ThinkPHP Detection

Detects ThinkPHP routing errors and framework markers without exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ThinkPHP framework fingerprints safe passive probes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

DNP3 integrity poll

Performs read-only DNP3 integrity-style polls: device attributes, binary inputs, binary output status, and analog inputs. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import...

S7 module enumeration

Enumerates rack/slot modules on a Siemens S7 PLC using SZL 0x0013 reads CPU, IO, CP modules. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

Adminer Detection

Detects Adminer single-file DB admin panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Adminer database administration panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanne...

Apache Airflow Detection

Detects Airflow /api/v1/health and admin UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Airflow web UI and health API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

gRPC Reflection Detection

Detects gRPC endpoints and enumerates services when server reflection is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detect gRPC services and server reflection exposure.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

InfluxDB Detection

Detects InfluxDB ping and health endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed InfluxDB HTTP API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "InfluxDB Detection", "description": "Detects...

mongo-express Detection

Detects mongo-express web UI and public config endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect mongo-express MongoDB admin UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

Apache Solr Detection

Detects Solr admin and system info endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Apache Solr admin interfaces.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Apache Solr Detection",...

Tomcat Manager Detection

Detects Tomcat /manager/html and host-manager interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Apache Tomcat Manager interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Tomcat Manager...

Webmin Detection

Detects Webmin login and session endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Webmin server administration panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanner,...

WordPress WPZOOM Portfolio CVE-2026-49069 detection

Detects WPZOOM Portfolio plugin versions = 1.4.21 affected by unauthenticated reflected XSS CVE-2026-49069. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress PLUGIN =...

GPO Attack Graph Enrich

Merge GPO local group / privilege findings into the agent attack graph using LDAP-derived GPO scope when available. !/usr/bin/env python3 -- coding: utf-8 -- """ Merge GPO audit findings into the agent attack graph. Accepts a JSON export from GPO scanners plus an optional LDAP scope map. """ from...

QUIC Upload File

Upload a local file to the remote host via an active QUIC C2 session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin class ModulePost,...

Apache .htaccess Persistence

Writes a persistence payload into an Apache .htaccess file. The file acts as a CGI/PHP shell triggered on HTTP access htshells / wireghoul technique. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import os import re from kittysploit import from...

Nginx + PHP-FPM Backdoor

Deploys a hidden PHP webshell and an Nginx snippet conf.d or sites-enabled routing requests to PHP-FPM. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

Windows UAC Bypass — FodHelper

HKCU ms-settings Shell Open command hijack + fodhelper.exe DelegateExecute, then registry cleanup. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import REGMSSETTINGS, UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name":...

Windows LSASS Dump (comsvcs)

Dump LSASS using comsvcs.dll MiniDump via rundll32, then download the minidump through the session. !/usr/bin/env python3 -- coding: utf-8 -- """ Dump LSASS via comsvcs.dll MiniDump rundll32 — stealthier than direct MiniDumpWriteDump from PowerShell on many Defender configs. """ from kittysploit...

AD CS Web Enrollment Detection

Detects Microsoft AD CS /certsrv and /CertEnroll HTTP enrollment surfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Detect AD CS web enrollment endpoints HTTP.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Consul KV Unauthenticated Write Verification

Tests reversible Consul /v1/kv PUT/DELETE when writeprobe is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated Consul KV writes reversible probe.""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Jenkins Open API Verification

Confirms unauthenticated Jenkins whoAmI/api and script console indicators. !/usr/bin/env python3 -- coding: utf-8 -- """Verify exposed Jenkins API and script console surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation...

AD CS Misconfiguration Scanner

Detects ESC-style AD CS template and enrollment service misconfigurations via LDAP. !/usr/bin/env python3 -- coding: utf-8 -- """Detect vulnerable AD CS certificate templates and enrollment services.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient, LDAP3AVAILABLE from...

MongoDB Unauthenticated Access Detection

Detects exposed MongoDB and whether databases are readable without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MongoDB instances and unauthenticated access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

GPO Privilege Rights Audit

Parse SYSVOL GptTmpl.inf User Rights Assignment and detect trustees with dangerous privileges SeDebug, SeImpersonate, SeBackup, etc.. !/usr/bin/env python3 -- coding: utf-8 -- """Audit dangerous User Rights Assignment configured via GPO on SYSVOL.""" from future import annotations import json fro...

OpenAPI Schema Abuse

Discovers exposed OpenAPI/Swagger documents and probes documented GET endpoints for unauthenticated access to sensitive routes. !/usr/bin/env python3 -- coding: utf-8 -- """Probe exposed OpenAPI/Swagger specs for unauthenticated sensitive endpoints.""" from future import annotations import json...

Bitbucket Detection

Detects Bitbucket REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Atlassian Bitbucket Server/Data Center.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanne...

Graylog Detection

Detects Graylog system and cluster API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Graylog log management API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Okta Detection

Detects Okta SSO tenants via OIDC metadata and login UI markers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Okta identity cloud tenants.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

Linux memfd_exec Evasion

Generate a Linux x64 ELF that decrypts a staged loader into memfdcreate and executes it with fexecve — fileless delivery effective against basic EDR. !/usr/bin/env python3 -- coding: utf-8 -- """ memfdcreate + fexecve fileless Linux loader. Builds an encrypted inner ELF loader, wraps it in an out...

Siemens S7-1200 PLC control

Sends raw S7comm-plus style commands to start, stop, reset, or factory-reset an unprotected Siemens S7-1200 PLC CPU. !/usr/bin/env python3 -- coding: utf-8 -- """ Siemens S7-1200 PLC control. Uses raw S7comm-plus style packets to start, stop, or reset unprotected S7-1200 CPUs. """ from future...

Active Directory Integrated DNS record manager

Add or remove A records in Active Directory integrated DNS zones via LDAP ldap3 only. Supports Unicode hostname variants abused in CVE-2026-26128 improper authentication in Windows SMB Server. !/usr/bin/env python3 -- coding: utf-8 -- import re import socket import struct from kittysploit import...

VLAN DTP Trunk Negotiation

Attempt to convert an access port into an 802.1Q trunk by sending Cisco DTP negotiation frames desirable/on/auto, then verify tagged VLAN reachability. !/usr/bin/env python3 -- coding: utf-8 -- """Negotiate an 802.1Q trunk via Cisco DTP from an access port.""" from future import annotations impor...

PDF CVE-2018-20065 PDFium URI No-Gesture

Generate PDF PoC for CVE-2018-20065: /OpenAction /URI navigation without user gesture in PDFium/Chrome. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.actions import writepdfiumopenactionuri class ModuleAuxiliary,...

PDF CVE-2024-12426 LibreOffice Expand URI

Generate PDF PoC for CVE-2024-12426: vnd.sun.star.expand URI leaks environment variables $HOME via LibreOffice on open. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writelibreofficeexpanduri class...

PDF UNC NTLM Callback Generator

Generate PDFs that reference UNC paths to coerce NTLM authentication from Windows PDF viewers. Covers GoToE, XObject streams, GoToR, Thread, URI actions, and Acrobat JavaScript APIs submitForm, getURL, launchURL, SOAP, openDoc. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import fro...

SSRF Cloud Metadata Harvest

Exploit a confirmed SSRF primitive to retrieve cloud provider metadata AWS IMDS, GCP computeMetadata, Azure instance and IAM hints. !/usr/bin/env python3 -- coding: utf-8 -- """ Harvest cloud instance metadata through a confirmed SSRF injection point. Chains from auxiliary/scanner/http/ssrfscanne...

VLAN ID Scanner

Hop through 802.1Q VLAN IDs on a Layer-2 access port by sending tagged DHCP and ARP probes, optionally harvesting CDP native VLAN hints first. !/usr/bin/env python3 -- coding: utf-8 -- """Discover active VLAN IDs from an access port using tagged DHCP/ARP probes.""" from future import annotations...

Linux userfaultfd Evasion Loader

Generate a Linux x64 ELF that uses userfaultfd to lazily resolve encrypted shellcode pages at access time, evading simple memory scans. !/usr/bin/env python3 -- coding: utf-8 -- """ userfaultfd delayed-reveal shellcode loader Linux x64. Maps shellcode with userfaultfd, drops pages from memory, th...

ETW/AMSI Patch Evasion

Generate a Windows x64 EXE that patches AMSI AmsiScanBuffer and/or ETW EtwEventWrite in-process before decrypting and running shellcode. !/usr/bin/env python3 -- coding: utf-8 -- """ In-process ETW/AMSI patch evasion loader. Patches AmsiScanBuffer and/or EtwEventWrite in-process, decrypts embedde...

Sleep Obfuscation Evasion

Generate a Windows x64 EXE that obfuscates shellcode in memory during Sleep XOR/RC4 + PAGENOACCESS, Ekko/Foliage-style before execution. !/usr/bin/env python3 -- coding: utf-8 -- """ Sleep memory obfuscation evasion loader Ekko/Foliage-style. Encrypts the shellcode region in memory, sets pages to...

IndexedDB Dump

Extract databases, object stores and records from IndexedDB from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "IndexedDB Dump", "description": "Extract databases, object stores and records from IndexedDB", "author": "KittySploit Team", "browser": Browser.ALL,...

API BOLA / IDOR Probe

Tests API object endpoints with alternate IDs to detect unauthorized cross-object access OWASP API1:2023 BOLA. !/usr/bin/env python3 -- coding: utf-8 -- """Probe API endpoints for Broken Object Level Authorization BOLA/IDOR.""" from future import annotations import json from typing import Dict,...

Argo CD Detection

Detects Argo CD version API and login UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Argo CD GitOps UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Argo CD Detection", "description":...

GitLab Detection

Detects GitLab login UI and version API exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed GitLab instances.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "GitLab Detection", "description": "Detec...

Harbor Registry Detection

Detects Harbor registry systeminfo API and sign-in UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Harbor container registry.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Harbor Registry Detection"...

Nexus Repository Detection

Detects Nexus/Artifactory-style repository manager APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Sonatype Nexus repository manager.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Nexus Repository...

Rancher Detection

Detects Rancher management server API and dashboard. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Rancher Kubernetes management UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

ICS engagement report

Builds a consolidated OT/ICS engagement report from passive JSON, workspace services, and optional active findings. Exports JSON and HTML. !/usr/bin/env python3 -- coding: utf-8 -- import json import os from kittysploit import from lib.protocols.ics.report import buildengagementreport, savereport...

S7 CPU STOP

Sends a STOP command to a Siemens S7 PLC CPU. This halts the running process and is extremely disruptive — lab use only with explicit authorization. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

PDF CVE-2014-8453 FormCalc Post Exfil

Generate PDF PoC for CVE-2014-8453: XFA FormCalc Post same-origin policy bypass exfiltrating data to attacker URL. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xfa import writexfaformcalcpost class ModuleAuxiliary...