WordPress WPZOOM Portfolio <= 1.4.21 - Reflected XSS (browser_server)

Unauthenticated reflected XSS via wpzoomloadmoreitems. Injects browserserver hook xss.js through postsdata.class attribute breakout. Default trigger uses tabindex+autofocus+onfocus no hover; mouseover fallback available. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Peyara Remote Mouse 1.0.1 unauthenticated keyboard RCE

Peyara Remote Mouse 1.0.1 exposes an unauthenticated Socket.IO WebSocket service on TCP 1313 that accepts remote keyboard events. This module opens cmd.exe on the target and types a command payload one keystroke at a time. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import gzip import...

Enumerate MSSQL Databases

Enumerate databases, schemas/tables, and columns on Microsoft SQL Server from kittysploit import from lib.protocols.mssql.mssqlclient import MSSQLClient class ModulePost, MSSQLClient: info = "name": "Enumerate MSSQL Databases", "description": "Enumerate databases, schemas/tables, and columns on...

PHP Auto-Prepend Combo (.htaccess + .user.ini)

Detects Apache/modphp vs PHP-FPM/Nginx stack from a PHP session and deploys persistence via .htaccess, .user.ini, or both best-effort auto selection. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.php.helpers import PhpPostHelper class ModulePost, PhpPostHelper:...

Pivot Autoroute

Discover reachable internal subnets from the active session and add framework pivot routes from kittysploit import import ipaddress import re class ModulePost: info = "name": "Pivot Autoroute", "description": "Discover reachable internal subnets from the active session and add framework pivot...

Windows LSASS Dump Chain

Run RunAsPPL audit, optional AMSI bypass, then attempt LSASS dump via comsvcs, external operator tool, and PowerShell MiniDump fallback. !/usr/bin/env python3 -- coding: utf-8 -- """ Orchestrate LSASS credential extraction: protection audit, optional AMSI bypass, comsvcs dump, optional external...

FTP Banner Detection

Detects FTP services and fingerprints common server products. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FTP service via welcome banner.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.ftp.detectors import probeftpbanner class...

Netlify Detection

Detects Netlify CDN/deploy platform response headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Netlify-hosted sites via platform headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Netlify Detection",...

DNP3 unsolicited enabled

Checks whether a DNP3 outstation accepts unsolicited response configuration !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import probednp3unsolicited from...

Elasticsearch Indices Verification

Confirms anonymous access to Elasticsearch cat/indices or cluster health. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated Elasticsearch index enumeration.""" import json from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclien...

Zig Shell Evasion

Generate a Windows x64 reverse shell compiled from pure Zig no shellcode. Supports GUI subsystem, startup sleep delay, and XOR-encoded LHOST string. !/usr/bin/env python3 -- coding: utf-8 -- """ Pure Zig Windows reverse shell with evasion options. Compiles a GUI-subsystem reverse shell no embedde...

ICS Passive Sniffer

Passively discover OT/ICS assets by sniffing traffic with Scapy on a SPAN/TAP interface or by replaying a PCAP. Parses Modbus TCP, S7comm, DNP3, BACnet/IP, and IEC 104; flags write paths and Purdue violations; exports JSON and syncs the workspace. No packets are sent to the network. !/usr/bin/env...

QUIC Execute Shellcode

Send hex-encoded shellcode to the implant for in-process execution !/usr/bin/env python3 -- coding: utf-8 -- import os import re from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin HEXRE =...

Zabbix Detection

Detects Zabbix frontend and apiinfo.version JSON-RPC endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zabbix monitoring UI and JSON-RPC API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse,...

Authenticated HTTP Surface Mapper

Maps post-authentication attack surface from a landing page using session cookies — admin paths, uploads, APIs, and privileged forms. !/usr/bin/env python3 -- coding: utf-8 -- """ Authenticated HTTP surface mapper. After login, crawls the landing page and shallow linked paths to discover admin...

Citrix Gateway Detection

Detects Citrix ADC/Gateway VPN and logon pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Citrix ADC / Gateway login surfaces.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

Gitea Detection

Detects Gitea version API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Gitea git forge.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner, Httpclient: info =...

HTTP SQLi Shell

Read-only SQL extraction via confirmed HTTP SQLi: union-based scalar or boolean-blind oracle. Starts Sqli pseudo-shell or runs singlesql. !/usr/bin/env python3 -- coding: utf-8 -- """ Generic HTTP SQL injection post-exploitation authorized testing only. After confirming SQLi scanner / manual,...

Telnet Service Detection

Detects Telnet services via initial banner. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Telnet service via banner.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.telnet.detectors import probetelnetbanner class ModuleScanner,...

PDF CVE-2018-5158 PDF.js PostScript Staged Delivery

Generate CVE-2018-5158 PDF with PostScript calculator JavaScript injection and staged payloads callback, fetch+eval, WebSocket. Uses CALLBACKURL. For authorized testing against legacy Firefox PDF.js 60. !/usr/bin/env python3 -- coding: utf-8 -- from pathlib import Path from typing import List fro...

PDF CVE-2025-66516 Tika XFA OOB XXE

Generate PDF PoC for CVE-2025-66516: blind OOB XXE via parameter entity in XFA targeting Apache Tika Confluence, Jira, etc.. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import writetikaxfaxxeoob class...

Cisco CUCM CVE-2026-20230 SSRF to arbitrary file write RCE

CVE-2026-20230 chains SSRF via /cmplatform/installClusterStatusExecute, Axis LogHandler arbitrary file write, and JSP webshell deployment to obtain remote command execution on Cisco Unified Communications Manager 15.0.1.13901-2. Opens an interactive HTTP command shell and optionally dispatches th...

OPC UA node browser

Browses top-level OPC UA nodes via an OPC UA session or direct target !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.protocols.ics.opcuaclient impor...

LDAP Add Service Principal Name

Add or remove an SPN on a target account to enable Kerberoast or RBCD prep chains from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient class ModulePost, LdapPostClient: info = "name": "LDAP Add Service Principal Name", "description": "Add or remove an SPN on a targ...

Enumerate MongoDB Collections

Enumerate MongoDB databases, collections, and optional document samples from kittysploit import from lib.protocols.mongodb.mongodbclient import MongoDBClient class ModulePost, MongoDBClient: info = "name": "Enumerate MongoDB Collections", "description": "Enumerate MongoDB databases, collections,...

PHP Session Hijack / Fixation Audit

Audits PHP session configuration, session.savepath permissions, active session files, and fixation-related ini settings from a PHP webshell session. !/usr/bin/env python3 -- coding: utf-8 -- import os import time from kittysploit import from lib.post.php.helpers import PhpPostHelper class...

SMB Upload File

Uploads a local file to a remote SMB share via an active SMB session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import ProcedureError, FailureType from lib.protocols.smb.smbsessionmixin import SMBSessionMixin class ModulePost,...

InfluxDB Unauthenticated Read Verification

Confirms anonymous InfluxDB HTTP queries via SHOW DATABASES. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated InfluxDB database listing.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.influxdb.detectors import...

Neo4j Unauthenticated Query Verification

Confirms anonymous Neo4j HTTP transaction commits with RETURN 1. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated Neo4j Cypher queries.""" import json from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Modbus write enabled

Checks whether Modbus TCP writes FC6 are accepted without authentication by writing a test value and verifying the register change. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient...

PostgreSQL Info Detection

Detects PostgreSQL via startup handshake and authentication challenge. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PostgreSQL service via startup handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.postgresql.detectors...

PowerShell Stager Evasion

Writes a PowerShell backdoor with optional AMSI bypass and ETW patch. Supports reverse-shell mode or shellcode stager mode VirtualAlloc + CreateThread. !/usr/bin/env python3 -- coding: utf-8 -- """ PowerShell stager with AMSI/ETW evasion prelude. Generates a .ps1 script with optional in-process...

WinRM Authentication Enumeration

Probe WinRM /wsman and enumerate advertised authentication methods. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate WinRM authentication methods on ports 5985/5986.""" from future import annotations import json from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

Graylog Detection

Detects Graylog system and cluster API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Graylog log management API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Open WebUI Detection

Detects Open WebUI config API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Open WebUI LLM chat interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse, ishtmlresponse class...

SharePoint Detection

Detects SharePoint REST API, layouts, and Microsoft 365 markers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft SharePoint and SharePoint Online.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Linux memfd_exec Evasion

Generate a Linux x64 ELF that decrypts a staged loader into memfdcreate and executes it with fexecve — fileless delivery effective against basic EDR. !/usr/bin/env python3 -- coding: utf-8 -- """ memfdcreate + fexecve fileless Linux loader. Builds an encrypted inner ELF loader, wraps it in an out...

Linux Ptrace Inject Evasion

Generate a Linux x64 ELF that performs classic ptrace injection: PTRACEATTACH, remote mmap via syscall gadget, PTRACEPOKEDATA, RIP hijack. !/usr/bin/env python3 -- coding: utf-8 -- """ Classic ptrace shellcode injection Linux x64. Spawns a sacrificial process, attaches with ptrace, remote-mmaps v...

Siemens S7-1200 PLC control

Sends raw S7comm-plus style commands to start, stop, reset, or factory-reset an unprotected Siemens S7-1200 PLC CPU. !/usr/bin/env python3 -- coding: utf-8 -- """ Siemens S7-1200 PLC control. Uses raw S7comm-plus style packets to start, stop, or reset unprotected S7-1200 CPUs. """ from future...

Siemens S7-300/400 PLC control

Sends raw S7comm CPU start/stop commands to Siemens S7-300 and S7-400 PLCs via the PIP PROGRAM interface. !/usr/bin/env python3 -- coding: utf-8 -- """ Siemens S7-300/400 PLC control. Uses classic S7comm PIP PROGRAM requests to start or stop S7-300 and S7-400 CPUs. """ from future import...

PDF CVE-2019-7089 XFA XSLT Callback

Generate PDF PoC for CVE-2019-7089: external XSLT stylesheet reference in XFA stream triggering UNC/HTTP callback on open. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xfa import writexfaxsltcallback class...

PDF CVE-2020-29075 Silent DNS Callback

Generate PDF PoC for CVE-2020-29075: silent DNS/HTTP via catalog /AA /WC, /WS, /DS without user prompt in Acrobat Reader. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.silent import writesilentdnscatalogaa class...

Cross Transform Correlator

Ingest JSON outputs from multiple OSINT transforms, correlate shared entities domains, IPs, emails, endpoints, score confidence, and suggest next pivots. !/usr/bin/env python3 -- coding: utf-8 -- """Correlate entities across multiple OSINT transform JSON outputs.""" from future import annotations...

OpenAPI Swagger Finder

Probe common OpenAPI/Swagger paths and validate exposed API specifications for version, title, and sensitive endpoint inventory. !/usr/bin/env python3 -- coding: utf-8 -- """Discover exposed OpenAPI and Swagger documentation endpoints.""" from future import annotations import json import re from...

Search Engine Footprint

Run passive search-engine dorks site:, filetype:, inurl: and collect indexed URLs, titles, and sensitive path hints. !/usr/bin/env python3 -- coding: utf-8 -- """Passive search-engine footprinting via HTML search results.""" from future import annotations import json import re from typing import...

MQTT Broker Identify

Detect MQTT brokers and test anonymous subscribe access on TCP 1883. !/usr/bin/env python3 -- coding: utf-8 -- """Identify exposed MQTT brokers and anonymous access.""" from future import annotations import json from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclie...

SSL/TLS Cipher Suite Enumeration

Enumerate cipher suites accepted by a TLS endpoint and flag weak or deprecated protocol versions. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate accepted TLS cipher suites on a live service.""" from future import annotations import json import re from kittysploit import from...

SNMP Community Probe

Tests common SNMP v1/v2c communities and collects basic system information. !/usr/bin/env python3 -- coding: utf-8 -- """Probe SNMP communities and enumerate basic system information.""" from future import annotations import json from kittysploit import from lib.protocols.snmp.snmpclient import...

Zig Linux Reverse Evasion

Generate a Linux x64 reverse shell compiled from pure Zig no shellcode. Supports startup sleep delay and XOR-encoded LHOST string. !/usr/bin/env python3 -- coding: utf-8 -- """ Pure Zig Linux reverse shell with evasion options. Compiles a static reverse shell no embedded shellcode with optional...

sRDI Reflective DLL Evasion

Generate a Windows x64 EXE that embeds sRDI-converted shellcode. Raw payload is wrapped in a minimal DLL, converted to reflective loader shellcode, encrypted ChaCha20/RC4, and executed in-process. !/usr/bin/env python3 -- coding: utf-8 -- """ Self-reflective DLL injection sRDI evasion loader. Wra...