Firmware → adaptive payload plan

Detect firmware CPU architecture from ELF headers, select the best payload BusyBox/CMD vs raw and listener adaptive vs reversetcp, then emit a ready-to-run CLI command sequence. !/usr/bin/env python3 -- coding: utf-8 -- """ Firmware arch → adaptive payload/listener plan. Scans ELF headers, select...

BLE UART pivot probe

Detect Nordic NUS and common UART-over-GATT profiles on a BLE session for interactive pivot uartexec / shell commands. !/usr/bin/env python3 -- coding: utf-8 -- """Probe BLE UART / Nordic NUS channels for shell pivot.""" from kittysploit import from lib.protocols.ble.blesessionmixin import...

MySQL Empty Password

Tests common MySQL/MariaDB usernames for empty-password login. Requires pymysql. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MySQL/MariaDB accounts with an empty password.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient...

PostgreSQL Empty Password

Tests common PostgreSQL usernames for trust or empty-password login via psycopg2. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PostgreSQL trust / empty-password access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

IEC104 double command

Sends an IEC 60870-5-104 double command CDCNA1. Intrusive — otpolicy gated + confirm latch. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

FTP FEAT Detection

Lists FTP features advertised via FEAT AUTH TLS, UTF8, EPSV, …. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FTP FEAT capabilities TLS, UTF8, EPSV, ….""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.ftp.detectors import probeftpfe...

CoAP Config Dump

Enumerate .well-known/core and GET common IoT config/status paths device, version, firmware, sensor, … to dump readable state. !/usr/bin/env python3 -- coding: utf-8 -- """Dump CoAP device/config resources well-known + common IoT paths.""" from kittysploit import from lib.protocols.coap.client...

BACnet/IP Client

Discovers a BACnet/IP device Who-Is and creates an interactive BACnet shell session !/usr/bin/env python3 -- coding: utf-8 -- """BACnet/IP bind listener — opens a BACnet session for interactive device access.""" from kittysploit import from lib.protocols.ics.bacnetclient import BacnetClient from...

mDNS / DNS-SD Enum

Enumerates DNS-SD instances via unicast or multicast mDNS, resolves PTR→SRV/TXT/A, and suggests KittySploit protocol sessions. !/usr/bin/env python3 -- coding: utf-8 -- """Deep mDNS / DNS-SD enumeration with SRV/TXT/A correlation and module handoff.""" from kittysploit import from...

RTSP Client

Connects to an RTSP/RTSPS endpoint, probes OPTIONS/DESCRIBE, and creates an interactive RTSP shell describe, setup/play interleaved, teardown. !/usr/bin/env python3 -- coding: utf-8 -- """RTSP bind listener — opens an interactive RTSP session toward a camera/NVR.""" from kittysploit import from...

PostgreSQL login bruteforce

Attempts common and wordlist-based PostgreSQL credentials. Use only on authorized targets — rate-limited by default. !/usr/bin/env python3 -- coding: utf-8 -- """ PostgreSQL login bruteforce — tests username/password combinations. """ from future import annotations import itertools import os impo...

OpenWrt / BusyBox Firmware Info

Collect firmware/board identity from an embedded Linux shell: openwrtrelease, board name, uname, and common version files. !/usr/bin/env python3 -- coding: utf-8 -- """Gather OpenWrt / embedded firmware identity from a BusyBox-style shell.""" from kittysploit import from lib.post.linux.session...

BLE UART exec

Send a command string over a BLE UART/NUS write characteristic and collect the notify response serial-over-GATT pivot. !/usr/bin/env python3 -- coding: utf-8 -- """Execute a command over BLE UART/NUS pivot channel.""" from kittysploit import from lib.protocols.ble.blesessionmixin import...

ONVIF Device Information

Query an IP camera ONVIF device service for manufacturer/model/firmware and Media service XAddr. Prefers an ONVIF session when set. !/usr/bin/env python3 -- coding: utf-8 -- """ONVIF device information gather HTTP SOAP.""" from kittysploit import from lib.protocols.onvif.session import...

IEC 61850 MMS identify

MMS Identify request — extract vendor/model/revision strings session preferred !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS Identify via session or direct target.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

IEC 61850 MMS directory dump

MMS Identify plus GetNameList for domains and named variables session preferred. !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS directory dump — Identify + GetNameList domains/variables.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Matter / CHIP Detection

Discovers Matter commissionable matterc.udp and operational matter.tcp nodes via mDNS, parses TXT VP/DT/DN/CM, and can probe UDP/5540 reachability. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Matter / CHIP nodes via mDNS and optional UDP/5540 probe.""" from kittysploit import from...

BusyBox Embedded HTTP Polling C2

POSIX/BusyBox ash HTTP polling implant for OpenWrt and embedded Linux. Pairs with listeners/multi/reversehttppolling base64 command protocol. from kittysploit import from lib.c2.embeddedhttpagent import buildembeddedhttpagentscript from lib.c2.embeddedsession import EmbeddedC2Mixin import uuid...

MySQL TLS Capability

Reports whether the MySQL/MariaDB handshake advertises SSL/TLS CLIENTSSL. Flags servers that do not support TLS. !/usr/bin/env python3 -- coding: utf-8 -- """Report MySQL/MariaDB TLS capability from the server handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

PostgreSQL Auth Method

Identifies the PostgreSQL AuthenticationRequest type trust, cleartext, md5, scram/sasl, … for a username. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PostgreSQL authentication method from startup handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

Firmware architecture → payload suggest

Scan a local firmware blob for embedded ELF headers, infer architecture mipsle/mipsbe/armle/arm64/x86/x64/…, recommend payloads, and show an adaptive listener plan. !/usr/bin/env python3 -- coding: utf-8 -- """ Scan a firmware image for ELF headers, detect CPU architecture, and suggest matching...

Deploy Embedded HTTP C2

Generate and optionally execute a BusyBox/ash HTTP polling agent on an OpenWrt/embedded shell. Pairs with listeners/multi/reversehttppolling. !/usr/bin/env python3 -- coding: utf-8 -- """Deploy BusyBox embedded HTTP polling C2 from a live shell session.""" from kittysploit import from...

SSH login bruteforce

Attempts common and wordlist-based SSH password credentials. Prefer running after scanner/ssh/sshauthmethods when password or keyboard-interactive auth is offered. Registers an SSH session on success. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """ SSH login bruteforce —...

FTP SYST Detection

Queries FTP SYST to fingerprint the remote system type. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FTP SYST response OS / server type.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.ftp.detectors import probeftpsyst class...

CoAP Resource Enum

Enumerate CoAP resources from .well-known/core and optionally GET discovered paths. Uses a CoAP session or rhost. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate CoAP resources via .well-known/core and optional path probes.""" from kittysploit import from lib.protocols.coap.client import...

IEC 60870-5-104 Client

Connects to an IEC 104 server and creates an interactive IEC 104 shell session !/usr/bin/env python3 -- coding: utf-8 -- """IEC 60870-5-104 bind listener — opens an IEC 104 session for interrogation.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

CoAP Resource Write

Send PUT, POST, or DELETE to a CoAP resource. Intrusive — use only on authorized lab targets. !/usr/bin/env python3 -- coding: utf-8 -- """Write CoAP resources via PUT/POST/DELETE lab / authorized testing.""" from kittysploit import from lib.protocols.coap.client import COAPPORT from...

ONVIF PTZ Status

Query ONVIF PTZ GetStatus for a media profile pan/tilt/zoom. Uses an ONVIF session or rhost. !/usr/bin/env python3 -- coding: utf-8 -- """Read ONVIF PTZ status for the first or selected media profile.""" from kittysploit import from lib.protocols.onvif.session import OnvifSessionMixin import json...

Windows Upgrade Cmd to PowerShell

Enable PowerShell on a Windows shell session: wrap the current session same or open a new PowerShell reverse-TCP session new. !/usr/bin/env python3 -- coding: utf-8 -- """ Switch a Windows cmd.exe shell session to PowerShell. Modes: - same: wrap commands on the current session with powershell...

Windows PowerShell CLM Bypass (TEMP redirect)

Bypass PowerShell Constrained Language Mode by launching a child powershell.exe with TEMP/TMP redirected to an AppLocker-allowed path default C:\Windows\Temp. PowerShell probes AppLocker script rules via a temp script; an allowed TEMP yields FullLanguage. !/usr/bin/env python3 -- coding: utf-8 --...

vBulletin runMaths Pre-Auth RCE Detection (CVE-2026-61511)

Detects unauthenticated RCE via vB5TemplateRuntime::runMaths CVE-2026-61511 by sending a safe phpfuck-encoded system'echo …' probe to ajax/render/pagenav. Affects vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 fixed in 6.2.2 / vendor patches. !/usr/bin/env python3 -- coding: utf-8 -- from...

Zig Kitty Agent HTTP Polling (Windows)

Compiled Zig Kitty implant: typed tasks over HTTP polling shell/ls/pwd/whoami/cat/download/upload/exit. Pairs with listeners/multi/reversehttppolling. !/usr/bin/env python3 -- coding: utf-8 -- """Zig Kitty HTTP polling implant Windows.""" from kittysploit import from...

LDAP Auth Check

Validates domain credentials with an LDAP bind and reports domain / DC info NetExec: nxc ldap -u -p . !/usr/bin/env python3 -- coding: utf-8 -- """Validate domain credentials over LDAP NetExec: nxc ldap host -u -p.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class...

LDAP AdminCount Accounts

Lists accounts with adminCount=1 AdminSDHolder / protected groups NetExec: nxc ldap -u -p --admin-count. !/usr/bin/env python3 -- coding: utf-8 -- """List adminCount=1 accounts NetExec: nxc ldap --admin-count.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from...

LDAP Group Members

List members of a group, or groups for a user NetExec: --groups 'Backup Operators' / -M groupmembership. !/usr/bin/env python3 -- coding: utf-8 -- """Group membership helpers NetExec: --groups / groupmembership.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from...

LDAP Enum Users

Lists domain users with pwdLastSet and badPwdCount NetExec: nxc ldap -u -p --users. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate domain users NetExec: nxc ldap --users.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from lib.protocols.ldap.adenum import...

MSSQL Enum Impersonate

Lists logins the current SQL user can EXECUTE AS NetExec: nxc mssql -M enumimpersonate. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate MSSQL impersonation rights NetExec: -M enumimpersonate.""" from future import annotations from kittysploit import class ModuleAuxiliary: info = "name":...

LDAP Query

Runs a raw LDAP filter and dumps matching attributes NetExec: nxc ldap -u -p --query 'sAMAccountName=user' ''. !/usr/bin/env python3 -- coding: utf-8 -- """Raw LDAP query NetExec: nxc ldap --query.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleAuxiliary,...

BusyBox / ash Reverse TCP

Minimal reverse TCP shell for BusyBox/ash IoT, containers, embedded Linux from kittysploit import class ModulePayload: CLIENTLANGUAGE = "sh" info = "name": "BusyBox / ash Reverse TCP", "description": "Minimal reverse TCP shell for BusyBox/ash IoT, containers, embedded Linux", "category":...

TFTP Enum

Attempts TFTP RRQ for common config/boot filenames NSE tftp-enum. !/usr/bin/env python3 -- coding: utf-8 -- """TFTP common-file enum NSE tftp-enum.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.tftp.detectors import probetftpenum class...

IPMI Version

Probes IPMI/RMCP Get Channel Authentication Capabilities on UDP/623 NSE ipmi-version. !/usr/bin/env python3 -- coding: utf-8 -- """IPMI version fingerprint NSE ipmi-version.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.ipmi.detectors...

NFS Showmount

Queries the MOUNT daemon via portmap for NFS export lists NSE nfs-showmount. !/usr/bin/env python3 -- coding: utf-8 -- """NFS showmount / export list NSE nfs-showmount.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.nfs.detectors import...

File Upload Lure

Show a fake file-attach modal and exfiltrate selected file metadata and content from kittysploit import import base64 import json import os import time class ModuleBrowserAuxiliary: info = "name": "File Upload Lure", "description": "Show a fake file-attach modal and exfiltrate selected file...

Windows VBScript Reverse TCP (csc on-box)

VBScript/cscript delivery vector: writes a tiny C reverse shell, compiles with csc.exe .NET Framework, and runs it — no powershell.exe from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "vbscript" info = "name": "Windows VBScript Reverse TCP csc on-box", "description":...

SMB Security Mode

Negotiates SMB2/3 and reports signing mode and selected dialect NSE smb2-security-mode / smb-protocols. !/usr/bin/env python3 -- coding: utf-8 -- """SMB2 security mode / dialect NSE smb2-security-mode / smb-protocols.""" from kittysploit import from lib.protocols.smb.smbscannerclient import...

PowerShell Command Shell, Reverse HTTPS (TLS)

Connect back over TLS SslStream and create an interactive command shell. No native reversehttps listener — terminate TLS on the operator side stunnel, openssl sserver, etc. and forward plaintext to listeners/multi/reversetcp, or use listeners/multi/reversetls for native TLS termination...

Oracle TNS Version

Queries Oracle TNS Listener for version/banner information NSE oracle-tns-version. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle TNS version NSE oracle-tns-version.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.oracle.detectors...

Windows CMD Reverse TCP (csc on-box)

Pure cmd.exe one-liner: writes a tiny C reverse shell, compiles with csc.exe .NET Framework, and runs it — no powershell.exe from kittysploit import class ModulePayload: CLIENTLANGUAGE = "cmd" info = "name": "Windows CMD Reverse TCP csc on-box", "description": "Pure cmd.exe one-liner: writes a ti...

SMB OS Discovery

Discovers OS / LAN Manager / domain hints from SMB negotiate and anonymous session setup NSE smb-os-discovery. !/usr/bin/env python3 -- coding: utf-8 -- """SMB OS / domain discovery NSE smb-os-discovery.""" from kittysploit import from lib.protocols.smb.smbscannerclient import Smbscannerclient...

Slack Socket Mode / Web API Polling Agent

Writes a Python implant that polls a Slack channel for commands and posts results. Controller: listeners/messaging/slacksocketmode. Requires a Slack bot token on the implant — install as backdoor, not exploit payload. from kittysploit import class ModuleBackdoor: """Slack Web API polling implant ...