Linux SUID/SGID Hunt

Find SUID/SGID binaries and match them against common GTFOBins-style escalation paths from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux SUID/SGID Hunt",...

WordPress Theme/Plugin Dropper

Installs PHP persistence in a WordPress site via must-use plugin, custom plugin, or theme functions.php append. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

Windows Gather EDR & Defender Audit

Audit Windows Defender status, RunAsPPL, Credential Guard / VBS, AMSI availability, and common EDR process indicators. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name":...

Windows Gather UAC & Integrity Audit

Audit UAC policy EnableLUA, ConsentPromptBehaviorAdmin, LocalAccountTokenFilterPolicy, groups, and privileges. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows Gather U...

Kubelet Read-Only API Verification

Confirms anonymous /pods access on kubelet read-only port 10255. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated kubelet read-only API on port 10255.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

Kubernetes Dashboard Unauth Verification

Confirms Kubernetes Dashboard settings allowing skip-login or open proxy API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify Kubernetes Dashboard skip-login and API proxy exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Modbus UDP Detection

Detects Modbus UDP responders via read holding registers probe. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Modbus UDP services on port 502.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.modbus.detectors import probemodbusudp...

Location to Geocode

Normalize a free-text location into canonical coordinates, display label, and country/region/city/postcode fields Nominatim. !/usr/bin/env python3 -- coding: utf-8 -- """Normalize a free-text location into coordinates and administrative fields.""" from future import annotations import json import...

Passive DNS Aggregator

Aggregate subdomains from certificate transparency and built-in permutations, with optional A-record resolution. !/usr/bin/env python3 -- coding: utf-8 -- """Aggregate passive subdomain sources CT + permutations with optional DNS resolution.""" from future import annotations import json from...

MQTT Broker Identify

Detect MQTT brokers and test anonymous subscribe access on TCP 1883. !/usr/bin/env python3 -- coding: utf-8 -- """Identify exposed MQTT brokers and anonymous access.""" from future import annotations import json from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclie...

SSL/TLS Cipher Suite Enumeration

Enumerate cipher suites accepted by a TLS endpoint and flag weak or deprecated protocol versions. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate accepted TLS cipher suites on a live service.""" from future import annotations import json import re from kittysploit import from...

S7comm Client

Connects to a Siemens S7 PLC and creates an interactive S7comm shell session !/usr/bin/env python3 -- coding: utf-8 -- """S7comm bind listener — opens an ISO-on-TCP session to a Siemens PLC.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

Authenticated HTTP Surface Mapper

Maps post-authentication attack surface from a landing page using session cookies — admin paths, uploads, APIs, and privileged forms. !/usr/bin/env python3 -- coding: utf-8 -- """ Authenticated HTTP surface mapper. After login, crawls the landing page and shallow linked paths to discover admin...

Windows UAC Bypass — Auto Chain

Try UAC bypass techniques in order: FodHelper → Eventvwr → ComputerDefaults → sdclt → CMSTPLUA → SilentCleanup. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windo...

Windows UAC Bypass — Eventvwr

HKCU mscfile shell open command hijack + eventvwr.exe. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import REGMSCFILE, UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows UAC Bypass — Eventvwr", "description": "HK...

Windows External Tool Runner

Upload a local binary or script to the target, execute it with operator-supplied arguments, and optionally download a remote output file. !/usr/bin/env python3 -- coding: utf-8 -- """ Upload a local operator tool to the target, execute it, and optionally pull an output artifact back through the...

GCP Cloud Run Detection

Detects Cloud Run hostnames and Google Frontend trace headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Google Cloud Run services.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

Apache ActiveMQ CVE-2026-34197 detection

Fingerprints Apache ActiveMQ Classic and flags versions affected by CVE-2026-34197 Jolokia addNetworkConnector RCE: 5.19.4 and 6.0.0 through 6.2.2. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from lib.protocols.http.httpclient...

ComfyUI Unauth Verification

Confirms ComfyUI systemstats and objectinfo APIs without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify ComfyUI unauthenticated workflow API access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

MLflow Unauth Verification

Confirms MLflow experiments search API without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated MLflow experiment listing.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

MSSQL Info - Detection

Detects MSSQL via TDS prelogin and reports version and encryption hints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft SQL Server via TDS prelogin.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.mssql.detectors import...

GPP Password Hunter

Search SYSVOL Group Policy Preferences XML files for encrypted cpassword credentials via SMB. !/usr/bin/env python3 -- coding: utf-8 -- """Hunt Group Policy Preferences passwords on SMB SYSVOL.""" from future import annotations import json import os import tempfile from typing import Dict, List...

PDF Phone-Home Full Suite

Generate the full KittySploit PDF phone-home suite 70 files with phone-home callbacks for upload-scanner and red-team validation. Covers URI actions, JavaScript, XFA, XXE, UNC/NTLM, and viewer-specific CVE PoCs. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf import...

SMB session acquire

Chains SMB recon null session, guest, credentials or wordlists and opens an authenticated SMB session when access is obtained. !/usr/bin/env python3 -- coding: utf-8 -- """ Probe SMB authentication profiles and open an interactive SMB session. Workflow: 1. Check null session / guest / supplied...

Cisco CUCM CVE-2026-20230 detection

Detects Cisco Unified Communications Manager instances exposing the webdialer WSDL endpoint used in CVE-2026-20230 SSRF to arbitrary file write and JSP command execution. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclie...

ComfyUI Detection

Detects ComfyUI system stats API and web UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ComfyUI generative AI workflow interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse,...

Ollama Detection

Detects Ollama model API via /api/tags endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Ollama local LLM API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

TeamCity Detection

Detects TeamCity REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect JetBrains TeamCity CI server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Linux Ptrace Inject Evasion

Generate a Linux x64 ELF that performs classic ptrace injection: PTRACEATTACH, remote mmap via syscall gadget, PTRACEPOKEDATA, RIP hijack. !/usr/bin/env python3 -- coding: utf-8 -- """ Classic ptrace shellcode injection Linux x64. Spawns a sacrificial process, attaches with ptrace, remote-mmaps v...

WordPress Atarim Plugin < 4.2.2 - Sensitive Information Exposure

CVE-2025-60188: Atarim WordPress plugin versions below 4.2.2 expose a site ID via an unauthenticated REST endpoint. That value is used as an HMAC key to forge signed admin-ajax requests and dump site configuration, license keys, and user PII. import hashlib import hmac import json import re from...

Gitea CVE-2026-20896 - X-WEBAUTH-USER reverse-proxy auth bypass

CVE-2026-20896: default Gitea Docker deployments = 1.26.2 ship with REVERSEPROXYTRUSTEDPROXIES = and accept X-WEBAUTH-USER from any source. An attacker can impersonate any user including admins on the web UI without a password or API token. !/usr/bin/env python3 -- coding: utf-8 -- import random...

PDF Action Callback Generator

Generate PDFs that trigger outbound requests via native PDF actions: /URI, /Launch, /GoToR, /GoToE, /SubmitForm, /ImportData, /Thread, XObject streams, and catalog /Names JavaScript triggers. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

PDF CVE-2017-10951 Foxit getURL Callback

Generate PDF PoC for CVE-2017-10951: Foxit Reader JavaScript this.getURL phone-home on document open. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.javascript import writefoxitgeturljs class ModuleAuxiliary,...

PDF CVE-2017-9096 XXE XFA Form

Generate PDF PoC for CVE-2017-9096: XXE in AcroForm /XFA XML stream for server-side PDF processors. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import writexxexfaacroform class ModuleAuxiliary, PdfCveMixin:...

PDF CVE-2022-28244 RichMedia CSP Bypass

Generate PDF PoC for CVE-2022-28244: RichMedia annotation with embedded HTML/JS bypassing Acrobat CSP for outbound callback. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writerichmediacspbypass...

PDF Polyglot Payload Generator

Generate non-standard PDF polyglots for upload-filter bypass testing: EICAR antivirus test string embedded in PDF, and ImageMagick SVG/MSL polyglot for server-side image processing pipelines. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

PDF XFA Callback Generator

Generate XFA-based PDFs with phone-home behavior: XDP form submit, external XSLT, FormCalc Post/GET, CRLF injection in submit headers, arbitrary HTTP header injection, and SOAP submit on initialize. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

Peyara Remote Mouse exposure detection

Detects Peyara Remote Mouse = 1.0.1 exposure by checking TCP 1313, an Engine.IO OPEN frame, and a Socket.IO namespace connect handshake. No keyboard injection is performed. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.websocket.websocketclient import...

Adobe Acrobat JavaScript Reverse Shell PDF

Generate a PDF with Acrobat OpenAction JavaScript that launches a framework-generated reverse-shell payload PowerShell by default. By default only the PDF is generated disablePayloadHandler=true; set disablePayloadHandler false to listen immediately after generation. Requires Adobe Acrobat/Reader...

WinRM Authentication Enumeration

Probe WinRM /wsman and enumerate advertised authentication methods. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate WinRM authentication methods on ports 5985/5986.""" from future import annotations import json from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

VLAN Double Tag Hop

Attempt to reach a target VLAN from an access port by sending double-tagged 802.1Q frames outer native VLAN + inner target VLAN. Useful when a switch forwards one untagged/native VLAN but does not filter nested tags. !/usr/bin/env python3 -- coding: utf-8 -- """Attempt VLAN hopping via double...

PDF CVE-2018-5158 PDF.js PostScript Injection

Generate PDF PoC for CVE-2018-5158: JavaScript injection via /FunctionType 4 PostScript calculator in PDF.js. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writepdfjspostscriptjs class...

PDF CVE-2019-7089 XFA XSLT Callback

Generate PDF PoC for CVE-2019-7089: external XSLT stylesheet reference in XFA stream triggering UNC/HTTP callback on open. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xfa import writexfaxsltcallback class...

PDF CVE-2020-29075 Silent DNS Callback

Generate PDF PoC for CVE-2020-29075: silent DNS/HTTP via catalog /AA /WC, /WS, /DS without user prompt in Acrobat Reader. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.silent import writesilentdnscatalogaa class...

PDF CVE-2025-59803 Foxit OCG Signing Trigger

Generate PDF PoC for CVE-2025-59803: JavaScript in /AA /WP and /DP fires during Foxit digital signing workflow OCG. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writefoxitocgsigningjs class...

PDF JavaScript Callback Generator

Generate PDFs with JavaScript phone-home payloads for Acrobat, Foxit, PDF.js and browser contexts. Includes OpenAction, annotation triggers, widget buttons, submitForm exfiltration, and per-API isolated test cases getURL, launchURL, SOAP, fetch, XHR, WebSocket, staged loaders. !/usr/bin/env pytho...

PDF Silent DNS Callback Generator

Generate PDFs with silent DNS/HTTP callbacks via Acrobat catalog additional actions /AA /WC, /WS, /DS that fire on document close or save without user interaction CVE-2020-29075. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfPhonehomeMixin,...

Memcached Detection

Detects Memcached and unauthenticated stats command access. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Memcached and unauthenticated stats access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.memcached.detectors import...

RabbitMQ AMQP Detection

Detects RabbitMQ AMQP 0-9-1 protocol on port 5672. !/usr/bin/env python3 -- coding: utf-8 -- """Detect RabbitMQ AMQP service on TCP 5672.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.rabbitmq.detectors import proberabbitmqamqp class...

Zookeeper Detection

Detects Zookeeper via four-letter srvr command. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Zookeeper service on TCP 2181.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.zookeeper.detectors import probezookeeper class...