GCP Add SSH Key Metadata

Add an SSH public key to project or instance metadata for legacy SSH access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Add SSH Key Metadata", "description": "Add an SSH...

GCP Logging Sinks

Enumerate Cloud Logging sinks in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Logging Sinks", "description": "Enumerate Cloud Logging sinks in the...

GCP Firestore Recursive Dump Loot

Recursively dump Firestore documents and nested subcollections from the default database !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firestore Recursive Dump Loot",...

Kubernetes ServiceAccount Secret Reader

Reads a pod service-account token from a PHP session and uses it to query the Kubernetes API for secrets in a namespace. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import class ModulePost: info = "name": "Kubernetes ServiceAccount Secret Reader", "description": "Reads ...

GCP Overprivileged Bindings

Find overprivileged IAM bindings: primitive roles, public principals, and broad group grants !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Overprivileged Bindings", "description": "Find...

Meterpreter Bind TCP

Meterpreter bind TCP handler with post-exploitation capabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket import threading import time import struct class ModuleListener: """Meterpreter bind TCP handler — connects to a bind payload on the target""" info =...

Zig Meterpreter macOS, Bind TCP

macOS Meterpreter bind TCP payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterbindtcp import ZigMeterpreterBindTcpBase class ModuleZigMeterpreterBindTcpBase, Payload: info = 'name': 'Zig Meterpreter macOS...

Unix Command Shell, Reverse TCP (via Perl)

Connect back and create a command shell via Perl IO::Socket from kittysploit import class ModulePayload: info = 'name': 'Unix Command Shell, Reverse TCP via Perl', 'description': 'Connect back and create a command shell via Perl IO::Socket', 'category': PayloadCategory.CMD, 'arch': Arch.PERL,...

Joomla JCE < 2.9.99.5 - Unauthenticated RCE (CVE-2026-48907)

Exploits CVE-2026-48907 in Joomla JCE Editor 2.9.99.5: unauthenticated arbitrary file upload via profile import or JCE browser chain, followed by PHP webshell execution. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Wayback Surface Hunter

Mine Internet Archive Wayback CDX for historical URLs and flag forgotten sensitive endpoints — admin panels, configs, backups, API docs, and debug paths. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class...

WiFi Deauth Detector

Passively detect 802.11 deauthentication and disassociation frames on a monitor-mode interface to spot deauth floods or rogue disconnect attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Detect 802.11 deauthentication and disassociation frames passive WIDS.""" from future import annotations...

Windows Gather Autologon and Unattend Secrets

Read Winlogon autologon values from the registry and scan Panther/Sysprep unattend XML files for cleartext passwords on a Windows session. !/usr/bin/env python3 -- coding: utf-8 -- """ Search Winlogon autologon registry values and unattend/sysprep XML files for embedded credentials on a Windows...

Windows Gather Clipboard

Read the current clipboard text from the interactive desktop session on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Read the current Windows clipboard text from an interactive user session. """ from kittysploit import from lib.post.windows.session import...

WiFi Beacon Scanner

Capture 802.11 beacon frames on a monitor-mode interface and list visible wireless networks SSID and BSSID. !/usr/bin/env python3 -- coding: utf-8 -- """Sniff 802.11 beacon frames on a monitor-mode interface.""" from future import annotations from typing import Dict from kittysploit import class...

Frigate NVR RCE detection (CVE-2026-25643)

Detects CVE-2026-25643 by fingerprinting Frigate NVR and checking whether the reported version is = 0.16.3. Optionally confirms an unauthenticated exploit path when /api/config/raw is reachable without credentials. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from...

Android WiFi Audit

Audit Android Wi-Fi posture: radio state, current connection, saved networks, MAC randomization, proxy, and insecure configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Audit Wi-Fi posture on a compromised Android device.""" from future import annotations import re from kittysploit impor...

Test

Test payload !/usr/bin/env python3 from kittysploit import class ModulePayload: info = 'name': 'Test', 'description': 'Test payload', 'listener': 'listeners/multi/reversetcp', def generateself: return b"\x90\xcc"...

Windows Gather RDP Files

Find and parse saved Remote Desktop .rdp files in common user locations on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate and parse saved .rdp client files on a Windows session. """ from kittysploit import from lib.post.windows.session import...

WordPress The Events Calendar CVE-2026-49772 (SQLi)

Detects CVE-2026-49772 in The Events Calendar 6.15.12–6.16.2: unauthenticated blind SQL injection via the order parameter on /wp-json/tec/v1/events. !/usr/bin/env python3 -- coding: utf-8 -- import time from urllib.parse import urlencode from kittysploit import from lib.protocols.http.httpclient...

AD honeytoken hunt (lastLogon oracle)

Flags probable AD honeytokens/decoys via empty auth history lastLogon=0, logonCount=0 and feeds Guardian. !/usr/bin/env python3 -- coding: utf-8 -- """ Repérage de honeytokens AD via l'oracle lastLogon historique comportemental. Préférer le module SMB SAMR, port 445 : scanner/smb/honeytokenhunt C...

Bluetooth LE Scanner

Discover nearby BLE devices using passive/active advertisement scanning. !/usr/bin/env python3 -- coding: utf-8 -- """Discover nearby Bluetooth Low Energy BLE devices.""" from future import annotations import asyncio from typing import Dict from kittysploit import class ModuleAuxiliary: info =...

WiFi Handshake Capture

Passively capture WPA/WPA2 EAPOL key exchanges on a monitor-mode interface and save matching frames to a PCAP file for offline cracking. !/usr/bin/env python3 -- coding: utf-8 -- """Passively capture WPA/WPA2 EAPOL handshakes on a monitor-mode interface.""" from future import annotations import o...

P2P Relay Listener

Operator listener for NAT-friendly C2 via KittyRelay hub v2 E2E encrypted. Start the hub with the standalone command: kittyrelay no framework. Agents use p2p relay payloads; operators use this module role=operator. !/usr/bin/env python3 -- coding: utf-8 -- """ P2P Relay Listener operator side The...

Unix Command Shell, P2P Relay (via Python)

P2P relay agent KSRL v2 E2E + Ed25519 identity + PTY. Requires cryptography on target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.relay.payloadstub import buildrelayptyagentscript class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Unix Command Shell, P2...

Enumerate PostgreSQL Configuration

Dump security-relevant server settings and paths from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Configuration", "description": "Dump security-relevant server settings and paths...

Check PostgreSQL Privileges

Review current role capabilities and notable grants from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Check PostgreSQL Privileges", "description": "Review current role capabilities and notable grants"...

PostgreSQL Read Server File

Read a server file via pgreadfile requires superuser from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "PostgreSQL Read Server File", "description": "Read a server file via pgreadfile requires...

Dump PostgreSQL Role Password Hashes

Dump role password hashes from pgauthid/pgshadow superuser. Supports SCRAM-SHA-256 and legacy MD5 hashes for offline cracking from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Dump PostgreSQL Role...

Next.js RSC server-action DoS (CVE-2026-23870)

Form-encoded cyclic RSC reply with Next-Action + Accept: text/x-component. Pre-patch React Next.js 16.2.5 can spin CPU / blow the stack. Availability only. !/usr/bin/env python3 -- coding: utf-8 -- import time from concurrent.futures import ThreadPoolExecutor, ascompleted from urllib.parse import...

Next.js _rsc weak cache-busting hash collision (CVE-2026-44582)

Reimplements the legacy 32-bit FNV-style mix and runs a birthday search for a colliding state-tree, next-url tuple. Optional HTTP GET with RSC prefetch headers can probe CDN cache behaviour. CPU-heavy; patched Next.js uses a stronger mix = 16.2.5. !/usr/bin/env python3 -- coding: utf-8 -- import...

Bludit CMS < 3.18.4 - API Unrestricted File Upload to RCE

Bludit CMS API plugin allows an authenticated user with a valid API token to upload files of any type and extension via POST /api/files/. This module uploads a PHP webshell to achieve Remote Code Execution. from kittysploit import from lib.protocols.http.httpclient import Httpclient import random...

Next.js /_next/image optimizer OOM (GHSA-h64f-5h5j-jqjh)

GET /next/image?url=&w=&q= against a large same-origin asset. Pre-16.2.5 the optimizer may decode the full image into memory OOM / long wall. v16.2.5 adds limits. Streams the response in 64 KiB chunks; can stress the target — use only on systems you own. !/usr/bin/env python3 -- coding: utf-8 --...

PowerShell reverse TCP line shell

Writes a PowerShell script that connects back over TCP and executes each received line via Invoke-Expression line-oriented command channel. from kittysploit import class ModuleBackdoor: info = "name": "PowerShell reverse TCP line shell", "description": "Writes a PowerShell script that connects ba...

Next.js i18n data-route middleware bypass (CVE-2026-44573) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44573 i18n /next/data middleware bypass. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js x-nextjs-data redirect cache poisoning (GHSA-3g8h) detection

Fingerprints Next.js and flags versions 16.2.5 affected by GHSA-3g8h-86w9-wvmq x-nextjs-data redirect cache poisoning. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionsc...

PHP CGI Argument Injection RCE (CVE-2024-4577)

Exploits PHP-CGI argument injection via query-string option smuggling to set autoprependfile=php://input and execute attacker-supplied PHP code. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient:...

Android adbd TLS auth bypass CVE-2026-0073 detection

Checks Android adbd over TCP for the STLS/TLS authentication bypass path and confirms command execution with a harmless id probe. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Android adbd STLS/TLS auth bypass CVE-2026-0073.""" import ssl from kittysploit import from core.framework.option...

AWS S3 Bucket File List

List files from an AWS S3 bucket using anonymous access. from kittysploit import import json import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "AWS S3 Bucket File List"...

Check MySQL Hardening

Audit common MySQL security hardening controls and risky configurations from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "Check MySQL Hardening", "description": "Audit common MySQL security hardening controls and risky...

AWS S3 public listing detect

Checks if S3 ListBucket is anonymously accessible no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Détection listing public AWS S3 check-only.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AWS S3 publi...

PackageKit TOCTOU Local Privilege Escalation (CVE-2026-41651)

This module exploits a TOCTOU vulnerability in PackageKit to achieve local privilege escalation. It compiles a Zig exploit, uploads it to the target, and executes it. from kittysploit import from core.framework.post import Post from core.lib.compiler.zigcompiler import ZigCompiler from...

Craft CMS CVE-2025-32432 Pre-Auth RCE

Exploits Craft CMS CVE-2025-32432, a pre-authentication remote code execution issue in the assets/generate-transform endpoint. The module poisons the active PHP session and triggers a Yii gadget chain to include the session file through yii\rbac\PhpManager. !/usr/bin/env python3 -- coding: utf-8 ...

Azure Blob File Sampler

Sample high-value blob files by extension/name and rank by likely sensitivity. from kittysploit import import json import re from urllib.parse import urlparse import xml.etree.ElementTree as ET from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name":...

Identity Exposure Graph

Link human and machine identity artifacts and score real exploitability. from kittysploit import import json import re class ModuleAuxiliary: info = "name": "Identity Exposure Graph", "author": "KittySploit Team", "description": "Link human and machine identity artifacts and score real...

GCP GCS Bucket File List

List files from a Google Cloud Storage bucket using anonymous access. from kittysploit import import json import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "GCP GCS...

GCP GCS File Download

Download a file from a GCS bucket via anonymous access. from kittysploit import import os import json from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "GCP GCS File Download", "author": "KittySploit...

Hop proxy PHP generator

Generates a standalone PHP hop proxy with custom upstream server and Hop-Name value. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import PHPPROXYTEMPLATE = r""" array 'method' = 'GET' , 'ssl'=array "verifypeer"=false, "verifypeername"=false, , ; $headers = array'Hop-Name' = $hopName...

GCP GCS Sensitive Pattern Scan

List and scan exposed GCS files for sensitive patterns keys, tokens, credentials. from kittysploit import import json import re import time import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

SaaS Tenant Discovery

Passive discovery of public SaaS / IdP signals for an organization domain: Microsoft 365 realm, autodiscover, Google Workspace, Okta, Auth0, Atlassian, Slack, Notion, and common mail/SaaS SPF-MX hints via DNS and optional certificate transparency. from kittysploit import import json import re fro...

AWS S3 public object read detect

Checks anonymous read access to a user-provided object path no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Détection lecture anonyme d'objet S3 check-only.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name"...