CoAP Service Detection

Detects CoAP endpoints responding to a .well-known/core GET request. !/usr/bin/env python3 -- coding: utf-8 -- """Detect CoAP services via UDP well-known/core probe.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.coap.detectors import...

Modbus UDP Detection

Detects Modbus UDP responders via read holding registers probe. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Modbus UDP services on port 502.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.modbus.detectors import probemodbusudp...

Multi Python HTTP Polling Beacon

HTTP polling implant with beacon profile jitter, kill date, working hours, cover traffic, optional daisy-chain hop, and Ed25519 implant identity from kittysploit import from lib.c2.beaconprofile import BeaconProfile from lib.c2.httppollingagent import buildhttppollingagentscript class...

Siemens HMI default credentials

Tests common default credentials against Siemens WinCC / Comfort Panel / SIMATIC HMI web interfaces over HTTPS. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.ics.siemensdefaults import HMIDEFAULTCREDENTIAL...

PROFINET DCP Identify

Layer-2 PROFINET DCP Identify broadcast on an Ethernet interface to discover Siemens and other Profinet devices device name, IP, vendor. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.profinetdcp import dcpidentify class ModuleAuxiliary: info = "name":...

SAMR group membership

List local/domain alias membership through MS-SAMR on port 445 without LDAP or Impacket. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate local/domain alias membership via SAMR port 445, no LDAP / Impacket. """ from kittysploit import from lib.protocols.samr.samrclient import SamrClient fr...

CouchDB Detection

Detects CouchDB REST API and Fauxton UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed CouchDB/Fauxton endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "CouchDB Detection",...

Exchange OWA Detection

Detects Outlook Web App and Exchange Control Panel endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft Exchange OWA/ECP exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Exchange OWA...

Kubernetes Dashboard Detection

Detects Kubernetes Dashboard login UI and proxy API paths. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Kubernetes Dashboard UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Kubernetes Dashboard...

phpMyAdmin Setup Detection

Detects publicly accessible phpMyAdmin setup/index.php configuration wizard. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed phpMyAdmin setup wizard.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

Apache Solr Detection

Detects Solr admin and system info endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Apache Solr admin interfaces.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Apache Solr Detection",...

WAF/CDN Fingerprint

Identify WAF or CDN products from response headers and blocking behavior. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprint WAF/CDN products using benign malicious probes.""" from future import annotations import json from kittysploit import from lib.protocols.http.httpclient import...

S7 protection level check

Detects Siemens S7 PLCs with weak or missing access protection protection level 1 / no password. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

Memcached Detection

Detects Memcached and unauthenticated stats command access. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Memcached and unauthenticated stats access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.memcached.detectors import...

RabbitMQ AMQP Detection

Detects RabbitMQ AMQP 0-9-1 protocol on port 5672. !/usr/bin/env python3 -- coding: utf-8 -- """Detect RabbitMQ AMQP service on TCP 5672.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.rabbitmq.detectors import proberabbitmqamqp class...

IEC 61850 MMS Identify

Probe TCP/102 for IEC 61850 MMS COTP + initiate and distinguish from Siemens S7comm on the same port. !/usr/bin/env python3 -- coding: utf-8 -- """Detect IEC 61850 MMS servers on ISO-on-TCP port 102.""" from future import annotations import json from kittysploit import from...

BACnet object inventory

Discovers BACnet devices and requests object inventory via ReadProperty session or direct !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import objectinventory, whois from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

ENIP tag enumeration

Best-effort EtherNet/IP tag/service hints for Rockwell/Siemens CIP targets !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.enipclient import enumerateeniptags from lib.protocols.ics.icsscannerclient...

Modbus write register

Writes a single holding register over Modbus TCP via an active Modbus session. Supports dry-run mode to validate connectivity without changing the PLC. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.icssessionmixin import ModbusSessionMixin class...

S7 download block

Downloads an MC7 block OB/FB/FC/DB/SDB from a Siemens PLC via an active S7comm session. Requires python-snap7. !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.ics.icssessionmixin import S7SessionMixin from lib.protocols.ics.s7client import...

Joomla SP LMS CVE-2026-48909 (PHP object injection) detection

Detects JoomShaper SP LMS comsplms = 4.1.3 affected by unauthenticated PHP object injection via the lmsOrders cookie CVE-2026-48909. Full RCE requires Joomla 5.2.2 FormattedtextLogger gadget chain. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from...

S7comm identify

Connects to Siemens S7 PLCs over ISO-on-TCP port 102 and reads CPU / module identification plus protection level via SZL. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import...

Telegram Channel Profiler

Passive Telegram surface profiling via public t.me previews and optional Bot API getChat for authorized investigations. No account login required. from kittysploit import import json import re from urllib.parse import quote from core.osint.providers import telegrambottoken from...

GPO Registry Audit

Parse SYSVOL GPO registry settings Registry.xml, registry.pol and detect relay-friendly SMB/NTLM policies, autologon passwords, and stored credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Audit insecure registry settings configured via GPO on SYSVOL.""" from future import annotations...

ComfyUI Detection

Detects ComfyUI system stats API and web UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ComfyUI generative AI workflow interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse,...

Azure Storage Service Probe

Probe Azure Queue, Table, and File endpoints for anonymous listing or readable responses complements blob-focused modules. !/usr/bin/env python3 -- coding: utf-8 -- """Probe Azure Queue, Table, and File storage services for anonymous exposure.""" from future import annotations import json from...

SonarQube Detection

Detects SonarQube system status API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed SonarQube instances.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "SonarQube Detection", "description":...

etcd Detection

Detects unauthenticated etcd v2/v3 health and version endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed etcd key-value API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "etcd Detection",...

PDF Silent DNS Callback Generator

Generate PDFs with silent DNS/HTTP callbacks via Acrobat catalog additional actions /AA /WC, /WS, /DS that fire on document close or save without user interaction CVE-2020-29075. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfPhonehomeMixin,...

OPC UA anonymous access

Checks whether an OPC UA server allows anonymous browsing on port 4840 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.protocols.ics.opcuaclient impo...

Windows LoadModule / Run Assembly

Load a local or catalog .NET assembly or a remote path into memory via Assembly.Load and invoke Main. Small assemblies embed in one PowerShell call; larger ones stage briefly to %TEMP% then delete. !/usr/bin/env python3 -- coding: utf-8 -- """Run a .NET assembly in-memory on a Windows session...

Spring Boot Actuator Detection

Detects exposed Spring Boot Actuator health, env, and heapdump endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Spring Boot Actuator endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import...

DNP3 integrity poll

Performs read-only DNP3 integrity-style polls: device attributes, binary inputs, binary output status, and analog inputs. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import...

Rancher Detection

Detects Rancher management server API and dashboard. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Rancher Kubernetes management UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

Confluence Pre-Auth OGNL Detection

Safe fingerprint for Confluence OGNL injection surface CVE-2022-26134 indicator — no weaponized payload. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Confluence OGNL pre-auth indicators CVE-2022-26134 fingerprint.""" from kittysploit import from lib.protocols.http.httpclient import...

DNP3 outstation identify

Identifies a DNP3 outstation on TCP/20000 via link-layer status and device attributes group 60 read. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import identifydnp3 from...

Generic Upload Webshell Probe

Probe generic file upload surfaces multipart POST for unrestricted extension handling and verify a harmless PHP/ASP execution marker. !/usr/bin/env python3 -- coding: utf-8 -- """ Generic multipart upload → webshell probe non-WordPress. Tests common upload endpoints and parameter names with a...

Imunify360 / ModSecurity Bypass Probe

Tests a battery of PHP execution and signature payloads through the current webshell channel to identify WAF/Imunify/ModSecurity blocking and likely bypass angles. !/usr/bin/env python3 -- coding: utf-8 -- """ Probe WAF / Imunify360 / ModSecurity filters through the active PHP session. Runs...

VNC Service Detection

Detects VNC servers via RFB protocol version banner. !/usr/bin/env python3 -- coding: utf-8 -- """Detect VNC/RFB remote desktop services.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.vnc.detectors import probevnc class ModuleScanner,...

LDAP AS-REP Roastable Users

Native LDAP enum of accounts with Kerberos pre-authentication disabled. For live $krb5asrep$ hashes use post/ldap/gather/asreproast. from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient from lib.protocols.ldap.adhelpers import UACNOPREAUTH class ModulePost,...

Tomcat Manager Detection

Detects Tomcat /manager/html and host-manager interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Apache Tomcat Manager interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Tomcat Manager...

Clipboard Monitor

Monitor clipboard copy/cut/paste events and poll readable clipboard text from the victim browser from kittysploit import import json import time import uuid class ModuleBrowserAuxiliary: info = "name": "Clipboard Monitor", "description": "Monitor clipboard copy/cut/paste events and poll readable...

Keycloak Detection

Detects Keycloak OpenID configuration and admin console. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Keycloak identity provider.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

Process Hollowing Evasion

Generate a Windows x64 EXE that hollows a suspended process default: notepad.exe, replaces its memory with decrypted shellcode, and resumes the primary thread. !/usr/bin/env python3 -- coding: utf-8 -- """ Process hollowing evasion loader. Creates a suspended child process, unmaps its original...

ClickHouse Unauthenticated Query Verification

Confirms anonymous ClickHouse HTTP queries via SELECT version and SELECT 1. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated ClickHouse SQL queries over HTTP.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

Kubernetes Dashboard Unauth Verification

Confirms Kubernetes Dashboard settings allowing skip-login or open proxy API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify Kubernetes Dashboard skip-login and API proxy exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

PDF Phone-Home Full Suite

Generate the full KittySploit PDF phone-home suite 70 files with phone-home callbacks for upload-scanner and red-team validation. Covers URI actions, JavaScript, XFA, XXE, UNC/NTLM, and viewer-specific CVE PoCs. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf import...

Apache .htaccess Persistence

Writes a persistence payload into an Apache .htaccess file. The file acts as a CGI/PHP shell triggered on HTTP access htshells / wireghoul technique. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import os import re from kittysploit import from...

MLflow Unauth Verification

Confirms MLflow experiments search API without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated MLflow experiment listing.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

RDP Service Detection

Detects RDP service via TPKT/X.224 pre-auth handshake. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft Remote Desktop RDP service on TCP 3389.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.rdp.detectors import proberdp...