DirPHP - phpfile LFI Detection (CVE-2014-5115)

Detects CVE-2014-5115 by requesting index.php?phpfile=/etc/passwd on DirPHP. !/usr/bin/env python3 -- coding: utf-8 -- """DirPHP phpfile local file inclusion CVE-2014-5115.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Kitty Agent Installer Pack

Writes kittyagent.py plus installlinux.sh systemd and/or installwindows.ps1 scheduled task. Controller: listeners/multi/reversehttppolling. from kittysploit import from lib.c2.agentinstaller import buildinstallreadme, buildlinuxinstallsh, buildwindowsschtasksinstallps1, from lib.c2.agentspec impo...

GitLab API Token Abuse

Uses leaked glpat- tokens to enumerate GitLab user identity and accessible projects via /api/v4. Auto-discovers tokens from CI YAML and bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Abuse leaked GitLab personal access tokens against GitLab API.""" from kittysploit import from...

ONVIF Client

Discovers an ONVIF device service, loads Media/PTZ/Events capabilities, and creates an interactive ONVIF shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ONVIF bind listener — opens an interactive ONVIF camera session.""" from kittysploit import from lib.protocols.onvif.client import...

NFS Showmount

Queries the MOUNT daemon via portmap for NFS export lists NSE nfs-showmount. !/usr/bin/env python3 -- coding: utf-8 -- """NFS showmount / export list NSE nfs-showmount.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.nfs.detectors import...

WordPress JNews Theme <8.0.6 - Cross-Site Scripting Detection

WordPress JNews theme before 8.0.6 contains a reflected cross-site scripting vulnerability. It does not sanitize the catid parameter in the POST request /?ajax-request=jnews with action=jnewsbuildmegacategory. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress JNews theme before 8.""" from...

FullStory RUM - Detect

Detects FullStory Session Replay & Digital Experience Intelligence artifacts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FullStory Session Replay & Digital Experience Intelligence artifacts.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Meshery - Detect

Meshery is a open source, cloud native manager that enables the design and management of all Kubernetes-based infrastructure and applications multi-cloud. !/usr/bin/env python3 -- coding: utf-8 -- """Meshery is a open source, cloud native manager that enables the design and management of all...

Libvirt Exporter Metrics Detection

Libvirt Exporter is leaking metrics. !/usr/bin/env python3 -- coding: utf-8 -- """Libvirt Exporter is leaking metrics.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Libvirt Exporter Metrics Detection', 'description...

Kube API Version Detection

Searches for exposed Kubernetes API servers which return version information unauthenticated !/usr/bin/env python3 -- coding: utf-8 -- """Searches for exposed Kubernetes API servers which return version information unauthenticated.""" from kittysploit import from lib.protocols.http.httpclient...

ipTIME Router Login Panel - Detect

ipTIME router login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ipTIME router login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ipTIME Router Login Panel -...

Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE Detection

The plugin does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains. !/usr/bin/env python3 --...

PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting Detection

A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier...

AVTECH Video Surveillance Product - Unauthenticated File Download Detection

AVTECH video surveillance products unauthenticated file download from web root through /cgi-bin/cgibox, Since the .cab string is verified by the strstr method, the file download can be realized by adding ?.cab at the end of the file name. !/usr/bin/env python3 -- coding: utf-8 -- """AVTECH video...

Springboot Liquidbase API Detection

This liquibase endpoint provides information about database changes !/usr/bin/env python3 -- coding: utf-8 -- """This liquibase endpoint provides information about database changes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

Umbraco CMS - Directory Listing Exposure Detection

Detected directory listing enabled on sensitive Umbraco CMS directories, potentially exposing configuration files, logs, backups, and other sensitive data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected directory listing enabled on sensitive Umbraco CMS directories, potentially exposing...

FirstPromoter - Detect

Detects FirstPromoter affiliate and referral tracking artifacts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FirstPromoter affiliate and referral tracking artifacts.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

XiongMai uc-httpd 1.0.0 - Buffer Overflow Detection

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725. !/usr/bin/env python3 -- coding: utf-8 -- """Buffer overflow in XiongMai uc-httpd 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Adobe Coldfusion - Authentication Bypass Detection

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

TOTVS Fluig Platform - Cross-Site Scripting Detection

A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argument redirectUrl/user with the input...

EPrints 3.4.2 - Cross-Site Scripting Detection

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability in the dataset parameter to the cgi/dataset dictionary URI. !/usr/bin/env python3 -- coding: utf-8 -- """EPrints 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure Detection

Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key RSA disclosure vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Reolink E1 Zoom Camera versions 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

Adobe Connect Central Version Detection

Detects Adobe Connect Central Version. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe Connect Central Version.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe Connect Central Version Detection',...

Boa Web Server - Detect

Boa is a single-tasking HTTP server. That means that unlike traditional web servers, it does not fork for each incoming connection, nor does it fork many copies of itself to handle multiple connections. !/usr/bin/env python3 -- coding: utf-8 -- """Boa is a single-tasking HTTP server.""" import re...

Brother Printer Panel - Detect

Brother printer web interface and management panel was detected. This template identifies exposed Brother printer panels that may be accessible without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Brother printer web interface and management panel was detected.""" from kittysploit...

Weblate Public Project - Exposure Detection

Weblate instance is publicly accessible. Public exposure of Weblate may lead to unauthorized access to translation projects, potential data leaks, credential exposure, or manipulation of open source localization data. Attackers can view available projects and access sensitive information if prope...

Oracle Internet File System FTP Service - Detect

Oracle Internet File System FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle Internet File System FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient:...

SGLang - Detect

Detects SGLang, a high-performance LLM serving framework that provides an OpenAI-compatible API default port 30000. This template identifies SGLang by checking for the unique /getmodelinfo endpoint returning "modelpath" and "isgeneration" and Prometheus metrics prefixed with "sglang:". An...

Sonarr Dashboard - Unauthenticated Detection

Exposure of Sonarr dashboard which can lead to sensitive information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Exposure of Sonarr dashboard which can lead to sensitive information disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

SwarmUI Panel - Detect

SwarmUI formerly StableSwarmUI is a modular Stable Diffusion web interface built on ASP.NET Core. It provides a feature-rich UI for AI image generation !/usr/bin/env python3 -- coding: utf-8 -- """SwarmUI formerly StableSwarmUI is a modular Stable Diffusion web interface built on ASP.""" from...

TamronOS IPTV/VOD - Remote Command Execution Detection

TamronOS IPTV/VOD contains a remote command execution in the 'host' parameter of the /api/ping endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """TamronOS IPTV/VOD contains a remote command execution in the 'host' parameter of the /api/ping endpoint.""" import re from kittysploit import from...

Dell DPI Remote Power Management - Detect

The Dell Metered Rack Power Distribution Unit distributes power to a server rack and are installed at the rear of a rack enclosure. !/usr/bin/env python3 -- coding: utf-8 -- """The Dell Metered Rack Power Distribution Unit distributes power to a server rack and are installed at the rear.""" from...

Vagrantfile Exposure Detection

Vagrantfile is exposed to external users. !/usr/bin/env python3 -- coding: utf-8 -- """Vagrantfile is exposed to external users.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Vagrantfile Exposure Detection',...

Sucuri Website Firewall - Not Configured Detection

Detects Sucuri Website Firewall - Not Configured. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Sucuri Website Firewall - Not Configured.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Sucuri Website Firewall...

Saia PCD Web-Server Configuration Page - Detect

Saia PCD Web-Server configuration page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Saia PCD Web-Server configuration page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Saia PCD Web-Serv...

Canon Remote UI Login Panel - Detect

Canon Remote UI login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Canon Remote UI login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Canon Remote UI Login Panel - Detect',...

ProfitTrailer Setup Page - Exposure Detection

Detects exposed ProfitTrailer Setup page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed ProfitTrailer Setup page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ProfitTrailer Setup Page - Exposure...

Adobe AEM CRX Namespace Editor Exposure Detection

Adobe AEM CRX Namespace Editor is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM CRX Namespace Editor is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM CRX Namespace Editor Exposu...

OpenEMR Setup Installation Page - Exposure Detection

Detects exposed OpenEMR setup installation pages which could allow unauthorized access or information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed OpenEMR setup installation pages which could allow unauthorized access or information disclosu.""" from kittysploit import...

EVlink Local Controller - Detection

Detects EVlink Local Controller - Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects EVlink Local Controller - Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EVlink Local Controller -...

Platformio Config File Disclosure Detection

“platformio.ini” Project Configuration File was detected. !/usr/bin/env python3 -- coding: utf-8 -- """“platformio.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Platformio Config File Disclosure Detection',...

Joget Panel - Detect

Joget panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Joget panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Joget Panel - Detect', 'description': 'Joget panel was detected.',...

Check Point Quantum Gateway - Information Disclosure Detection

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available. !/usr/bin/env python3 -- coding: utf-8 -...

Royal Event Management System - Stored Cross-Site Scripting Detection

Royal Event Management System contains a stored cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

HTTPBin - Cross-Site Scripting Detection

HTTPBin contains a cross-site scripting vulnerability which can allow an attacker to execute arbitrary script. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env python3 -- coding: utf-8 -- """HTTPBin contains a cross-site scriptin...

Apache Druid - Local File Inclusion Detection

Apache Druid ingestion system is vulnerable to local file inclusion. The InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t...

AEM UserInfo Servlet Credentials Exposure Detection

Adobe Experience Manager UserInfoServlet is exposed which allows an attacker to bruteforce credentials. You can get valid usernames from jcr:createdBy, jcr:lastModifiedBy, cq:LastModifiedBy attributes of any JCR node. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe Experience Manager...

Metasploitable3 Linux Environment

Metasploitable3 Ubuntu 14.04 lab VM packaged for Docker — intentionally vulnerable Linux target for authorized internal-lab agent benchmarks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = "name": "Metasploitable3 Linux Environment",...

Dalfox Found-Action Deserialization RCE

Exploits CVE-2026-45087 in dalfox = 2.12.0 REST server mode: POST /scan deserializes found-action into scan options. Hosts a callback URL; when dalfox hits it and reports a finding, the supplied shell command runs on the dalfox host. !/usr/bin/env python3 -- coding: utf-8 -- """ Dalfox REST API...

Jira Detection

Detects Jira dashboards and serverInfo API exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Atlassian Jira instances.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Jira Detection", "description...