Rocket.Chat Detection

Detects Rocket.Chat info API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Rocket.Chat collaboration server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

GraphQL Introspection Abuse

Confirm GraphQL introspection, enumerate schema types/fields, and flag sensitive queries users, admin, secrets for follow-up exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """ GraphQL introspection and lightweight abuse probe. Runs full introspection when enabled, surfaces sensitive...

VNC Service Detection

Detects VNC servers via RFB protocol version banner. !/usr/bin/env python3 -- coding: utf-8 -- """Detect VNC/RFB remote desktop services.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.vnc.detectors import probevnc class ModuleScanner,...

Memcached Detection

Detects Memcached and unauthenticated stats command access. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Memcached and unauthenticated stats access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.memcached.detectors import...

Process Herpaderping Evasion

Generate a Windows x64 EXE that maps shellcode via a file section, overwrites the on-disk file with decoy content Herpaderping, and executes from the stale mapped view. !/usr/bin/env python3 -- coding: utf-8 -- """ Process Herpaderping-style evasion loader. Writes shellcode to a temp file, create...

XOR Stream Transform

XORs the C2 stream with a repeating key. Symmetric encode/decode. Evades simple signature detection. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import class ModuleTransform: """XOR stream transform - obfuscates C2 traffic with a repeating XOR key."""...

WebSocket Mimic Transform

Wraps C2 bytes in WebSocket-like binary frames with an initial HTTP Upgrade exchange. !/usr/bin/env python3 -- coding: utf-8 -- """ WebSocket mimic transform. The first server-side encode prepends an HTTP 101 response, generated client code prepends an HTTP Upgrade request, then traffic is wrappe...

PHP HTTPS Mimic Transform

Sends a fake TLS ClientHello then wraps C2 bytes in TLS Application Data records. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.httpsmimic import CLIENTHELLOBYTES, Module as PythonHttpsTransform, class ModulePythonHttpsTransform:...

PHP Base64 Frame Transform

Frames C2 chunks as length-prefixed Base64 lines and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.base64frame import Module as PythonBase64FrameTransform class ModulePythonBase64FrameTransform: """PHP Base64...

HTTPS Mimic Transform

Sends fake TLS 1.2 Client/Server Hello at start, then TLS Application Data. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import TLS record: type 1 + version 2 + length 2 + fragment TLSHEADERLEN = 5 TLSHANDSHAKE = 0x16 TLSAPPLICATIONDATA = 0x17 TLSVERSION1...

ROT Stream Transform

Shifts each byte by a fixed value mod 256. Encode: add shift, decode: subtract. Simple Caesar-style obfuscation. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import class ModuleTransform: """ROT Caesar stream transform - shifts each byte by a fixed value...

GCP Overprivileged Bindings

Find overprivileged IAM bindings: primitive roles, public principals, and broad group grants !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Overprivileged Bindings", "description": "Find...

MeiG FORGE_SLT711 GoAhead blind OS command injection (CVE-2026-36356)

Unauthenticated blind OS command injection in MeiG Smart FORGESLT711 Ortel 4G LTE CPE and related MDM9607 firmware. The GoAhead endpoint POST /action/SetRemoteAccessCfg passes the JSON password field to sprintf"echo root:"%s"|chpasswd" and system as root. !/usr/bin/env python3 -- coding: utf-8 --...

GCP Cloud Run Env Vars Loot

Extract environment variables from Cloud Run services and jobs !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Run Env Vars Loot", "description": "Extract environment...

GCP Firebase Realtime Database Loot

Discover Firebase RTDB instances and read database JSON via authenticated REST access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Realtime Database Loot",...

GCP Storage Bucket Objects Loot

List and optionally preview objects from Cloud Storage buckets !/usr/bin/env python3 -- coding: utf-8 -- import json from urllib.parse import quote from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage Bucket Objects Loot",...

GCP Cloud Function Deploy Command Pivot

Deploy a Gen2 Cloud Function via Cloud Build that executes an arbitrary command on HTTP invoke !/usr/bin/env python3 -- coding: utf-8 -- import json import re import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Functi...

GCP Artifact Registry Images Loot

List Artifact Registry repositories, packages, and image versions !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Artifact Registry Images Loot", "description": "List Artifact...

GCP Cloud Build History Loot

Extract Cloud Build history, substitutions, images, and secret references !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Build History Loot", "description": "Extract Clou...

D-Link / ZynOS ROM-0 admin password disclosure

Unauthenticated download of /rom-0 on ZynOS / RomPager-based routers exposes a compressed configuration blob. LZS decompression at offset 8568 reveals the device administrator password in plaintext. Tested on D-Link DSL-2600U firmware v1.08; affects multiple D-Link, TP-Link, ZyXEL, and ZTE models...

Google Cloud API Console Listener

Creates an interactive GCP/Firebase API console from a token or service account. !/usr/bin/env python3 -- coding: utf-8 -- import json import os import time from urllib.parse import quote import requests from kittysploit import DEFAULTSCOPES = "https://www.googleapis.com/auth/cloud-platform",...

GCP Compute SSH Pivot via OS Login

Pivot to a VM by importing an SSH key through OS Login and preparing a Compute SSH session !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute SSH Pivot via OS...

GCP Logging Sinks

Enumerate Cloud Logging sinks in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Logging Sinks", "description": "Enumerate Cloud Logging sinks in the...

GCP Service Account Risk

Assess service account hygiene, key exposure, and privilege concentration !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Account Risk", "description": "Assess service account...

Zig Meterpreter macOS, Bind TCP

macOS Meterpreter bind TCP payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterbindtcp import ZigMeterpreterBindTcpBase class ModuleZigMeterpreterBindTcpBase, Payload: info = 'name': 'Zig Meterpreter macOS...

Unix Command Shell, Reverse TCP (via Ruby)

Connect back and create a command shell via Ruby TCPSocket from kittysploit import class ModulePayload: info = 'name': 'Unix Command Shell, Reverse TCP via Ruby', 'description': 'Connect back and create a command shell via Ruby TCPSocket', 'author': 'KittySploit Team', 'category':...

Zig Meterpreter macOS, Reverse TCP

macOS Meterpreter payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterreversetcp import ZigMeterpreterReverseTcpBase class ModuleZigMeterpreterReverseTcpBase, Payload: info = 'name': 'Zig Meterpreter macOS...

Joomla JCE < 2.9.99.5 - Unauthenticated RCE (CVE-2026-48907)

Exploits CVE-2026-48907 in Joomla JCE Editor 2.9.99.5: unauthenticated arbitrary file upload via profile import or JCE browser chain, followed by PHP webshell execution. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

WiFi Handshake Capture

Passively capture WPA/WPA2 EAPOL key exchanges on a monitor-mode interface and save matching frames to a PCAP file for offline cracking. !/usr/bin/env python3 -- coding: utf-8 -- """Passively capture WPA/WPA2 EAPOL handshakes on a monitor-mode interface.""" from future import annotations import o...

WiFi Deauth Detector

Passively detect 802.11 deauthentication and disassociation frames on a monitor-mode interface to spot deauth floods or rogue disconnect attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Detect 802.11 deauthentication and disassociation frames passive WIDS.""" from future import annotations...

Windows Gather Autologon and Unattend Secrets

Read Winlogon autologon values from the registry and scan Panther/Sysprep unattend XML files for cleartext passwords on a Windows session. !/usr/bin/env python3 -- coding: utf-8 -- """ Search Winlogon autologon registry values and unattend/sysprep XML files for embedded credentials on a Windows...

Windows Gather Clipboard

Read the current clipboard text from the interactive desktop session on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Read the current Windows clipboard text from an interactive user session. """ from kittysploit import from lib.post.windows.session import...

WiFi Beacon Scanner

Capture 802.11 beacon frames on a monitor-mode interface and list visible wireless networks SSID and BSSID. !/usr/bin/env python3 -- coding: utf-8 -- """Sniff 802.11 beacon frames on a monitor-mode interface.""" from future import annotations from typing import Dict from kittysploit import class...

Frigate NVR RCE detection (CVE-2026-25643)

Detects CVE-2026-25643 by fingerprinting Frigate NVR and checking whether the reported version is = 0.16.3. Optionally confirms an unauthenticated exploit path when /api/config/raw is reachable without credentials. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from...

Android WiFi Audit

Audit Android Wi-Fi posture: radio state, current connection, saved networks, MAC randomization, proxy, and insecure configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Audit Wi-Fi posture on a compromised Android device.""" from future import annotations import re from kittysploit impor...

OpenClaw AI agent gateway detection

Detects exposed OpenClaw formerly Clawdbot/Moltbot AI agent gateways and flags versions likely affected by CVE-2026-25253 token exfiltration. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Bluetooth Classic Scanner

Discover nearby classic Bluetooth devices using hcitool or bluetoothctl inquiry scans. !/usr/bin/env python3 -- coding: utf-8 -- """Discover nearby classic Bluetooth devices via inquiry scan.""" from future import annotations import re import shutil import subprocess from typing import Dict from...

Windows Gather RDP Files

Find and parse saved Remote Desktop .rdp files in common user locations on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate and parse saved .rdp client files on a Windows session. """ from kittysploit import from lib.post.windows.session import...

WordPress The Events Calendar CVE-2026-49772 (SQLi)

Detects CVE-2026-49772 in The Events Calendar 6.15.12–6.16.2: unauthenticated blind SQL injection via the order parameter on /wp-json/tec/v1/events. !/usr/bin/env python3 -- coding: utf-8 -- import time from urllib.parse import urlencode from kittysploit import from lib.protocols.http.httpclient...

AD honeytoken hunt (lastLogon oracle)

Flags probable AD honeytokens/decoys via empty auth history lastLogon=0, logonCount=0 and feeds Guardian. !/usr/bin/env python3 -- coding: utf-8 -- """ Repérage de honeytokens AD via l'oracle lastLogon historique comportemental. Préférer le module SMB SAMR, port 445 : scanner/smb/honeytokenhunt C...

P2P Relay Listener

Operator listener for NAT-friendly C2 via KittyRelay hub v2 E2E encrypted. Start the hub with the standalone command: kittyrelay no framework. Agents use p2p relay payloads; operators use this module role=operator. !/usr/bin/env python3 -- coding: utf-8 -- """ P2P Relay Listener operator side The...

Unix Command Shell, P2P Relay (via Python)

P2P relay agent KSRL v2 E2E + Ed25519 identity + PTY. Requires cryptography on target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.relay.payloadstub import buildrelayptyagentscript class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Unix Command Shell, P2...

Dump PostgreSQL Role Password Hashes

Dump role password hashes from pgauthid/pgshadow superuser. Supports SCRAM-SHA-256 and legacy MD5 hashes for offline cracking from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Dump PostgreSQL Role...

Enumerate PostgreSQL Configuration

Dump security-relevant server settings and paths from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Configuration", "description": "Dump security-relevant server settings and paths...

Check PostgreSQL Privileges

Review current role capabilities and notable grants from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Check PostgreSQL Privileges", "description": "Review current role capabilities and notable grants"...

Enumerate PostgreSQL Privilege Escalation Paths

Find likely PostgreSQL privilege escalation paths: superuser role chain, SECURITY DEFINER functions, unsafe searchpath, and risky extensions from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate...

Enumerate PostgreSQL Databases

Enumerate databases and tables/schemas in the current database from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Databases", "description": "Enumerate databases and tables/schemas...

PostgreSQL Read Server File

Read a server file via pgreadfile requires superuser from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "PostgreSQL Read Server File", "description": "Read a server file via pgreadfile requires...

Windows FodHelper UAC Bypass

HKCU ms-settings shell open command hijack + fodhelper.exe default value + empty DelegateExecute, then registry cleanup. sessionid comes from the Post base class. !/usr/bin/env python3 -- coding: utf-8 -- import time from kittysploit import REGKEY =...

Bludit CMS < 3.18.4 - API Unrestricted File Upload to RCE

Bludit CMS API plugin allows an authenticated user with a valid API token to upload files of any type and extension via POST /api/files/. This module uploads a PHP webshell to achieve Remote Code Execution. from kittysploit import from lib.protocols.http.httpclient import Httpclient import random...