GCP Generate Access Token

Generate a short-lived OAuth2 access token for a target service account !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Generate Access Token", "description": "Generate a...

GCP API Keys

Enumerate API keys and their restrictions in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP API Keys", "description": "Enumerate API keys and their...

phpSysInfo CVE-2026-55584 detection

Fingerprints phpSysInfo and flags versions = 3.4.5 affected by CVE-2026-55584 PSIALLOWED IP allowlist bypass via X-Forwarded-For / Client-IP. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.phpsysinfo...

GCP IAM Policy

Retrieve and display the IAM policy for the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP IAM Policy", "description": "Retrieve and display the IAM policy...

IKEv1 IPsec VPN connect (PSK + XAUTH)

Brings up an IKEv1 IPsec VPN tunnel using a cracked or known pre-shared key and XAUTH user credentials. Generates a temporary strongSwan stroke configuration, runs ipsec up, and reports the assigned virtual IP. Requires root and a local strongSwan/libreswan install. Chain after ikepskcapture +...

GCP Secret Sprawl

Detect Secret Manager sprawl: stale secrets, many versions, and weak replication posture !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Secret Sprawl", "description": "Detect Secret Manage...

GCP Service Account Risk

Assess service account hygiene, key exposure, and privilege concentration !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Account Risk", "description": "Assess service account...

GCP Artifact Registry Pull Tokens Loot

Build Docker pull URIs and registry login material for Artifact Registry images !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Artifact Registry Pull Tokens Loot", "description...

GCP Attack Graph

Build an IAM and resource attack graph for the current principal and project !/usr/bin/env python3 -- coding: utf-8 -- import re from collections import defaultdict from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Attack Graph",...

GCP Create Service Account Key

Create a user-managed JSON key for a service account !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Create Service Account Key", "description": "Create a...

GCP Cloud Run Services

Enumerate Cloud Run services in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Run Services", "description": "Enumerate Cloud Run services in the...

PHP Meterpreter, Reverse TCP

Meterpreter-like PHP payload that connects back via TCP !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: CLIENTLANGUAGE = "php" info = 'name': 'PHP Meterpreter, Reverse TCP', 'description': 'Meterpreter-like PHP payload that connects back via TCP', 'author':...

GCP Service Account Keys

Enumerate keys for IAM service accounts in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from urllib.parse import quote from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Account Keys",...

GCP Impersonate Service Account

Validate and obtain short-lived credentials by impersonating a service account !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Impersonate Service Account", "description":...

GCP Cloud Run Env Vars Loot

Extract environment variables from Cloud Run services and jobs !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Run Env Vars Loot", "description": "Extract environment...

IKEv1 / IPsec endpoint detection (ike-scan)

Detects IKEv1 ISAKMP VPN endpoints on UDP 500/4500. Sends Main Mode and Aggressive Mode probes similar to ike-scan, parses SA transforms, vendor IDs XAUTH, DPD, Cisco Unity, and reports whether Aggressive Mode PSK capture may be possible. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit...

Pivot PHP-CGI CVE-2012-1823 through PHP session

Uses an existing PHP session to POST a PHP-CGI argument injection payload to an internal URL, useful for Kubernetes/cluster lateral movement. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePost: info = "name": "Pivot PHP-CGI CVE-2012-1823 through PHP session",...

PHP-CGI Argument Injection RCE (CVE-2012-1823)

Exploits legacy PHP-CGI argument injection by setting allowurlinclude and autoprependfile=php://input, then posting attacker-supplied PHP code. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient:...

Reverse MQTT Shell Listener

Command/result C2 over MQTT topics, separate from the generic MQTT pub/sub listener. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json import time from kittysploit import class ModuleListener: info = "name": "Reverse MQTT Shell Listener", "description": "Command/result C2 over...

Zig Meterpreter Windows, Reverse TCP

Windows Meterpreter payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterreversetcp import ZigMeterpreterReverseTcpBase class ModuleZigMeterpreterReverseTcpBase, Payload: info = 'name': 'Zig Meterpreter...

Meterpreter Bind TCP

Meterpreter bind TCP handler with post-exploitation capabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket import threading import time import struct class ModuleListener: """Meterpreter bind TCP handler — connects to a bind payload on the target""" info =...

Zig Meterpreter Linux, Bind TCP

Linux Meterpreter bind TCP payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterbindtcp import ZigMeterpreterBindTcpBase class ModuleZigMeterpreterBindTcpBase, Payload: info = 'name': 'Zig Meterpreter Linux...

Windows Python Meterpreter, Bind TCP

Small Meterpreter stager for Windows - bind TCP requires Python on target !/usr/bin/env python3 -- coding: utf-8 -- """ Windows Python Meterpreter Bind TCP Payload Author: KittySploit Team Version: 2.0.0 This payload creates a small Meterpreter stager that listens on the target, accepts a...

Unix File Writer (via Python)

Write base64-decoded content to a local file without opening a network connection from kittysploit import class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Unix File Writer via Python', 'description': 'Write base64-decoded content to a local file without opening a network connection'...

Unix Command Shell, Bind TCP (via Perl)

Listen on the target and expose an interactive command shell via Perl IO::Socket from kittysploit import class ModulePayload: info = 'name': 'Unix Command Shell, Bind TCP via Perl', 'description': 'Listen on the target and expose an interactive command shell via Perl IO::Socket', 'author':...

Unix Command Shell, Reverse TCP (via Ruby)

Connect back and create a command shell via Ruby TCPSocket from kittysploit import class ModulePayload: info = 'name': 'Unix Command Shell, Reverse TCP via Ruby', 'description': 'Connect back and create a command shell via Ruby TCPSocket', 'author': 'KittySploit Team', 'category':...

Zig Meterpreter Linux, Bind TCP (compat)

Linux Meterpreter bind TCP payload in Zig compatibility path; requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- """ Compatibility module for the Linux Zig Meterpreter bind TCP payload. Prefer payloads/singles/cmd/unix/zigmeterpreterlinuxbindtcp. """ from kittysploit import from...

Zig Meterpreter Linux, Reverse TCP

Linux Meterpreter payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterreversetcp import ZigMeterpreterReverseTcpBase class ModuleZigMeterpreterReverseTcpBase, Payload: info = 'name': 'Zig Meterpreter Linux...

Zig Meterpreter macOS, Bind TCP

macOS Meterpreter bind TCP payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterbindtcp import ZigMeterpreterBindTcpBase class ModuleZigMeterpreterBindTcpBase, Payload: info = 'name': 'Zig Meterpreter macOS...

Zig Meterpreter Windows, Bind TCP

Windows Meterpreter bind TCP payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterbindtcp import ZigMeterpreterBindTcpBase class ModuleZigMeterpreterBindTcpBase, Payload: info = 'name': 'Zig Meterpreter...

Python Meterpreter, Bind TCP

Meterpreter-like payload that listens on the target via TCP requires Python on target !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import base64 import struct class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Python Meterpreter, Bind TCP',...

Zig Meterpreter macOS, Reverse TCP

macOS Meterpreter payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterreversetcp import ZigMeterpreterReverseTcpBase class ModuleZigMeterpreterReverseTcpBase, Payload: info = 'name': 'Zig Meterpreter macOS...

Meterpreter Reverse TCP (compat alias)

Compatibility alias for listeners/multi/meterpreterreversetcp. Prefer meterpreterreversetcp for new configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Compatibility alias for the Meterpreter reverse TCP listener.""" from kittysploit import Listener from...

Unix Command Shell, Bind TCP (via Python)

Listen on the target and expose an interactive command shell via Python from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Unix Command Shell, Bind TCP via Python', 'description': 'Listen on the target and expose an interactive command shell via...

Unix Command Shell, Reverse TCP (via Perl)

Connect back and create a command shell via Perl IO::Socket from kittysploit import class ModulePayload: info = 'name': 'Unix Command Shell, Reverse TCP via Perl', 'description': 'Connect back and create a command shell via Perl IO::Socket', 'category': PayloadCategory.CMD, 'arch': Arch.PERL,...

PowerShell Command Shell, Bind TCP

Listen on the target and expose a command shell via PowerShell !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 from lib.c2.stagerevasion import powershellprelude class ModulePayload: CLIENTLANGUAGE = "powershell" info = 'name': 'PowerShell Command Shell, Bind TCP',...

CDN Origin IP Finder

Find probable origin server IPs hidden behind CDNs Cloudflare, Fastly, Akamai by correlating DNS on direct/staging subdomains, MX records, and CT enumeration. from kittysploit import import ipaddress import json import re from urllib.parse import urlparse import dns.resolver from...

Joomla JCE CVE-2026-48907 (unauthenticated RCE) detection

Detects Joomla sites running JCE Editor 2.9.99.5 vulnerable to CVE-2026-48907 unauthenticated arbitrary file upload leading to RCE. Combines JCE version fingerprinting with an optional active probe that uploads a harmless PHP math verifier no shell. !/usr/bin/env python3 -- coding: utf-8 -- impor...

Email Pattern Harvester

Harvest organizational email addresses and patterns from passive sources: DMARC/SPF TXT records, RDAP contacts, and certificate transparency naming hints. from kittysploit import import json import os import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient...

Joomla JCE < 2.9.99.5 - Unauthenticated RCE (CVE-2026-48907)

Exploits CVE-2026-48907 in Joomla JCE Editor 2.9.99.5: unauthenticated arbitrary file upload via profile import or JCE browser chain, followed by PHP webshell execution. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

GitHub Org Exposure Scanner

Discover public GitHub repositories tied to a target domain/org, scan README and workflow files for secret patterns, and surface CI/CD misconfigurations. from kittysploit import import json import re from urllib.parse import quote from lib.protocols.http.httpclient import Httpclient class...

Persona Password Profiler

Collect OSINT on a person name/email or company domain, then propose 20 contextually relevant password candidates for authorized assessments. from kittysploit import import json import os import re from urllib.parse import urlparse from core.osint.passwordprofiling import applyrdapcompanyname,...

Wayback Surface Hunter

Mine Internet Archive Wayback CDX for historical URLs and flag forgotten sensitive endpoints — admin panels, configs, backups, API docs, and debug paths. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class...

Windows LSASS Memory Dump

Dump the LSASS process to a minidump file using PowerShell's internal MiniDumpWriteDump wrapper on a Windows shell or Meterpreter session, then download the dump through the session. !/usr/bin/env python3 -- coding: utf-8 -- """ Dump LSASS process memory via PowerShell MiniDumpWriteDump on a...

WiFi Handshake Capture

Passively capture WPA/WPA2 EAPOL key exchanges on a monitor-mode interface and save matching frames to a PCAP file for offline cracking. !/usr/bin/env python3 -- coding: utf-8 -- """Passively capture WPA/WPA2 EAPOL handshakes on a monitor-mode interface.""" from future import annotations import o...

Windows Gather PuTTY WinSCP FileZilla Sessions

Collect saved PuTTY registry sessions, WinSCP registry sessions, and FileZilla XML site entries on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Extract saved PuTTY, WinSCP, and FileZilla session data from a Windows session. """ from kittysploit import from...

Windows Gather RDP Files

Find and parse saved Remote Desktop .rdp files in common user locations on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate and parse saved .rdp client files on a Windows session. """ from kittysploit import from lib.post.windows.session import...

WiFi Deauth Detector

Passively detect 802.11 deauthentication and disassociation frames on a monitor-mode interface to spot deauth floods or rogue disconnect attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Detect 802.11 deauthentication and disassociation frames passive WIDS.""" from future import annotations...

OpenClaw AI agent gateway detection

Detects exposed OpenClaw formerly Clawdbot/Moltbot AI agent gateways and flags versions likely affected by CVE-2026-25253 token exfiltration. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

WiFi Beacon Scanner

Capture 802.11 beacon frames on a monitor-mode interface and list visible wireless networks SSID and BSSID. !/usr/bin/env python3 -- coding: utf-8 -- """Sniff 802.11 beacon frames on a monitor-mode interface.""" from future import annotations from typing import Dict from kittysploit import class...