VLAN ID Scanner

Hop through 802.1Q VLAN IDs on a Layer-2 access port by sending tagged DHCP and ARP probes, optionally harvesting CDP native VLAN hints first. !/usr/bin/env python3 -- coding: utf-8 -- """Discover active VLAN IDs from an access port using tagged DHCP/ARP probes.""" from future import annotations...

PHP WebSocket Mimic Transform

Wraps C2 bytes in WebSocket-like binary frames and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.websocketmimic import Module as PythonWebSocketTransform class ModulePythonWebSocketTransform: """PHP WebSocket...

HTTP Chunked Mimic Transform

Wraps C2 bytes in HTTP/1.1 chunked transfer frames with initial HTTP-like headers. !/usr/bin/env python3 -- coding: utf-8 -- """ HTTP chunked mimic transform. The first server-side encode prepends an HTTP/1.1 response header, the first client-side encode generated for payloads prepends an HTTP PO...

GCP Set IAM Policy Binding

Add an IAM role binding for a member on the project or a service account !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Set IAM Policy Binding", "description": "Add an IAM role...

GCP Compute Instances

Enumerate Compute Engine instances in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute Instances", "description": "Enumerate Compute Engine...

Next.js CSP-nonce reflected XSS (CVE-2026-44581) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44581 CSP nonce reflected XSS. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Generex NetMan 204 CVE-2022-47893 - RCE via Firmware Upload

Generex NetMan 204 accepts a crafted firmware file upload that enables remote code execution. This module uploads the operator-supplied firmware and dispatches a real framework payload to obtain a session. import time from kittysploit import from lib.protocols.http.httpclient import Httpclient fr...

Swagger/OpenAPI detection

Detects exposed Swagger or OpenAPI documentation API disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Swagger / OpenAPI exposé.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/swagger", "/swagger/", "/swagger.json", "/swagger.yaml",...

Directory listing detection

Detects if directory listing is enabled on the server. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHSTOCHECK = "/", "/images/", "/img/", "/assets/", "/static/", "/backup/", "/uploads/", "/files/", "/media/" class...

IP Reverse DNS

Retrieves PTR reverse DNS hostnames for an IP address. from kittysploit import import dns.resolver import dns.reversename import ipaddress class ModuleAuxiliary: info = 'name': 'IP Reverse DNS', 'author': 'KittySploit Team', 'description': 'Retrieves PTR reverse DNS hostnames for an IP address.',...

HTTP Request Smuggling Scanner

Probes for HTTP request smuggling CL.TE / TE.CL by sending crafted requests that front-end and back-end parse differently. !/usr/bin/env python3 -- coding: utf-8 -- """ HTTP Request Smuggling scanner: detects desync between front-end and back-end by sending crafted requests with conflicting...

DNS C2 (Kittysploit DNS)

Uses Kittysploit DNS server API to send commands and receive agent output. Create URLs via API, no local UDP. !/usr/bin/env python3 -- coding: utf-8 -- """ DNS C2 Kittysploit DNS - Uses your Kittysploit DNS server API to send commands and receive agent output. No UDP listener: commands are pushed...

Redis Listener

Redis in-memory store listener - creates interactive Redis shell session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import redis class ModuleListener: info = 'name': 'Redis Listener', 'description': 'Redis in-memory store listener - creates interactive Redis shell session',...

SmarterMail Auth Bypass and RCE

Authentication bypass via force-reset-password no valid old password required followed by login and RCE via AddOrUpdateMount API. The /api/v1/auth/force-reset-password endpoint allows resetting the admin password with an arbitrary old password. After reset, login yields an access token. The...

PowerShell Command Shell, Reverse TCP

Connect back and create a command shell via PowerShell !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 from lib.c2.stagerevasion import powershellprelude from lib.c2.tcpresilience import buildpowershellreconnectwrapper, parsecoverendpoints class ModulePayload:...

FTP Gather System Information

Gathers detailed system information from FTP server including version, features, and capabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import socket import re class ModulePost, FTPClientMixin: """FTP System...

FTP Create Persistence

Creates persistent backdoor access by uploading scheduled task scripts, cron jobs, or startup scripts !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os import tempfile import time class ModulePost, FTPClientMixin:...

Windows Gather System Information

Enumerates Windows system information including OS details, users, processes, services, network configuration, and security settings !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re class ModulePost: """Windows System Enumeration Module""" info = "name": "Windows Gather...

FTP Delete File

Deletes files or directories from the FTP server !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os class ModulePost, FTPClientMixin: """FTP File Deletion Module""" info = "name": "FTP Delete File", "description":...

Linux Port Forwarding

Create port forwards through a compromised Linux session for network pivoting from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import socket import threading import time class ModulePost, System, LinuxSessionMixin: info = "name"...

Linux Gather Configurations

Linux Gather Configurations with enumeration of configuration files from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Gather Configurations", "description": "Linu...

SPA Scanner

Scans for vulnerabilities and misconfigurations in Single Page Applications including exposed API endpoints, authentication issues, and client-side vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re impo...

SQL Injection Scanner

Scans for SQL injection vulnerabilities including union-based, boolean-based, time-based, and error-based SQL injection !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import...

Fortinet FortiWeb CVE-2025-64446 Authentication Bypass

FortiWeb v8.0.0 - Authentication bypass via CGI parsing vulnerability allowing unauthorized admin access CVE-2025-64446 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import json import base64 import random import string clas...

Linux x64 Reverse TCP Stager

Linux x64 Reverse TCP Stager from kittysploit import class ModulePayload: info = 'name': 'Linux x64 Reverse TCP Stager', 'description': 'Linux x64 Reverse TCP Stager', 'author': 'KittySploit Team', 'category': PayloadCategory.STAGER, 'arch': Arch.X64, 'platform': Platform.LINUX, 'listener':...

Wordpress plugin - 1 Flash Gallery

1 Flash Gallery Wordpress Plugin File Upload Exploit from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = "name": "Wordpress plugin - 1 Flash Gallery", "description": "1 Flash Gallery Wordpress Plugin File Upload Exploit", "cve": "",...

WebGoat Environment

OWASP WebGoat - Learning platform for web application security testing !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = 'name': 'WebGoat Environment', 'description': 'OWASP WebGoat - Learning platform for web application security testing',...

PHP 7.0-7.3 disable_functions bypass

PHP 7.0-7.3 disablefunctions bypass using UAF vulnerability from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.0-7.3 disablefunctions bypass", "description": "PHP 7.0-7.3 disablefunctions bypass using UAF...

Wordpress Plugin Ajax Multi Upload 1.1 - Shell Upload

WordPress Plugin Ajax Multi Upload is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context o...

Generic HTTP Client Listener

Ultra-simple HTTP client listener - framework handles session management !/usr/bin/env python3 -- coding: utf-8 -- """ Generic HTTP Client Listener - Ultra-simple implementation following generic pattern Author: KittySploit Team Version: 1.0.0 """ from kittysploit import import requests class...

Enumerate AWS EC2

Enumerate EC2 instances, security groups, and related resources !/usr/bin/env python3 -- coding: utf-8 -- """ AWS EC2 Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates EC2 instances, security groups, and related resources. """ from kittysploit import import json fr...

D-Link DIR-605 CSRF

D-Link DIR-605 router - Change admin password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DIR-605 CSRF", "description": "D-Link DIR-605 router - Change admin password via CSRF POST", "author": "KittySplo...

Adive Framework 2.0.7

Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users editor or developer to create an administrator account via admin/user/add from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.httplogin import Httplogin class...

Shell Php GET

Shell Php GET from kittysploit import class ModuleBackdoor: info = 'name': 'Shell Php GET', 'description': 'Shell Php GET', 'author': 'KittySploit Team', 'listener': 'listeners/web/phpget', 'sessiontype': SessionType.PHP, 'arch': Arch.PHP, paramname = OptString"kittyshell", "param name for...

FTP Gather File Listing

Enumerates files and directories on FTP server, optionally downloading interesting files !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os class ModulePost, FTPClientMixin: """FTP File Enumeration Module""" info =...

Fortinet FortiWeb Fabric Connector SQLi (CVE-2025-25257)

Exploits CVE-2025-25257 pre-auth SQL injection in FortiWeb Fabric Connector /api/fabric/device/status via a crafted Authorization Bearer token, then attempts OS command execution through stacked SQL payloads WatchTowr chain. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiWeb Fabric...

Log4Shell RCE (CVE-2021-44228)

Exploits CVE-2021-44228 Log4j JNDI lookup injection via HTTP headers and query parameters. Uses sleep-based confirmation then delivers the configured reverse CMD payload through a user-supplied LDAP callback URL. !/usr/bin/env python3 -- coding: utf-8 -- """Log4Shell JNDI injection RCE...

TOTOLINK A3700R Command Injection (CVE-2023-46574)

Exploits CVE-2023-46574 in TOTOLINK A3700R: command injection in the FileName parameter of UploadFirmwareFile via /cgi-bin/cstecgi.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """TOTOLINK A3700R firmware upload command injection CVE-2023-46574.""" import json import re from kittysploit import...

Dahua RPC Login Auth Bypass (CVE-2021-33044)

Exploits CVE-2021-33044 and CVE-2021-33045 in Dahua IPC/VTH/VTO: crafted global.login RPC requests bypass authentication and return a valid session. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua RPC login auth bypass CVE-2021-33044 / CVE-2021-33045.""" import json from kittysploit import fro...

TBK DVR Auth Bypass (CVE-2018-9995)

Exploits CVE-2018-9995 in TBK/rebranded DVRs: Cookie uid=admin bypasses auth and /device.rsp?opt=user&cmd=list returns all user credentials in JSON. !/usr/bin/env python3 -- coding: utf-8 -- """TBK DVR cookie auth bypass credential leak CVE-2018-9995.""" import json from kittysploit import from...

XiongMai uc-httpd Overflow (CVE-2018-10088)

Exploits CVE-2018-10088 in XiongMai uc-httpd 1.0.0 used in many IP cameras/DVRs: stack buffer overflow via oversized HTTP headers. Verifies uc-httpd surface and sends the canonical overflow trigger arch-specific shellcode may be required. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai...

Apache Struts2 Content-Type OGNL RCE (CVE-2017-5638)

Exploits CVE-2017-5638 in Apache Struts 2.3.x/2.5.x via OGNL injection in the Content-Type header Jakarta multipart parser. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 Jakarta multipart OGNL RCE CVE-2017-5638.""" import re from kittysploit...

GL.iNET Wi-Fi Key Disclosure (CVE-2023-31478)

Exploits CVE-2023-31478 in GL.iNet routers 3.216: unauthenticated POST to /api/router/mesh/status leaks SSID and Wi-Fi encryption key. !/usr/bin/env python3 -- coding: utf-8 -- """GL.iNET mesh status Wi-Fi key disclosure CVE-2023-31478.""" from kittysploit import from lib.protocols.http.httpclien...

GitHub Enterprise Server CVE-2026-3854 Detection

Detects GitHub Enterprise Server instances potentially vulnerable to CVE-2026-3854 push option header injection leading to RCE. Checks GHES fingerprint and git push option endpoint behaviour. !/usr/bin/env python3 -- coding: utf-8 -- """Detect GitHub Enterprise Server push-option RCE surface...

JFrog Artifactory Join-Key Admin RCE (CVE-2026-82329)

Exploits CVE-2026-82329 in JFrog Artifactory: default blank cluster join key allows forging an HS256 JWT and obtaining admin access via POST /access/api/v1/registry/join, then executes commands through the system API. !/usr/bin/env python3 -- coding: utf-8 -- """JFrog Artifactory blank join-key...

Juniper J-Web PHPRC RCE (CVE-2023-36845)

Exploits CVE-2023-36845 in Juniper Junos J-Web: PHP environment variable modification via /?PHPRC=/dev/fd/0 enables autoprependfile code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Juniper J-Web PHPRC RCE CVE-2023-36845.""" import re from kittysploit import from...

Next.js RSC Multi-CVE Chain RCE

Full-chain Next.js RSC exploitation: tries CVE-2025-55182 React2Shell first, then falls back to Next.js-specific RSC endpoints. Integrates detection signals from CVE-2026-44582/44573/44578 auxiliary modules. !/usr/bin/env python3 -- coding: utf-8 -- """Next.js RSC multi-CVE exploit chain...

Citrix ShareFile File Read (CVE-2020-8982)

Exploits CVE-2020-8982 in Citrix ShareFile StorageZones str: depth = r'\..\' 8 target = re...

ConnectWise ScreenConnect Guest Transfer (CVE-2026-84869)

Targets CVE-2026-84869 in ScreenConnect before 26.6.5.9742: guest file transfer without Host confirmation during active sessions. Validates vulnerable build markers and probes guest-accessible transfer endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """ConnectWise ScreenConnect guest file...

GeoServer Jiffle WPS RCE (CVE-2022-24816)

Exploits CVE-2022-24816 in GeoServer via WPS ras:Jiffle: malicious Jiffle script is compiled through Janino into Java for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer Jiffle/Janino WPS RCE CVE-2022-24816.""" import re from kittysploit import from...