Jira Detection

Detects Jira dashboards and serverInfo API exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Atlassian Jira instances.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Jira Detection", "description...

Jupyter Notebook Detection

Detects Jupyter /api/status and login endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Jupyter Notebook/Lab.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Kubernetes Dashboard Detection

Detects Kubernetes Dashboard login UI and proxy API paths. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Kubernetes Dashboard UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Kubernetes Dashboard...

Vercel Detection

Detects Vercel edge/deploy platform response headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Vercel-hosted sites via platform headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Vercel Detection",...

Zabbix Detection

Detects Zabbix frontend and apiinfo.version JSON-RPC endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zabbix monitoring UI and JSON-RPC API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse,...

OPC UA anonymous access

Checks whether an OPC UA server allows anonymous browsing on port 4840 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.protocols.ics.opcuaclient impo...

Xiaomi Smart Camera C400 factory-mode miIO UDP RCE

Unauthenticated root code execution on a factory-state Xiaomi C400 smart camera over miIO UDP/54321. Connect to the camera AP default 192.168.14.1, then run this module with an ARM bind shell payload default TCP/5555 on the device. !/usr/bin/env python3 -- coding: utf-8 -- from future import...

EtherNet/IP List Identity

Sends an EtherNet/IP List Identity request UDP/44818 to discover Rockwell, Siemens, and other CIP devices. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.enipclient import listidentity from...

CouchDB Detection

Detects CouchDB REST API and Fauxton UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed CouchDB/Fauxton endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "CouchDB Detection",...

Jaeger Detection

Detects Jaeger query API and UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Jaeger tracing UI and API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner, Httpclient: info =...

pgAdmin Detection

Detects pgAdmin4 browser UI and misc/ping endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect pgAdmin PostgreSQL web console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanne...

phpPgAdmin Detection

Detects phpPgAdmin PostgreSQL administration panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed phpPgAdmin panels.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "phpPgAdmin Detection", "description"...

Prometheus Detection

Detects Prometheus /metrics and status API exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Prometheus monitoring endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Prometheus Detection",...

SonarQube Detection

Detects SonarQube system status API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed SonarQube instances.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "SonarQube Detection", "description":...

WordPress Profile Builder Pro PHP object injection detection

Detects Profile Builder Pro = 3.14.5 unauthenticated PHP object injection via wppbrequestuserspins admin-ajax args parameter. Optionally sends a safe stdClass probe; HTTP 500 indicates deserialization of attacker input. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Tuple...

JS Source Map Analyzer

Download client JS bundles, follow sourceMappingURL references, parse .map files, and extract decompiled sources, API routes, and secret literals. !/usr/bin/env python3 -- coding: utf-8 -- """ JavaScript source map analyzer — recover decompiled/original sources from .map files. Fetches bundled .j...

BACnet object inventory

Discovers BACnet devices and requests object inventory via ReadProperty session or direct !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import objectinventory, whois from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

BACnet write property

Sends a BACnet WriteProperty request intrusive — BMS/OT lab only. Gated by otpolicy destructive markers + confirm latch. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import writeproperty from lib.protocols.ics.constants import...

OpenSSH Banner Detection

Detects SSH services and extracts OpenSSH or Dropbear version banners. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SSH service and fingerprint OpenSSH/Dropbear banners.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.ssh.detector...

Windows AMSI Bypass

Disable AMSI in the current PowerShell process. Variants: plain amsiInitFailed reflection, obfuscated/Base64 field names, AmsiContext patch, or AmsiScanBuffer memory patch double-add trampoline. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.stagerevasion import...

Windows LoadModule / Run Assembly

Load a local or catalog .NET assembly or a remote path into memory via Assembly.Load and invoke Main. Small assemblies embed in one PowerShell call; larger ones stage briefly to %TEMP% then delete. !/usr/bin/env python3 -- coding: utf-8 -- """Run a .NET assembly in-memory on a Windows session...

Adobe ColdFusion CVE-2026-48282 detection

Fingerprints Adobe ColdFusion and flags versions affected by CVE-2026-48282 RDS path traversal: ColdFusion 2025 = Update 9, ColdFusion 2023 = Update 20. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from lib.protocols.http.httpclien...

Log4Shell Header Detection

Sends safe JNDI-style markers in HTTP headers and detects Log4j-related error reflection CVE-2021-44228 indicator, no outbound callback. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Log4Shell CVE-2021-44228 header injection indicators.""" from kittysploit import from...

Dark Web Mention Hunter

Search authorized breach/darkweb intelligence providers IntelX API for mentions of a domain, email, or keyword. Does not perform direct Tor scraping. from kittysploit import import json import re import time from urllib.parse import urlparse from core.osint.providers import intelxapikey from...

Tenable Nessus <= 10.12.0 malicious .nessus SQLi (CVE-2026-57588)

Generate a weaponized Nessus scan result .nessus XML that triggers SQL injection when imported by a privileged Nessus administrator on versions prior to 10.12.1. Payloads target PostgreSQL Nessus default backend: UNION metadata exfiltration, time-based blind pgsleep, boolean, file read, and...

Web Surface Harvester

Passive harvest of security.txt, robots.txt, and sitemap.xml — contacts, disallowed paths, and public URL inventory. !/usr/bin/env python3 -- coding: utf-8 -- """Harvest security.txt, robots.txt, and sitemap.xml from a target domain.""" from future import annotations import json import re from...

Generic Upload Webshell Probe

Probe generic file upload surfaces multipart POST for unrestricted extension handling and verify a harmless PHP/ASP execution marker. !/usr/bin/env python3 -- coding: utf-8 -- """ Generic multipart upload → webshell probe non-WordPress. Tests common upload endpoints and parameter names with a...

CDP / LLDP Neighbor Enumerator

Passively capture Cisco CDP and IEEE 802.1AB LLDP frames on a switch access/trunk port to discover native VLAN, voice VLAN, port VLAN, and upstream switch identity. !/usr/bin/env python3 -- coding: utf-8 -- """Passively enumerate CDP and LLDP neighbors to map VLAN and switch context.""" from futu...

Process Hollowing Evasion

Generate a Windows x64 EXE that hollows a suspended process default: notepad.exe, replaces its memory with decrypted shellcode, and resumes the primary thread. !/usr/bin/env python3 -- coding: utf-8 -- """ Process hollowing evasion loader. Creates a suspended child process, unmaps its original...

Service Worker Register

Register a persistent service worker that re-injects the KittySploit hook on HTML navigations from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Service Worker Register", "description": "Register a persistent service worker that re-injects the KittySploit hook on HT...

WebAuthn Probe

Detect WebAuthn / passkey support and platform authenticator availability from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "WebAuthn Probe", "description": "Detect WebAuthn / passkey support and platform authenticator availability", "author": "KittySploit Team",...

Reverse QUIC C2 Listener

Reverse QUIC/TLS 1.3 listener for KittySploit implants ALPN kitty-quic. Supports shell commands, file upload/download, and shellcode execution. !/usr/bin/env python3 -- coding: utf-8 -- """Reverse QUIC C2 listener for compatible implants ALPN kitty-quic.""" from kittysploit import import asyncio...

Import BloodHound Graph

Merge BloodHound nodes/edges JSON into the agent attack graph for lightweight path planning without Neo4j. !/usr/bin/env python3 -- coding: utf-8 -- """ Import BloodHound JSON export into the agent attack graph. Set exportpath to nodes.json, edges.json, or a directory containing both. The merged...

QUIC Execute Shellcode

Send hex-encoded shellcode to the implant for in-process execution !/usr/bin/env python3 -- coding: utf-8 -- import os import re from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin HEXRE =...

Linux SUID/SGID Hunt

Find SUID/SGID binaries and match them against common GTFOBins-style escalation paths from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux SUID/SGID Hunt",...

WordPress Theme/Plugin Dropper

Installs PHP persistence in a WordPress site via must-use plugin, custom plugin, or theme functions.php append. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

Windows Gather EDR & Defender Audit

Audit Windows Defender status, RunAsPPL, Credential Guard / VBS, AMSI availability, and common EDR process indicators. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name":...

Windows Gather UAC & Integrity Audit

Audit UAC policy EnableLUA, ConsentPromptBehaviorAdmin, LocalAccountTokenFilterPolicy, groups, and privileges. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows Gather U...

Kubelet Read-Only API Verification

Confirms anonymous /pods access on kubelet read-only port 10255. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated kubelet read-only API on port 10255.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Apache Tomcat CVE-2026-43512 detection

Fingerprints Apache Tomcat and flags versions affected by CVE-2026-43512 DIGEST authentication bypass: 9.0.x 9.0.118, 10.1.x 10.1.55, 11.0.x 11.0.22, 8.5.x = 8.5.100. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from...

Kubernetes Dashboard Unauth Verification

Confirms Kubernetes Dashboard settings allowing skip-login or open proxy API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify Kubernetes Dashboard skip-login and API proxy exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Modbus UDP Detection

Detects Modbus UDP responders via read holding registers probe. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Modbus UDP services on port 502.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.modbus.detectors import probemodbusudp...

Location to Geocode

Normalize a free-text location into canonical coordinates, display label, and country/region/city/postcode fields Nominatim. !/usr/bin/env python3 -- coding: utf-8 -- """Normalize a free-text location into coordinates and administrative fields.""" from future import annotations import json import...

Passive DNS Aggregator

Aggregate subdomains from certificate transparency and built-in permutations, with optional A-record resolution. !/usr/bin/env python3 -- coding: utf-8 -- """Aggregate passive subdomain sources CT + permutations with optional DNS resolution.""" from future import annotations import json from...

MQTT Broker Identify

Detect MQTT brokers and test anonymous subscribe access on TCP 1883. !/usr/bin/env python3 -- coding: utf-8 -- """Identify exposed MQTT brokers and anonymous access.""" from future import annotations import json from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclie...

SSL/TLS Cipher Suite Enumeration

Enumerate cipher suites accepted by a TLS endpoint and flag weak or deprecated protocol versions. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate accepted TLS cipher suites on a live service.""" from future import annotations import json import re from kittysploit import from...

Encrypted Shellcode Dropper Evasion

Generate a Windows x64 EXE that decrypts embedded shellcode in memory and executes it via VirtualAlloc/VirtualProtect/CreateThread. Uses ChaCha20 or RC4 encryption with optional pre-execution sleep. !/usr/bin/env python3 -- coding: utf-8 -- """ Encrypted shellcode dropper Win32 API. Minimal Windo...

S7comm Client

Connects to a Siemens S7 PLC and creates an interactive S7comm shell session !/usr/bin/env python3 -- coding: utf-8 -- """S7comm bind listener — opens an ISO-on-TCP session to a Siemens PLC.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Authenticated HTTP Surface Mapper

Maps post-authentication attack surface from a landing page using session cookies — admin paths, uploads, APIs, and privileged forms. !/usr/bin/env python3 -- coding: utf-8 -- """ Authenticated HTTP surface mapper. After login, crawls the landing page and shallow linked paths to discover admin...

QUIC Download File

Download a remote file from the implant via an active QUIC C2 session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin class ModulePost,...