HTTPS Mimic Transform

Sends fake TLS 1.2 Client/Server Hello at start, then TLS Application Data. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import TLS record: type 1 + version 2 + length 2 + fragment TLSHEADERLEN = 5 TLSHANDSHAKE = 0x16 TLSAPPLICATIONDATA = 0x17 TLSVERSION1...

XOR Stream Transform

XORs the C2 stream with a repeating key. Symmetric encode/decode. Evades simple signature detection. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import class ModuleTransform: """XOR stream transform - obfuscates C2 traffic with a repeating XOR key."""...

WordPress Breeze Cache CVE-2026-3844 detection

Detects Breeze Cache = 2.4.4 with unauthenticated arbitrary file upload via fetchgravatarfromremote / breezefetchgravatar when local Gravatar hosting is enabled. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Tuple from kittysploit import from lib.protocols.http.httpclient...

WordPress Breeze Cache <= 2.4.4 - Unauthenticated RCE

CVE-2026-3844 — Unauthenticated arbitrary file upload via breezefetchgravatar when Breeze 'Host Files Locally - Gravatars' is enabled. Uploads PHP to wp-content/uploads/avatars/, gravatars/, or cache/breeze/. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import List, Optional,...

SMB share enumeration

Connects over SMB null session, guest, or supplied credentials and lists available shares with optional top-level directory listing. Intended for reconnaissance during an engagement, not as a one-shot vulnerability check. !/usr/bin/env python3 -- coding: utf-8 -- """Énumération des partages SMB...

ES File Explorer CVE-2019-6447 detection

Detects the unauthenticated ES File Explorer HTTP API on TCP 59777 CVE-2019-6447. Sends getDeviceInfo and fingerprints responses from affected builds = 4.1.9.7.4. !/usr/bin/env python3 -- coding: utf-8 -- import ast import json from typing import Optional, Union from kittysploit import from...

ES File Explorer <= 4.1.9.7.4 - Arbitrary File Read

CVE-2019-6447 — ES File Explorer exposes an unauthenticated HTTP API on TCP 59777 that allows listing device content and arbitrary file download via the getFile command. !/usr/bin/env python3 -- coding: utf-8 -- import ast import json from pathlib import Path from typing import Optional, Union fr...

PRTG Network Monitor < 18.2.39 - Authenticated Command Injection RCE

CVE-2018-9276 — authenticated remote code execution via command injection in PRTG EXE notification settings. Logs in as a PRTG administrator, stages an OutFile notification, then injects a command through message10 and triggers execution via /api/notificationtest.htm. Ensure a listener is...

OpenSSL Heartbleed CVE-2014-0160 detection

Sends a malformed TLS heartbeat CVE-2014-0160 and reports whether the server returns more data than declared. Supports direct TLS e.g. HTTPS and cleartext services that upgrade with STARTTLS/STLS/AUTH TLS. !/usr/bin/env python3 -- coding: utf-8 -- """Detect OpenSSL Heartbleed CVE-2014-0160 via...

OpenSSL Heartbleed CVE-2014-0160 - Memory dump

Repeatedly triggers the TLS heartbeat over-read CVE-2014-0160 to collect server memory. Optional RSA private key reconstruction when the leaked buffer contains prime factors matching the service certificate modulus. !/usr/bin/env python3 -- coding: utf-8 -- """Exploit OpenSSL Heartbleed...

PRTG Network Monitor CVE-2018-9276 detection

Detects PRTG Network Monitor instances below 18.2.39 vulnerable to authenticated command injection in EXE notification settings CVE-2018-9276. Fingerprints the Server header and optionally confirms administrator credentials. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import...

AgentTesla Config Extractor

Analyze AgentTesla .NET payloads: locate string-decryption methods, invoke them with IL-derived keys under a watchdog timeout, and extract likely C2 indicators HTTP, SMTP, FTP. Requires pythonnet and dnlib.dll. !/usr/bin/env python3 -- coding: utf-8 -- """ Extract C2 configuration from AgentTesla...

Redis ACL Audit

Review Redis ACL users and highlight risky permissions, weak user posture, and dangerous command access from kittysploit import from lib.protocols.redis.redisclient import RedisClient import re class ModulePost, RedisClient: info = "name": "Redis ACL Audit", "description": "Review Redis ACL users...

Check Redis Hardening

Audit common Redis security misconfigurations from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Check Redis Hardening", "description": "Audit common Redis security misconfigurations", "author": "KittySploit Team",...

Enumerate Redis Server Info

Dump Redis server, memory, replication, and persistence information from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Enumerate Redis Server Info", "description": "Dump Redis server, memory, replication, and persistence...

Redis Delete Keys

Delete one or more Redis keys by name or SCAN pattern from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Delete Keys", "description": "Delete one or more Redis keys by name or SCAN pattern", "author": "KittySploit...

Redis Flush Database

Delete all keys in the current database FLUSHDB or all databases FLUSHALL from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Flush Database", "description": "Delete all keys in the current database FLUSHDB or all...

Redis Inject Backdoor Key

Plant a persistent marker or C2 callback key in Redis from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Inject Backdoor Key", "description": "Plant a persistent marker or C2 callback key in Redis", "author":...

Redis Set Expiration

Set EXPIRE on a key or remove expiration with PERSIST from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Set Expiration", "description": "Set EXPIRE on a key or remove expiration with PERSIST", "author": "KittySploi...

Redis Set Key

Create or overwrite a string key in the current Redis database from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Set Key", "description": "Create or overwrite a string key in the current Redis database", "author":...

Shell Capability Profiler

Fingerprint an unusual shell and list available interpreters, transfer tools, TTY support, and execution constraints from kittysploit import class ModulePost: info = "name": "Shell Capability Profiler", "description": "Fingerprint an unusual shell and list available interpreters, transfer tools,...

Redis Inject Session

Overwrite a cached session key to hijack an application session from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Inject Session", "description": "Overwrite a cached session key to hijack an application session",...

Redis Modify ACL

List, inspect, create, update, or delete Redis ACL users Redis 6+ from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Modify ACL", "description": "List, inspect, create, update, or delete Redis ACL users Redis 6+",...

Enumerate Redis Configuration

Dump security-relevant Redis server configuration from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Enumerate Redis Configuration", "description": "Dump security-relevant Redis server configuration", "author": "KittySplo...

Redis Keyspace Profiler

Profile Redis keys, TTLs, memory usage, and suspicious naming patterns without dumping values by default from kittysploit import from lib.protocols.redis.redisclient import RedisClient import re class ModulePost, RedisClient: info = "name": "Redis Keyspace Profiler", "description": "Profile Redis...

Restricted Shell Audit

Identify restricted or atypical shell constraints, escape-capable binaries, sudo posture, and writable PATH risks from kittysploit import import re class ModulePost: info = "name": "Restricted Shell Audit", "description": "Identify restricted or atypical shell constraints, escape-capable binaries...

GCP IAM PrivEsc Paths

Identify practical IAM privilege escalation paths for the current GCP principal !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP IAM PrivEsc Paths", "description": "Identify practical IAM...

Google Cloud API Console Listener

Creates an interactive GCP/Firebase API console from a token or service account. !/usr/bin/env python3 -- coding: utf-8 -- import json import os import time from urllib.parse import quote import requests from kittysploit import DEFAULTSCOPES = "https://www.googleapis.com/auth/cloud-platform",...

GCP Firebase Exposure

Analyze Firebase/Firestore exposure: apps, hosting, rules, remote config, and API keys !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Exposure", "description": "Analyze...

Slack Socket Mode Polling Shell

Uses Slack Socket Mode as a command/result transport for lab agents. !/usr/bin/env python3 -- coding: utf-8 -- import time from kittysploit import try: from slackbolt import App from slackbolt.adapter.socketmode import SocketModeHandler SLACKAVAILABLE = True except Exception: App =...

GCP Create Service Account Key

Create a user-managed JSON key for a service account !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Create Service Account Key", "description": "Create a...

GCP Network Paths

Map network exposure paths via firewalls, VPCs, GKE endpoints, and Cloud Run ingress !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Network Paths", "description": "Map network exposure pat...

AD Object ACL Operations

Runs common bloodyAD object/ACL operations: set owner, add GenericAll, move DN, set password, enable account. !/usr/bin/env python3 -- coding: utf-8 -- import os import shlex import shutil import subprocess from kittysploit import try: from ldap3 import ALL, Connection, Server LDAP3AVAILABLE = Tr...

AD Shadow Credentials Auto

Runs Certipy shadow auto against an account and surfaces the resulting TGT/NT hash output. !/usr/bin/env python3 -- coding: utf-8 -- import os import shlex import shutil import subprocess from kittysploit import class ModulePost: info = "name": "AD Shadow Credentials Auto", "description": "Runs...

GCP Attack Graph

Build an IAM and resource attack graph for the current principal and project !/usr/bin/env python3 -- coding: utf-8 -- import re from collections import defaultdict from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Attack Graph",...

WordPress GiveWP CVE-2024-5932 detection

Detects exposed GiveWP plugin versions affected by PHP object injection RCE. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "WordPre...

GCP IAM Policy

Retrieve and display the IAM policy for the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP IAM Policy", "description": "Retrieve and display the IAM policy...

GCP Artifact Registry Images Loot

List Artifact Registry repositories, packages, and image versions !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Artifact Registry Images Loot", "description": "List Artifact...

GCP Cloud Function Sources Loot

Extract Cloud Functions source locations and download archives when accessible !/usr/bin/env python3 -- coding: utf-8 -- import json from urllib.parse import quote from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Function...

GCP Storage Bucket Objects Loot

List and optionally preview objects from Cloud Storage buckets !/usr/bin/env python3 -- coding: utf-8 -- import json from urllib.parse import quote from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage Bucket Objects Loot",...

ZynOS / RomPager ROM-0 admin password disclosure detection

Detects unauthenticated exposure of /rom-0 on ZynOS / RomPager routers. When present, the blob can be decompressed to recover the administrator password CVE-2014-4019 class issue; D-Link DSL-2600U and related models. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

GCP Service Account Lateral Movement

Map service account impersonation and workload attachment chains for lateral movement !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Account Lateral Movement",...

GCP Storage Buckets

Enumerate Cloud Storage buckets in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage Buckets", "description": "Enumerate Cloud Storage buckets in t...

GCP Overprivileged Bindings

Find overprivileged IAM bindings: primitive roles, public principals, and broad group grants !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Overprivileged Bindings", "description": "Find...

GCP Project Summary

Summarize a Google Cloud project from the current GCP API session !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Project Summary", "description": "Summarize a Google Cloud...

GCP Service Account Risk

Assess service account hygiene, key exposure, and privilege concentration !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Account Risk", "description": "Assess service account...

IKEv1 Aggressive Mode PSK capture

Captures IKEv1 Aggressive Mode handshake material for offline pre-shared key cracking. Outputs a hashcat-compatible line gxr:gxi:ckyr:ckyi:saib:idirb:nib:nrb:hashr suitable for modes 5300 MD5, 5400 SHA1, or 5410 SHA256. Equivalent to ike-scan --aggressive --pskcrack. !/usr/bin/env python3 --...

Wing FTP Server <= 8.1.2 Authenticated Session Poisoning RCE

CVE-2026-44403: an authenticated full Wing FTP administrator can inject Lua into domain-admin session serialization by poisoning the mydirectory basefolder field. The module logs in, creates or updates a poisoned domain admin, triggers execution by logging in as that account, and dispatches the...

GCP BigQuery Datasets

Enumerate BigQuery datasets in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP BigQuery Datasets", "description": "Enumerate BigQuery datasets in the...

D-Link / ZynOS ROM-0 admin password disclosure

Unauthenticated download of /rom-0 on ZynOS / RomPager-based routers exposes a compressed configuration blob. LZS decompression at offset 8568 reveals the device administrator password in plaintext. Tested on D-Link DSL-2600U firmware v1.08; affects multiple D-Link, TP-Link, ZyXEL, and ZTE models...