Systemd Unit Persistence

Creates and enables a systemd service unit that executes a payload on boot and restarts on failure. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost, LinuxPersistenceMixin: info...

Test

Test payload !/usr/bin/env python3 from kittysploit import class ModulePayload: info = 'name': 'Test', 'description': 'Test payload', 'listener': 'listeners/multi/reversetcp', def generateself: return b"\x90\xcc"...

Next.js CSP-nonce reflected XSS (CVE-2026-44581) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44581 CSP nonce reflected XSS. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

OpenEclass RCE (CVE-2026-22241) Detection

Detects GUnet OpenEclass instances vulnerable to Remote Code Execution CVE-2026-22241 by checking the platform version. Versions prior to 4.2 are vulnerable to an unrestricted file upload in the theme import functionality. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Redirect Browser

Redirect browser victim to a URL from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Redirect Browser", "description": "Redirect browser victim to a URL", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL, "sessiontype": SessionType.BROWSER, url =...

Metasploitable Environment

Metasploitable Linux - Intentionally vulnerable Linux distribution for penetration testing !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = 'name': 'Metasploitable Environment', 'description': 'Metasploitable Linux - Intentionally vulnerable...

Zammad WebSocket Session Leak RCE (CVE-2026-102489)

Horizon3 chain for CVE-2026-102489: WebSocket event base triggers NoMethodError leaking connected users Cookie headers; hijacked session installs malicious ERB via packages API and triggers password-reset template evaluation. Blind file output on target default /tmp/zammadrce.txt. !/usr/bin/env...

ZesleCP — Authenticated Arbitrary File Write → Cron → Root RCE — Detect

Fingerprint / reachability check for ZesleCP — Authenticated Arbitrary File Write → Cron → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for ZesleCP — Authenticated Arbitrary File Write → Cron → Root RCE""" from kittysploit import from lib.protocols.http.httpclient import...

RTS Intercom VLink Virtual Matrix — OpenSSL Argument Injection → SYSTEM RCE — Detect

Fingerprint / reachability check for RTS Intercom VLink Virtual Matrix — OpenSSL Argument Injection → SYSTEM RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for RTS Intercom VLink Virtual Matrix — OpenSSL Argument Injection → SYSTEM RCE""" from kittysploit import from...

Wyn Enterprise Unauthenticated Root RCE (Token Forgery + Zip-Slip + Provider Loa — Detect

Fingerprint / reachability check for Wyn Enterprise Unauthenticated Root RCE Token Forgery + Zip-Slip + Provider Load !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Wyn Enterprise Unauthenticated Root RCE Token Forgery + Zip-Slip + Provider Load""" from kittysploit import from...

Loadbalancer.org ADC deployment template injection RCE

Config-group Basic auth POST to /lbadmin/config/deployment/index.php with base64 deployment JSON injects into haproxy reload sudo NOPASSWD. !/usr/bin/env python3 -- coding: utf-8 -- """Loadbalancer.org ADC deployment template command injection root.""" from future import annotations import base64...

vMix 29 ScriptStartDynamic VBScript Blocklist Bypass RCE — Detect

Fingerprint / reachability check for vMix 29 ScriptStartDynamic VBScript Blocklist Bypass RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for vMix 29 ScriptStartDynamic VBScript Blocklist Bypass RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ntdll Unhooking Loader Evasion

Restore ntdll.dll .text from disk to strip userland hooks, then decrypt and run embedded shellcode via VirtualAlloc/CreateThread. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from...

OP5 Monitor CVE-2025-34115 Detect

Detects OP5 Monitor / ITRS login surface. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OP5 Monitor / ITRS login surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "OP5 Monitor CVE-2025-34115 Detect",...

UnrealIRCd CVE-2010-2075 backdoor RCE

CVE-2010-2075: trojaned UnrealIRCd 3.2.8.1 executes any line starting with AB; as shell via system without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """UnrealIRCd CVE-2010-2075 trojaned backdoor AB; command execution.""" from future import annotations import socket import time fro...

HFS CVE-2014-6287 search macro RCE

CVE-2014-6287 HttpFileServer 2.3–2.3c: NUL-byte desync in the search handler allows .exec|cmd. macro execution without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Rejetto HFS CVE-2014-6287 unauthenticated search macro command execution.""" from future import annotations from...

crawl4ai CVE-2026-91940 detect

Detects crawl4ai HTTP API POST /crawl vulnerable to CVE-2026-91940 untrusted PDFContentScrapingStrategy imagesavedir arbitrary write 0.9.3. !/usr/bin/env python3 -- coding: utf-8 -- """Detect crawl4ai API CVE-2026-91940 exposure.""" from kittysploit import from lib.protocols.http.httpclient impor...

Kener CVE-2026-105030 monitor tag enumeration

CVE-2026-105030 Kener 4.0.0–4.1.5: /dashboard-apis/monitor-bar may return hidden or inactive monitors when tag lookups skip ishidden/status filters. !/usr/bin/env python3 -- coding: utf-8 -- """Kener CVE-2026-105030 hidden/inactive monitor tag enumeration.""" import json from kittysploit import...

FortiWeb Reflected XSS (CVE-2021-22122)

Exploits CVE-2021-22122 in FortiWeb 6.2/6.3: unauthenticated reflected XSS via error3 and omnisuccess API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """FortiWeb reflected XSS CVE-2021-22122.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Arista VeloCloud Orchestrator Auth Bypass (CVE-2026-93952)

Targets CVE-2026-93952 in on-prem VeloCloud Orchestrator VCO: when certificate-based Edge authentication is enabled, forged/absent cert checks may allow unauthenticated access to privileged portal and REST APIs. Probes internal API routes after portal fingerprinting. !/usr/bin/env python3 --...

phpVMS Legacy Importer Auth Bypass (CVE-2026-42569)

Exploits CVE-2026-42569 in phpVMS 7.0.6: unauthenticated access to the legacy /importer feature exposes database configuration and import controls. !/usr/bin/env python3 -- coding: utf-8 -- """phpVMS legacy importer auth bypass CVE-2026-42569.""" from kittysploit import from...

Acronis Backup CVE-2026-87886 Detect

Detects Acronis Backup integrations on cPanel/WHM, Plesk, or DirectAdmin that may be affected by CVE-2026-87886 insecure file permissions enabling local privilege escalation. Fingerprints the plugin surface and parses build numbers against fixed releases cPanel 1.9.3.1021, Plesk 1.8.11.638,...

Vacron NVR - board.cgi Command Injection (CVE-2025-34043)

Exploits unauthenticated OS command injection via Vacron /board.cgi?cmd=. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Vacron NVR board.cgi RCE CVE-2025-34043 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

Mitel AWC - xsl Parameter RCE

Exploits Mitel AWC command injection via the xsl parameter of /awcuser/cgi-bin/vcs. !/usr/bin/env python3 -- coding: utf-8 -- """Mitel AWC xsl parameter command injection.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

phpMyAdmin - server_sync.php Backdoor RCE (CVE-2012-5159)

Exploits CVE-2012-5159 by POSTing PHP to /serversync.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin serversync.php backdoor CVE-2012-5159 — opens execute session.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient fr...

hybris Commerce - medias context LFI Detection (CVE-2014-8871)

Detects CVE-2014-8871 by requesting /medias/?context= with a base64-encoded master|root|...|../../../../../../etc/passwd| payload. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce context= base64 path traversal CVE-2014-8871.""" import base64 import re from kittysploit import from...

vsftpd - Compromised Package Backdoor RCE (CVE-2011-2523)

Triggers the vsftpd 2.3.4 backdoor via USER X: then opens an interactive session against the shell on TCP/6200. !/usr/bin/env python3 -- coding: utf-8 -- """vsftpd 2.3.4 backdoor RCE CVE-2011-2523.""" import re import socket import time from kittysploit import from...

Trilium Notes Safe Import RCE (CVE-2026-45668)

Exploits CVE-2026-45668 in Trilium Notes TriliumNext = 0.102.1: a malicious export ZIP imported with safeImport=true keeps a code-note XSS payload, a docName label with path traversal, and a '' noteId preserved verbatim. Opening the trigger doc loads the payload via jQuery into a nodeIntegration...

Public .idea Folder containing files with sensitive data Detection

Searches for .idea Folder by querying the /.idea and a few other files with sensitive data. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for .""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Public .idea...

LearnPress < 4.3.2 - Broken Access Control Detection

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders...

Apache InLong - Detect

Detects a Apache InLong server, a one-stop, full-scenario integration framework for massive data. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Apache InLong server, a one-stop, full-scenario integration framework for massive data.""" from kittysploit import from...

AceNet AceReporter Report Panel - Detect

Detects AceNet AceReporter Report Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AceNet AceReporter Report Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AceNet AceReporter Repo...

NATS Messaging Server Detection

Detects NATS servers by reading the INFO greeting on TCP 4222. !/usr/bin/env python3 -- coding: utf-8 -- """Detect NATS messaging servers via INFO handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.nats.detectors import probenats...

Rockwell Automation FactoryTalk ViewPoint - Panel Detection

Rockwell Automation FactoryTalk ViewPoint is a web-based HMI that allows remote monitoring and control of industrial automation systems from a browser. It provides access to FactoryTalk View Machine Edition and Site Edition displays. Exposed instances may allow unauthorised access to industrial...

X-Recruiting Header Detection

Websites that advertise jobs via HTTP headers !/usr/bin/env python3 -- coding: utf-8 -- """Websites that advertise jobs via HTTP headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'X-Recruiting Header Detection'...

TVT DVR Sensitive Device - Information Disclosure Detection

A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5LMM and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure. !/usr/bin/env pytho...

Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting Detection

Jenkins Gitlab Hook 1.4.2 and earlier does not escape project names in the buildnow endpoint, resulting in a reflected cross-site scripting vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins Gitlab Hook 1.""" from kittysploit import from lib.protocols.http.httpclient import...

Langflow - Broken Access Control Detection

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories...

Ruby Gem::ConfigFile Credential - Exposure Detection

Ruby Gem credentials file is exposed, potentially leaking RubyGems API keys. The /.gem/credentials file stores authentication tokens for publishing gems to RubyGems.org or private gem servers. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby Gem credentials file is exposed, potentially leaking...

Axway SecureTransport Login Panel - Detect

AXWAY SecureTransport login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AXWAY SecureTransport login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Axway SecureTransport Login...

Cleo Technology - Detect

This template detects Cleo technologies, including VLTrader, Harmony, and LexiCom, by inspecting response headers.It also extracts version information for each identified technology. !/usr/bin/env python3 -- coding: utf-8 -- """This template detects Cleo technologies, including VLTrader, Harmony,...

Web Suite Detect

Detects Web Suite Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Web Suite Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Web Suite Detect', 'description': 'Detects Web Suite Detect.', 'author'...

Microsoft SharePoint - Site Metadata Disclosure Detection

Detected exposed SharePoint site metadata endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed SharePoint site metadata endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Microsoft...

Unibox Panel - Detect

Unibox Administrator panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Unibox Administrator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Unibox Panel - Detect', 'description':...

JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS Detection

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jpyearbuilt leads to cross...

InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion Detection

The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files ...

Palo Alto Expedition - Admin Account Takeover Detection

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. !/usr/bin/env python3 -- coding: utf-8 -- """Missing authentication for a critical function in Palo Alto Networks...

Fortinet FortiWeb Login Panel - Detect

Fortinet FortiWeb login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiWeb login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fortinet FortiWeb Login Panel -...

WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File Detection

Hummingbird Performance WordPress plugin = 3.18.0 contains a sensitive information exposure caused by improper handling in the 'request' function, letting unauthenticated attackers extract sensitive data including Cloudflare API credentials, exploit requires no authentication. !/usr/bin/env pytho...

GLPI Status Domain Disclosure Detection

Detects GLPI Status Domain Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects GLPI Status Domain Disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GLPI Status Domain Disclosure Detection',...