Search PostgreSQL Sensitive Data

Find columns likely to hold secrets password, token, apikey, etc. and optionally dump a few sample rows from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Search PostgreSQL Sensitive Data",...

Enumerate PostgreSQL Foreign Connections

List postgresfdw servers, user mappings, foreign tables, dblink sessions, and connection strings in function source from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Foreign...

PostgreSQL Read Server File

Read a server file via pgreadfile requires superuser from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "PostgreSQL Read Server File", "description": "Read a server file via pgreadfile requires...

Check PostgreSQL Privileges

Review current role capabilities and notable grants from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Check PostgreSQL Privileges", "description": "Review current role capabilities and notable grants"...

Windows FodHelper UAC Bypass

HKCU ms-settings shell open command hijack + fodhelper.exe default value + empty DelegateExecute, then registry cleanup. sessionid comes from the Post base class. !/usr/bin/env python3 -- coding: utf-8 -- import time from kittysploit import REGKEY =...

HTTP response — credential leak detect

Scans an HTTP response body for exposed credentials: PEM private keys, Google service account JSON, AWS keys. Returns leaked values in output. Use proxyflowid or responsebodyb64 for a captured KittyProxy flow. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json import re from...

Firebase stack & hosting init — detect

Passive recon: reads the configured path for Firebase SDK / API hints, checks response headers, and optionally GETs /firebase/init.json Firebase Hosting auto-config. Positive when init.json returns a project config or strong in-page markers FIREBASEDEFAULTS, etc.. !/usr/bin/env python3 -- coding:...

Firebase Realtime Database — public REST access

GET /.json?shallow=true on the Realtime Database root to see if rules allow unauthenticated reads. Optionally PUT+GET+DELETE a random key when probewrite is enabled only on assets you are authorized to test. !/usr/bin/env python3 -- coding: utf-8 -- """ Inspired by FireSploit Shubham Sharma: RTDB...

Apache Tomcat Tribes EncryptInterceptor bypass (CVE-2026-34486)

Cleartext Tribes ChannelReceiver traffic may be deserialized after failed decryption EncryptInterceptor. Provide command CommonsCollections6, no JVM or serializedpath for a custom chain. Requires commons-collections 3.x on the target matching this gadget. !/usr/bin/env python3 -- coding: utf-8 --...

Windows PSR capture

Records a brief Problem Steps Recorder psr.exe session to a ZIP on the target, then downloads the file through the current session base64 chunks and saves it under ./output. !/usr/bin/env python3 -- coding: utf-8 -- """ PSR psr.exe short recordings on the target; ZIP bytes are pulled through the...

Next.js WebSocket upgrade SSRF (CVE-2026-44578) detection

Detects Next.js and flags CVE-2026-44578 router-server WebSocket upgrade SSRF. Affected: 13.4.13–15.5.15 and 16.0.0–16.2.4; fixed in 15.5.16 / 16.2.5. Self-hosted Node server only Vercel not affected. Optional active probe: absolute-URI WebSocket upgrade to AWS IMDSv1. Companion auxiliary confirm...

Next.js i18n Pages data-route middleware bypass (CVE-2026-44573)

Pages Router with i18n exposes /next/data///.json. On vulnerable Next.js, /next/data//.json no locale can skip the middleware matcher while x-nextjs-data: 1 forces the data handler — leaking getServerSideProps JSON that should have been gated. Set sentinel to a string your protected page embeds i...

Next.js x-nextjs-data redirect cache poisoning (GHSA-3g8h) detection

Fingerprints Next.js and flags versions 16.2.5 affected by GHSA-3g8h-86w9-wvmq x-nextjs-data redirect cache poisoning. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionsc...

Bludit CMS < 3.18.4 - API Unrestricted File Upload to RCE

Bludit CMS API plugin allows an authenticated user with a valid API token to upload files of any type and extension via POST /api/files/. This module uploads a PHP webshell to achieve Remote Code Execution. from kittysploit import from lib.protocols.http.httpclient import Httpclient import random...

PowerShell reverse TCP line shell

Writes a PowerShell script that connects back over TCP and executes each received line via Invoke-Expression line-oriented command channel. from kittysploit import class ModuleBackdoor: info = "name": "PowerShell reverse TCP line shell", "description": "Writes a PowerShell script that connects ba...

Next.js next/script beforeInteractive XSS (GHSA-gx5p-jg67-6x7h)

GET the page with a reflected query param containing a breakout; checks whether it appears verbatim after self.nexts=....push unsafe JSON-in-script vs \u003c escapes patched. Requires a page that forwards the param into props. !/usr/bin/env python3 -- coding: utf-8 -- from urllib.parse import...

Next.js CSP-nonce reflected XSS (CVE-2026-44581)

GET with Content-Security-Policy: script-src 'nonce-' where the payload uses a TAB as separator so the legacy nonce parser accepts it; reflected nonce must not be attribute-escaped ' where the payload uses a TAB " "as separator so the legacy nonce parser accepts it; reflected nonce must not be "...

Next.js RSC / HTML cache poisoning (GHSA-wfc6) detection

Fingerprints Next.js and flags versions 16.2.5 affected by GHSA-wfc6-r584-vfw7 RSC misclassified as text/html cache poisoning. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import...

Next.js /_next/image optimizer OOM (GHSA-h64f-5h5j-jqjh)

GET /next/image?url=&w=&q= against a large same-origin asset. Pre-16.2.5 the optimizer may decode the full image into memory OOM / long wall. v16.2.5 adds limits. Streams the response in 64 KiB chunks; can stress the target — use only on systems you own. !/usr/bin/env python3 -- coding: utf-8 --...

Next.js i18n data-route middleware bypass (CVE-2026-44573) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44573 i18n /next/data middleware bypass. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js /_next/image OOM (GHSA-h64f) detection

Fingerprints Next.js and flags versions 16.2.5 potentially affected by GHSA-h64f-5h5j-jqjh /next/image OOM. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js RSC / HTML cache poisoning (GHSA-wfc6-r584-vfw7)

Three GETs on the same URL: baseline, then with loose RSC + Next-Router-Prefetch, then clean again. Pre-16.2.5 stacks may mis-classify Flight as text/html so CDNs cache RSC bytes under an HTML content-type key. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Bludit CMS < 3.18.4 - API Unrestricted File Upload (CVE-2026-25099)

Detects CVE-2026-25099 on Bludit when a valid API token is provided. Optional active probe uploads a harmless .txt file to confirm unrestricted upload behavior. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import random...

Next.js router-server WebSocket upgrade SSRF (CVE-2026-44578)

Exploits CVE-2026-44578: WebSocket upgrade handler proxies absolute http:// request-line URIs GET, port 80 without honouring finished/308 from normalizeRepeatedSlashes. Actions: test confirm, aws / azure IMDS harvest, custom ssrfurl. Self-hosted only; Vercel/nginx often block. Fixed in 15.5.16 /...

Next.js dynamic-route param injection (CVE-2026-44574)

Probes GHSA-492v-c6pp-mqqv: inbound nxtP / nxtI internal search params plus proxy-style headers can skew App Router params vs middleware pathname; second probe uses %252F in a dynamic segment. Configure sentinel to a string only the protected page renders. !/usr/bin/env python3 -- coding: utf-8 -...

Next.js _rsc weak hash collision (CVE-2026-44582) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44582 weak rsc cache-busting hash. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js Next-Resume DoS (GHSA-mg66) detection

Fingerprints Next.js and flags versions 16.2.5 potentially affected by GHSA-mg66-mrh9-m8jx Next-Resume DoS. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js _rsc weak cache-busting hash collision (CVE-2026-44582)

Reimplements the legacy 32-bit FNV-style mix and runs a birthday search for a colliding state-tree, next-url tuple. Optional HTTP GET with RSC prefetch headers can probe CDN cache behaviour. CPU-heavy; patched Next.js uses a stronger mix = 16.2.5. !/usr/bin/env python3 -- coding: utf-8 -- import...

fruit_shell

Writes a PowerShell reverse TCP line shell using a dotted host/port encoding x for octet separators, underscore before port. from kittysploit import class ModuleBackdoor: info = "name": "fruitshell", "description": "Writes a PowerShell reverse TCP line shell using a dotted host/port " "encoding x...

Next.js RSC server-action DoS (CVE-2026-23870)

Form-encoded cyclic RSC reply with Next-Action + Accept: text/x-component. Pre-patch React Next.js 16.2.5 can spin CPU / blow the stack. Availability only. !/usr/bin/env python3 -- coding: utf-8 -- import time from concurrent.futures import ThreadPoolExecutor, ascompleted from urllib.parse import...

Next.js x-nextjs-data redirect cache poisoning (GHSA-3g8h-86w9-wvmq)

Compares GET responses on a redirecting route with and without x-nextjs-data: 1. Pre-16.2.5 Next.js may return 2xx + x-nextjs-redirect without Location, breaking browsers and poisoning shared caches. Patched stacks keep a normal 3xx + Location. !/usr/bin/env python3 -- coding: utf-8 -- from...

Next.js CSP-nonce reflected XSS (CVE-2026-44581) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44581 CSP nonce reflected XSS. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js next/script beforeInteractive XSS (GHSA-gx5p) detection

Fingerprints Next.js and flags versions 16.2.5 affected by GHSA-gx5p-jg67-6x7h next/script beforeInteractive XSS. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan...

Next.js Next-Resume DoS / cache-poisoning (GHSA-mg66-mrh9-m8jx)

POST a large text/plain JSON-shaped body with next-resume: 1 and x-next-resume-state-length: 1 to a PPR page. Pre-16.2.5 the renderer may accept the header and spend CPU/memory on resume. Builds a multi‑MiB body client-side — use only on systems you own. !/usr/bin/env python3 -- coding: utf-8 --...

Next.js RSC server-action DoS (CVE-2026-23870) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-23870 expensive cyclic RSC server-action parsing. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionsca...

Next.js dynamic-route param injection (CVE-2026-44574) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44574 dynamic route parameter injection. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

DirtyFrag Local Privilege Escalation

Exploits the 'DirtyFrag' AFALG/rxrpc page cache corruption vulnerability to achieve local privilege escalation. This module compiles a C exploit, uploads it to the target, and executes it to gain root via /usr/bin/su or /etc/passwd corruption. from kittysploit import from core.framework.post impo...

NocoBase Workflow Script Node VM Sandbox Escape RCE

Exploits CVE-2026-34156 in NocoBase Workflow Script Node. The module leverages an exposed host-realm WritableWorkerStdio stream object console.stdout / console.stderr to traverse the prototype chain, obtain the host-realm's Function constructor, and execute arbitrary commands bypassing the Node.j...

Android adbd TLS auth bypass CVE-2026-0073 detection

Checks Android adbd over TCP for the STLS/TLS authentication bypass path and confirms command execution with a harmless id probe. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Android adbd STLS/TLS auth bypass CVE-2026-0073.""" import ssl from kittysploit import from core.framework.option...

ARM LE Thumb XOR Encoder

Prepends a compact Thumb decoder stub and XOR-encodes raw ARM little-endian payload bytes with a one-byte key. !/usr/bin/env python3 -- coding: utf-8 -- """Thumb ARM little-endian single-byte XOR encoder.""" import re from kittysploit import class ModuleEncoder: info = "name": "ARM LE Thumb XOR...

Bricks Builder CVE-2024-25600 detection

Detects WordPress Bricks theme = 1.9.6 affected by CVE-2024-25600 unauthenticated renderelement RCE. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Tuple from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import...

PHP CGI Argument Injection (CVE-2024-4577) detection

Fingerprints PHP-CGI stacks and flags PHP versions in the CVE-2024-4577 affected ranges on Windows 8.1 8.1.29, 8.2 8.2.20, 8.3 8.3.8. Confirm exploitation with exploits/linux/http/phpcgicve20244577rce. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from...

PHP CGI Argument Injection RCE (CVE-2024-4577)

Exploits PHP-CGI argument injection via query-string option smuggling to set autoprependfile=php://input and execute attacker-supplied PHP code. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient:...

MindsDB CVE-2026-27483 - Path Traversal to RCE

MindsDB versions below 25.9.1.1 are vulnerable to a path traversal in /api/files upload. A crafted file write can overwrite pip internals and execute attacker-controlled code when a handler installation is triggered. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from...

Cisco RV340 SSL VPN unauthenticated RCE (CVE-2022-20699)

Stack buffer overflow in SSL VPN. Sends self.payload bytes ARM stager, optionally encoded by the framework padded to Metasploit layout, over TLS. !/usr/bin/env python3 -- coding: utf-8 -- CVE-2022-20699 — Cisco RV340 SSL VPN RCE Flashback / Metasploit-aligned. import secrets import socket import...

Android adbd TLS Auth Bypass (CVE-2026-0073)

Uses the adbd STLS/TLS EVPPKEYcmp authentication bypass to create an Android shell session over ADB TCP. !/usr/bin/env python3 -- coding: utf-8 -- """Android adbd EVPPKEYcmp TLS authentication bypass session module.""" import socket import time from kittysploit import from lib.protocols.adb.adbtl...

ARM LE reverse TCP shell (raw)

Thumb ARM 32-bit connect-back stager: socket, connect, dup2 x3, execve /bin/sh. Null-free IPv4 handling per Flashback. Output is raw bytes not a command string. !/usr/bin/env python3 -- coding: utf-8 -- Null-free ARM LE reverse TCP + dup2 + execve"/bin/sh" — Flashback / Metasploit prepshelly. IPv...

MindsDB CVE-2026-27483 detection

Detects MindsDB versions 25.9.1.1 potentially affected by CVE-2026-27483 path traversal in /api/files that can lead to RCE. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation...

n8n CVE-2026-21858 + CVE-2025-68613 detection

Detects n8n instances with version 1.121 potentially affected by CVE-2026-21858 and CVE-2025-68613 arbitrary file read, token forgery, workflow RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Bricks Builder CVE-2024-25600 - Unauthenticated RCE

Exploits unauthenticated RCE in Bricks Builder by abusing the renderelement API with a leaked nonce and query editor/code execution settings. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit,...