MSSQL Info - Detection

Detects MSSQL via TDS prelogin and reports version and encryption hints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft SQL Server via TDS prelogin.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.mssql.detectors import...

MinIO Public Bucket Listing Verification

Confirms anonymous ListBuckets or open bucket listing on MinIO/S3 API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify MinIO/S3 anonymous bucket listing.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlrespon...

PHP user.ini Persistence

Deploys a PHP webshell via .user.ini autoprependfile / autoappendfile. Works with PHP-FPM and Apache when userini is enabled. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

PDF CVE-2018-4993 GoToE NTLM Callback

Generate PDF PoCs for CVE-2018-4993: /GoToE action with UNC path NTLM and HTTPS URL variant. Phone-home validation for Adobe Reader. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.actions import writegotoeunc,...

Apache Struts Detection

Detects Struts2 action extensions and OGNL error fingerprints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Struts2 framework indicators.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse...

phpPgAdmin Detection

Detects phpPgAdmin PostgreSQL administration panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed phpPgAdmin panels.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "phpPgAdmin Detection", "description"...

Vercel Detection

Detects Vercel edge/deploy platform response headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Vercel-hosted sites via platform headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Vercel Detection",...

DNP3 unsolicited enabled

Checks whether a DNP3 outstation accepts unsolicited response configuration !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import probednp3unsolicited from...

Telnet Service Detection

Detects Telnet services via initial banner. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Telnet service via banner.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.telnet.detectors import probetelnetbanner class ModuleScanner,...

HTTP SQLi Shell

Read-only SQL extraction via confirmed HTTP SQLi: union-based scalar or boolean-blind oracle. Starts Sqli pseudo-shell or runs singlesql. !/usr/bin/env python3 -- coding: utf-8 -- """ Generic HTTP SQL injection post-exploitation authorized testing only. After confirming SQLi scanner / manual,...

InfluxDB Detection

Detects InfluxDB ping and health endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed InfluxDB HTTP API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "InfluxDB Detection", "description": "Detects...

Mattermost Detection

Detects Mattermost system ping API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Mattermost team collaboration server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

pgAdmin Detection

Detects pgAdmin4 browser UI and misc/ping endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect pgAdmin PostgreSQL web console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanne...

RabbitMQ Management Detection

Detects RabbitMQ management UI and overview API. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed RabbitMQ management plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "RabbitMQ Management Detection",...

Spring Cloud Gateway Detection

Detects exposed Spring Cloud Gateway route definitions via Actuator. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Spring Cloud Gateway actuator routes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

BACnet write property

Sends a BACnet WriteProperty request intrusive — BMS/OT lab only. Gated by otpolicy destructive markers + confirm latch. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import writeproperty from lib.protocols.ics.constants import...

Export passive ICS report

Loads a JSON report produced by auxiliary/scanner/ics/passivesniffer and optionally copies it or syncs discovered OT assets to the workspace. !/usr/bin/env python3 -- coding: utf-8 -- import json import os import shutil from kittysploit import from lib.protocols.ics.report import savereport class...

Neo4j Unauthenticated Query Verification

Confirms anonymous Neo4j HTTP transaction commits with RETURN 1. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated Neo4j Cypher queries.""" import json from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Azure Storage Service Probe

Probe Azure Queue, Table, and File endpoints for anonymous listing or readable responses complements blob-focused modules. !/usr/bin/env python3 -- coding: utf-8 -- """Probe Azure Queue, Table, and File storage services for anonymous exposure.""" from future import annotations import json from...

AD CS Web Enrollment Detection

Detects Microsoft AD CS /certsrv and /CertEnroll HTTP enrollment surfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Detect AD CS web enrollment endpoints HTTP.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Langflow < 1.9.0 Public Build RCE (CVE-2026-33017)

CVE-2026-33017: Langflow versions below 1.9.0 allow unauthenticated remote code execution by posting a malicious custom component to /api/v1/buildpublictmp/flowid/flow with a clientid session cookie. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from...

Cross Transform Correlator

Ingest JSON outputs from multiple OSINT transforms, correlate shared entities domains, IPs, emails, endpoints, score confidence, and suggest next pivots. !/usr/bin/env python3 -- coding: utf-8 -- """Correlate entities across multiple OSINT transform JSON outputs.""" from future import annotations...

HashiCorp Vault Detection

Detects Vault /v1/sys/health and UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HashiCorp Vault API and UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

MLflow Detection

Detects MLflow tracking server UI and REST API. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MLflow tracking server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse, ishtmlresponse class...

ComfyUI Unauth Verification

Confirms ComfyUI systemstats and objectinfo APIs without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify ComfyUI unauthenticated workflow API access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Log4Shell Header Detection

Sends safe JNDI-style markers in HTTP headers and detects Log4j-related error reflection CVE-2021-44228 indicator, no outbound callback. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Log4Shell CVE-2021-44228 header injection indicators.""" from kittysploit import from...

XOR Stream Transform

XORs the C2 stream with a repeating key. Symmetric encode/decode. Evades simple signature detection. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import class ModuleTransform: """XOR stream transform - obfuscates C2 traffic with a repeating XOR key."""...

HTTPS Mimic Transform

Sends fake TLS 1.2 Client/Server Hello at start, then TLS Application Data. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import TLS record: type 1 + version 2 + length 2 + fragment TLSHEADERLEN = 5 TLSHANDSHAKE = 0x16 TLSAPPLICATIONDATA = 0x17 TLSVERSION1...

WebSocket Mimic Transform

Wraps C2 bytes in WebSocket-like binary frames with an initial HTTP Upgrade exchange. !/usr/bin/env python3 -- coding: utf-8 -- """ WebSocket mimic transform. The first server-side encode prepends an HTTP 101 response, generated client code prepends an HTTP Upgrade request, then traffic is wrappe...

PHP HTTPS Mimic Transform

Sends a fake TLS ClientHello then wraps C2 bytes in TLS Application Data records. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.httpsmimic import CLIENTHELLOBYTES, Module as PythonHttpsTransform, class ModulePythonHttpsTransform:...

PHP Base64 Frame Transform

Frames C2 chunks as length-prefixed Base64 lines and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.base64frame import Module as PythonBase64FrameTransform class ModulePythonBase64FrameTransform: """PHP Base64...

GCP Overprivileged Bindings

Find overprivileged IAM bindings: primitive roles, public principals, and broad group grants !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Overprivileged Bindings", "description": "Find...

MeiG FORGE_SLT711 GoAhead blind OS command injection (CVE-2026-36356)

Unauthenticated blind OS command injection in MeiG Smart FORGESLT711 Ortel 4G LTE CPE and related MDM9607 firmware. The GoAhead endpoint POST /action/SetRemoteAccessCfg passes the JSON password field to sprintf"echo root:"%s"|chpasswd" and system as root. !/usr/bin/env python3 -- coding: utf-8 --...

GCP Cloud Run Env Vars Loot

Extract environment variables from Cloud Run services and jobs !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Run Env Vars Loot", "description": "Extract environment...

GCP Firebase Realtime Database Loot

Discover Firebase RTDB instances and read database JSON via authenticated REST access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Realtime Database Loot",...

GCP Storage Bucket Objects Loot

List and optionally preview objects from Cloud Storage buckets !/usr/bin/env python3 -- coding: utf-8 -- import json from urllib.parse import quote from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage Bucket Objects Loot",...

GCP Cloud Function Deploy Command Pivot

Deploy a Gen2 Cloud Function via Cloud Build that executes an arbitrary command on HTTP invoke !/usr/bin/env python3 -- coding: utf-8 -- import json import re import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Functi...

GCP Artifact Registry Images Loot

List Artifact Registry repositories, packages, and image versions !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Artifact Registry Images Loot", "description": "List Artifact...

GCP Cloud Build History Loot

Extract Cloud Build history, substitutions, images, and secret references !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Build History Loot", "description": "Extract Clou...

GCP Compute SSH Pivot via Metadata

Pivot to a VM by injecting an SSH key into Compute metadata and preparing a Compute SSH session !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute SSH Pivot via...

AD Object ACL Operations

Runs common bloodyAD object/ACL operations: set owner, add GenericAll, move DN, set password, enable account. !/usr/bin/env python3 -- coding: utf-8 -- import os import shlex import shutil import subprocess from kittysploit import try: from ldap3 import ALL, Connection, Server LDAP3AVAILABLE = Tr...

GCP Workload Identity Federation

Analyze workload identity pools, providers, and risky federation configurations !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Workload Identity Federation", "description":...

D-Link / ZynOS ROM-0 admin password disclosure

Unauthenticated download of /rom-0 on ZynOS / RomPager-based routers exposes a compressed configuration blob. LZS decompression at offset 8568 reveals the device administrator password in plaintext. Tested on D-Link DSL-2600U firmware v1.08; affects multiple D-Link, TP-Link, ZyXEL, and ZTE models...

GCP Storage HMAC Keys Loot

List Cloud Storage HMAC keys used for S3-compatible interoperability access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage HMAC Keys Loot", "description": "List Cloud...

GCP Add SSH Key Metadata

Add an SSH public key to project or instance metadata for legacy SSH access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Add SSH Key Metadata", "description": "Add an SSH...

GCP Logging Sinks

Enumerate Cloud Logging sinks in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Logging Sinks", "description": "Enumerate Cloud Logging sinks in the...

Kubernetes ServiceAccount Secret Reader

Reads a pod service-account token from a PHP session and uses it to query the Kubernetes API for secrets in a namespace. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import class ModulePost: info = "name": "Kubernetes ServiceAccount Secret Reader", "description": "Reads ...

GCP Service Account Risk

Assess service account hygiene, key exposure, and privilege concentration !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Account Risk", "description": "Assess service account...

GCP Artifact Registry Pull Tokens Loot

Build Docker pull URIs and registry login material for Artifact Registry images !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Artifact Registry Pull Tokens Loot", "description...

Zig Meterpreter macOS, Bind TCP

macOS Meterpreter bind TCP payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterbindtcp import ZigMeterpreterBindTcpBase class ModuleZigMeterpreterBindTcpBase, Payload: info = 'name': 'Zig Meterpreter macOS...