Apache ActiveMQ <=5.15.5 - Cross-Site Scripting Detection

Apache ActiveMQ versions 5.0.0 to 5.15.5 are vulnerable to cross-site scripting via the web based administration console on the queue.jsp page. The root cause of this issue is improper data filtering of the QueueFilter parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Apache ActiveMQ versio...

WWBN AVideo 11.6 - Cross-Site Scripting Detection

WWBN AVideo 11.6 contains a cross-site scripting vulnerability in the footer alerts functionality via the 'msg' parameter, which is inserted into the document with insufficient sanitization. !/usr/bin/env python3 -- coding: utf-8 -- """WWBN AVideo 11.""" from kittysploit import from...

Amazon Web Services S3 Explorer - Detect

Amazon Web Services S3 Explorer page was detected. Page contains links to sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Amazon Web Services S3 Explorer page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Royal Event Management System - Stored Cross-Site Scripting Detection

Royal Event Management System contains a stored cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

Netsweeper 4.0.3 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in webadmin/policy/grouptableajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting...

Mystic Stealer Panel - Detect

Mystic Stealer panel were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Mystic Stealer panel were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Mystic Stealer Panel - Detect', 'description':...

Basic Auth Detection

Detects Basic Auth Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Basic Auth Detection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Basic Auth Detection', 'description': 'Detects Basic...

Hikvision - Authentication Bypass Detection

Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0...

Jaeger UI Detection

Jaeger UI dashboard is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Jaeger UI dashboard is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jaeger UI Detection', 'description': 'Jaeger UI dashboard i...

Huawei HG255s - Local File Inclusion Detection

Huawei HG255s is vulnerable to local file inclusion due to insufficient validation of the received HTTP requests. A remote attacker may access the local files on the device without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG255s is vulnerable to local file inclusion due...

UniFi Network Application CVE-2026-22557 — path traversal file read

Exploits CVE-2026-22557: unauthenticated arbitrary file read through the guest portal pageerror parameter on /guest/s//wechat/sign and /login. Uses lib.protocols.http.lfi for one-shot reads or an interactive LFI shell. Pair with scanner/http/unificve202622557. Note: full OS file disclosure...

FreeScout CVE-2026-28289 detection

Fingerprints FreeScout and compares the reported version against CVE-2026-28289 = ..., fixed in .... Optional admin credentials can be used only to read the version from the authenticated footer. Version check only — no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing...

Nitro Pro PDF Reader 11 Javascript API RCE

CVE-2017-7442: Nitro / Nitro Pro PDF Reader 11 unsafe Javascript API. this.saveAs writes an embedded HTA to disk; app.launchURL with a c$: path bypasses the security dialog and executes it. Cmd/PowerShell payloads are run from the HTA directly. Binary MZ payloads are staged over HTTP as a...

Foxit PDF Reader Pointer Overwrite UAF

Foxit PDF Reader v9.0.1.1049 Use-After-Free CVE-2018-9948 / CVE-2018-9958. Select a Windows payload; the PDF ROP calls WinExec on a short command. delivery=http serves an HTA stage over HTTP mshta http://LHOST/h and can also serve the PDF. delivery=smb embeds a UNC path to an EXE/BAT you host...

VLC Media Player MKV Use After Free

CVE-2018-11529: Use-after-free in VideoLAN VLC = 2.2.8 MKV parsing 32-bit and 64-bit. Generates two .mkv files: part1 vulnerability + heap spray to open in VLC, and part2 must sit in the same directory. Requires a raw shellcode payload = 0x300 bytes. Meterpreter-sized payloads often crash VLC —...

BLE GATT Characteristics

Enumerates GATT characteristics UUID, handle, properties for a BLE session !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — list GATT characteristics and properties.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin import json class ModulePost,...

OPC UA Client

Connects to an OPC UA server and creates an interactive OPC UA shell session !/usr/bin/env python3 -- coding: utf-8 -- """OPC UA bind listener — opens an OPC UA session for node browsing and diagnostics.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

DoIP Client

Connects to an automotive DoIP ISO 13400 gateway, performs routing activation, and creates a session for UDS diagnostic post modules !/usr/bin/env python3 -- coding: utf-8 -- """DoIP bind listener — connects to a DoIP gateway and opens a diagnostic session.""" from kittysploit import from...

UART Firmware Info

Probes a UART console with read-only commands to collect kernel, OS release, CPU, and bootloader / firmware identity strings !/usr/bin/env python3 -- coding: utf-8 -- """ UART Firmware Info - Probes serial console for OS / firmware identity """ from kittysploit import from...

Windows Gather Wireless Current Connection Info

Gather information about the current connection on each wireless LAN interface via 'netsh wlan show interfaces' on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Gather current WLAN connection details on each wireless interface Metasploit-style...

Copy Fail Docker Escape via Modprobe (CVE-2026-31431)

Exploits CVE-2026-31431 Copy Fail / authencesn AEAD page-cache write from inside a Linux container to overwrite /proc/sys/kernel/modprobe, plant a host payload, and trigger requestmodule for host code execution. Requires a writable host path privileged container, shared PID+mount, or hostPath e.g...

Moodle detection

Detects a Moodle installation and reports the version from lib/upgrade.txt when available. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Moodle and report the version from lib/upgrade.txt.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

phpMyAdmin Authenticated Remote Code Execution (CVE-2018-12613)

phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which can be exploited post-authentication to execute PHP code by application. Tested against phpMyAdmin v4.8.1. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin 4.8.0/4.8.1 authenticated LFI to RCE — CVE-2018-12613...

Metasploitable3 Linux Environment

Metasploitable3 Ubuntu 14.04 lab VM packaged for Docker — intentionally vulnerable Linux target for authorized internal-lab agent benchmarks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = "name": "Metasploitable3 Linux Environment",...

SMB Client

Connects to a remote SMB server and creates an interactive SMB shell session !/usr/bin/env python3 -- coding: utf-8 -- """ SMB client listener — connects to a remote SMB service and creates an interactive session. """ from kittysploit import from lib.protocols.smb.smbclient import SMBAuth,...

Spring Cloud Azure B2C CVE-2026-50338 Detection

Detect B2C JWT-protected APIs; verify CVE-2026-50338 when Entra creds are set !/usr/bin/env python3 -- coding: utf-8 -- """Detect CVE-2026-50338 Spring Cloud Azure B2C cross-issuer auth bypass.""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import...

Windows Gather DLL & COM Hijack Surface

Find writable PATH dirs and HKCU COM overrides !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather DLL & COM Hijack Surface", "description": "Fi...

Windows Defender Evasive JS.Net and HTA

Generate an HTA that writes and compiles a JScript.NET file containing shellcode on the target machine. The compiled EXE executes the payload via dynamic P/Invoke VirtualAlloc/CreateThread. RC4 or HTTPS payloads are recommended for best results against Defender. !/usr/bin/env python3 -- coding:...

Vercel Detection

Detects Vercel edge/deploy platform response headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Vercel-hosted sites via platform headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Vercel Detection",...

Spring Cloud Gateway Detection

Detects exposed Spring Cloud Gateway route definitions via Actuator. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Spring Cloud Gateway actuator routes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

PDF CVE-2018-4993 GoToE NTLM Callback

Generate PDF PoCs for CVE-2018-4993: /GoToE action with UNC path NTLM and HTTPS URL variant. Phone-home validation for Adobe Reader. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.actions import writegotoeunc,...

Apache Tomcat CVE-2026-43512 DIGEST authentication bypass

CVE-2026-43512: when DIGEST authentication is enabled, RealmBase.getDigest concatenates the literal string "null" for unknown usernames. A client digest computed with password="null" matches the server hash. Note: standard UserDatabaseRealm may still reject unknown users in getPrincipal;...

Splunk Detection

Detects Splunk management REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Splunk Enterprise web/API interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlresponse, ishtmlresponse...

WordPress Atarim Plugin < 4.2.2 - Sensitive Information Exposure

CVE-2025-60188: Atarim WordPress plugin versions below 4.2.2 expose a site ID via an unauthenticated REST endpoint. That value is used as an HMAC key to forge signed admin-ajax requests and dump site configuration, license keys, and user PII. import hashlib import hmac import json import re from...

ThinkPHP Detection

Detects ThinkPHP routing errors and framework markers without exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ThinkPHP framework fingerprints safe passive probes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

QUIC Upload File

Upload a local file to the remote host via an active QUIC C2 session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin class ModulePost,...

phpPgAdmin Detection

Detects phpPgAdmin PostgreSQL administration panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed phpPgAdmin panels.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "phpPgAdmin Detection", "description"...

Mattermost Detection

Detects Mattermost system ping API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Mattermost team collaboration server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

Person to Usernames

Generate likely username candidates from a person's full name, structured name fields, display name, and aliases. !/usr/bin/env python3 -- coding: utf-8 -- """Generate likely usernames from a person's name and aliases.""" from future import annotations import json import os from kittysploit impor...

MinIO Detection

Detects MinIO health and console login endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed MinIO object storage API and console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "MinIO Detection",...

Windows Gather UAC & Integrity Audit

Audit UAC policy EnableLUA, ConsentPromptBehaviorAdmin, LocalAccountTokenFilterPolicy, groups, and privileges. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows Gather U...

Ollama Detection

Detects Ollama model API via /api/tags endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Ollama local LLM API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Modbus UDP Detection

Detects Modbus UDP responders via read holding registers probe. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Modbus UDP services on port 502.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.modbus.detectors import probemodbusudp...

Export passive ICS report

Loads a JSON report produced by auxiliary/scanner/ics/passivesniffer and optionally copies it or syncs discovered OT assets to the workspace. !/usr/bin/env python3 -- coding: utf-8 -- import json import os import shutil from kittysploit import from lib.protocols.ics.report import savereport class...

Palo Alto GlobalProtect CVE-2026-0257 detection

Fingerprints Palo Alto GlobalProtect and flags PAN-OS versions affected by CVE-2026-0257 authentication override cookie forgery. Actual exploitability also requires authentication override cookies to be enabled and certificate reuse with the HTTPS service. !/usr/bin/env python3 -- coding: utf-8 -...

RabbitMQ Management Detection

Detects RabbitMQ management UI and overview API. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed RabbitMQ management plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "RabbitMQ Management Detection",...

S7 module enumeration

Enumerates rack/slot modules on a Siemens S7 PLC using SZL 0x0013 reads CPU, IO, CP modules. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

InfluxDB Detection

Detects InfluxDB ping and health endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed InfluxDB HTTP API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "InfluxDB Detection", "description": "Detects...

VxWorks RPC integer overflow DoS

Exploits CVE-2015-7599, an integer overflow in VxWorks RPC authentication svcauth.c, to crash or disrupt VxWorks 5.5 through 6.9.4.1 systems with RPC enabled on TCP/111. !/usr/bin/env python3 -- coding: utf-8 -- """ VxWorks RPC integer overflow denial of service CVE-2015-7599. Triggers an integer...

pgAdmin Detection

Detects pgAdmin4 browser UI and misc/ping endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect pgAdmin PostgreSQL web console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanne...