WordPress WP Maps Blind SQLi (CVE-2026-39492)

Exploits CVE-2026-39492 in WP Maps bool: , sigma, threshold, samplecount = self.module.wpmapsbaselineself.module.wpbase if samplecount 3.0: return False self.threshold = threshold return True def probeself, condition: str - float: self.requests += 1 payload = self.module.wpmapsifpayloadcondition,...

Gitea/Forgejo CVE-2026-60004 Diffpatch Detect

Detects Gitea or Forgejo instances potentially affected by CVE-2026-60004 unauthenticated/authenticated diffpatch git hook RCE via bare-clone add/add conflict on hooks/post-index-change. Fixed in Gitea 1.27.1. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Gitea/Forgejo CVE-2026-60004...

Firmware architecture → payload suggest

Scan a local firmware blob for embedded ELF headers, infer architecture mipsle/mipsbe/armle/arm64/x86/x64/…, recommend payloads, and show an adaptive listener plan. !/usr/bin/env python3 -- coding: utf-8 -- """ Scan a firmware image for ELF headers, detect CPU architecture, and suggest matching...

Firmware → adaptive payload plan

Detect firmware CPU architecture from ELF headers, select the best payload BusyBox/CMD vs raw and listener adaptive vs reversetcp, then emit a ready-to-run CLI command sequence. !/usr/bin/env python3 -- coding: utf-8 -- """ Firmware arch → adaptive payload/listener plan. Scans ELF headers, select...

DNP3 operate CROB

Sends a Control Relay Output Block g12v1 via Select/Operate or Direct Operate. Intrusive — OT lab / riskapproved only gated by otpolicy. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client...

OpenWrt / BusyBox Firmware Info

Collect firmware/board identity from an embedded Linux shell: openwrtrelease, board name, uname, and common version files. !/usr/bin/env python3 -- coding: utf-8 -- """Gather OpenWrt / embedded firmware identity from a BusyBox-style shell.""" from kittysploit import from lib.post.linux.session...

MySQL TLS Capability

Reports whether the MySQL/MariaDB handshake advertises SSL/TLS CLIENTSSL. Flags servers that do not support TLS. !/usr/bin/env python3 -- coding: utf-8 -- """Report MySQL/MariaDB TLS capability from the server handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

ONVIF Device Information

Query an IP camera ONVIF device service for manufacturer/model/firmware and Media service XAddr. Prefers an ONVIF session when set. !/usr/bin/env python3 -- coding: utf-8 -- """ONVIF device information gather HTTP SOAP.""" from kittysploit import from lib.protocols.onvif.session import...

MySQL Empty Password

Tests common MySQL/MariaDB usernames for empty-password login. Requires pymysql. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MySQL/MariaDB accounts with an empty password.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient...

BLE UART exec

Send a command string over a BLE UART/NUS write characteristic and collect the notify response serial-over-GATT pivot. !/usr/bin/env python3 -- coding: utf-8 -- """Execute a command over BLE UART/NUS pivot channel.""" from kittysploit import from lib.protocols.ble.blesessionmixin import...

Matter discover

Browse Matter commissionable/operational DNS-SD records and summarize vendor, device type, and commissioning mode session preferred. !/usr/bin/env python3 -- coding: utf-8 -- """Matter mDNS discovery via session or target.""" from kittysploit import from lib.protocols.matter.client import...

FTP SYST Detection

Queries FTP SYST to fingerprint the remote system type. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FTP SYST response OS / server type.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.ftp.detectors import probeftpsyst class...

PostgreSQL Auth Method

Identifies the PostgreSQL AuthenticationRequest type trust, cleartext, md5, scram/sasl, … for a username. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PostgreSQL authentication method from startup handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

mDNS / DNS-SD Enum

Enumerates DNS-SD instances via unicast or multicast mDNS, resolves PTR→SRV/TXT/A, and suggests KittySploit protocol sessions. !/usr/bin/env python3 -- coding: utf-8 -- """Deep mDNS / DNS-SD enumeration with SRV/TXT/A correlation and module handoff.""" from kittysploit import from...

RTSP Client

Connects to an RTSP/RTSPS endpoint, probes OPTIONS/DESCRIBE, and creates an interactive RTSP shell describe, setup/play interleaved, teardown. !/usr/bin/env python3 -- coding: utf-8 -- """RTSP bind listener — opens an interactive RTSP session toward a camera/NVR.""" from kittysploit import from...

Deploy Embedded HTTP C2

Generate and optionally execute a BusyBox/ash HTTP polling agent on an OpenWrt/embedded shell. Pairs with listeners/multi/reversehttppolling. !/usr/bin/env python3 -- coding: utf-8 -- """Deploy BusyBox embedded HTTP polling C2 from a live shell session.""" from kittysploit import from...

PostgreSQL Empty Password

Tests common PostgreSQL usernames for trust or empty-password login via psycopg2. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PostgreSQL trust / empty-password access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

RTSP stream probe

DESCRIBE → SETUP RTP/AVP/TCP interleaved → PLAY and drain a short sample to confirm media delivery session preferred. !/usr/bin/env python3 -- coding: utf-8 -- """RTSP interleaved stream probe — SETUP/PLAY and drain a few RTP bytes.""" from kittysploit import from lib.protocols.rtsp.client import...

ONVIF Snapshot Grab

Authenticate to ONVIF Media service, resolve GetSnapshotUri for the first profile, and download a JPEG snapshot. Prefers an ONVIF session. !/usr/bin/env python3 -- coding: utf-8 -- """Fetch an ONVIF snapshot JPEG via GetSnapshotUri.""" from kittysploit import from lib.protocols.onvif.session impo...

Windows Upgrade Cmd to PowerShell

Enable PowerShell on a Windows shell session: wrap the current session same or open a new PowerShell reverse-TCP session new. !/usr/bin/env python3 -- coding: utf-8 -- """ Switch a Windows cmd.exe shell session to PowerShell. Modes: - same: wrap commands on the current session with powershell...

Adaptive Reverse TCP Listener

Reverse TCP listener that probes OS on connect and auto-upgrades Unix shells to PTY. Windows stays in line mode. !/usr/bin/env python3 -- coding: utf-8 -- """Adaptive reverse TCP listener. Detects OS on connect, attempts Unix PTY upgrade, stamps session metadata so classicshell / post modules can...

vBulletin runMaths Pre-Auth RCE Detection (CVE-2026-61511)

Detects unauthenticated RCE via vB5TemplateRuntime::runMaths CVE-2026-61511 by sending a safe phpfuck-encoded system'echo …' probe to ajax/render/pagenav. Affects vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 fixed in 6.2.2 / vendor patches. !/usr/bin/env python3 -- coding: utf-8 -- from...

LDAP Auth Check

Validates domain credentials with an LDAP bind and reports domain / DC info NetExec: nxc ldap -u -p . !/usr/bin/env python3 -- coding: utf-8 -- """Validate domain credentials over LDAP NetExec: nxc ldap host -u -p.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class...

LDAP Group Members

List members of a group, or groups for a user NetExec: --groups 'Backup Operators' / -M groupmembership. !/usr/bin/env python3 -- coding: utf-8 -- """Group membership helpers NetExec: --groups / groupmembership.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from...

LDAP AdminCount Accounts

Lists accounts with adminCount=1 AdminSDHolder / protected groups NetExec: nxc ldap -u -p --admin-count. !/usr/bin/env python3 -- coding: utf-8 -- """List adminCount=1 accounts NetExec: nxc ldap --admin-count.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from...

LDAP Query

Runs a raw LDAP filter and dumps matching attributes NetExec: nxc ldap -u -p --query 'sAMAccountName=user' ''. !/usr/bin/env python3 -- coding: utf-8 -- """Raw LDAP query NetExec: nxc ldap --query.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleAuxiliary,...

HTTP NTLM Info

Sends an NTLM Type-1 negotiate and parses the Type-2 challenge for NetBIOS / DNS domain and computer names NSE http-ntlm-info. !/usr/bin/env python3 -- coding: utf-8 -- """HTTP NTLM challenge info NSE http-ntlm-info.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Persistent Formjacking

Hook existing and dynamically added forms via MutationObserver and exfiltrate submissions from kittysploit import import json import time import uuid class ModuleBrowserAuxiliary: info = "name": "Persistent Formjacking", "description": "Hook existing and dynamically added forms via MutationObserv...

Oracle TNS Version

Queries Oracle TNS Listener for version/banner information NSE oracle-tns-version. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle TNS version NSE oracle-tns-version.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.oracle.detectors...

SOCKS Open Proxy

Tests whether a SOCKS4/5 service allows unauthenticated CONNECT to an external host NSE socks-open-proxy. !/usr/bin/env python3 -- coding: utf-8 -- """Open SOCKS4/5 proxy check NSE socks-open-proxy.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

Broadcast WS-Discovery

Sends a WS-Discovery Probe to 239.255.255.250:3702 and collects ProbeMatches NSE broadcast-wsdd-discover. !/usr/bin/env python3 -- coding: utf-8 -- """WS-Discovery multicast probe NSE broadcast-wsdd-discover.""" from kittysploit import from lib.scanner.broadcast.detectors import probebroadcastwsd...

SNMP Win32 Users

Enumerates Windows local usernames via LANMANAGER-MIB over SNMP NSE snmp-win32-users. !/usr/bin/env python3 -- coding: utf-8 -- """Windows users via SNMP NSE snmp-win32-users.""" from kittysploit import from lib.scanner.snmp.detectors import probesnmpwin32users class ModuleScanner: info = "name":...

File Upload Lure

Show a fake file-attach modal and exfiltrate selected file metadata and content from kittysploit import import base64 import json import os import time class ModuleBrowserAuxiliary: info = "name": "File Upload Lure", "description": "Show a fake file-attach modal and exfiltrate selected file...

SMB Security Mode

Negotiates SMB2/3 and reports signing mode and selected dialect NSE smb2-security-mode / smb-protocols. !/usr/bin/env python3 -- coding: utf-8 -- """SMB2 security mode / dialect NSE smb2-security-mode / smb-protocols.""" from kittysploit import from lib.protocols.smb.smbscannerclient import...

SMB MS17-010 (EternalBlue)

Unauthenticated SMBv1 probe for MS17-010 CVE-2017-0143 / EternalBlue via PeekNamedPipe on FID 0 NSE smb-vuln-ms17-010. !/usr/bin/env python3 -- coding: utf-8 -- """MS17-010 / EternalBlue detection NSE smb-vuln-ms17-010.""" from kittysploit import from lib.protocols.smb.smbscannerclient import...

Oracle SID Brute

Brute-forces common Oracle SIDs against a TNS listener NSE oracle-sid-brute. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle SID brute NSE oracle-sid-brute.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.oracle.detectors import...

Web Device APIs Probe

Probe WebUSB, WebSerial and WebBluetooth availability and optionally request devices from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Web Device APIs Probe", "description": "Probe WebUSB, WebSerial and WebBluetooth availability and optionally request devices",...

DNS NSID / BIND Version

Queries CHAOS TXT id.server / version.bind and EDNS NSID to fingerprint a nameserver NSE dns-nsid. !/usr/bin/env python3 -- coding: utf-8 -- """DNS NSID / CHAOS version probe NSE dns-nsid.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

SMB OS Discovery

Discovers OS / LAN Manager / domain hints from SMB negotiate and anonymous session setup NSE smb-os-discovery. !/usr/bin/env python3 -- coding: utf-8 -- """SMB OS / domain discovery NSE smb-os-discovery.""" from kittysploit import from lib.protocols.smb.smbscannerclient import Smbscannerclient...

SNMP Cisco IOS Config Hints

Fingerprints Cisco IOS via SNMP and checks for config-copy MIB / image strings read-only subset of NSE snmp-ios-config; does not push config to TFTP. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco IOS SNMP config/info NSE snmp-ios-config inspired, read-only.""" from kittysploit import from...

Frame Ancestors / Breakout Probe

Detect framing context, ancestor origins, sandboxing, and breakout/clickjacking signals from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Frame Ancestors / Breakout Probe", "description": "Detect framing context, ancestor origins, sandboxing, and...

TFTP Enum

Attempts TFTP RRQ for common config/boot filenames NSE tftp-enum. !/usr/bin/env python3 -- coding: utf-8 -- """TFTP common-file enum NSE tftp-enum.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.tftp.detectors import probetftpenum class...

Python MQTT Reverse Shell

Connect to an MQTT broker, subscribe to cmd topic, publish results stdlib MQTT 3.1.1 — no paho required on target. Pairs with listeners/iot/reversemqttshell. from kittysploit import from lib.c2.mqttreverseagent import buildmqttreverseagentscript class ModulePayload: """MQTT reverse shell agent —...

PowerShell Command Shell, Reverse HTTPS (TLS)

Connect back over TLS SslStream and create an interactive command shell. No native reversehttps listener — terminate TLS on the operator side stunnel, openssl sserver, etc. and forward plaintext to listeners/multi/reversetcp, or use listeners/multi/reversetls for native TLS termination...

BusyBox / ash Reverse TCP

Minimal reverse TCP shell for BusyBox/ash IoT, containers, embedded Linux from kittysploit import class ModulePayload: CLIENTLANGUAGE = "sh" info = "name": "BusyBox / ash Reverse TCP", "description": "Minimal reverse TCP shell for BusyBox/ash IoT, containers, embedded Linux", "category":...

Web Command Shell (ASP / ASPX / JSP)

Generate a minimal web command shell for upload/write after web RCE. Pairs with listeners/web/php style interaction or generic HTTP. Default: password-protected cmd execution via GET/POST param. from kittysploit import class ModulePayload: """Web command shells for ASP/ASPX/JSP RCE chains.""" inf...

IIS Shortname Disclosure

Detects IIS tilde / 8.3 short-name enumeration vulnerability by comparing status codes for existing vs non-existing shortname probes NSE http-iis-short-name-brute. !/usr/bin/env python3 -- coding: utf-8 -- """IIS shortname 8.3 disclosure NSE http-iis-short-name-brute.""" from kittysploit import...

PowerShell Reverse WebSocket Shell

Connect back over WebSocket .NET ClientWebSocket and run commands from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "powershell" info = "name": "PowerShell Reverse WebSocket Shell", "description": "Connect back over WebSocket .NET ClientWebSocket and run commands",...

Overlay / Clickjacking Kit

Inject clickjacking overlays: bait iframe, full-page click capture, or decoy button from kittysploit import import json import uuid class ModuleBrowserAuxiliary: info = "name": "Overlay / Clickjacking Kit", "description": "Inject clickjacking overlays: bait iframe, full-page click capture, or dec...

DOM Snapshot

Export page HTML snapshot and optional viewport canvas capture for reporting from kittysploit import import json import os import time class ModuleBrowserAuxiliary: info = "name": "DOM Snapshot", "description": "Export page HTML snapshot and optional viewport canvas capture for reporting",...