IEC 104 interrogation

Connects to an IEC 60870-5-104 server TCP/2404, performs STARTDT, and sends a general interrogation command read-only activation. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient impo...

ICS engagement report

Builds a consolidated OT/ICS engagement report from passive JSON, workspace services, and optional active findings. Exports JSON and HTML. !/usr/bin/env python3 -- coding: utf-8 -- import json import os from kittysploit import from lib.protocols.ics.report import buildengagementreport, savereport...

API BOLA / IDOR Probe

Tests API object endpoints with alternate IDs to detect unauthorized cross-object access OWASP API1:2023 BOLA. !/usr/bin/env python3 -- coding: utf-8 -- """Probe API endpoints for Broken Object Level Authorization BOLA/IDOR.""" from future import annotations import json from typing import Dict,...

SSTI Probe

Detects Server-Side Template Injection via benign math evaluation payloads. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Server-Side Template Injection SSTI on common reflection points.""" from future import annotations import json from typing import Dict, List, Tuple from urllib.parse...

Bitbucket Detection

Detects Bitbucket REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Atlassian Bitbucket Server/Data Center.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanne...

ClickHouse Detection

Detects ClickHouse /ping and HTTP query interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ClickHouse HTTP interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "ClickHouse Detection", "description":...

Active Directory Integrated DNS record manager

Add or remove A records in Active Directory integrated DNS zones via LDAP ldap3 only. Supports Unicode hostname variants abused in CVE-2026-26128 improper authentication in Windows SMB Server. !/usr/bin/env python3 -- coding: utf-8 -- import re import socket import struct from kittysploit import...

PDF Action Callback Generator

Generate PDFs that trigger outbound requests via native PDF actions: /URI, /Launch, /GoToR, /GoToE, /SubmitForm, /ImportData, /Thread, XObject streams, and catalog /Names JavaScript triggers. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

PDF CVE-2017-10951 Foxit getURL Callback

Generate PDF PoC for CVE-2017-10951: Foxit Reader JavaScript this.getURL phone-home on document open. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.javascript import writefoxitgeturljs class ModuleAuxiliary,...

PDF CVE-2022-28244 RichMedia CSP Bypass

Generate PDF PoC for CVE-2022-28244: RichMedia annotation with embedded HTML/JS bypassing Acrobat CSP for outbound callback. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writerichmediacspbypass...

PDF Polyglot Payload Generator

Generate non-standard PDF polyglots for upload-filter bypass testing: EICAR antivirus test string embedded in PDF, and ImageMagick SVG/MSL polyglot for server-side image processing pipelines. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

PDF UNC NTLM Callback Generator

Generate PDFs that reference UNC paths to coerce NTLM authentication from Windows PDF viewers. Covers GoToE, XObject streams, GoToR, Thread, URI actions, and Acrobat JavaScript APIs submitForm, getURL, launchURL, SOAP, openDoc. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import fro...

PDF XXE Payload Generator

Generate PDFs with XML external entity callbacks in XMP metadata, XFA forms, Acrobat JavaScript XMLData.parse, and OOB parameter entities targeting server-side parsers PDFBox, iText, Apache Tika. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

Reverse WHOIS Org Mapper

Find related domains from a registrant organization/email string using passive reverse WHOIS sources. !/usr/bin/env python3 -- coding: utf-8 -- """Reverse WHOIS pivot by organization, email, or registrant string.""" from future import annotations import json from urllib.parse import urlparse from...

Username Search

Check social platforms for likely username existence using the cached WhatsMyName site catalog with trusted-site filtering. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate social-media accounts for a username via the WhatsMyName catalog.""" from future import annotations import json import...

SSRF Cloud Metadata Harvest

Exploit a confirmed SSRF primitive to retrieve cloud provider metadata AWS IMDS, GCP computeMetadata, Azure instance and IAM hints. !/usr/bin/env python3 -- coding: utf-8 -- """ Harvest cloud instance metadata through a confirmed SSRF injection point. Chains from auxiliary/scanner/http/ssrfscanne...

GPO Inheritance Map

Enumerate GPO links on domains and OUs, compute inheritance order, and map which computers are affected by each GPO. !/usr/bin/env python3 -- coding: utf-8 -- """Map Active Directory GPO inheritance and affected computers.""" from future import annotations import json from typing import Dict, Lis...

CDP / LLDP Neighbor Enumerator

Passively capture Cisco CDP and IEEE 802.1AB LLDP frames on a switch access/trunk port to discover native VLAN, voice VLAN, port VLAN, and upstream switch identity. !/usr/bin/env python3 -- coding: utf-8 -- """Passively enumerate CDP and LLDP neighbors to map VLAN and switch context.""" from futu...

Linux Debian Evasion Packaging

Generate an obfuscated .deb package whose postinst decodes and executes an embedded encrypted ELF loader. Extends debpackaging for stealth delivery. !/usr/bin/env python3 -- coding: utf-8 -- """ Obfuscated Debian package with embedded loader. Builds an encrypted ELF shellcode loader, embeds it...

Linux eBPF Evasion Loader

Generate a Linux x64 ELF that installs eBPF map/program hooks to register process and port hide rules, then decrypts and runs embedded shellcode. Root privileges are required on the target host. !/usr/bin/env python3 -- coding: utf-8 -- """ eBPF-assisted Linux evasion loader. Loads a minimal BPF...

Linux proc_mem / vm_writev Evasion

Generate a Linux x64 ELF that injects shellcode via processvmwritev or /proc/pid/mem instead of PTRACEPOKEDATA — fewer ptrace write traces. !/usr/bin/env python3 -- coding: utf-8 -- """ /proc/pid/mem and processvmwritev injection evasion. Spawns a host process, remote-mmaps via ptrace syscall...

WebAuthn Probe

Detect WebAuthn / passkey support and platform authenticator availability from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "WebAuthn Probe", "description": "Detect WebAuthn / passkey support and platform authenticator availability", "author": "KittySploit Team",...

Fortinet FortiSandbox CVE-2026-25089 OS command injection

CVE-2026-25089: unauthenticated OS command injection in the FortiSandbox web UI VNC start handler. Attacker-controlled JSON fields vmname, extra are interpolated into startvnc.sh without sanitisation CWE-78. !/usr/bin/env python3 -- coding: utf-8 -- import json import re from typing import...

Adobe ColdFusion RDS path traversal RCE (CVE-2026-48282)

CVE-2026-48282: Adobe ColdFusion Remote Development Service RDS exposes /CFIDE/main/ide.cfm without authentication on affected builds. Path traversal allows arbitrary file read/write and CFML webshell deployment for remote code execution. Affected: ColdFusion 2025 = Update 9, ColdFusion 2023 =...

WordPress Profile Builder Pro <= 3.14.5 - PHP Object Injection RCE

Unauthenticated PHP object injection in Profile Builder Pro via the wppbrequestuserspins admin-ajax action args parameter. Full RCE requires a POP gadget chain; this module chains The Events Calendar Monolog ProcessHandler Monolog/RCE10 when that plugin is present. !/usr/bin/env python3 -- coding...

ARM LE bind TCP shell (raw)

Thumb ARM 32-bit bind shell: socket, bind, listen, accept, dup2 x3, execve /bin/sh. Null-free port encoding when possible. !/usr/bin/env python3 -- coding: utf-8 -- """ Thumb ARM bind TCP shell raw bytes for embedded Linux targets. Derived from the Xiaomi C400 factory-mode PoC bind shell Botond...

Elasticsearch Indices Search

List Elasticsearch indices and optionally run search queries import json from kittysploit import from lib.protocols.elasticsearch.elasticsearchclient import ElasticsearchClient class ModulePost, ElasticsearchClient: info = "name": "Elasticsearch Indices Search", "description": "List Elasticsearch...

QUIC Download File

Download a remote file from the implant via an active QUIC C2 session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin class ModulePost,...

LD_PRELOAD Persistence

Builds a shared library with a constructor that runs a payload, installs it on disk, and adds its path to /etc/ld.so.preload. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

PHP user.ini Persistence

Deploys a PHP webshell via .user.ini autoprependfile / autoappendfile. Works with PHP-FPM and Apache when userini is enabled. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

Windows UAC Bypass — CMSTPLUA COM

UAC bypass via CMSTPLUA COM object ShellExecute runas — CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows UAC Bypas...

Windows Gather EDR & Defender Audit

Audit Windows Defender status, RunAsPPL, Credential Guard / VBS, AMSI availability, and common EDR process indicators. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name":...

Windows Gather RunAsPPL & LSASS Protection Audit

Audit LSA RunAsPPL, LSASS protection level, Credential Guard / VBS, and recommend an LSASS dump technique comsvcs, external tool, or PS fallback. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost,...

ComfyUI Unauth Verification

Confirms ComfyUI systemstats and objectinfo APIs without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify ComfyUI unauthenticated workflow API access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

AD CS Misconfiguration Scanner

Detects ESC-style AD CS template and enrollment service misconfigurations via LDAP. !/usr/bin/env python3 -- coding: utf-8 -- """Detect vulnerable AD CS certificate templates and enrollment services.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient, LDAP3AVAILABLE from...

MongoDB Unauthenticated Access Detection

Detects exposed MongoDB and whether databases are readable without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MongoDB instances and unauthenticated access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

GPO Local Group Audit

Parse SYSVOL GPO files Groups.xml, GptTmpl.inf and detect trustees added to privileged local groups Administrators, RDP Users, etc.. !/usr/bin/env python3 -- coding: utf-8 -- """Audit privileged local group assignments configured via GPO on SYSVOL.""" from future import annotations import json fr...

GPP Password Hunter

Search SYSVOL Group Policy Preferences XML files for encrypted cpassword credentials via SMB. !/usr/bin/env python3 -- coding: utf-8 -- """Hunt Group Policy Preferences passwords on SMB SYSVOL.""" from future import annotations import json import os import tempfile from typing import Dict, List...

Docker API Exposure Verification

Confirms unauthenticated Docker Engine /version and /containers/json on TCP 2375. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Docker Engine API on TCP 2375.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.docker.detectors...

SNMP Service Detection

Detects SNMP agents responding to the public community sysDescr OID. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SNMP service via public community sysDescr.""" from kittysploit import class ModuleScanner: info = "name": "SNMP Service Detection", "description": "Detects SNMP agents...

Peyara Remote Mouse exposure detection

Detects Peyara Remote Mouse = 1.0.1 exposure by checking TCP 1313, an Engine.IO OPEN frame, and a Socket.IO namespace connect handshake. No keyboard injection is performed. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.websocket.websocketclient import...

ImageMagick PDF/SVG Polyglot Server-Side RCE

Generate an SVG/MSL polyglot that executes a framework payload when processed by vulnerable ImageMagick/GraphicsMagick delegate chains. By default only the file is generated disablePayloadHandler=true; set disablePayloadHandler false to listen immediately after generation. Upload the generated fi...

Adobe Acrobat JavaScript Reverse Shell PDF

Generate a PDF with Acrobat OpenAction JavaScript that launches a framework-generated reverse-shell payload PowerShell by default. By default only the PDF is generated disablePayloadHandler=true; set disablePayloadHandler false to listen immediately after generation. Requires Adobe Acrobat/Reader...

EtherNet/IP List Identity

Sends an EtherNet/IP List Identity request UDP/44818 to discover Rockwell, Siemens, and other CIP devices. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.enipclient import listidentity from...

S7 module enumeration

Enumerates rack/slot modules on a Siemens S7 PLC using SZL 0x0013 reads CPU, IO, CP modules. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

InfluxDB Detection

Detects InfluxDB ping and health endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed InfluxDB HTTP API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "InfluxDB Detection", "description": "Detects...

Jupyter Notebook Detection

Detects Jupyter /api/status and login endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Jupyter Notebook/Lab.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

WebLogic Console Detection

Detects Oracle WebLogic administration console login pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Oracle WebLogic console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "WebLogic Console...

WordPress Profile Builder Pro PHP object injection detection

Detects Profile Builder Pro = 3.14.5 unauthenticated PHP object injection via wppbrequestuserspins admin-ajax args parameter. Optionally sends a safe stdClass probe; HTTP 500 indicates deserialization of attacker input. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Tuple...

PROFINET DCP device IP setup

Reconfigures a PROFINET device's IP address, subnet mask, and gateway via unauthenticated Layer-2 DCP Set requests on an Ethernet interface. !/usr/bin/env python3 -- coding: utf-8 -- """ PROFINET DCP device IP configuration. Uses Layer-2 PROFINET DCP Set requests to reconfigure a target device's ...