Kargo Login Panel - Detect

Kargo login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Kargo login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Kargo Login Panel - Detect', 'description': 'Kargo login...

Atlassian Confluence <5.8.17 - Information Disclosure Detection

Atlassian Confluence before 5.8.17 contains an information disclsoure vulnerability. A remote authenticated user can read configuration files via the decoratorName parameter to 1 spaces/viewdefaultdecorator.action or 2 admin/viewdefaultdecorator.action. !/usr/bin/env python3 -- coding: utf-8 --...

Netdata Panel - Detect

Netdata panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Netdata panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import lookslikenetdatainfo, validatejsonprobe class ModuleScanner, Httpclient:...

C-Lodop Printer - Arbitrary File Read Detection

The C-Lodop printer has an arbitrary file reading vulnerability. By constructing a special URL, it can read any file in the system. !/usr/bin/env python3 -- coding: utf-8 -- """The C-Lodop printer has an arbitrary file reading vulnerability.""" from kittysploit import from...

MailHog Panel - Detect

MailHog panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """MailHog panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MailHog Panel - Detect', 'description': 'MailHog panel was...

NETGEAR Routers - Remote Code Execution Detection

NETGEAR routers R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly others allow...

WirelessHART Fieldgate SWG70 3.0 - Local File Inclusion Detection

WirelessHART Fieldgate SWG70 3.0 is vulnerable to local file inclusion via the fcgi-bin/wgsetcgi filename parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WirelessHART Fieldgate SWG70 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DAR-8000-10 - Command Injection Detection

D-Link DAR-8000-10 version has an operating system command injection vulnerability. The vulnerability originates from the parameter id of the file /app/sys1.php which can lead to operating system command injection. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAR-8000-10 version has an...

Ivanti Connect Secure CVE-2024-21887 Detection

Detects the CVE-2023-46805 auth-bypass path that enables CVE-2024-21887 command injection by reading restricted JSON APIs without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Connect Secure CVE-2024-21887 surface via CVE-2023-46805 auth bypass.""" from kittysploit import fr...

Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution Detection

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

Apache Struts2 S2-053 - Remote Code Execution Detection

Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1 uses an unintentional expression in a Freemarker tag instead of string literals, which makes it susceptible to remote code execution attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts 2.""" import re from kittysploit...

Cyberoam NetGenie Cross-Site Scripting Detection

Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 are susceptible to reflected cross-site scripting via the 'u' parameter of ft.php. !/usr/bin/env python3 -- coding: utf-8 -- """Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 are susceptible to reflected...

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection Detection

Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. !/usr/bin/env python3 -- coding: utf-8 -- """Visual Tools DVR VX16 4.""" import re from kittysploit import from lib.protocols.http.httpclient import...

TeamCity < 2023.11.4 - Authentication Bypass Detection

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible !/usr/bin/env python3 -- coding: utf-8 -- """In JetBrains TeamCity before 2023.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Ivanti Cloud Services Appliance - Path Traversal Detection

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. !/usr/bin/env python3 -- coding: utf-8 -- """Path Traversal in the Ivanti CSA before 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Palo Alto GlobalProtect CVE-2024-3400 Detection

Detects CVE-2024-3400 in Palo Alto Networks PAN-OS GlobalProtect by confirming the SESSID path-traversal file-create canary 404 then 403. !/usr/bin/env python3 -- coding: utf-8 -- """Palo Alto GlobalProtect CVE-2024-3400 path traversal / RCE detection.""" import secrets from kittysploit import fr...

Centreon Login Panel - Detect

Centreon login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Centreon login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Centreon Login Panel - Detect', 'description':...

FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting Detection

FortiGate FortiOS through SSL VPN Web Portal contains a cross-site scripting vulnerability. The login redir parameter is not sanitized, so an attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...

Lighttpd Config File - File Disclosure Detection

Lighttpd Config file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Lighttpd Config file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Lighttpd Config File - File Disclosure Detection',...

Blazor Boot File Disclosure Detection

Exposed Blazor Boot a web framework developed by Microsoft config file. !/usr/bin/env python3 -- coding: utf-8 -- """Exposed Blazor Boot a web framework developed by Microsoft config file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

OVPN Configuration Download Page - Detect

OVPS configuration download page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OVPS configuration download page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OVPN Configuration Download...

Express-handlebars - Local File Inclusion Detection

Express-handlebars is susceptible to local file inclusion because it mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...

Navicat On-Prem Server Panel - Detect

Navicat On-Prem Server is an on-premise solution that provides you with the option to host a cloud environment for storing Navicat objects internally at your location. In our On-Prem environment, you can enjoy complete control over your system and maintain 100% privacy. It is secure and reliable...

IBM FTP CS Service - Detect

IBM FTP CS service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """IBM FTP CS service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'IBM FTP CS Service -...

Veritas NetBackup OpsCenter Analytics Login - Detect

A Veritas NetBackup OpsCenter Analytics page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A Veritas NetBackup OpsCenter Analytics page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Verit...

HG Configuration - Detect

HG configuration was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HG configuration was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HG Configuration - Detect', 'description': 'HG configuration...

PyPICloud Login Panel - Detect

PyPLCloud login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """PyPLCloud login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PyPICloud Login Panel - Detect', 'description':...

WordPress All-in-One Security <=4.4.1 - Hidden Login Page Exposure Detection

WordPress All-in-One Security plugin through 4.4.1 contains an exposure of the actual URL of the "hidden login page" feature. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress All-in-One Security plugin through 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Kyan Credential - Exposure Detection

Kyan Network login panel was detected. Password and other credential theft is possible via accessing this panel. !/usr/bin/env python3 -- coding: utf-8 -- """Kyan Network login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Amazon S3 Torrent Download - Detect

Amazon S3 Torrent download was detected, which can allow a malicious user to download files. !/usr/bin/env python3 -- coding: utf-8 -- """Amazon S3 Torrent download was detected, which can allow a malicious user to download files.""" from kittysploit import from lib.protocols.http.httpclient impo...

PostHog Login Panel - Detect

PostHog login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """PostHog login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PostHog Login Panel - Detect', 'description': 'PostHog...

Apache Detection

Some Apache servers have the version on the response header. The OpenSSL version can be also obtained !/usr/bin/env python3 -- coding: utf-8 -- """Some Apache servers have the version on the response header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Vugex Framework Source Code - Detect

Detects the presence of exposed Vugex Framework source code by identifying common files and directories associated with the framework. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of exposed Vugex Framework source code by identifying common files and directories associ."""...

Concrete5 Detection

An instance running Concrete5 is detected by looking for specific HTTP headers, HTML tags, and known endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """An instance running Concrete5 is detected by looking for specific HTTP headers, HTML tags, and known endpoints.""" from kittysploit import...

Cloudlog Panel - Detect

Cloudlog panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Cloudlog panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cloudlog Panel - Detect', 'description': 'Cloudlog panel was...

Lexmark Device Detect

Detects Lexmark Device Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Lexmark Device Detect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Lexmark Device Detect', 'description': 'Detects...

Danswer Panel - Detect

Danswer panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Danswer panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Danswer Panel - Detect', 'description': 'Danswer panel was...

Go.Control Event Administration Panel - Detect

Detects the presence of the Go.Control Event Administration login panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of the Go.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Go.Control Event...

Mitric Checker Login Panel - Detect

Mitric Checker login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Mitric Checker login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Mitric Checker Login Panel - Detect',...

Fiori Launchpad Login Panel - Detect

Fiori Launchpad login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Fiori Launchpad login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fiori Launchpad Login Panel - Detect',...

ZOHO ManageEngine SupportCenter Panel - Detect

ZOHO ManageEngine SupportCenter panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ZOHO ManageEngine SupportCenter panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ZOHO ManageEngine...

Prestashop Installer Exposure Detection

Prestashop is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Prestashop is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

PrivateGPT - Detect

PrivateGPT panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """PrivateGPT panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PrivateGPT - Detect', 'description': 'PrivateGPT...

Dynamicweb Login Panel - Detect

Dynamicweb login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dynamicweb login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dynamicweb Login Panel - Detect', 'description':...

MAG Dashboard Login Panel - Detect

MAG Dashboard login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """MAG Dashboard login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MAG Dashboard Login Panel - Detect',...

SAP Dispatcher - Detect

The SAP Dispatcher is the central process that manages communication between user requests and work processes. !/usr/bin/env python3 -- coding: utf-8 -- """The SAP Dispatcher is the central process that manages communication between user requests and work processes.""" import socket from...

Celebrus - Detect

Celebrus was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Celebrus was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Celebrus - Detect', 'description': 'Celebrus was detected.', 'author':...

NPM Debug Log Disclosure Detection

NPM Debug log file exposed. !/usr/bin/env python3 -- coding: utf-8 -- """NPM Debug log file exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NPM Debug Log Disclosure Detection', 'description': 'NPM Debug log...

Arcade.php - SQL Injection Detection

The arcade.php script is vulnerable to SQL injection. By exploiting this vulnerability, an attacker can manipulate the SQL queries executed by the script, potentially gaining unauthorized access to the database. !/usr/bin/env python3 -- coding: utf-8 -- """The arcade.""" from kittysploit import...

Mixed Active Content Detection

This check detects if there are any active content loaded over HTTP instead of HTTPS. !/usr/bin/env python3 -- coding: utf-8 -- """This check detects if there are any active content loaded over HTTP instead of HTTPS.""" import re from kittysploit import from lib.protocols.http.httpclient import...