GlobalSCAPE Secure FTP Service - Detect

GlobalSCAPE Secure FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GlobalSCAPE Secure FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name':...

Pritunl - Panel Detection

Realtime website and application monitoring tool !/usr/bin/env python3 -- coding: utf-8 -- """Realtime website and application monitoring tool.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pritunl - Panel...

Langfuse Panel - Detect

Langfuse panel was detected. Langfuse is an open-source LLM engineering platform for observability, evaluations, prompt management and analytics. Exposed instances may reveal LLM prompts, traces, evaluations, and connected API keys. !/usr/bin/env python3 -- coding: utf-8 -- """Langfuse panel was...

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting Detection

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. !/usr/bin/env python3 --...

Auth.json File - Disclosure Detection

auth.json file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """auth.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Auth.json File - Disclosure Detection', 'description': 'auth.json file is exposed.',...

CentOs-WebPanel Test Page Detection

Detects CentOs-WebPanel Test Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CentOs-WebPanel Test Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CentOs-WebPanel Test Page Detection', 'description':...

Uptime-Kuma < v1.23.0 - Improper Access Control Detection

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing...

Proofpoint Protection Server Panel - Detect

Proofpoint Protection Server panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Proofpoint Protection Server panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Proofpoint Protection...

Adobe AEM CRX Browser Exposure Detection

Detects Adobe AEM CRX Browser Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe AEM CRX Browser Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM CRX Browser Exposure Detection',...

OneinStack Control Center Dashboard - Detect

OneinStack Control Center dashboard was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OneinStack Control Center dashboard was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OneinStack Control Cent...

NPM package.json Disclosure Detection

All NodeJS packages contain a file, usually in the project root, called package.json - this file holds various metadata relevant to the project generated by package managers such as npm, yarn, pnpm. !/usr/bin/env python3 -- coding: utf-8 -- """All NodeJS packages contain a file, usually in the...

Langflow CVE-2026-5027 path traversal file write RCE

Exploits CVE-2026-5027: unsanitized multipart filename on POST /api/v2/files Langflow = 1.8.4. With default auto-login, unauthenticated arbitrary file write. Modes: proof /tmp, cron drop /etc/cron.d reverse shell, write custom path/content. Fixed in 1.9.0+. !/usr/bin/env python3 -- coding: utf-8 ...

Windows Gather Defender CVE-2026-41091 / CVE-2026-45498 Audit

Post gather for Microsoft Defender CVE-2026-41091 LPE via Malware Protection Engine link-following and CVE-2026-45498 Antimalware Platform DoS. Reads AMEngineVersion / AMProductVersion via Get-MpComputerStatus, compares against fixed floors ... / ..., and lists MsMpEng/NisSrv/Sense processes...

Planyo ulap.php unauthenticated SSRF (CVE-2026-3576)

Confirms CVE-2026-3576 in Planyo Online Reservation System = 3.0: unauthenticated SSRF via /wp-content/plugins/planyo-online-reservation-system/ulap.php ulapurl. Uses a differential allow-list probe disallowed host blocked, localhost allowed and optionally fetches a lab canary bound on the target...

Foxit PDF Reader Pointer Overwrite UAF

Foxit PDF Reader v9.0.1.1049 Use-After-Free CVE-2018-9948 / CVE-2018-9958. Select a Windows payload; the PDF ROP calls WinExec on a short command. delivery=http serves an HTA stage over HTTP mshta http://LHOST/h and can also serve the PDF. delivery=smb embeds a UNC path to an EXE/BAT you host...

VLC Media Player MKV Use After Free

CVE-2018-11529: Use-after-free in VideoLAN VLC = 2.2.8 MKV parsing 32-bit and 64-bit. Generates two .mkv files: part1 vulnerability + heap spray to open in VLC, and part2 must sit in the same directory. Requires a raw shellcode payload = 0x300 bytes. Meterpreter-sized payloads often crash VLC —...

BLE GATT Characteristics

Enumerates GATT characteristics UUID, handle, properties for a BLE session !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — list GATT characteristics and properties.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin import json class ModulePost,...

OPC UA Client

Connects to an OPC UA server and creates an interactive OPC UA shell session !/usr/bin/env python3 -- coding: utf-8 -- """OPC UA bind listener — opens an OPC UA session for node browsing and diagnostics.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

DoIP Client

Connects to an automotive DoIP ISO 13400 gateway, performs routing activation, and creates a session for UDS diagnostic post modules !/usr/bin/env python3 -- coding: utf-8 -- """DoIP bind listener — connects to a DoIP gateway and opens a diagnostic session.""" from kittysploit import from...

BLE Notify Capture

Subscribes to GATT notifications/indications and captures values for a timed window !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — subscribe to notifications/indications and capture traffic.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin from...

CANBUS Session Info

Displays interface, CAN ID, timing, and message statistics for a CANBUS session !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS Session Info - Displays metadata and statistics for a CANBUS session Author: KittySploit Team Version: 1.0.0 """ from kittysploit import from core.outputhandler...

Windows Gather Wireless Current Connection Info

Gather information about the current connection on each wireless LAN interface via 'netsh wlan show interfaces' on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Gather current WLAN connection details on each wireless interface Metasploit-style...

CANBUS OBD-II Query

Queries OBD-II data such as supported PIDs, VIN, custom PID values, and DTCs !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS OBD-II Query - Sends read-only OBD-II diagnostic queries over a CANBUS session Author: KittySploit Team Version: 1.0.0 """ from kittysploit import from...

WinRM Persistence Scheduled Task

Create a scheduled task persistence entry through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Persistence Scheduled Task",...

WinRM Download File

Download a remote file through an active WinRM session pypsrp fetch !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Download File",...

SSH login

Compatibility alias for auxiliary/scanner/ssh/sshloginbruteforce. Attempts common and wordlist-based SSH credentials and registers an interactive SSH session on success. !/usr/bin/env python3 -- coding: utf-8 -- """ Compatibility alias for auxiliary/scanner/ssh/sshloginbruteforce. Prefer the...

phpMyAdmin Authenticated Remote Code Execution (CVE-2018-12613)

phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which can be exploited post-authentication to execute PHP code by application. Tested against phpMyAdmin v4.8.1. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin 4.8.0/4.8.1 authenticated LFI to RCE — CVE-2018-12613...

Splunk CVE-2022-43571 (SimpleXML PDF RCE) detection

Detects Splunk Enterprise instances in the CVE-2022-43571 affected version ranges 8.1.12, 8.2.0–8.2.8, 9.0.0–9.0.1. Reads the version from the login page by default; optional credentials refine the check via the authenticated home page. Does not exploit. !/usr/bin/env python3 -- coding: utf-8 --...

Moodle detection

Detects a Moodle installation and reports the version from lib/upgrade.txt when available. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Moodle and report the version from lib/upgrade.txt.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Metasploitable3 Windows Environment

Metasploitable3 Windows Server 2008 R2 lab VM via Vagrant — intentionally vulnerable Windows target for authorized internal-lab agent benchmarks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleVagrantEnvironment: info = "name": "Metasploitable3 Windows Environment",...

Windows Gather Kerberos Ticket Audit

Dump klist and logon session Kerberos context !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Kerberos Ticket Audit", "description": "Dump...

Spring Cloud Azure B2C CVE-2026-50338 Detection

Detect B2C JWT-protected APIs; verify CVE-2026-50338 when Entra creds are set !/usr/bin/env python3 -- coding: utf-8 -- """Detect CVE-2026-50338 Spring Cloud Azure B2C cross-issuer auth bypass.""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import...

Cisco IOS CMP CVE-2017-3881 telnet exposure

Passive check for CVE-2017-3881 exposure: telnet reachable on a Cisco IOS or IOS XE device. CMP malformed-option handling is tied to telnet session negotiation; confirm patch level separately before exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cisco IOS telnet exposure for...

Balbooa Forms CVE-2026-56291 detection

Detects Joomla sites running Balbooa Forms combaforms 2.4.1 vulnerable to CVE-2026-56291 — unauthenticated arbitrary file upload via form.uploadAttachmentFile without CSRF or permission checks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient...

Host Header Injection Probe

Tests Host and X-Forwarded-Host manipulation for reflection in responses, redirects, and cache/password-reset style poisoning signals. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Host header and X-Forwarded-Host injection misconfigurations.""" from future import annotations import json fr...

HashiCorp Vault Detection

Detects Vault /v1/sys/health and UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HashiCorp Vault API and UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

SMB session acquire

Chains SMB recon null session, guest, credentials or wordlists and opens an authenticated SMB session when access is obtained. !/usr/bin/env python3 -- coding: utf-8 -- """ Probe SMB authentication profiles and open an interactive SMB session. Workflow: 1. Check null session / guest / supplied...

QUIC Upload File

Upload a local file to the remote host via an active QUIC C2 session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin class ModulePost,...

Splunk Detection

Detects Splunk management REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Splunk Enterprise web/API interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlresponse, ishtmlresponse...

Ollama Detection

Detects Ollama model API via /api/tags endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Ollama local LLM API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Export passive ICS report

Loads a JSON report produced by auxiliary/scanner/ics/passivesniffer and optionally copies it or syncs discovered OT assets to the workspace. !/usr/bin/env python3 -- coding: utf-8 -- import json import os import shutil from kittysploit import from lib.protocols.ics.report import savereport class...

Mattermost Detection

Detects Mattermost system ping API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Mattermost team collaboration server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

MinIO Public Bucket Listing Verification

Confirms anonymous ListBuckets or open bucket listing on MinIO/S3 API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify MinIO/S3 anonymous bucket listing.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlrespon...

MinIO Detection

Detects MinIO health and console login endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed MinIO object storage API and console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "MinIO Detection",...

Module Stomping Evasion

Generate a Windows x64 EXE that loads a benign DLL default: version.dll, stomps its .text section with decrypted shellcode, and executes in-place. !/usr/bin/env python3 -- coding: utf-8 -- """ Module stomping evasion loader. Loads a legitimate DLL locally, overwrites its .text section with...

phpPgAdmin Detection

Detects phpPgAdmin PostgreSQL administration panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed phpPgAdmin panels.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "phpPgAdmin Detection", "description"...

MLflow Detection

Detects MLflow tracking server UI and REST API. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MLflow tracking server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse, ishtmlresponse class...

DNP3 master probe

Active DNP3 master-style probe against an outstation on TCP/20000 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import probednp3master from lib.protocols.ics.icsscannerclient import...

BACnet Who-Is discovery

Sends BACnet/IP Who-Is requests UDP/47808 and collects I-Am responses for BMS / building controller discovery. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import whois from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Linux userfaultfd Evasion Loader

Generate a Linux x64 ELF that uses userfaultfd to lazily resolve encrypted shellcode pages at access time, evading simple memory scans. !/usr/bin/env python3 -- coding: utf-8 -- """ userfaultfd delayed-reveal shellcode loader Linux x64. Maps shellcode with userfaultfd, drops pages from memory, th...