Sangfor EDR - Authentication Bypass Detection

Sangfor EDR contains an authentication bypass vulnerability. An attacker can access the system with admin privileges by accessing the login page directly using a provided username rather than going through the login screen without providing a username. This makes it possible to obtain sensitive...

Jinhe OA C6 download.jsp - Arbitary File Read Detection

There is an arbitrary file read vulnerability in Jinhe OA C6 download.jsp file, through which an attacker can obtain sensitive information in the server !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary file read vulnerability in Jinhe OA C6 download.""" from kittysploit import...

Jolokia Logback JNDI - Remote Code Execution Detection

Jolokia Logback is vulnerable to RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Jolokia Logback is vulnerable to RCE.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jolokia Logback JNDI - Remote Code Execution...

Well-Known OAuth Authorization Server Metadata Detection

Detects OAuth 2.0 Authorization Server metadata RFC 8414. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OAuth 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Well-Known OAuth Authorization Server Metadata...

Sonarr Dashboard - Unauthenticated Detection

Exposure of Sonarr dashboard which can lead to sensitive information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Exposure of Sonarr dashboard which can lead to sensitive information disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ChurchCRM - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability was discovered in ChurchCRM via the 'username' parameter in /session/begin. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting XSS vulnerability was discovered in ChurchCRM via the 'username' parameter .""" from...

Google Cloud Run Default Page Detection

Detects Google Cloud Run Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Google Cloud Run Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Google Cloud Run Default Page Detection',...

AmpGuard Wifi Setup Detection

AmpGuard wifi setup panel detected. !/usr/bin/env python3 -- coding: utf-8 -- """AmpGuard wifi setup panel detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AmpGuard Wifi Setup Detection', 'description':...

Wuzhicms Detected

Wuzhicms was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Wuzhicms was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wuzhicms Detected', 'description': 'Wuzhicms was detected.', 'author':...

D-Link DCS - Unauth Credential Disclosure Detection (CVE-2020-25078)

Detects CVE-2020-25078 by requesting /config/getuser?index=0 and looking for name=/pass= credential lines without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DCS IP camera credential disclosure via /config/getuser CVE-2020-25078.""" import re from kittysploit import from...

DedeCMS 5.7 - Cross-Site Scripting Detection

DeDeCMS 5.7 contains a cross-site scripting vulnerability in the '/include/dialog/config.php' file. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """DeDeCMS 5.""" from kittysploit impo...

WordPress Eatery 2.2 - Open Redirect Detection

WordPress Eatery theme 2.2 contains an open redirect vulnerability. The theme accepts a user-controlled input that specifies a link to an external site. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized...

Zyxel Firewall Panel - Detect

Zyxel Firewall panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel Firewall panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zyxel Firewall Panel - Detect', 'description': 'Zyxel...

HashiCorp Consul Web UI Login Panel - Detect

HashiCorp Consul Web UI login panel was detected, !/usr/bin/env python3 -- coding: utf-8 -- """HashiCorp Consul Web UI login panel was detected,.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HashiCorp Consul Web U...

ScoreMe Theme - Cross-Site Scripting Detection

WordPress ScoreMe theme through 2016-04-01 contains a reflected cross-site scripting vulnerability via the s parameter which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...

D-Link - Local File Inclusion Detection

D-Link is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link is vulnerable to local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'D-Link - Local File...

Dnsmasq Config - File Disclosure Detection

Dnsmasq Config file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Dnsmasq Config file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dnsmasq Config - File Disclosure Detection', 'description':...

Wooyun - Local File Inclusion Detection

Wooyun is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Wooyun is vulnerable to local file inclusion.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wooyun - Local File Inclusion...

OA E-Weaver SptmForPortalThumbnail - Arbitrary File Read Detection

The controllable preview parameters of SptmForPortalThumbnail.jsp are not filtered and are directly spliced to the web root directory for file downloading. !/usr/bin/env python3 -- coding: utf-8 -- """The controllable preview parameters of SptmForPortalThumbnail.""" from kittysploit import from...

Qualitor <= v8.24 - Server-Side Request Forgery Detection

Qualitor v8.24 was discovered to contain a Server-Side Request Forgery SSRF via the component /request/viewValidacao.php. !/usr/bin/env python3 -- coding: utf-8 -- """Qualitor v8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

ThinkPHP Errors - Sensitive Information Exposure Detection

ThinkPHP error is leaking sensitive info. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP error is leaking sensitive info.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ThinkPHP Errors - Sensitive Information...

Sophos Web Appliance Detection

Detects Sophos Web Appliance. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Sophos Web Appliance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Sophos Web Appliance Detection', 'description': 'Detects Sophos...

WildFly Welcome Page - Tech Detect

WildFly welcome page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """WildFly welcome page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WildFly Welcome Page - Tech Detect', 'description':...

Qlik Sense Enterprise - Path Traversal Detection

A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous...

React / Vite Client Env Bundle Exposure Detection

Scans HTML and JS bundles for embedded REACTAPP / VITE / NEXTPUBLIC values API keys, Supabase, Firebase, etc.. !/usr/bin/env python3 -- coding: utf-8 -- """Detect REACTAPP / VITE client env secrets leaked in SPA bundles or runtime JS.""" from kittysploit import from lib.protocols.http.httpclient...

ForgeRock OpenAM <7.0 - Remote Code Execution Detection

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization Detection

Open Access Management OpenAM is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution RCE via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream...

Dropbear sshd Detection

Dropbear is a software package written by Matt Johnston that provides a Secure Shell-compatible server and client. It is designed as a replacement for standard OpenSSH for environments with low memory and processor resources, such as embedded systems !/usr/bin/env python3 -- coding: utf-8 --...

VMware Workspace ONE Access - Server-Side Template Injection Detection

VMware Workspace ONE Access is susceptible to a remote code execution vulnerability due to a server-side template injection flaw. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identit...

Exposed Prisma Database Schema - Exposure Detection

Prisma is a modern ORM extremely popular in the Node.js and TypeScript Next.js/Express ecosystems. Developers often accidentally expose the prisma/ folder in web directories during deployments or Docker builds. This template checks for the exposure of the schema.prisma file, which typically...

Avatier Password Management Panel Detection

An Avatier password management panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Avatier password management panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Avatier Password...

Credentials File Disclosure Detection

Internal secret file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Internal secret file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Credentials File Disclosure Detection', 'description':...

Spring Boot Health Actuator Panel - Detect

Spring Boot Health Actuator panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Health Actuator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import validatespringjsonprobe from...

OA E-Weaver SignatureDownLoad - Arbitrary File Read Detection

There is an arbitrary file reading vulnerability in the E-Weaver SignatureDownLoad interface of Panwei OA. An attacker can read any file on the server through the vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary file reading vulnerability in the E-Weaver...

WordPress Payeezy Pay <=2.97 - Local File Inclusion Detection

WordPress Plugin WP Payeezy Pay is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin WP Payeezy Pay version 2.97...

NCBI ToolBox - Directory Traversal Detection

NCBI ToolBox 2.0.7 through 2.2.26 legacy versions contain a path traversal vulnerability via viewcgi.cgi which may result in reading of arbitrary files i.e., significant information disclosure or file deletion via the nph-viewgif.cgi query string. !/usr/bin/env python3 -- coding: utf-8 -- """NCBI...

WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion Detection

WordPress Duplicator 1.3.24 & 1.3.26 are vulnerable to local file inclusion vulnerabilities that could allow attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two versions v1.3.24 and v1.3.26, the vulnerability wasn't...

VMWare Workspace ONE UEM - Server-Side Request Forgery Detection

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...

IND780 - Local File Inclusion Detection

IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 SS Label 'IND7808.0.07', Version 7.2.10 June 18, 2012 SS Label 'IND7807.2.10' is vulnerable to unauthenticated local file inclusion. It is possible to traverse the folders of the affected host by providing a relative path to the...

vBulletin - Open Redirect Detection

vBulletin 3.x.x and 4.2.x through 4.2.5 contains an open redirect vulnerability via the redirector.php URL parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding...

Prime Mover < 1.9.3 - Sensitive Data Exposure Detection

Prime Mover plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.2 via directory listing in the 'prime-mover-export-files/1/' folder. This makes it possible for unauthenticated attackers to extract sensitive data including site and...

Spring Boot LoggerConfig Actuator Panel - Detect

Spring Boot LoggerConfig Actuator panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot LoggerConfig Actuator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Spring Boot...

shadoweb wdja v1.5.1 - Cross-Site Scripting Detection

shadoweb wdja v1.5.1 is susceptible to cross-site scripting because it allows attackers to execute arbitrary code and gain escalated privileges via the backurl parameter to /php/passport/index.php. !/usr/bin/env python3 -- coding: utf-8 -- """shadoweb wdja v1.""" from kittysploit import from...

WordPress Guppy <=1.1 - Information Disclosure Detection

WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another. !/usr/bin/env python3 -- coding:...

MooSocial 3.1.8 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scriptin...

Wing FTP 6.4.4 - Cross-Site Scripting Detection

Wing FTP 6.4.4 is vulnerable to cross-site scripting via its web interface because an arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of sandboxed arbitrary HTML and JavaScript in the user's browser. !/usr/bin/env python3 -- coding: utf-8 --...

Joomla! Harmis Messenger 1.2.2 - Local File Inclusion Detection

Joomla! Harmis Messenger 1.2.2 is vulnerable to local file inclusion which could give an attacker read access to arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla! Harmis Messenger 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Couchbase Server - Broken Access Control Detection

Couchbase Server versions 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0-4.6.5, 5.0.0, 5.1.1, 5.5.0, and 5.5.1 contain insecure permissions for the projector and indexer REST endpoints caused by unauthenticated access, letting attackers access administrative APIs without authentication, exploit require...

WordPress GraceMedia Media Player 1.0 - Local File Inclusion Detection

WordPress GraceMedia Media Player plugin 1.0 is susceptible to local file inclusion via the cfg parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress GraceMedia Media Player plugin 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Caucho Resin >=4.0.52 <=4.0.56 - Directory traversal Detection

There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request. !/usr/bin/env python3 -- coding: utf-8 -- """There is a Directory traversal...