Spring Cloud Azure B2C Cross-Issuer Auth Bypass (CVE-2026-50338)

Mint an Entra clientcredentials token and call a B2C-protected API CVE-2026-50338 !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import json from typing import Any, Optional from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Spring Cloud Azure B2C CVE-2026-50338 Detection

Detect B2C JWT-protected APIs; verify CVE-2026-50338 when Entra creds are set !/usr/bin/env python3 -- coding: utf-8 -- """Detect CVE-2026-50338 Spring Cloud Azure B2C cross-issuer auth bypass.""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import...

Windows http.sys TLS buffer-ref overflow DoS (CVE-2026-47291)

Streams HTTP/1.1 header lines one per TLS record over HTTPS to grow http.sys UlpReferenceBuffers until the 16-bit capacity wraps 65536 references. Vulnerable pre-patch hosts bugcheck; patched hosts drop the connection cleanly. Requires MaxRequestBytes = 262144 on target. !/usr/bin/env python3 --...

Windows Winlogon registry symlink deletion (CVE-2026-42989)

Plants a volatile registry symlink under the interactive session SAT key. On logout and reboot, Winlogon SYSTEM deletes the SAT subtree and follows the link into an arbitrary HKLM target path. Requires an interactive logon session. !/usr/bin/env python3 -- coding: utf-8 -- from future import...

Cisco IOS XE CVE-2023-20198 WSMA privilege escalation

CVE-2023-20198: unauthenticated access to the Cisco IOS XE Web UI WSMA endpoint allows arbitrary CLI execution and creation of a privilege-15 local account. Retrieves a session token from the logout confirmation page, then submits SOAP execCLI or configApply requests to add an administrative user...

Cisco IOS CMP CVE-2017-3881 credless privilege-15 telnet

CVE-2017-3881: sends malformed Cluster Management Protocol CMP telnet options CISCOKITS to patch in-memory authentication hooks and grant unauthenticated privilege-15 CLI on the next telnet session. ROP gadgets are firmware-specific; wrong image may crash the device. !/usr/bin/env python3 --...

Cisco IOS XE CVE-2023-20198 detection

Detects Cisco IOS XE Web UI and flags CVE-2023-20198 by comparing the advertised IOS XE version against Cisco fixed releases. Falls back to a WSMA show version probe only when the version cannot be read from the Web UI page. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import...

Cisco IOS CMP CVE-2017-3881 telnet exposure

Passive check for CVE-2017-3881 exposure: telnet reachable on a Cisco IOS or IOS XE device. CMP malformed-option handling is tied to telnet session negotiation; confirm patch level separately before exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cisco IOS telnet exposure for...

Ninja Forms File Uploads CVE-2026-0740 detection

Detects Ninja Forms File Uploads = 3.3.26 with unauthenticated arbitrary file upload via nffuupload admin-ajax action CVE-2026-0740. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Tuple from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Balbooa Forms CVE-2026-56291 detection

Detects Joomla sites running Balbooa Forms combaforms 2.4.1 vulnerable to CVE-2026-56291 — unauthenticated arbitrary file upload via form.uploadAttachmentFile without CSRF or permission checks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient...

Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload RCE

CVE-2026-56291 — Balbooa Forms combaforms 2.4.1 exposes form.uploadAttachmentFile without CSRF or permission checks. Uploads the configured framework PHP payload e.g. reversetcp with attacker-controlled extension to images/baforms/uploads/. !/usr/bin/env python3 -- coding: utf-8 --...

Ninja Forms File Uploads <= 3.3.26 - Unauthenticated Arbitrary File Upload

CVE-2026-0740 — Unauthenticated arbitrary file upload in the Ninja Forms File Uploads WordPress extension via nffugetnewnonce / nffuupload admin-ajax actions. Destination filename is attacker-controlled, enabling path traversal and PHP webshell placement. !/usr/bin/env python3 -- coding: utf-8 --...

UART Proxy

Bidirectional UART MITM between two serial devices. Captures hex traffic, applies in-flight byte-pattern replacements with optional checksum recalculation, and replays Akheron-style capture files. Useful for embedded firmware, IoT, and OT hardware reverse engineering. !/usr/bin/env python3 --...

Joomla Helix3 CVE-2026-49049 (unauthenticated file write) detection

Detects JoomShaper Helix3 = 3.1.1 affected by CVE-2026-49049: unauthenticated arbitrary file write/delete and template parameter overwrite via the comajax helix3 plugin handler. !/usr/bin/env python3 -- coding: utf-8 -- import json import random import string from kittysploit import from...

Joomla Helix3 <= 3.1.1 - Unauthenticated Arbitrary File Write (CVE-2026-49049)

CVE-2026-49049 in JoomShaper Helix3 = 3.1.1: unauthenticated file write via comajax helix3 save path traversal in layoutName, arbitrary file delete via remove, and template parameter overwrite via import Helix3 v3.x. The save action always appends .json — no reliable shell; use for authorized fil...

Windows Defender Evasive JS.Net and HTA

Generate an HTA that writes and compiles a JScript.NET file containing shellcode on the target machine. The compiled EXE executes the payload via dynamic P/Invoke VirtualAlloc/CreateThread. RC4 or HTTPS payloads are recommended for best results against Defender. !/usr/bin/env python3 -- coding:...

Windows Gather EDR & Defender Audit

Audit Windows Defender status, RunAsPPL, Credential Guard / VBS, AMSI availability, and common EDR process indicators. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name":...

API BOLA / IDOR Probe

Tests API object endpoints with alternate IDs to detect unauthorized cross-object access OWASP API1:2023 BOLA. !/usr/bin/env python3 -- coding: utf-8 -- """Probe API endpoints for Broken Object Level Authorization BOLA/IDOR.""" from future import annotations import json from typing import Dict,...

PDF UNC NTLM Callback Generator

Generate PDFs that reference UNC paths to coerce NTLM authentication from Windows PDF viewers. Covers GoToE, XObject streams, GoToR, Thread, URI actions, and Acrobat JavaScript APIs submitForm, getURL, launchURL, SOAP, openDoc. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import fro...

PDF Polyglot Payload Generator

Generate non-standard PDF polyglots for upload-filter bypass testing: EICAR antivirus test string embedded in PDF, and ImageMagick SVG/MSL polyglot for server-side image processing pipelines. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

PDF CVE-2017-10951 Foxit getURL Callback

Generate PDF PoC for CVE-2017-10951: Foxit Reader JavaScript this.getURL phone-home on document open. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.javascript import writefoxitgeturljs class ModuleAuxiliary,...

Rancher Detection

Detects Rancher management server API and dashboard. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Rancher Kubernetes management UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

Palo Alto GlobalProtect CVE-2026-0257 auth override bypass

CVE-2026-0257: when GlobalProtect authentication override cookies are enabled and the encryption certificate is exposed via the HTTPS service, an attacker can retrieve the public key from the TLS chain and forge portal-userauthcookie values to bypass authentication on the portal or gateway...

PDF CVE-2025-66516 Tika XFA OOB XXE

Generate PDF PoC for CVE-2025-66516: blind OOB XXE via parameter entity in XFA targeting Apache Tika Confluence, Jira, etc.. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import writetikaxfaxxeoob class...

SSTI Probe

Detects Server-Side Template Injection via benign math evaluation payloads. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Server-Side Template Injection SSTI on common reflection points.""" from future import annotations import json from typing import Dict, List, Tuple from urllib.parse...

SMB Relay Surface Audit

Aggregate SMB signing posture, null session acceptance, and SMBv1 availability into a relay-risk report. !/usr/bin/env python3 -- coding: utf-8 -- """Aggregate SMB signing, null session, and SMBv1 signals for NTLM relay surface.""" from future import annotations import json from kittysploit impor...

WinRM Authentication Enumeration

Probe WinRM /wsman and enumerate advertised authentication methods. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate WinRM authentication methods on ports 5985/5986.""" from future import annotations import json from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

Argo CD Detection

Detects Argo CD version API and login UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Argo CD GitOps UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Argo CD Detection", "description":...

Citrix Gateway Detection

Detects Citrix ADC/Gateway VPN and logon pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Citrix ADC / Gateway login surfaces.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

ComfyUI Detection

Detects ComfyUI system stats API and web UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ComfyUI generative AI workflow interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse,...

Graylog Detection

Detects Graylog system and cluster API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Graylog log management API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Open WebUI Detection

Detects Open WebUI config API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Open WebUI LLM chat interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse, ishtmlresponse class...

TeamCity Detection

Detects TeamCity REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect JetBrains TeamCity CI server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

ICS engagement report

Builds a consolidated OT/ICS engagement report from passive JSON, workspace services, and optional active findings. Exports JSON and HTML. !/usr/bin/env python3 -- coding: utf-8 -- import json import os from kittysploit import from lib.protocols.ics.report import buildengagementreport, savereport...

Siemens S7-1200 PLC control

Sends raw S7comm-plus style commands to start, stop, reset, or factory-reset an unprotected Siemens S7-1200 PLC CPU. !/usr/bin/env python3 -- coding: utf-8 -- """ Siemens S7-1200 PLC control. Uses raw S7comm-plus style packets to start, stop, or reset unprotected S7-1200 CPUs. """ from future...

PDF Action Callback Generator

Generate PDFs that trigger outbound requests via native PDF actions: /URI, /Launch, /GoToR, /GoToE, /SubmitForm, /ImportData, /Thread, XObject streams, and catalog /Names JavaScript triggers. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

PDF CVE-2018-4993 GoToE NTLM Callback

Generate PDF PoCs for CVE-2018-4993: /GoToE action with UNC path NTLM and HTTPS URL variant. Phone-home validation for Adobe Reader. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.actions import writegotoeunc,...

PDF CVE-2019-7089 XFA XSLT Callback

Generate PDF PoC for CVE-2019-7089: external XSLT stylesheet reference in XFA stream triggering UNC/HTTP callback on open. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xfa import writexfaxsltcallback class...

PDF CVE-2025-70401 Apryse Annotation XSS

Generate PDF PoC for CVE-2025-70401: stored DOM XSS via Text annotation /T field in Apryse WebViewer img callback. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writeannotauthorxss class...

Cross Transform Correlator

Ingest JSON outputs from multiple OSINT transforms, correlate shared entities domains, IPs, emails, endpoints, score confidence, and suggest next pivots. !/usr/bin/env python3 -- coding: utf-8 -- """Correlate entities across multiple OSINT transform JSON outputs.""" from future import annotations...

Tenable Nessus <= 10.12.0 malicious .nessus SQLi (CVE-2026-57588)

Generate a weaponized Nessus scan result .nessus XML that triggers SQL injection when imported by a privileged Nessus administrator on versions prior to 10.12.1. Payloads target PostgreSQL Nessus default backend: UNION metadata exfiltration, time-based blind pgsleep, boolean, file read, and...

Favicon HTTP Fingerprint

Collect favicon hashes Shodan-compatible MurmurHash3 and HTTP fingerprints Server, powered-by, title for host correlation and shadow-asset discovery. !/usr/bin/env python3 -- coding: utf-8 -- """Favicon and HTTP fingerprint pivoting for host correlation.""" from future import annotations import...

Telegram Channel Profiler

Passive Telegram surface profiling via public t.me previews and optional Bot API getChat for authorized investigations. No account login required. from kittysploit import import json import re from urllib.parse import quote from core.osint.providers import telegrambottoken from...

Generic Upload Webshell Probe

Probe generic file upload surfaces multipart POST for unrestricted extension handling and verify a harmless PHP/ASP execution marker. !/usr/bin/env python3 -- coding: utf-8 -- """ Generic multipart upload → webshell probe non-WordPress. Tests common upload endpoints and parameter names with a...

Linux userfaultfd Evasion Loader

Generate a Linux x64 ELF that uses userfaultfd to lazily resolve encrypted shellcode pages at access time, evading simple memory scans. !/usr/bin/env python3 -- coding: utf-8 -- """ userfaultfd delayed-reveal shellcode loader Linux x64. Maps shellcode with userfaultfd, drops pages from memory, th...

ETW/AMSI Patch Evasion

Generate a Windows x64 EXE that patches AMSI AmsiScanBuffer and/or ETW EtwEventWrite in-process before decrypting and running shellcode. !/usr/bin/env python3 -- coding: utf-8 -- """ In-process ETW/AMSI patch evasion loader. Patches AmsiScanBuffer and/or EtwEventWrite in-process, decrypts embedde...

Service Worker Register

Register a persistent service worker that re-injects the KittySploit hook on HTML navigations from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Service Worker Register", "description": "Register a persistent service worker that re-injects the KittySploit hook on HT...

Fortinet FortiSandbox CVE-2026-25089 OS command injection

CVE-2026-25089: unauthenticated OS command injection in the FortiSandbox web UI VNC start handler. Attacker-controlled JSON fields vmname, extra are interpolated into startvnc.sh without sanitisation CWE-78. !/usr/bin/env python3 -- coding: utf-8 -- import json import re from typing import...

WordPress Profile Builder Pro <= 3.14.5 - PHP Object Injection RCE

Unauthenticated PHP object injection in Profile Builder Pro via the wppbrequestuserspins admin-ajax action args parameter. Full RCE requires a POP gadget chain; this module chains The Events Calendar Monolog ProcessHandler Monolog/RCE10 when that plugin is present. !/usr/bin/env python3 -- coding...

CVE-2026-26128 Windows SMB improper authentication privesc

CVE-2026-26128: improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. This module chains ADIDNS Unicode hostname registration, Kerberos coercion, and SMB Kerberos relay to AD CS or MSSQL to obtain machine/user certificates or SQL access as the...