Yarn Lock File Disclosure Detection

The yarn.lock file stores the versions of each Yarn dependency installed. It's a lock file for package.json. !/usr/bin/env python3 -- coding: utf-8 -- """The yarn.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Yarn...

SolarView Compact <= 6.00 - Local File Inclusion Detection

There is an arbitrary read file vulnerability in SolarView Compact 6.00 and below, attackers can bypass authentication to read files through texteditor.php !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary read file vulnerability in SolarView Compact 6.""" from kittysploit import...

Label Studio < 1.18.0 - Reflected XSS Detection

Label Studio 1.18.0 contains a stored XSS caused by improper sanitization in POST /projects/upload-example/ endpoint, letting attackers inject malicious scripts to hijack sessions and perform unauthorized actions, exploit requires sending crafted requests. !/usr/bin/env python3 -- coding: utf-8 -...

Splash - Detect

Splash rendering service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Splash rendering service was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Splash - Detect', 'description': 'Splash...

Avatier Password Management Panel Detection

An Avatier password management panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Avatier password management panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Avatier Password...

Pandora FMS Mobile Console Login Panel - Detect

Pandora FMS Mobile Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Pandora FMS Mobile Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pandora FMS Mobil...

SonicWall SRA 4600 VPN - SQL Injection Detection

The SonicWall SRA 4600 VPN appliance is susceptible to a pre-authentication SQL injection vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The SonicWall SRA 4600 VPN appliance is susceptible to a pre-authentication SQL injection vulnerability.""" from kittysploit import from...

Grafana Unauthenticated Access Detection

Detects Grafana instances configured with anonymous access enabled, allowing unauthenticated users to access dashboards, data sources, organization info, and potentially sensitive monitoring data without any credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Grafana instances...

YesWiki Panel - Detect

YesWiki panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """YesWiki panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'YesWiki Panel - Detect', 'description': 'YesWiki panel was...

VMware vCloud Director Panel - Detect

VMware vCloud Director panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware vCloud Director panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VMware vCloud Director Panel - Detect...

WordPress user registration enabled Detection

Detects WordPress user registration enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detects WordPress user registration enabled.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress user registration enabl...

WordPress Plugin Site Kit by Google - Full Path Disclosure Detection

WordPress plugin Site Kit by Google internal file system path is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress plugin Site Kit by Google internal file system path is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Joomla! Component Canteen 1.0 - Local File Inclusion Detection

A SQL injection vulnerability in menu.php in the Canteen comcanteen component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the mealid parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A SQL injection vulnerability in menu.""" import re from...

News Script Pro 2.4 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

Apache ShardingSphere ElasticJob-UI privilege escalation Detection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere ElasticJob-UI 3.x version 3.0.0 and pri...

SOAP-based ASP.NET web services ASMX - Detect

SOAP-based ASP.NET web services collection was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SOAP-based ASP.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SOAP-based ASP.NET web services ASMX - Detect',...

Apache Hertzbeat - Detect

Detects a Apache Hertzbeat web application is in use, that is a real-time monitoring system with agentless, performance cluster, prometheus-compatible, custom monitoring and status page building capabilities. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Apache Hertzbeat web application ...

Jamf Pro Login Panel - Detect

Jamf Pro login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Jamf Pro login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jamf Pro Login Panel - Detect',...

Yarn Integrity File Disclosure Detection

Detected the .yarn-integrity file generated by the Yarn package manager and stored in nodemodules/.yarn-integrity.Exposure of this file could have revealed sensitive dependency information and aided attackers in identifying vulnerable packages for supply chain attacks. !/usr/bin/env python3 --...

Apache Ozone - Exposure Detection

Detects if path /conf of Apache Ozone web application is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Detects if path /conf of Apache Ozone web application is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

vBulletin `Search.php` - SQL Injection Detection

vBulletin 4 is vulnerable to an SQL injection vulnerability, which may allow an attacker can execute malicious SQL statements that control a web application's database server. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin 4 is vulnerable to an SQL injection vulnerability, which may allow...

Telerik Report Server Login Panel - Detect

Telerik Report Server login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Telerik Report Server login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Telerik Report Server Login...

ElasticSearch v1.1.1/1.2 RCE Detection

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...

cgit Web Interface - Detection

Detects cgit web interface for Git repositories. cgit is a hyperfast web frontend for Git repositories written in C. It provides a web-based interface to browse Git repositories, view commits, diffs, and files. cgit is designed to be publicly accessible for open source projects. However, detectin...

Adobe AEM Disk Usage Information Disclosure Detection

Adobe AEM Disk Usage Information is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM Disk Usage Information is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM Disk Usage Information...

PrestaShop MyPrestaModules - PhpInfo Disclosure Detection

PrestaShop modules by MyPrestaModules expose PHPInfo !/usr/bin/env python3 -- coding: utf-8 -- """PrestaShop modules by MyPrestaModules expose PHPInfo.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PrestaShop...

Apiman Login Panel Detection

An Apiman instance was detected via the login redirection. !/usr/bin/env python3 -- coding: utf-8 -- """An Apiman instance was detected via the login redirection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apima...

XNAT Login Panel - Detect

XNAT login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """XNAT login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XNAT Login Panel - Detect', 'description': 'XNAT login panel...

Apache Storm Unauth Detection

Apache Storm instance is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Storm instance is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import lookslikeapachestormsummary, validatejsonprobe class...

Weglot API Key - Exposed Detection

Detected Weglot API key was found exposed in a publicly accessible JavaScript file. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Weglot API key was found exposed in a publicly accessible JavaScript file.""" import re from kittysploit import from lib.protocols.http.httpclient import...

kkFileView 4.1.0 - Cross-Site Scripting Detection

kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the errorMsg parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...

Apache SkyWalking - Dashboard Detection

Apache SkyWalking server, an APM, Application Performance Monitoring System, exposed the backend monitoring dashboard. An attacker can execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """Apache SkyWalking server, an APM, Application Performance Monitoring System, exposed...

Emby Login Panel - Detect

Emby login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Emby login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Emby Login Panel - Detect', 'description': 'Emby login panel...

Odoo <= 8.0-20160726 & 9.0 - Open Redirect Detection

An Open Redirect vulnerability in Odoo versions = 8.0-20160726 and 9.0. This issue allows an attacker to redirect users to untrusted sites via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """An Open Redirect vulnerability in Odoo versions = 8.""" import re from kittysploit import from...

EasyCoder FTP Service - Detect

EasyCoder FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """EasyCoder FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'EasyCoder FTP Servic...

ACTi Video Monitoring Panel - Detection

Detects ACTi Video Monitoring Panel - Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ACTi Video Monitoring Panel - Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ACTi Video Monitoring Pan...

Businesso Installer Exposure Detection

Businesso is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Businesso is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

TeslaMate - Unauthenticated Access Detection

A misconfig in Teslamate allows unauthorized access to /settings endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """A misconfig in Teslamate allows unauthorized access to /settings endpoint.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Headlamp Kubernetes UI Panel - Detect

Detected Headlamp Kubernetes Web UI panel exposed, which could lead to unauthorized access to Kubernetes cluster management if not properly secured. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Headlamp Kubernetes Web UI panel exposed, which could lead to unauthorized access to Kubernete...

Helicone Panel - Detect

Helicone, an open-source LLM observability platform that provides logging, monitoring, and analytics for LLM applications and is commonly self-hosted via Docker, was detected. An exposed, unauthenticated Helicone web dashboard instance was identified. !/usr/bin/env python3 -- coding: utf-8 --...

H2O Dashboard - Exposure Detection

H2o dashboard by default has no authentication and can lead to RCE on the host. !/usr/bin/env python3 -- coding: utf-8 -- """H2o dashboard by default has no authentication and can lead to RCE on the host.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

LabVIEW/NI Service Locator Detection

National Instruments LabVIEW Service Locator detected and enumerated. This services leaks a list of all services provided by the device, hardware capabilities and possibly versions. These hardware devices should not be exposed to the internet. !/usr/bin/env python3 -- coding: utf-8 -- """National...

BRAVIA Signage - Exposure Detection

Bravia Signage is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Bravia Signage is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'BRAVIA Signage - Exposure Detection', 'description': 'Bravia Signage ...

WordPress Data Source for Contact Form 7 - Full Path Disclosure Detection

WordPress Plugin CData Source for Contact Form 7 files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin CData Source for Contact Form 7...

ESPEasy Installation Exposure Detection

ESPEasy is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """ESPEasy is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

AutomationDirect Panel - Detect

AutomationDirect panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AutomationDirect panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AutomationDirect Panel - Detect', 'description':...

ForgeRock IG Login/Welcome Page - Detect

Detects ForgeRock Identity Gateway login or welcome page and extracts version number !/usr/bin/env python3 -- coding: utf-8 -- """Detects ForgeRock Identity Gateway login or welcome page and extracts version number.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Ruby on Rails storage.yml File Disclosure Detection

Ruby on Rails storage.yml file is disclosed. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails storage.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ruby on Rails storage.yml File Disclosure Detection',...

Epson Device Unauthorized Access Detect

A publicly available Epson device panel printer, scanner, etc. was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A publicly available Epson device panel printer, scanner, etc.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

WordPress WPS Hide Login - Error Log Disclosure Detection

Detected whether the WPS Hide Login plugin’s /classes/ directory was exposed with directory listing enabled due to server misconfiguration, potentially disclosing PHP error logs or source code. !/usr/bin/env python3 -- coding: utf-8 -- """Detected whether the WPS Hide Login plugin’s /classes/...