OpenShift Assisted Installer Panel - Detect

OpenShift Assisted Installer panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OpenShift Assisted Installer panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenShift Assisted...

Keycloak Admin Console Configuration Disclosure Detection

Detected Keycloak admin console configuration was exposing realm name, client ID, SSL requirements, and authentication server URL enabling reconnaissance and targeted authentication attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Keycloak admin console configuration was exposing...

Laravel Nova - Unauthenticated Admin Panel Access Detection

Laravel Nova admin panel is accessible without authentication. Nova provides full CRUD access to application models and database records, making unauthenticated access a critical security risk. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel Nova admin panel is accessible without...

Ansible AWX Detection

Detects Ansible AWX Instance !/usr/bin/env python3 -- coding: utf-8 -- """Detects Ansible AWX Instance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ansible AWX Detection', 'description': 'Detects Ansible AWX...

Laravel Livewire - Detect

Detects the presence of Laravel Livewire, a full-stack framework for Laravel that builds dynamic interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of Laravel Livewire, a full-stack framework for Laravel that builds dynamic interfaces.""" from kittysploit import from...

AWStats Config - Detect

AWStats configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWStats Config - Detect',...

aiohttp - Directory Traversal Detection

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

GotWeb Detect

Game of Trees Got is a version control system which prioritizes ease of use and simplicity over flexibility. !/usr/bin/env python3 -- coding: utf-8 -- """Game of Trees Got is a version control system which prioritizes ease of use and simplicity over flexibility.""" from kittysploit import from...

Pandora Fms < 3.1.1 - Directory Traversal Detection

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via 1 the page parameter to ajax.php or 2 the id parameter to general/pandorahelp.php, and allow remote attackers to include and execute, create, modify, or...

FineCMS <=5.0.10 - Cross-Site Scripting Detection

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. !/usr/bin/env python3 -- coding: utf-8 -- """FineCMS through 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting Detection

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. !/usr/bin/env python3 --...

MicroStrategy Instances Detection Template

Detect if MicroStrategy instances exist in your URLS !/usr/bin/env python3 -- coding: utf-8 -- """Detect if MicroStrategy instances exist in your URLS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MicroStrategy...

Dell IDRAC Panel - Detect

Dell IDRAC panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dell IDRAC panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dell IDRAC Panel - Detect', 'description': 'Dell IDRAC panel...

Strapi Admin - Installer Detection

Strapi Admin Registration enabled was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Strapi Admin Registration enabled was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Strapi Admin - Installer...

UnRaid <=6.80 - Remote Code Execution Detection

UnRaid =6.80 allows remote unauthenticated attackers to execute arbitrary code. !/usr/bin/env python3 -- coding: utf-8 -- """UnRaid =6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'UnRaid =6.80 - Remote Code...

XWiki >= 3.4-milestone-1 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as:...

ASP.NET Launch Settings - Exposure Detection

Detected exposed launchSettings.json files in ASP.NET Core applications. This file contains environment variables and launch configurations that may leak sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed launchSettings.""" from kittysploit import from...

VMware Site Recovery Manager Panel - Detect

VMware Site Recovery Manger panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware Site Recovery Manger panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VMware Site Recovery Manage...

UniFi Network Application CVE-2026-22557 — path traversal file read

Exploits CVE-2026-22557: unauthenticated arbitrary file read through the guest portal pageerror parameter on /guest/s//wechat/sign and /login. Uses lib.protocols.http.lfi for one-shot reads or an interactive LFI shell. Pair with scanner/http/unificve202622557. Note: full OS file disclosure...

Foxit PDF Reader Pointer Overwrite UAF

Foxit PDF Reader v9.0.1.1049 Use-After-Free CVE-2018-9948 / CVE-2018-9958. Select a Windows payload; the PDF ROP calls WinExec on a short command. delivery=http serves an HTA stage over HTTP mshta http://LHOST/h and can also serve the PDF. delivery=smb embeds a UNC path to an EXE/BAT you host...

Nitro Pro PDF Reader 11 Javascript API RCE

CVE-2017-7442: Nitro / Nitro Pro PDF Reader 11 unsafe Javascript API. this.saveAs writes an embedded HTA to disk; app.launchURL with a c$: path bypasses the security dialog and executes it. Cmd/PowerShell payloads are run from the HTA directly. Binary MZ payloads are staged over HTTP as a...

VLC Media Player MKV Use After Free

CVE-2018-11529: Use-after-free in VideoLAN VLC = 2.2.8 MKV parsing 32-bit and 64-bit. Generates two .mkv files: part1 vulnerability + heap spray to open in VLC, and part2 must sit in the same directory. Requires a raw shellcode payload = 0x300 bytes. Meterpreter-sized payloads often crash VLC —...

FreeScout CVE-2026-28289 detection

Fingerprints FreeScout and compares the reported version against CVE-2026-28289 = ..., fixed in .... Optional admin credentials can be used only to read the version from the authenticated footer. Version check only — no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing...

BLE GATT Characteristics

Enumerates GATT characteristics UUID, handle, properties for a BLE session !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — list GATT characteristics and properties.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin import json class ModulePost,...

DoIP Client

Connects to an automotive DoIP ISO 13400 gateway, performs routing activation, and creates a session for UDS diagnostic post modules !/usr/bin/env python3 -- coding: utf-8 -- """DoIP bind listener — connects to a DoIP gateway and opens a diagnostic session.""" from kittysploit import from...

OPC UA Client

Connects to an OPC UA server and creates an interactive OPC UA shell session !/usr/bin/env python3 -- coding: utf-8 -- """OPC UA bind listener — opens an OPC UA session for node browsing and diagnostics.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

UART Firmware Info

Probes a UART console with read-only commands to collect kernel, OS release, CPU, and bootloader / firmware identity strings !/usr/bin/env python3 -- coding: utf-8 -- """ UART Firmware Info - Probes serial console for OS / firmware identity """ from kittysploit import from...

Windows Gather Wireless Current Connection Info

Gather information about the current connection on each wireless LAN interface via 'netsh wlan show interfaces' on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Gather current WLAN connection details on each wireless interface Metasploit-style...

Copy Fail Docker Escape via Modprobe (CVE-2026-31431)

Exploits CVE-2026-31431 Copy Fail / authencesn AEAD page-cache write from inside a Linux container to overwrite /proc/sys/kernel/modprobe, plant a host payload, and trigger requestmodule for host code execution. Requires a writable host path privileged container, shared PID+mount, or hostPath e.g...

phpMyAdmin Authenticated Remote Code Execution (CVE-2018-12613)

phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which can be exploited post-authentication to execute PHP code by application. Tested against phpMyAdmin v4.8.1. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin 4.8.0/4.8.1 authenticated LFI to RCE — CVE-2018-12613...

Metasploitable3 Windows Environment

Metasploitable3 Windows Server 2008 R2 lab VM via Vagrant — intentionally vulnerable Windows target for authorized internal-lab agent benchmarks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleVagrantEnvironment: info = "name": "Metasploitable3 Windows Environment",...

Moodle detection

Detects a Moodle installation and reports the version from lib/upgrade.txt when available. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Moodle and report the version from lib/upgrade.txt.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Metasploitable3 Linux Environment

Metasploitable3 Ubuntu 14.04 lab VM packaged for Docker — intentionally vulnerable Linux target for authorized internal-lab agent benchmarks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = "name": "Metasploitable3 Linux Environment",...

Windows Gather Kerberos Ticket Audit

Dump klist and logon session Kerberos context !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Kerberos Ticket Audit", "description": "Dump...

Spring Cloud Azure B2C CVE-2026-50338 Detection

Detect B2C JWT-protected APIs; verify CVE-2026-50338 when Entra creds are set !/usr/bin/env python3 -- coding: utf-8 -- """Detect CVE-2026-50338 Spring Cloud Azure B2C cross-issuer auth bypass.""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import...

MinIO Detection

Detects MinIO health and console login endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed MinIO object storage API and console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "MinIO Detection",...

phpPgAdmin Detection

Detects phpPgAdmin PostgreSQL administration panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed phpPgAdmin panels.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "phpPgAdmin Detection", "description"...

ThinkPHP Detection

Detects ThinkPHP routing errors and framework markers without exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ThinkPHP framework fingerprints safe passive probes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Vercel Detection

Detects Vercel edge/deploy platform response headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Vercel-hosted sites via platform headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Vercel Detection",...

DNP3 unsolicited enabled

Checks whether a DNP3 outstation accepts unsolicited response configuration !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import probednp3unsolicited from...

Telnet Service Detection

Detects Telnet services via initial banner. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Telnet service via banner.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.telnet.detectors import probetelnetbanner class ModuleScanner,...

HTTP SQLi Shell

Read-only SQL extraction via confirmed HTTP SQLi: union-based scalar or boolean-blind oracle. Starts Sqli pseudo-shell or runs singlesql. !/usr/bin/env python3 -- coding: utf-8 -- """ Generic HTTP SQL injection post-exploitation authorized testing only. After confirming SQLi scanner / manual,...

InfluxDB Detection

Detects InfluxDB ping and health endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed InfluxDB HTTP API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "InfluxDB Detection", "description": "Detects...

Mattermost Detection

Detects Mattermost system ping API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Mattermost team collaboration server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

pgAdmin Detection

Detects pgAdmin4 browser UI and misc/ping endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect pgAdmin PostgreSQL web console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanne...

RabbitMQ Management Detection

Detects RabbitMQ management UI and overview API. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed RabbitMQ management plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "RabbitMQ Management Detection",...

Spring Cloud Gateway Detection

Detects exposed Spring Cloud Gateway route definitions via Actuator. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Spring Cloud Gateway actuator routes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Traefik Dashboard Detection

Detects Traefik reverse-proxy dashboard and /api/overview exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Traefik dashboard and API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Traefik...

BACnet write property

Sends a BACnet WriteProperty request intrusive — BMS/OT lab only. Gated by otpolicy destructive markers + confirm latch. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import writeproperty from lib.protocols.ics.constants import...

Export passive ICS report

Loads a JSON report produced by auxiliary/scanner/ics/passivesniffer and optionally copies it or syncs discovered OT assets to the workspace. !/usr/bin/env python3 -- coding: utf-8 -- import json import os import shutil from kittysploit import from lib.protocols.ics.report import savereport class...