Browser Extension Detect

Best-effort detection of installed Chromium extensions via web-accessible resources from kittysploit import import json Common Chromium extension IDs and a representative web-accessible resource path. Detection is best-effort: MV3 + locked resources produce many false negatives. DEFAULTEXTENSIONS...

DOM Snapshot

Export page HTML snapshot and optional viewport canvas capture for reporting from kittysploit import import json import os import time class ModuleBrowserAuxiliary: info = "name": "DOM Snapshot", "description": "Export page HTML snapshot and optional viewport canvas capture for reporting",...

Docker Daemon Exposed (HTTP)

Detects an unauthenticated Docker Engine API via /version and /vApiVersion/containers/json. Typical port: 2375. !/usr/bin/env python3 -- coding: utf-8 -- """Docker Daemon exposed over HTTP API.""" import json import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

HTTP TRACE Method Enabled

Sends an HTTP TRACE request and checks whether the server echoes the request, which can enable Cross-Site Tracing XST style attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HTTP TRACE method reflection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

FTP Anonymous Login

Checks whether the FTP service allows anonymous or guest login and optionally lists the landing directory. !/usr/bin/env python3 -- coding: utf-8 -- """Detect anonymous FTP login.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

Laravel .env disclosure

Detects publicly accessible Laravel .env files that may leak database credentials, APPKEY, and other secrets. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel .env sensitive information disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS...

Windows Seatbelt Recon (optional external)

OPTIONAL: requires Seatbelt.exe in data/assemblies/. Prefer native post/shell/windows/gather modules enumsystem, privilegeescalationsurface, edraudit, …. Seatbelt is a broad C host checklist, not a credential dumper. !/usr/bin/env python3 -- coding: utf-8 -- """Host situational awareness via...

WebDAV Enabled

Detects WebDAV by issuing PROPFIND and looking for Multi-Status / DAV response markers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect enabled WebDAV PROPFIND.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/", "/webdav/", "/DavWWWRoot/",...

Kitty Agent (typed tasks)

HTTP polling agent with typed tasks: shell, ls, pwd, whoami, cat, download, upload. Uses the same reversehttppolling listener as the classic beacon. from kittysploit import from lib.c2.beaconprofile import BeaconProfile from lib.c2.kittyagent import buildkittyagentscript class ModulePayload:...

SNMP Default Community

Probes SNMP v1/v2c agents for common default community strings e.g. public/private via sysDescr. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SNMP agents accepting default community strings.""" from kittysploit import DEFAULTCOMMUNITIES = "public", "private", "community", "snmp", "snmpd",...

Windows loadmodule (alias)

Alias of post/shell/windows/manage/runassembly — set module= then run. !/usr/bin/env python3 -- coding: utf-8 -- """Alias module: loadmodule → same as runassembly.""" from kittysploit import from modules.post.shell.windows.manage.runassembly import Module as RunAssemblyModule class...

SharePoint CVE-2026-50522 Trust Endpoint Detection

Detects an exposed on-prem SharePoint WS-Federation trust endpoint /trust/default.aspx associated with CVE-2026-50522 unauthenticated BinaryFormatter deserialization RCE. Surface detection only — no gadget payload is sent. !/usr/bin/env python3 -- coding: utf-8 -- """ Detect exposed SharePoint...

FastCGI Echo Endpoint Script - Detect

FastCGI echo endpoint script was detected, which lists several kinds of sensitive information such as port numbers, server software versions, port numbers, and IP addresses. !/usr/bin/env python3 -- coding: utf-8 -- """FastCGI echo endpoint script was detected, which lists several kinds of...

JIRA in HTTPS mode - Open Redirect Detection

Detected Open redirect vulnerability in Jira via osdestination parameter versions 5.2.11, 6.2, and 6.2.2. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Open redirect vulnerability in Jira via osdestination parameter versions 5.""" import re from kittysploit import from...

OurMGMT3 Admin Login Panel - Detect

OurMGMT3 admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OurMGMT3 admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OurMGMT3 Admin Login Panel - Detect',...

STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion Detection

STAGIL Navigation for Jira Menu & Themes plugin before 2.0.52 is susceptible to local file inclusion via modifying the fileName parameter to the snjCustomDesignConfig endpoint. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This...

mooSocial v.3.1.8 - Cross-Site Scripting Detection

Cross-Site Scripting XSS vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-Site Scripting XSS vulnerability in mooSocial v.""" fr...

Drupal 11.x-dev - Full Path Disclosure Detection

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. !/usr/bin/env python3 -- coding: utf-8 -- """core/authorize.""" from kittysploit import from lib.protocols.http.httpclient...

MeteoBridge <= 6.1 - Remote Code Execution Detection

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote...

1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure Detection

1 Click WordPress Migration = 2.2 contains an information disclosure caused by uncleared debug information, letting attackers retrieve embedded sensitive data, exploit requires no specific privileges. !/usr/bin/env python3 -- coding: utf-8 -- """1 Click WordPress Migration = 2.""" from kittysploi...

Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal Detection

Windmill 1.603.3 contains a path traversal caused by unsanitized filename parameter in getlogfile endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Windmill 1.""" from kittysploit import...

WordPress Core <=6.2 - Directory Traversal Detection

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wplang’ parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.""" from kittysploit import from...

SAP Internet Graphics Server (IGS) Detection

Detection of SAP Internet Graphics Server IGS !/usr/bin/env python3 -- coding: utf-8 -- """Detection of SAP Internet Graphics Server IGS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SAP Internet Graphics Server I...

AWStats Listing Detection

Searches for exposed awstats Internal Information. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for exposed awstats Internal Information.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWStats Listing...

PhpMyAdmin Scripts - Remote Code Execution Detection

PhpMyAdmin Scripts 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 are susceptible to a remote code execution in setup.php that allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. Combined with the ability to save files on server, this can allow...

Poste.io Admin Panel - Detect

Poste.io login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Poste.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Poste.io Admin Panel - Detect', 'description': 'Poste.io login panel was...

Detect Selea Targa IP OCR-ANPR Camera

Various version of the Selea Targa IP OCR-ANPR Camera are vulnerable to an Unauthenticated RTP/RTSP/M-JPEG Stream Disclosure flaw !/usr/bin/env python3 -- coding: utf-8 -- """Various version of the Selea Targa IP OCR-ANPR Camera are vulnerable to an Unauthenticated RTP/RTSP/M-JPEG Str.""" from...

MeTube Instance Detected

A MeTube instance was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A MeTube instance was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MeTube Instance Detected', 'description': 'A MeTube instanc...

Synology DSM System Info - Detect

Detected the disclosure of Synology DiskStation Manager DSM system information via the SYNO.API.Info endpoint, identifying all available APIs, versions, and installed packages returned without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the disclosure of Synology...

elFinder - Install Detection

An elFinder implementation was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """An elFinder implementation was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'elFinder - Install Detection',...

elFinder 2.1.58 - Remote Code Execution Detection

elFinder 2.1.58 is vulnerable to remote code execution. This can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. !/usr/bin/env python3 -- coding: utf-8 -- """elFinder 2.""" from kittysploit import from...

Open Game Panel Login Panel - Detect

Open Game Panel login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Open Game Panel login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Open Game Panel Login Panel - Detect',...

Cobbler WebGUI Login Panel - Detect

Cobbler WebGUI login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cobbler WebGUI login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cobbler WebGUI Login Panel - Detect',...

Craft CMS Admin Login Panel - Detect

Craft CMS admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Craft CMS admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Craft CMS Admin Login Panel - Detect',...

Lucee - Unset Credentials Detection

The Lucee admin panel has a first-time setup page which allows any user to set the administrator password. !/usr/bin/env python3 -- coding: utf-8 -- """The Lucee admin panel has a first-time setup page which allows any user to set the administrator password.""" from kittysploit import from...

Qualtrics Login Panel - Detect

Qualtrics login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Qualtrics login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Qualtrics Login Panel - Detect', 'description':...

XWiki WYSIWYG API - Open Redirect Detection

A vulnerability in XWiki's WYSIWYG API allows an attacker to redirect users to arbitrary external URLs through the xerror parameter. This could be used in phishing attacks to redirect users to malicious websites. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in XWiki's WYSIWYG API...

Onion Website Supported via Onion-Location Header Detection

Identified websites that supported Tor network access through the Onion-Location HTTP response header, which pointed to a corresponding .onion service for enhanced privacy and anonymity. !/usr/bin/env python3 -- coding: utf-8 -- """Identified websites that supported Tor network access through the...

ngSurvey Login Panel - Detect

ngSurvey products was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ngSurvey products was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ngSurvey Login Panel - Detect', 'description': 'ngSurvey...

Detect Shiro Framework

Detects Detect Shiro Framework. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Detect Shiro Framework.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Detect Shiro Framework', 'description': 'Detects Detect Shi...

Spinnaker Detect

Detects the Spinnaker continuous delivery software !/usr/bin/env python3 -- coding: utf-8 -- """Detects the Spinnaker continuous delivery software.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Spinnaker Detect',...

Jira Unauthenticated Projects Detection

Detects Jira Unauthenticated Projects. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jira Unauthenticated Projects.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jira Unauthenticated Projects Detection',...

Node-RED Dashboard - Detect

Node-RED dashboard was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED dashboard was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Node-RED Dashboard - Detect', 'description': 'Node-RED...

Vista Web Login Panel Detection

Vista Web login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Vista Web login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Vista Web Login Panel Detection', 'description':...

HP Media Vault Detect

Detects HP Media Vault Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects HP Media Vault Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HP Media Vault Detect', 'description': 'Detects HP Media Vaul...

WAGO PLC Panel - Detect

WAGO PLC panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """WAGO PLC panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WAGO PLC Panel - Detect', 'description': 'WAGO PLC panel was...

Uninitialized GitLab instances Detection

Prior to version 14, GitLab installations required a root password to be set via the web UI. If the administrator skipped this step, any visitor could set a password and control the instance. !/usr/bin/env python3 -- coding: utf-8 -- """Prior to version 14, GitLab installations required a root...

Kiteworks PCN Panel - Detect

Kiteworks PCN Login Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Kiteworks PCN Login Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Kiteworks PCN Panel - Detect', 'description...

Hardcoded .npmrc AuthToken Detection

Detects Hardcoded .npmrc AuthToken. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Hardcoded .""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Hardcoded .npmrc AuthToken Detection', 'description': 'Detects...

Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal Detection

Carel pCOWeb HVAC BACnet Gateway 2.1.0 contains an unauthenticated arbitrary file disclosure caused by improper verification of the 'file' GET parameter in logdownload.cgi, letting attackers disclose sensitive files via directory traversal, exploit requires no authentication. !/usr/bin/env python...