Tomcat Manager Detection

Detects Tomcat /manager/html and host-manager interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Apache Tomcat Manager interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Tomcat Manager...

Mattermost Detection

Detects Mattermost system ping API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Mattermost team collaboration server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

Person to Usernames

Generate likely username candidates from a person's full name, structured name fields, display name, and aliases. !/usr/bin/env python3 -- coding: utf-8 -- """Generate likely usernames from a person's name and aliases.""" from future import annotations import json import os from kittysploit impor...

MinIO Detection

Detects MinIO health and console login endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed MinIO object storage API and console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "MinIO Detection",...

Memcached Detection

Detects Memcached and unauthenticated stats command access. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Memcached and unauthenticated stats access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.memcached.detectors import...

VNC Service Detection

Detects VNC servers via RFB protocol version banner. !/usr/bin/env python3 -- coding: utf-8 -- """Detect VNC/RFB remote desktop services.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.vnc.detectors import probevnc class ModuleScanner,...

Windows Gather UAC & Integrity Audit

Audit UAC policy EnableLUA, ConsentPromptBehaviorAdmin, LocalAccountTokenFilterPolicy, groups, and privileges. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows Gather U...

Ollama Detection

Detects Ollama model API via /api/tags endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Ollama local LLM API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Multi Python HTTP Polling Beacon

HTTP polling implant with beacon profile jitter, kill date, working hours, cover traffic, optional daisy-chain hop, and Ed25519 implant identity from kittysploit import from lib.c2.beaconprofile import BeaconProfile from lib.c2.httppollingagent import buildhttppollingagentscript class...

Modbus TCP identify

Actively probes Modbus TCP port 502 by scanning unit IDs and reading holding registers. Safe read-only reconnaissance for PLC/RTU discovery. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Windows AMSI Bypass

Disable AMSI in the current PowerShell process. Variants: plain amsiInitFailed reflection, obfuscated/Base64 field names, AmsiContext patch, or AmsiScanBuffer memory patch double-add trampoline. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.stagerevasion import...

Joomla SP LMS CVE-2026-48909 (PHP object injection) detection

Detects JoomShaper SP LMS comsplms = 4.1.3 affected by unauthenticated PHP object injection via the lmsOrders cookie CVE-2026-48909. Full RCE requires Joomla 5.2.2 FormattedtextLogger gadget chain. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from...

S7 download block

Downloads an MC7 block OB/FB/FC/DB/SDB from a Siemens PLC via an active S7comm session. Requires python-snap7. !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.ics.icssessionmixin import S7SessionMixin from lib.protocols.ics.s7client import...

Modbus UDP Detection

Detects Modbus UDP responders via read holding registers probe. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Modbus UDP services on port 502.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.modbus.detectors import probemodbusudp...

ENIP tag enumeration

Best-effort EtherNet/IP tag/service hints for Rockwell/Siemens CIP targets !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.enipclient import enumerateeniptags from lib.protocols.ics.icsscannerclient...

PDF CVE-2026-25755 jsPDF Object Injection

Generate PDF PoC for CVE-2026-25755: jsPDF addJS object injection with /AA /O auto-action URI callback. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writejspdfobjectinjection class ModuleAuxiliary...

Apache Solr CVE-2026-44825 detection

Detects Apache Solr instances in the CVE-2026-44825 affected version range 9.4.x through 9.10.x before 9.10.2, and 10.0.0 and reports whether admin endpoints require authentication. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient impo...

Export passive ICS report

Loads a JSON report produced by auxiliary/scanner/ics/passivesniffer and optionally copies it or syncs discovered OT assets to the workspace. !/usr/bin/env python3 -- coding: utf-8 -- import json import os import shutil from kittysploit import from lib.protocols.ics.report import savereport class...

Imunify360 / ModSecurity Bypass Probe

Tests a battery of PHP execution and signature payloads through the current webshell channel to identify WAF/Imunify/ModSecurity blocking and likely bypass angles. !/usr/bin/env python3 -- coding: utf-8 -- """ Probe WAF / Imunify360 / ModSecurity filters through the active PHP session. Runs...

Gitea CVE-2026-20896 - X-WEBAUTH-USER reverse-proxy auth bypass

CVE-2026-20896: default Gitea Docker deployments = 1.26.2 ship with REVERSEPROXYTRUSTEDPROXIES = and accept X-WEBAUTH-USER from any source. An attacker can impersonate any user including admins on the web UI without a password or API token. !/usr/bin/env python3 -- coding: utf-8 -- import random...

Web Surface Harvester

Passive harvest of security.txt, robots.txt, and sitemap.xml — contacts, disallowed paths, and public URL inventory. !/usr/bin/env python3 -- coding: utf-8 -- """Harvest security.txt, robots.txt, and sitemap.xml from a target domain.""" from future import annotations import json import re from...

Auth0 Detection

Detects Auth0 tenants via OIDC metadata and hosted login pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Auth0 identity platform tenants.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse...

PDF CVE-2024-4367 PDF.js FontMatrix RCE PoC

Generate PDF PoC for CVE-2024-4367: arbitrary JavaScript via unsanitized Type1 FontMatrix in PDF.js fetch callback for validation. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writepdfjsfontmatrix...

MLflow Detection

Detects MLflow tracking server UI and REST API. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MLflow tracking server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse, ishtmlresponse class...

VLAN ID Scanner

Hop through 802.1Q VLAN IDs on a Layer-2 access port by sending tagged DHCP and ARP probes, optionally harvesting CDP native VLAN hints first. !/usr/bin/env python3 -- coding: utf-8 -- """Discover active VLAN IDs from an access port using tagged DHCP/ARP probes.""" from future import annotations...

SSL/TLS HSTS and OCSP Audit

Audit HTTP→HTTPS redirects, HSTS policy quality, and OCSP stapling on the live TLS service. !/usr/bin/env python3 -- coding: utf-8 -- """Audit HSTS policy and OCSP stapling for an HTTPS service.""" from future import annotations import json import re from kittysploit import from...

SAMR user enumeration

Enumerate SAM accounts through MS-SAMR / NetUserEnum on port 445 without LDAP or Impacket. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate domain/local SAM accounts via native SAMR/NetAPI port 445, no LDAP bind. """ from kittysploit import from lib.protocols.samr import SamEnumerationErro...

DNP3 master probe

Active DNP3 master-style probe against an outstation on TCP/20000 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import probednp3master from lib.protocols.ics.icsscannerclient import...

Import BloodHound Graph

Merge BloodHound nodes/edges JSON into the agent attack graph for lightweight path planning without Neo4j. !/usr/bin/env python3 -- coding: utf-8 -- """ Import BloodHound JSON export into the agent attack graph. Set exportpath to nodes.json, edges.json, or a directory containing both. The merged...

Early Bird APC Evasion

Generate a Windows x64 EXE that performs Early Bird injection: CREATESUSPENDED, WriteProcessMemory, QueueUserAPC on the main thread, ResumeThread. !/usr/bin/env python3 -- coding: utf-8 -- """ Early Bird APC injection evasion loader. Creates a suspended process, writes shellcode remotely, queues ...

TIA Portal project leak

Probes web-exposed Siemens TIA Portal project archives .ap17/.ap18/.zap that may disclose PLC/HMI source projects. !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.ics.siemensdefaults import...

Palo Alto GlobalProtect CVE-2026-0257 detection

Fingerprints Palo Alto GlobalProtect and flags PAN-OS versions affected by CVE-2026-0257 authentication override cookie forgery. Actual exploitability also requires authentication override cookies to be enabled and certificate reuse with the HTTPS service. !/usr/bin/env python3 -- coding: utf-8 -...

Systemd Unit Persistence

Creates and enables a systemd service unit that executes a payload on boot and restarts on failure. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost, LinuxPersistenceMixin: info...

BACnet Who-Is discovery

Sends BACnet/IP Who-Is requests UDP/47808 and collects I-Am responses for BMS / building controller discovery. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import whois from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

GCP Cloud Run Detection

Detects Cloud Run hostnames and Google Frontend trace headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Google Cloud Run services.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

S7 PLC password bruteforce

Attempts common Siemens S7 session passwords against protected PLCs. Use only on authorized lab systems — rate-limited by default. !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Linux userfaultfd Evasion Loader

Generate a Linux x64 ELF that uses userfaultfd to lazily resolve encrypted shellcode pages at access time, evading simple memory scans. !/usr/bin/env python3 -- coding: utf-8 -- """ userfaultfd delayed-reveal shellcode loader Linux x64. Maps shellcode with userfaultfd, drops pages from memory, th...

QNX qconn remote command execution

Exploits unauthenticated access to the QNX Neutrino qconn service to execute arbitrary commands as root via the launcher interface TCP/8000. !/usr/bin/env python3 -- coding: utf-8 -- """ QNX qconn remote command execution. Abuses the qconn service on QNX Neutrino default TCP/8000 to spawn a root...

Linux Container Escape Check

Assess Docker socket, capabilities, cgroups, mount namespaces, and privileged container indicators from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Container...

Purple Team Detection Export

Generate Sigma/EDR detection packs for post-exploitation modules Windows & Linux using the post telemetry registry. !/usr/bin/env python3 -- coding: utf-8 -- """Generate detection packs for post-ex modules purple team.""" from kittysploit import import os from core.detection import...

Cockpit Detection

Detects Cockpit Project web console on /cockpit or port 9090. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cockpit Linux server management UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse clas...

Neo4j Browser Detection

Detects Neo4j HTTP status/version endpoints and browser UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Neo4j Browser and HTTP management API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse...

Grafana Unauthenticated API Verification

Confirms anonymous Grafana datasources/org/search API access. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated Grafana API access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse...

MySQL login bruteforce

Attempts common and wordlist-based MySQL/MariaDB credentials. Use only on authorized targets — rate-limited by default. !/usr/bin/env python3 -- coding: utf-8 -- """ MySQL login bruteforce — tests username/password combinations against a MySQL/MariaDB server. """ from future import annotations...

RabbitMQ Management Detection

Detects RabbitMQ management UI and overview API. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed RabbitMQ management plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "RabbitMQ Management Detection",...

Direct Windows Syscall Evasion

Generate a Windows x64 EXE that evades userland hooks by calling direct syscalls NtAllocateVirtualMemory, NtWriteVirtualMemory, etc.. Shellcode is encrypted ChaCha20 or RC4 and base64-encoded. Prefer HTTPS/RC4 payloads and high SLEEP values for better evasion. !/usr/bin/env python3 -- coding: utf...

mongo-express Detection

Detects mongo-express web UI and public config endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect mongo-express MongoDB admin UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

PHP mail() / sendmail RCE Chain

Checks mail availability and sendmailpath, then attempts sendmail argument injection -X to write a PHP file into a writable directory. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.php.helpers import PhpPostHelper class ModulePost, PhpPostHelper: info = "name":...

Windows UAC Bypass — SilentCleanup (windir)

Hijack %windir% for Disk Cleanup SilentCleanup scheduled task schtasks /Run — no admin required to set user env. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name":...

Command Shell, Reverse QUIC (via Python)

Connect back over QUIC/TLS 1.3 ALPN kitty-quic and expose a command channel with upload, download, and shellcode support. Requires aioquic on the target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.quic.constants import DEFAULTQUICALPN from...