S7 program transfer detect

Actively probes whether Siemens S7 program-transfer jobs appear reachable upload/download channel. Complements passive sniffer detections. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Rocket.Chat Detection

Detects Rocket.Chat info API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Rocket.Chat collaboration server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Windows Gather DPAPI Credentials

Collect DPAPI master keys, Credential Manager vault entries, and cmdkey stored credentials without external Mimikatz !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import wincompatfailuretype, winprobepowershell import base64 class ModulePost: info...

S7 CPU STOP

Sends a STOP command to a Siemens S7 PLC CPU. This halts the running process and is extremely disruptive — lab use only with explicit authorization. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Consul KV Unauthenticated Write Verification

Tests reversible Consul /v1/kv PUT/DELETE when writeprobe is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated Consul KV writes reversible probe.""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

SSH authorized_keys Persistence

Adds an SSH public key to authorizedkeys for persistent key-based access. Optionally prefixes command= restrictions. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

Ollama API Exposure Verification

Confirms Ollama /api/tags and /api/version respond without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify exposed Ollama API with model enumeration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Cisco CUCM CVE-2026-20230 detection

Detects Cisco Unified Communications Manager instances exposing the webdialer WSDL endpoint used in CVE-2026-20230 SSRF to arbitrary file write and JSP command execution. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclie...

Windows Token Impersonation Helper

Basic Incognito-style token and privilege audit with optional RunAs test !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModulePost: info = "name": "Windows Token Impersonation Helper", "description": "Basic Incognito-style token and privilege audit with...

BACnet write property

Sends a BACnet WriteProperty request intrusive — BMS/OT lab only. Gated by otpolicy destructive markers + confirm latch. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import writeproperty from lib.protocols.ics.constants import...

Open WebUI Unauth Verification

Confirms Open WebUI /api/config or /api/models without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify Open WebUI unauthenticated config and model access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation...

PDF CVE-2016-2175 XXE XMP Metadata

Generate PDF PoC for CVE-2016-2175: XXE in XMP /Metadata stream targeting server-side parsers PDFBox, iText. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import writexxexmpmetadata class ModuleAuxiliary,...

Dalfox Found-Action Deserialization RCE

Exploits CVE-2026-45087 in dalfox = 2.12.0 REST server mode: POST /scan deserializes found-action into scan options. Hosts a callback URL; when dalfox hits it and reports a finding, the supplied shell command runs on the dalfox host. !/usr/bin/env python3 -- coding: utf-8 -- """ Dalfox REST API...

MSSQL Info - Detection

Detects MSSQL via TDS prelogin and reports version and encryption hints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft SQL Server via TDS prelogin.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.mssql.detectors import...

CVE-2026-26128 Windows SMB improper authentication detection

CVE-2026-26128: improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. Detects exposure factors for SMB improper-authentication privesc abuse: LDAP/ADIDNS reachability, AD CS HTTP enrollment, and SMB signing posture on coercion targets...

PDF CVE-2017-9096 XXE XFA Form

Generate PDF PoC for CVE-2017-9096: XXE in AcroForm /XFA XML stream for server-side PDF processors. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import writexxexfaacroform class ModuleAuxiliary, PdfCveMixin:...

Fortinet FortiSandbox CVE-2026-25089 detection

Fingerprints FortiSandbox and flags versions affected by CVE-2026-25089 unauthenticated OS command injection in the VNC start handler: 5.0.0–5.0.5, 4.4.0–4.4.8, and all 4.2.x. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from...

Indirect Windows Syscall Evasion

Generate a Windows x64 EXE that resolves syscall numbers via Hell's Gate hashing and invokes them indirectly through an ntdll syscall gadget. Shellcode is encrypted ChaCha20 or RC4 and base64-encoded. !/usr/bin/env python3 -- coding: utf-8 -- """ Indirect Windows syscall evasion loader...

Host Header Injection Probe

Tests Host and X-Forwarded-Host manipulation for reflection in responses, redirects, and cache/password-reset style poisoning signals. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Host header and X-Forwarded-Host injection misconfigurations.""" from future import annotations import json fr...

Samba CVE-2026-4480 print-command (%J) injection

CVE-2026-4480: Samba print servers configured with a print command that references %J pass the client-controlled job description to a shell without escaping metacharacters. An unauthenticated attacker with access to a guest printer share can submit a crafted print job for remote code execution...

Log4Shell Header Detection

Sends safe JNDI-style markers in HTTP headers and detects Log4j-related error reflection CVE-2021-44228 indicator, no outbound callback. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Log4Shell CVE-2021-44228 header injection indicators.""" from kittysploit import from...

SMB Relay Surface Audit

Aggregate SMB signing posture, null session acceptance, and SMBv1 availability into a relay-risk report. !/usr/bin/env python3 -- coding: utf-8 -- """Aggregate SMB signing, null session, and SMBv1 signals for NTLM relay surface.""" from future import annotations import json from kittysploit impor...

Nextcloud Detection

Detects Nextcloud status endpoint and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Nextcloud file sync and collaboration instance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse cla...

Tenable Nessus <= 10.12.0 malicious .nessus SQLi (CVE-2026-57588)

Generate a weaponized Nessus scan result .nessus XML that triggers SQL injection when imported by a privileged Nessus administrator on versions prior to 10.12.1. Payloads target PostgreSQL Nessus default backend: UNION metadata exfiltration, time-based blind pgsleep, boolean, file read, and...

SharePoint Taxonomy SQLi -> AppLifecycle NDCS RCE (CVE-2026-26114)

CVE-2026-26114 full-chain authenticated exploit for Microsoft SharePoint Server. Abuses a Taxonomy CSOM CustomSortOrder SQL injection to insert AppInstallations, AppJobs and AppTasks rows, then triggers OWSTIMER to deserialize a TypeConfuseDelegate NetDataContractSerializer gadget for remote code...

PDF CVE-2018-5158 PDF.js PostScript Injection

Generate PDF PoC for CVE-2018-5158: JavaScript injection via /FunctionType 4 PostScript calculator in PDF.js. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writepdfjspostscriptjs class...

Apache Superset Detection

Detects Superset health API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Superset BI dashboard.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse, parsejsonresponse class...

Windows Defender Exclusion / Disable

Add a Defender exclusion path preferred, lower noise or optionally disable real-time protection components via Set-MpPreference. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info =...

Apache Tomcat CVE-2026-43512 detection

Fingerprints Apache Tomcat and flags versions affected by CVE-2026-43512 DIGEST authentication bypass: 9.0.x 9.0.118, 10.1.x 10.1.55, 11.0.x 11.0.22, 8.5.x = 8.5.100. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from...

Apache Struts Detection

Detects Struts2 action extensions and OGNL error fingerprints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Struts2 framework indicators.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse...

Windows External Tool Runner

Upload a local binary or script to the target, execute it with operator-supplied arguments, and optionally download a remote output file. !/usr/bin/env python3 -- coding: utf-8 -- """ Upload a local operator tool to the target, execute it, and optionally pull an output artifact back through the...

TeamCity Detection

Detects TeamCity REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect JetBrains TeamCity CI server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Webmin Detection

Detects Webmin login and session endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Webmin server administration panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanner,...

Windows ETW Patch

Patch EtwEventWrite in ntdll RET stub inside the current PowerShell process to reduce script telemetry. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin ETWPATCHPS = r""" Add-Type @" using System; using...

PDF CVE-2014-8453 FormCalc Post Exfil

Generate PDF PoC for CVE-2014-8453: XFA FormCalc Post same-origin policy bypass exfiltrating data to attacker URL. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xfa import writexfaformcalcpost class ModuleAuxiliary...

S7 read DB

Reads bytes from a Siemens PLC data block via an active S7comm session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.icssessionmixin import S7SessionMixin class ModulePost, S7SessionMixin: info = "name": "S7 read DB", "description": "Reads bytes from a...

Favicon HTTP Fingerprint

Collect favicon hashes Shodan-compatible MurmurHash3 and HTTP fingerprints Server, powered-by, title for host correlation and shadow-asset discovery. !/usr/bin/env python3 -- coding: utf-8 -- """Favicon and HTTP fingerprint pivoting for host correlation.""" from future import annotations import...

WinRM Service Detection

Detects WinRM /wsman endpoints on ports 5985/5986. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WinRM /wsman endpoints and advertised auth methods.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.winrm.detectors import probewinrm...

Windows Disable PowerShell Logging

Disable PowerShell Script Block, Module, and Transcription logging. Modes: registry admin GPO keys or sessioncache in-process cachedGroupPolicySettings + PS ETW provider — no admin required. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.stagerevasion import...

Module Stomping Evasion

Generate a Windows x64 EXE that loads a benign DLL default: version.dll, stomps its .text section with decrypted shellcode, and executes in-place. !/usr/bin/env python3 -- coding: utf-8 -- """ Module stomping evasion loader. Loads a legitimate DLL locally, overwrites its .text section with...

VLAN DTP Trunk Negotiation

Attempt to convert an access port into an 802.1Q trunk by sending Cisco DTP negotiation frames desirable/on/auto, then verify tagged VLAN reachability. !/usr/bin/env python3 -- coding: utf-8 -- """Negotiate an 802.1Q trunk via Cisco DTP from an access port.""" from future import annotations impor...

PostgreSQL COPY FROM PROGRAM RCE (CVE-2019-9193)

Authenticated remote code execution via COPY FROM PROGRAM on PostgreSQL 9.3 through 11.7. Requires a superuser database session. import re from typing import Optional, Tuple from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost,...

PDF CVE-2024-4367 PDF.js Staged Delivery

Generate a CVE-2024-4367 FontMatrix PDF with staged JavaScript for authorized testing: callback, fetch+eval stager, or WebSocket C2. Uses CALLBACKURL not LHOST. PDF.js runs in a browser sandbox — for OS reverse shells use exploits/multi/fileformat/ with framework PAYLOAD. !/usr/bin/env python3 --...

OpenAPI Schema Abuse

Discovers exposed OpenAPI/Swagger documents and probes documented GET endpoints for unauthenticated access to sensitive routes. !/usr/bin/env python3 -- coding: utf-8 -- """Probe exposed OpenAPI/Swagger specs for unauthenticated sensitive endpoints.""" from future import annotations import json...

Shell Profile Persistence

Persists a payload in shell startup files: /.bashrc, /.profile, /etc/profile.d/, or a custom profile path. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost, LinuxPersistenceMixi...

Langflow < 1.9.0 Public Build RCE (CVE-2026-33017)

CVE-2026-33017: Langflow versions below 1.9.0 allow unauthenticated remote code execution by posting a malicious custom component to /api/v1/buildpublictmp/flowid/flow with a clientid session cookie. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from...

Zookeeper Unauthenticated Enumeration

Collects Zookeeper srvr/stat/conf output via unauthenticated four-letter commands. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Zookeeper four-letter-word admin commands without authentication.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient fr...

Apache ActiveMQ CVE-2026-34197 Jolokia RCE

CVE-2026-34197: authenticated Jolokia exec on org.apache.activemq MBeans allows addNetworkConnector with a crafted vm:// URI that loads remote Spring XML xbean:http://ATTACKER/shell.xml for arbitrary code execution. This module serves shell.xml with an inline base64 JSP webshell, then invokes the...

Apache ActiveMQ CVE-2026-34197 detection

Fingerprints Apache ActiveMQ Classic and flags versions affected by CVE-2026-34197 Jolokia addNetworkConnector RCE: 5.19.4 and 6.0.0 through 6.2.2. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from lib.protocols.http.httpclient...

Samba CVE-2026-4480 detection

Fingerprints Samba and flags versions affected by CVE-2026-4480 print-command %J command injection. Fixed upstream in 4.22.10, 4.23.8, and 4.24.3. Actual exploitability also requires a custom print command that references %J and is not using cups/iprint. !/usr/bin/env python3 -- coding: utf-8 --...