection',...

CKAN DataStore SQL Search - SQL Injection Detection

CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastoresearchsql API endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """CKAN, an open-source data management system used for powering open data...

WordPress Jannah Theme <5.4.5 - Cross-Site Scripting Detection

WordPress Jannah theme before 5.4.5 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Jannah theme before 5.""" from kittysploit import from...

Nokia Nuage Networks VSP - Dashboard Panel Detection

Nokia Nuage Networks VSP Virtualized Services Platform is a software-defined networking platform for enterprise and service provider SDN/NFV deployments. The web dashboard is exposed on ports 8443, 9090, or 11443. !/usr/bin/env python3 -- coding: utf-8 -- """Nokia Nuage Networks VSP Virtualized...

Ollama Detection

Detects Ollama model API via /api/tags endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Ollama local LLM API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Open eClass 3.15 - Remote Code Execution (CVE-2024-26503)

CVE-2024-26503: authenticated unrestricted file upload in /modules/admin/certbadge.php stores a PHP webshell under /courses/userprogressdata/badgetemplates/. !/usr/bin/env python3 -- coding: utf-8 -- """Open eClass CVE-2024-26503 authenticated certbadge icon upload RCE.""" from future import...

PHP2Shell RCE (CVE-2026-109618 / CVE-2026-109619)

Exploits PHP2Shell via session.uploadprogress heap corruption CVE-2026-109618 / CVE-2026-109619. Sends large multipart bodies, plants autoprependfile, then runs the requested command. Requires a matching profile under data/exploits/CVE-2026-109618/profiles/. !/usr/bin/env python3 -- coding: utf-8...

Cisco IOS SNMP RCE (CVE-2025-20352)

Exploits CVE-2025-20352 stack-based buffer overflow in Cisco IOS/IOS-XE SNMP subsystem. Sends crafted SNMP SET/GET packets to trigger overflow and execute shellcode or crash for confirmation. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco IOS/IOS-XE SNMP stack overflow RCE CVE-2025-20352."""...

Linksys E-Series TheMoon RCE

Module exploits remote code execution vulnerability in multiple Linksys E-Series devices. Vulnerability was actively used by TheMoon Worm. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E-Series TheMoon RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Home Assistant - Supervisor Auth Bypass Detection (CVE-2023-27482)

Home Assistant supervised installs are vulnerable to authentication bypass via path traversal under /api/hassio/app/ and /api/hassioingress/ CVE-2023-27482, exposing supervisor/core info without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Home Assistant Supervisor authentication...

Synology DSM - imageSelector.cgi RCE Detection (CVE-2013-6955)

Detects CVE-2013-6955 by appending commands into redirect.cgi via imageSelector.cgi SLICEUPLOAD and reading /redirect.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Synology DSM imageSelector.cgi RCE CVE-2013-6955.""" import re from kittysploit import from lib.protocols.http.httpclient import...

BLE UART pivot probe

Detect Nordic NUS and common UART-over-GATT profiles on a BLE session for interactive pivot uartexec / shell commands. !/usr/bin/env python3 -- coding: utf-8 -- """Probe BLE UART / Nordic NUS channels for shell pivot.""" from kittysploit import from lib.protocols.ble.blesessionmixin import...

Firmware → adaptive payload plan

Detect firmware CPU architecture from ELF headers, select the best payload BusyBox/CMD vs raw and listener adaptive vs reversetcp, then emit a ready-to-run CLI command sequence. !/usr/bin/env python3 -- coding: utf-8 -- """ Firmware arch → adaptive payload/listener plan. Scans ELF headers, select...

Spring Boot Actuator Heap Dump

Detects exposed Spring Boot Actuator heapdump endpoints that can leak JVM memory, secrets, and HTTP traffic. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Actuator heapdump exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/heapdump",...

SAPControl ABAPReadSyslog - Disclosure Detection

Detected SAP systems where the SAPControl SOAP web service exposes the ABAPReadSyslog operation without authentication. ABAPReadSyslog returns the ABAP system log equivalent to transaction SM21 via SAPControl sapstartsrv and includes fields such as client, username, transaction code, message...

Home Assistant HACS - Local File Inclusion Detection

Home Assistant before 2021.1.3 lacks a protection layer against directory-traversal attacks in custom integrations, letting attackers access arbitrary files, exploit requires attacker to deploy malicious custom integration. !/usr/bin/env python3 -- coding: utf-8 -- """Home Assistant before 2021."...

KubeOperator Foreground `kubeconfig` - File Download Detection

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used t...

MobileIron Login Panel - Detect

MobileIron login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """MobileIron login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MobileIron Login Panel - Detect', 'description':...