Windows Gather UAC & Integrity Audit

Audit UAC policy EnableLUA, ConsentPromptBehaviorAdmin, LocalAccountTokenFilterPolicy, groups, and privileges. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows Gather U...

Windows Clear Event Logs

Clear Security, System, Application and PowerShell operational logs via wevtutil. Generates high-visibility events 1102/104. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin:...

Windows External Tool Runner

Upload a local binary or script to the target, execute it with operator-supplied arguments, and optionally download a remote output file. !/usr/bin/env python3 -- coding: utf-8 -- """ Upload a local operator tool to the target, execute it, and optionally pull an output artifact back through the...

Cassandra Native Protocol Detection

Detects Cassandra via CQL native protocol OPTIONS/SUPPORTED handshake. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cassandra CQL native protocol on TCP 9042.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.cassandra.detectors...

Kubelet Read-Only API Verification

Confirms anonymous /pods access on kubelet read-only port 10255. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated kubelet read-only API on port 10255.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

ActiveMQ Jolokia Verification

Confirms unauthenticated Jolokia list/read on ActiveMQ web console. !/usr/bin/env python3 -- coding: utf-8 -- """Verify ActiveMQ Jolokia read access without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation...

AD CS Web Enrollment Detection

Detects Microsoft AD CS /certsrv and /CertEnroll HTTP enrollment surfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Detect AD CS web enrollment endpoints HTTP.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Fortinet FortiSandbox CVE-2026-25089 detection

Fingerprints FortiSandbox and flags versions affected by CVE-2026-25089 unauthenticated OS command injection in the VNC start handler: 5.0.0–5.0.5, 4.4.0–4.4.8, and all 4.2.x. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from...

MLflow Unauth Verification

Confirms MLflow experiments search API without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated MLflow experiment listing.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Ollama API Exposure Verification

Confirms Ollama /api/tags and /api/version respond without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify exposed Ollama API with model enumeration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

MQTT TLS Broker Detection

Detects MQTTS brokers and anonymous subscribe access on TCP 8883. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MQTT brokers over TLS on port 8883.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.mqtt.detectors import...

MongoDB Unauthenticated Access Detection

Detects exposed MongoDB and whether databases are readable without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MongoDB instances and unauthenticated access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

GPO Privilege Rights Audit

Parse SYSVOL GptTmpl.inf User Rights Assignment and detect trustees with dangerous privileges SeDebug, SeImpersonate, SeBackup, etc.. !/usr/bin/env python3 -- coding: utf-8 -- """Audit dangerous User Rights Assignment configured via GPO on SYSVOL.""" from future import annotations import json fro...

Docker API Exposure Verification

Confirms unauthenticated Docker Engine /version and /containers/json on TCP 2375. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Docker Engine API on TCP 2375.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.docker.detectors...

CoAP Service Detection

Detects CoAP endpoints responding to a .well-known/core GET request. !/usr/bin/env python3 -- coding: utf-8 -- """Detect CoAP services via UDP well-known/core probe.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.coap.detectors import...

WordPress Atarim Plugin < 4.2.2 - Sensitive Information Exposure

CVE-2025-60188: Atarim WordPress plugin versions below 4.2.2 expose a site ID via an unauthenticated REST endpoint. That value is used as an HMAC key to forge signed admin-ajax requests and dump site configuration, license keys, and user PII. import hashlib import hmac import json import re from...

Active Directory Integrated DNS record manager

Add or remove A records in Active Directory integrated DNS zones via LDAP ldap3 only. Supports Unicode hostname variants abused in CVE-2026-26128 improper authentication in Windows SMB Server. !/usr/bin/env python3 -- coding: utf-8 -- import re import socket import struct from kittysploit import...

VLAN DTP Trunk Negotiation

Attempt to convert an access port into an 802.1Q trunk by sending Cisco DTP negotiation frames desirable/on/auto, then verify tagged VLAN reachability. !/usr/bin/env python3 -- coding: utf-8 -- """Negotiate an 802.1Q trunk via Cisco DTP from an access port.""" from future import annotations impor...

S7 CPU STOP

Sends a STOP command to a Siemens S7 PLC CPU. This halts the running process and is extremely disruptive — lab use only with explicit authorization. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Dark Web Mention Hunter

Search authorized breach/darkweb intelligence providers IntelX API for mentions of a domain, email, or keyword. Does not perform direct Tor scraping. from kittysploit import import json import re import time from urllib.parse import urlparse from core.osint.providers import intelxapikey from...

Passive DNS Aggregator

Aggregate subdomains from certificate transparency and built-in permutations, with optional A-record resolution. !/usr/bin/env python3 -- coding: utf-8 -- """Aggregate passive subdomain sources CT + permutations with optional DNS resolution.""" from future import annotations import json from...

Web Surface Harvester

Passive harvest of security.txt, robots.txt, and sitemap.xml — contacts, disallowed paths, and public URL inventory. !/usr/bin/env python3 -- coding: utf-8 -- """Harvest security.txt, robots.txt, and sitemap.xml from a target domain.""" from future import annotations import json import re from...

SSL/TLS Configuration Audit

Audit a live TLS service: negotiated protocol and cipher, certificate chain metadata SAN, expiry, issuer, hostname coverage, weak/legacy TLS signals, and optional trust-store validation. !/usr/bin/env python3 -- coding: utf-8 -- """Live SSL/TLS configuration audit for TCP services.""" from future...

SSL/TLS Cipher Suite Enumeration

Enumerate cipher suites accepted by a TLS endpoint and flag weak or deprecated protocol versions. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate accepted TLS cipher suites on a live service.""" from future import annotations import json import re from kittysploit import from...

Linux Debian Evasion Packaging

Generate an obfuscated .deb package whose postinst decodes and executes an embedded encrypted ELF loader. Extends debpackaging for stealth delivery. !/usr/bin/env python3 -- coding: utf-8 -- """ Obfuscated Debian package with embedded loader. Builds an encrypted ELF shellcode loader, embeds it...

Encrypted Shellcode Dropper Evasion

Generate a Windows x64 EXE that decrypts embedded shellcode in memory and executes it via VirtualAlloc/VirtualProtect/CreateThread. Uses ChaCha20 or RC4 encryption with optional pre-execution sleep. !/usr/bin/env python3 -- coding: utf-8 -- """ Encrypted shellcode dropper Win32 API. Minimal Windo...

Process Herpaderping Evasion

Generate a Windows x64 EXE that maps shellcode via a file section, overwrites the on-disk file with decoy content Herpaderping, and executes from the stale mapped view. !/usr/bin/env python3 -- coding: utf-8 -- """ Process Herpaderping-style evasion loader. Writes shellcode to a temp file, create...

Module Stomping Evasion

Generate a Windows x64 EXE that loads a benign DLL default: version.dll, stomps its .text section with decrypted shellcode, and executes in-place. !/usr/bin/env python3 -- coding: utf-8 -- """ Module stomping evasion loader. Loads a legitimate DLL locally, overwrites its .text section with...

Xiaomi Smart Camera C400 factory-mode miIO UDP RCE

Unauthenticated root code execution on a factory-state Xiaomi C400 smart camera over miIO UDP/54321. Connect to the camera AP default 192.168.14.1, then run this module with an ARM bind shell payload default TCP/5555 on the device. !/usr/bin/env python3 -- coding: utf-8 -- from future import...

Reverse QUIC C2 Listener

Reverse QUIC/TLS 1.3 listener for KittySploit implants ALPN kitty-quic. Supports shell commands, file upload/download, and shellcode execution. !/usr/bin/env python3 -- coding: utf-8 -- """Reverse QUIC C2 listener for compatible implants ALPN kitty-quic.""" from kittysploit import import asyncio...

ARM LE bind TCP shell (raw)

Thumb ARM 32-bit bind shell: socket, bind, listen, accept, dup2 x3, execve /bin/sh. Null-free port encoding when possible. !/usr/bin/env python3 -- coding: utf-8 -- """ Thumb ARM bind TCP shell raw bytes for embedded Linux targets. Derived from the Xiaomi C400 factory-mode PoC bind shell Botond...

LDAP Delegation Audit

Audit unconstrained, constrained, and resource-based constrained delegation from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient from lib.protocols.ldap.adhelpers import UACTRUSTEDFORDELEGATION, UACTRUSTEDTOAUTHFORDELEGATION, class ModulePost, LdapPostClient: info ...

QUIC Download File

Download a remote file from the implant via an active QUIC C2 session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin class ModulePost,...

Linux Gather VLAN Profiles

Collect VLAN subinterfaces, trunk/bridge settings, and network manager profiles from a compromised Linux host to map virtual LAN segmentation and pivot opportunities. !/usr/bin/env python3 -- coding: utf-8 -- """Gather VLAN, trunk, and bridge configuration from a Linux shell session.""" from futu...

LD_PRELOAD Persistence

Builds a shared library with a constructor that runs a payload, installs it on disk, and adds its path to /etc/ld.so.preload. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

Systemd Unit Persistence

Creates and enables a systemd service unit that executes a payload on boot and restarts on failure. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost, LinuxPersistenceMixin: info...

WordPress Theme/Plugin Dropper

Installs PHP persistence in a WordPress site via must-use plugin, custom plugin, or theme functions.php append. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

Windows UAC Bypass — Eventvwr

HKCU mscfile shell open command hijack + eventvwr.exe. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import REGMSCFILE, UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows UAC Bypass — Eventvwr", "description": "HK...

Windows LSASS Dump (comsvcs)

Dump LSASS using comsvcs.dll MiniDump via rundll32, then download the minidump through the session. !/usr/bin/env python3 -- coding: utf-8 -- """ Dump LSASS via comsvcs.dll MiniDump rundll32 — stealthier than direct MiniDumpWriteDump from PowerShell on many Defender configs. """ from kittysploit...

MSSQL Info - Detection

Detects MSSQL via TDS prelogin and reports version and encryption hints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft SQL Server via TDS prelogin.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.mssql.detectors import...

GPP Password Hunter

Search SYSVOL Group Policy Preferences XML files for encrypted cpassword credentials via SMB. !/usr/bin/env python3 -- coding: utf-8 -- """Hunt Group Policy Preferences passwords on SMB SYSVOL.""" from future import annotations import json import os import tempfile from typing import Dict, List...

Zookeeper Unauthenticated Enumeration

Collects Zookeeper srvr/stat/conf output via unauthenticated four-letter commands. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Zookeeper four-letter-word admin commands without authentication.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient fr...

Neo4j Browser Detection

Detects Neo4j HTTP status/version endpoints and browser UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Neo4j Browser and HTTP management API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse...

MinIO Public Bucket Listing Verification

Confirms anonymous ListBuckets or open bucket listing on MinIO/S3 API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify MinIO/S3 anonymous bucket listing.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlrespon...

ComfyUI Unauth Verification

Confirms ComfyUI systemstats and objectinfo APIs without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify ComfyUI unauthenticated workflow API access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

QUIC Execute Shellcode

Send hex-encoded shellcode to the implant for in-process execution !/usr/bin/env python3 -- coding: utf-8 -- import os import re from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin HEXRE =...

PHP user.ini Persistence

Deploys a PHP webshell via .user.ini autoprependfile / autoappendfile. Works with PHP-FPM and Apache when userini is enabled. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

Cisco CUCM CVE-2026-20230 detection

Detects Cisco Unified Communications Manager instances exposing the webdialer WSDL endpoint used in CVE-2026-20230 SSRF to arbitrary file write and JSP command execution. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclie...

ImageMagick PDF/SVG Polyglot Server-Side RCE

Generate an SVG/MSL polyglot that executes a framework payload when processed by vulnerable ImageMagick/GraphicsMagick delegate chains. By default only the file is generated disablePayloadHandler=true; set disablePayloadHandler false to listen immediately after generation. Upload the generated fi...

Kubernetes Dashboard Unauth Verification

Confirms Kubernetes Dashboard settings allowing skip-login or open proxy API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify Kubernetes Dashboard skip-login and API proxy exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...