Crypto Address Pivot

Extract cryptocurrency addresses from OSINT text/artifacts and enrich via public blockchain APIs Blockchair. Passive — no wallet interaction. from kittysploit import import json import re from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Crypt...

Favicon HTTP Fingerprint

Collect favicon hashes Shodan-compatible MurmurHash3 and HTTP fingerprints Server, powered-by, title for host correlation and shadow-asset discovery. !/usr/bin/env python3 -- coding: utf-8 -- """Favicon and HTTP fingerprint pivoting for host correlation.""" from future import annotations import...

Telegram Channel Profiler

Passive Telegram surface profiling via public t.me previews and optional Bot API getChat for authorized investigations. No account login required. from kittysploit import import json import re from urllib.parse import quote from core.osint.providers import telegrambottoken from...

JWT / OAuth Misconfiguration Probe

Probe API surfaces for JWT alg=none, weak secrets, OAuth callback open redirects, and missing state parameter enforcement. !/usr/bin/env python3 -- coding: utf-8 -- """ JWT and OAuth/OIDC misconfiguration probe. Detects alg=none, weak HMAC secrets, expired-signature acceptance, open redirects in...

SSL/TLS Configuration Audit

Audit a live TLS service: negotiated protocol and cipher, certificate chain metadata SAN, expiry, issuer, hostname coverage, weak/legacy TLS signals, and optional trust-store validation. !/usr/bin/env python3 -- coding: utf-8 -- """Live SSL/TLS configuration audit for TCP services.""" from future...

SNMP Community Probe

Tests common SNMP v1/v2c communities and collects basic system information. !/usr/bin/env python3 -- coding: utf-8 -- """Probe SNMP communities and enumerate basic system information.""" from future import annotations import json from kittysploit import from lib.protocols.snmp.snmpclient import...

Linux LD_PRELOAD Evasion

Generate a malicious shared object loaded via LDPRELOAD. The .so constructor decrypts and executes shellcode in a detached thread; a wrapper script forces LDPRELOAD on a chosen host binary. !/usr/bin/env python3 -- coding: utf-8 -- """ LDPRELOAD shared-object evasion. Generates a malicious .so...

Early Bird APC Evasion

Generate a Windows x64 EXE that performs Early Bird injection: CREATESUSPENDED, WriteProcessMemory, QueueUserAPC on the main thread, ResumeThread. !/usr/bin/env python3 -- coding: utf-8 -- """ Early Bird APC injection evasion loader. Creates a suspended process, writes shellcode remotely, queues ...

Process Herpaderping Evasion

Generate a Windows x64 EXE that maps shellcode via a file section, overwrites the on-disk file with decoy content Herpaderping, and executes from the stale mapped view. !/usr/bin/env python3 -- coding: utf-8 -- """ Process Herpaderping-style evasion loader. Writes shellcode to a temp file, create...

sRDI Reflective DLL Evasion

Generate a Windows x64 EXE that embeds sRDI-converted shellcode. Raw payload is wrapped in a minimal DLL, converted to reflective loader shellcode, encrypted ChaCha20/RC4, and executed in-process. !/usr/bin/env python3 -- coding: utf-8 -- """ Self-reflective DLL injection sRDI evasion loader. Wra...

Zig Shell Evasion

Generate a Windows x64 reverse shell compiled from pure Zig no shellcode. Supports GUI subsystem, startup sleep delay, and XOR-encoded LHOST string. !/usr/bin/env python3 -- coding: utf-8 -- """ Pure Zig Windows reverse shell with evasion options. Compiles a GUI-subsystem reverse shell no embedde...

History Dump

Collect navigation history signals available to JavaScript Performance API, referrer, history.length from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "History Dump", "description": "Collect navigation history signals available to JavaScript Performance API, referre...

Modbus TCP Client

Connects to a Modbus TCP server and creates an interactive Modbus shell session !/usr/bin/env python3 -- coding: utf-8 -- """Modbus TCP bind listener — opens a Modbus session for interactive register access.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Azure Whoami

Display the Azure identity and subscription context for the current Run Command session !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.azure import AzurePostMixin class ModulePost, AzurePostMixin: info = "name": "Azure Whoami", "description": "Display...

Windows UAC Bypass — CMSTPLUA COM

UAC bypass via CMSTPLUA COM object ShellExecute runas — CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows UAC Bypas...

Windows UAC Bypass — sdclt

HKCU Folder shell open command hijack + sdclt.exe /KickOffElev DelegateExecute. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import REGFOLDER, UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows UAC Bypass — sdclt...

Windows UAC Bypass — SilentCleanup (windir)

Hijack %windir% for Disk Cleanup SilentCleanup scheduled task schtasks /Run — no admin required to set user env. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name":...

Windows ETW Patch

Patch EtwEventWrite in ntdll RET stub inside the current PowerShell process to reduce script telemetry. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin ETWPATCHPS = r""" Add-Type @" using System; using...

AWS Elastic Beanstalk Detection

Detects Elastic Beanstalk environment hostnames and headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect AWS Elastic Beanstalk environments.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AWS Elastic Beansta...

Windows Clear Event Logs

Clear Security, System, Application and PowerShell operational logs via wevtutil. Generates high-visibility events 1102/104. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin:...

Fortinet FortiSandbox CVE-2026-25089 detection

Fingerprints FortiSandbox and flags versions affected by CVE-2026-25089 unauthenticated OS command injection in the VNC start handler: 5.0.0–5.0.5, 4.4.0–4.4.8, and all 4.2.x. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from...

Ollama API Exposure Verification

Confirms Ollama /api/tags and /api/version respond without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify exposed Ollama API with model enumeration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

BACnet Device Inventory

Discover BACnet/IP devices and perform read-only object inventory requests via ReadProperty. !/usr/bin/env python3 -- coding: utf-8 -- """Read-only BACnet device inventory via Who-Is and ReadProperty.""" from kittysploit import from lib.protocols.ics.bacnetclient import objectinventory, whois fro...

GPO Registry Audit

Parse SYSVOL GPO registry settings Registry.xml, registry.pol and detect relay-friendly SMB/NTLM policies, autologon passwords, and stored credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Audit insecure registry settings configured via GPO on SYSVOL.""" from future import annotations...

Docker API Exposure Verification

Confirms unauthenticated Docker Engine /version and /containers/json on TCP 2375. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Docker Engine API on TCP 2375.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.docker.detectors...

Microsoft Exchange CVE-2026-45504 detection

Detects Microsoft Exchange Server instances exposing OWA and EWS endpoints used in CVE-2026-45504 authenticated SSRF arbitrary file read via reference attachments and GetAttachmentPreview. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import...

Cisco CUCM CVE-2026-20230 SSRF to arbitrary file write RCE

CVE-2026-20230 chains SSRF via /cmplatform/installClusterStatusExecute, Axis LogHandler arbitrary file write, and JSP webshell deployment to obtain remote command execution on Cisco Unified Communications Manager 15.0.1.13901-2. Opens an interactive HTTP command shell and optionally dispatches th...

Langflow < 1.9.0 Public Build RCE (CVE-2026-33017)

CVE-2026-33017: Langflow versions below 1.9.0 allow unauthenticated remote code execution by posting a malicious custom component to /api/v1/buildpublictmp/flowid/flow with a clientid session cookie. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from...

WordPress WPZOOM Portfolio <= 1.4.21 - Reflected XSS (browser_server)

Unauthenticated reflected XSS via wpzoomloadmoreitems. Injects browserserver hook xss.js through postsdata.class attribute breakout. Default trigger uses tabindex+autofocus+onfocus no hover; mouseover fallback available. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Command Shell, Reverse QUIC (via Python)

Connect back over QUIC/TLS 1.3 ALPN kitty-quic and expose a command channel with upload, download, and shellcode support. Requires aioquic on the target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.quic.constants import DEFAULTQUICALPN from...

Peyara Remote Mouse 1.0.1 unauthenticated keyboard RCE

Peyara Remote Mouse 1.0.1 exposes an unauthenticated Socket.IO WebSocket service on TCP 1313 that accepts remote keyboard events. This module opens cmd.exe on the target and types a command payload one keystroke at a time. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import gzip import...

EtherNet/IP CIP scan

Combines List Identity with TCP CIP Register Session probing !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.enipclient import scanenipcip from lib.protocols.ics.icsscannerclient import...

Telnet Service Detection

Detects Telnet services via initial banner. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Telnet service via banner.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.telnet.detectors import probetelnetbanner class ModuleScanner,...

VNC Service Detection

Detects VNC servers via RFB protocol version banner. !/usr/bin/env python3 -- coding: utf-8 -- """Detect VNC/RFB remote desktop services.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.vnc.detectors import probevnc class ModuleScanner,...

Schneider Quantum 140 PLC control

Uses Modbus/TCP with Schneider Quantum proprietary function 0x5A to start or stop Schneider Quantum 140 series PLCs without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """ Schneider Quantum 140 series PLC start/stop control. Uses Schneider's proprietary Modbus extension function 0x5...

DNP3 master probe

Active DNP3 master-style probe against an outstation on TCP/20000 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import probednp3master from lib.protocols.ics.icsscannerclient import...

S7comm session acquire

Opens an authenticated S7comm session to a Siemens PLC and registers it in the framework session list for follow-on OT modules. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.framework.basemodule import ModuleResult from lib.protocols.ics.constants import...

IEC104 interrogation dump

Collects IEC 60870-5-104 responses after a general interrogation session preferred !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

Modbus write coil

Writes a single Modbus coil FC5 via an active Modbus session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.icssessionmixin import ModbusSessionMixin class ModulePost, ModbusSessionMixin: info = "name": "Modbus write coil", "description": "Writes a single...

LDAP Add Service Principal Name

Add or remove an SPN on a target account to enable Kerberoast or RBCD prep chains from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient class ModulePost, LdapPostClient: info = "name": "LDAP Add Service Principal Name", "description": "Add or remove an SPN on a targ...

Enumerate MSSQL Databases

Enumerate databases, schemas/tables, and columns on Microsoft SQL Server from kittysploit import from lib.protocols.mssql.mssqlclient import MSSQLClient class ModulePost, MSSQLClient: info = "name": "Enumerate MSSQL Databases", "description": "Enumerate databases, schemas/tables, and columns on...

PHP Auto-Prepend Combo (.htaccess + .user.ini)

Detects Apache/modphp vs PHP-FPM/Nginx stack from a PHP session and deploys persistence via .htaccess, .user.ini, or both best-effort auto selection. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.php.helpers import PhpPostHelper class ModulePost, PhpPostHelper:...

Windows Gather DPAPI Credentials

Collect DPAPI master keys, Credential Manager vault entries, and cmdkey stored credentials without external Mimikatz !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import wincompatfailuretype, winprobepowershell import base64 class ModulePost: info...

PostgreSQL Info Detection

Detects PostgreSQL via startup handshake and authentication challenge. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PostgreSQL service via startup handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.postgresql.detectors...

ENIP tag enumeration

Best-effort EtherNet/IP tag/service hints for Rockwell/Siemens CIP targets !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.enipclient import enumerateeniptags from lib.protocols.ics.icsscannerclient...

DNP3 read points (legacy path)

Read binary and analog input points from a DNP3 outstation using group 1 and group 30 object reads. Requires prior dnp3identify. !/usr/bin/env python3 -- coding: utf-8 -- """ DNP3 read points — analog/binary input enumeration. Solidifies the DNP3 client readpoints path for post-recon data...

Modbus write register

Writes a single holding register over Modbus TCP via an active Modbus session. Supports dry-run mode to validate connectivity without changing the PLC. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.icssessionmixin import ModbusSessionMixin class...

Imunify360 / ModSecurity Bypass Probe

Tests a battery of PHP execution and signature payloads through the current webshell channel to identify WAF/Imunify/ModSecurity blocking and likely bypass angles. !/usr/bin/env python3 -- coding: utf-8 -- """ Probe WAF / Imunify360 / ModSecurity filters through the active PHP session. Runs...

PostgreSQL COPY FROM PROGRAM RCE (CVE-2019-9193)

Authenticated remote code execution via COPY FROM PROGRAM on PostgreSQL 9.3 through 11.7. Requires a superuser database session. import re from typing import Optional, Tuple from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost,...

Linux Container Escape Check

Assess Docker socket, capabilities, cgroups, mount namespaces, and privileged container indicators from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Container...