Windows VBScript Reverse TCP (csc on-box)

VBScript/cscript delivery vector: writes a tiny C reverse shell, compiles with csc.exe .NET Framework, and runs it — no powershell.exe from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "vbscript" info = "name": "Windows VBScript Reverse TCP csc on-box", "description":...

PowerShell Kitty Agent (typed tasks)

PowerShell HTTP polling agent with typed tasks shell/ls/pwd/whoami/cat/download/upload for listeners/multi/reversehttppolling from kittysploit import import base64 from lib.c2.beaconprofile import BeaconProfile from lib.c2.powershellhttppolling import buildpowershellhttppollingscript class...

Broadcast DHCP Discover

Sends a DHCP DISCOVER and reports offers NSE broadcast-dhcp-discover. Requires scapy and typically elevated privileges. !/usr/bin/env python3 -- coding: utf-8 -- """DHCP broadcast discover NSE broadcast-dhcp-discover.""" from kittysploit import from lib.scanner.broadcast.detectors import...

NetBIOS NBSTAT

Queries NetBIOS node status UDP/137 for registered names and MAC NSE nbstat. !/usr/bin/env python3 -- coding: utf-8 -- """NetBIOS node status NSE nbstat.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.netbios.detectors import probenbsta...

Fake Session Expired

Show a session-expired / re-auth modal to harvest credentials and optional MFA from kittysploit import import json import uuid class ModuleBrowserAuxiliary: info = "name": "Fake Session Expired", "description": "Show a session-expired / re-auth modal to harvest credentials and optional MFA",...

Windows Kerberoast (optional Rubeus)

OPTIONAL fallback: requires Rubeus.exe for live $krb5tgs$ hashes. Prefer native post/ldap/gather/kerberoast. !/usr/bin/env python3 -- coding: utf-8 -- """Kerberoast via Rubeus loadmodule — request TGS and extract hashcat lines.""" from kittysploit import from lib.post.windows.hashloot import...

Tomcat Manager Default Login

Detects Apache Tomcat Manager default credentials via HTTP Basic. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat Manager default login.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient Common Tomcat Manager credential pairs CREDS = "tomcat"...

SNMP Default Community

Probes SNMP v1/v2c agents for common default community strings e.g. public/private via sysDescr. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SNMP agents accepting default community strings.""" from kittysploit import DEFAULTCOMMUNITIES = "public", "private", "community", "snmp", "snmpd",...

Docker Daemon Exposed (HTTP)

Detects an unauthenticated Docker Engine API via /version and /vApiVersion/containers/json. Typical port: 2375. !/usr/bin/env python3 -- coding: utf-8 -- """Docker Daemon exposed over HTTP API.""" import json import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Dahua Smart Park Management Platform - Arbitary File Read Detection

Dahua Smart Park Management Platform is vulnerable to Local File Inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua Smart Park Management Platform is vulnerable to Local File Inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

XVR Login Panel - Detect

XVR login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """XVR login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XVR Login Panel - Detect', 'description': 'XVR login panel was...

WordPress Javo Spot Premium Theme - Unauthenticated Directory Traversal Detection

WordPress Javo Spot Premium Theme wp-config was discovered via local file inclusion. This file is remotely accessible and its content available for reading. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Javo Spot Premium Theme wp-config was discovered via local file inclusion.""" from...

TitanNit Web Control - Exposure Detection

Detects TitanNit Web Control - Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects TitanNit Web Control - Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'TitanNit Web Control - Exposure Detection...

Joomla! Component SVMap 1.1.1 - Local File Inclusion Detection

A directory traversal vulnerability in the SVMap comsvmap component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the SVMap comsvmap...

Joomla! Component JInventory 1.23.02 - Local File Inclusion Detection

A directory traversal vulnerability in jinventory.php in the JInventory comjinventory component 1.23.02 and possibly other versions before 1.26.03, a module for Joomla!, allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python...

Osclass Security Advisory 3.4.1 - Local File Inclusion Detection

A directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter in a render action to oc-admin/index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in OSClass before 3."""...

Khoj - Detect

Khoj was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Khoj was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Khoj - Detect', 'description': 'Khoj was detected.', 'author': 'KittySploit Team',...

Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass Detection

Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code via the sgcgoogleanalytic parameter that runs on all pages served by WordPress. The saveGoogleCode function in smartgooglecode.php does not check if the...

Atarim < 4.2.2 - Sensitive Information Exposure Detection

Vito Peleg Atarim = 4.2 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data remotely, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -...

Apache Hadoop YARN ResourceManager - Remote Code Execution Detection

Apache Hadoop YARN ResourceManager is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Apache...

Zabbix Login Panel - Detect

Zabbix login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zabbix login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zabbix Login Panel - Detect', 'description': 'Zabbix logi...

Z-BlogPHP Panel - Detect

Z-BlogPHP panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Z-BlogPHP panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Z-BlogPHP Panel - Detect', 'description': 'Z-BlogPHP panel was...

Zentao Panel - Detect

Zentao panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zentao panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zentao Panel - Detect', 'description': 'Zentao panel was detected.',...

Diced Zipline - Detect

Zipline panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zipline panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Diced Zipline - Detect', 'description': 'Zipline panel was...

Erlang Port Mapper Daemon Detection

The erlang port mapper daemon is used to coordinate distributed erlang instances. His job is to keep track of which node name listens on which address. Hence, epmd map symbolic node names to machine addresses. !/usr/bin/env python3 -- coding: utf-8 -- """The erlang port mapper daemon is used to...

Mailoney Honeypot - Detect

A Mailoney SMTP honeypot has been identified. The response to the 'HELP' command differs from real installations, signaling a possible deceptive setup. !/usr/bin/env python3 -- coding: utf-8 -- """A Mailoney SMTP honeypot has been identified.""" import socket from kittysploit import from...

Hewlett-Packard FTP Service - Detect

Hewlett-Packard FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Hewlett-Packard FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name':...

TP Print FTP Service - Detect

TP Print FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """TP Print FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'TP Print FTP Service -...

TIBCO BusinessWorks - Detect

TIBCO BusinessWorks was detected - an enterprise integration and application development platform used to connect systems and data across an organization. !/usr/bin/env python3 -- coding: utf-8 -- """TIBCO BusinessWorks was detected - an enterprise integration and application development platform...

Tinyproxy - Detect

Lightweight HTTP/HTTPS proxy daemon for POSIX operating systems !/usr/bin/env python3 -- coding: utf-8 -- """Lightweight HTTP/HTTPS proxy daemon for POSIX operating systems.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Typo3 Directory Listing Detection

Detects directory listing enabled on the TYPO3 temp directory. The typo3temp folder contains cached files, compiled assets, and temporary data that may reveal sensitive information about the application structure and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Detects directory...

vBulletin - Full Path Disclosure Detection

Detects vBulletin - Full Path Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects vBulletin - Full Path Disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'vBulletin - Full Path Disclosure...

vLLM OpenAI-Compatible Server - Detect

Detected vLLM was a high-throughput LLM serving engine that exposed an OpenAI-compatible HTTP API on TCP 8000 with no authentication by default. !/usr/bin/env python3 -- coding: utf-8 -- """Detected vLLM was a high-throughput LLM serving engine that exposed an OpenAI-compatible HTTP API on TCP 80...

vRealize Log Insight - Panel Detect

Detect vRealize Log Insight login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Detect vRealize Log Insight login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'vRealize Log...

Wagtail Login - Detect

The Wagtail panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """The Wagtail panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wagtail Login - Detect', 'description': 'The...

Wazuh Login Panel Detection

Wazuh - The Open Source Security Platform !/usr/bin/env python3 -- coding: utf-8 -- """Wazuh - The Open Source Security Platform.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wazuh Login Panel Detection',...

WeatherLinkIP Configuration Panel - Detect

WeatherLinkIP configuration panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """WeatherLinkIP configuration panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WeatherLinkIP Configuration...

GTranslate < 2.8.11 - Open Redirect Detection

The Translate WordPress with GTranslate WordPress plugin was affected by an Unauthenticated Open Redirect security vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The Translate WordPress with GTranslate WordPress plugin was affected by an Unauthenticated Open Redirect secu.""" import ...

WordPress Securimage-WP 3.2.4 - Cross-Site Scripting Detection

WordPress Securimage-WP 3.2.4 plugin contains a cross-site scripting vulnerability via siwptest.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials an...

ViewPoint System Status Detection

ViewPoint System status page is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """ViewPoint System status page is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ViewPoint System Status Detection',...

VMware vCloud Director Panel - Detect

VMware vCloud Director panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware vCloud Director panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VMware vCloud Director Panel - Detect...

Visual Studio Code MCP Configuration ("mcp.json") Exposure Detection

Detected exposed VS Code MCP Model Context Protocol configuration files mcp.json which may contain sensitive information including API keys, server endpoints, authentication tokens, and tool configurations for AI assistants and language models. !/usr/bin/env python3 -- coding: utf-8 -- """Detecte...

Admin Menu Editor - Full Path Disclosure Detection

Admin Menu Editor WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Admin Menu Editor...

WordPress bbPress Plugin - Full Path Disclosure Detection

WordPress plugin bbPress internal file system path was disclosed through direct access to the plugin's main PHP file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress plugin bbPress internal file system path was disclosed through direct access to the plugin's main PH.""" from kittysploit...

WordPress WP-PageNavi - Full Path Disclosure Detection

WordPress WP-PageNavi plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WP-PageNavi plugin files are publicly accessible without...

WordPress WP Mail SMTP - Full Path Disclosure Detection

WordPress WP Mail SMTP plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WP Mail SMTP plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

Emerson Network Power IntelliSlot Web Card - Exposure Detection

Emerson IntelliSlot Web Card interface panel was discovered. This web interface provides remote monitoring and management capabilities for Emerson Network Power devices. Unauthorized access to this interface could potentially allow attackers to view sensitive information or control critical...

Express Default Page Detection

Detects Express Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Express Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Express Default Page Detection', 'description': 'Detects Expres...

FastMile 5G Gateway Panel - Detect

FastMile 5G Gateway web interface was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """FastMile 5G Gateway web interface was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FastMile 5G Gateway Pan...

FatPipe IPVPN® Panel - Detect

Detects FatPipe IPVPN® Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FatPipe IPVPN® Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FatPipe IPVPN® Panel - Detect', 'description'...