Camaleon CMS CVE-2024-46987 detection

Fingerprints Camaleon CMS and flags versions = 2.9.0 affected by CVE-2024-46987 authenticated path traversal in /admin/media/downloadprivatefile. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.camaleoncve202446987 import camaleonpagepath,...

Camaleon CMS authenticated path traversal (CVE-2024-46987)

Camaleon CMS ≤ 2.9.0 allows authenticated administrators to read arbitrary local files via GET /admin/media/downloadprivatefile with a path traversal in the file parameter and a valid authtoken cookie. Uses lib.protocols.http.lfi execute hook + optional shell. !/usr/bin/env python3 -- coding: utf...

GCP GCS Sensitive Pattern Scan

List and scan exposed GCS files for sensitive patterns keys, tokens, credentials. from kittysploit import import json import re import time import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

AWS Security Posture

Audit AWS account security posture IAM, root safeguards, MFA, and S3 public exposure !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json class ModulePost: info = "name": "AWS Security Posture", "description": "Audit AWS account security posture IAM, root safeguards, MFA,...

Craft CMS CVE-2025-32432 Pre-Auth RCE

Exploits Craft CMS CVE-2025-32432, a pre-authentication remote code execution issue in the assets/generate-transform endpoint. The module poisons the active PHP session and triggers a Yii gadget chain to include the session file through yii\rbac\PhpManager. !/usr/bin/env python3 -- coding: utf-8 ...

IAM Attack Surface Mapping

Map dangerous IAM permissions on current principal to identify privilege escalation paths !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import fnmatch class ModulePost: info = "name": "IAM Attack Surface Mapping", "description": "Map dangerous IAM permissions on...

GUnet OpenEclass < 4.2 - Remote Code Execution (RCE)

CVE-2026-22241 - OpenEclass Unrestricted File Upload RCE via malicious theme upload. This module exploits a vulnerability where an authenticated administrator can upload a ZIP file containing a PHP web shell, which is then extracted to a predictable location. !/usr/bin/env python3 -- coding: utf-...

Hop proxy PHP generator

Generates a standalone PHP hop proxy with custom upstream server and Hop-Name value. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import PHPPROXYTEMPLATE = r""" array 'method' = 'GET' , 'ssl'=array "verifypeer"=false, "verifypeername"=false, , ; $headers = array'Hop-Name' = $hopName...

AWS S3 File Download

Download a file from an AWS S3 bucket via anonymous access. from kittysploit import import os import json from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "AWS S3 File Download", "author": "KittySploit...

Azure Blob File Download

Download selected blob files from Azure container manual list or flagged scan results. from kittysploit import import json import os import re from urllib.parse import urlparse import xml.etree.ElementTree as ET from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclien...

Azure Blob File Sampler

Sample high-value blob files by extension/name and rank by likely sensitivity. from kittysploit import import json import re from urllib.parse import urlparse import xml.etree.ElementTree as ET from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name":...

GCP GCS Bucket File List

List files from a Google Cloud Storage bucket using anonymous access. from kittysploit import import json import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "GCP GCS...

GCP GCS File Download

Download a file from a GCS bucket via anonymous access. from kittysploit import import os import json from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "GCP GCS File Download", "author": "KittySploit...

Breach Exposure Score

Estimate exposure risk for a domain/email using passive public breach signals. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Breach Exposure Score", "author":...

Cloud Misconfig Exposure Detector

Identify likely exposed AWS/Azure/GCP cloud resources from passive URL and naming signals. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Cloud Misconfig Exposu...

Email Infra Pivot

Pivot on email infrastructure MX/SPF/DMARC/DKIM for a target domain. from kittysploit import import json import dns.resolver class ModuleAuxiliary: info = "name": "Email Infra Pivot", "author": "KittySploit Team", "description": "Pivot on email infrastructure MX/SPF/DMARC/DKIM for a target...

Subdomain Takeover Hint

Detect possible subdomain takeover indicators from DNS CNAME and HTTP fingerprints. from kittysploit import import json import dns.resolver from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Subdomain Takeover...

FUXA CVE-2025-69985 detection

Fingerprints FUXA SCADA/HMI and flags versions = 1.2.8 affected by CVE-2025-69985 unauthenticated /api/runscript RCE. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

Pyload Js2Py RCE detection (CVE-2024-39205 / CVE-2024-28397)

Sends a timed sleep via POST /flash/addcrypted2 with a Host: 127.0.0.1: bypass and a CVE-2024-28397 Js2Py sandbox-escape payload. Vulnerable hosts exhibit a delayed response consistent with command execution. !/usr/bin/env python3 -- coding: utf-8 -- import random import time import requests from...

SUSE Manager / Uyuni CVE-2025-46811 WebSocket detection

Detects unauthenticated exposure of /rhn/websocket/minion/remote-commands by requesting a preview of Salt minions CVE-2025-46811. Affected stacks include Uyuni 2025.05, SUSE Manager 5.0.4, SUSE Manager 4.3.15 per public advisories. !/usr/bin/env python3 -- coding: utf-8 -- import json import...

DVWA SQLi shell (lab)

Login to DVWA CSRF token, set security low, UNION SQLi on /vulnerabilities/sqli/; uses lib Sqli pseudo-shell shellsqli or singlesql. !/usr/bin/env python3 -- coding: utf-8 -- """ DVWA SQL Injection lab helper authorized testing only. Authenticates like other DVWA KittySploit modules, forces...

Azure Blob public listing detect

Checks if Azure Blob container listing is anonymously accessible no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Détection listing public Azure Blob container check-only.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

OpenEclass RCE (CVE-2026-22241) Detection

Detects GUnet OpenEclass instances vulnerable to Remote Code Execution CVE-2026-22241 by checking the platform version. Versions prior to 4.2 are vulnerable to an unrestricted file upload in the theme import functionality. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

SUSE Manager / Uyuni WebSocket unauthenticated remote command (CVE-2025-46811)

Unauthenticated access to /rhn/websocket/minion/remote-commands allows listing registered Salt minions preview and scheduling arbitrary shell commands on a chosen minion. Affects Uyuni 2025.05, SUSE Manager 5.0.4, SUSE Manager 4.3.15 and related releases as described in the advisory. !/usr/bin/en...

Check MySQL Hardening

Audit common MySQL security hardening controls and risky configurations from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "Check MySQL Hardening", "description": "Audit common MySQL security hardening controls and risky...

Enumerate MySQL Roles

Enumerate MySQL roles and role assignments to users from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "Enumerate MySQL Roles", "description": "Enumerate MySQL roles and role assignments to users", "author": "KittySploit...

AWS S3 public object read detect

Checks anonymous read access to a user-provided object path no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Détection lecture anonyme d'objet S3 check-only.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name"...

GCP GCS Exposure Path Prioritizer

Correlate GCS findings into prioritized exposure-to-impact paths. from kittysploit import import json import re import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "GCP G...

Enumerate MySQL Users

Enumerate MySQL users, hosts, password status, and privileges from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "Enumerate MySQL Users", "description": "Enumerate MySQL users, hosts, password status, and privileges",...

AWS S3 public listing detect

Checks if S3 ListBucket is anonymously accessible no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Détection listing public AWS S3 check-only.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AWS S3 publi...

Azure Blob public object read detect

Checks anonymous read access to a user-provided blob path no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Détection lecture anonyme blob Azure check-only.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

FUXA <= 1.2.8 Authentication Bypass + RCE (CVE-2025-69985)

Unauthenticated access to the protected /api/runscript endpoint when authentication is enabled, followed by remote command execution via Node.js childprocess.execSync in script code. Fixed in FUXA 1.2.8. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from...

AWS S3 Exposure Path Prioritizer

Correlate AWS S3 findings into prioritized exposure-to-impact paths. from kittysploit import import json import re import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "AW...

AWS S3 Bucket File List

List files from an AWS S3 bucket using anonymous access. from kittysploit import import json import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "AWS S3 Bucket File List"...

AWS S3 Exposure Audit

Audit multiple AWS S3 buckets for anonymous listing and public read exposure signals. from kittysploit import import json from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "AWS S3 Exposure Audit", "author":...

Azure Blob ACL Misconfig Hint

Analyze blob exposure findings and provide prioritized remediation guidance. from kittysploit import import json from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Azure Blob ACL Misconfig Hint", "author":...

Azure Blob Exposure Audit

Audit multiple Azure blob containers for anonymous exposure and listing. from kittysploit import import json from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Azure Blob Exposure Audit", "author": "KittySploit...

Azure Blob Sensitive Pattern Scan

List and scan exposed blob files for sensitive patterns keys, secrets, credentials. from kittysploit import import json import re import time from urllib.parse import urlparse import xml.etree.ElementTree as ET from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient...

Azure Blob Write Access Check

Check whether blob upload is possible dry-run by default, controlled write test optional. from kittysploit import import json import time from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Azure Blob Write Acce...

GCP GCS Exposure Audit

Audit multiple GCS buckets for anonymous listing/public exposure indicators. from kittysploit import import json from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "GCP GCS Exposure Audit", "author": "KittySploi...

Domain Surface Mapper

Map domain attack surface using DNS, WHOIS, CT subdomains, and HTTP security headers. from kittysploit import import json import dns.resolver from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Domain Surface...

Identity Exposure Graph

Link human and machine identity artifacts and score real exploitability. from kittysploit import import json import re class ModuleAuxiliary: info = "name": "Identity Exposure Graph", "author": "KittySploit Team", "description": "Link human and machine identity artifacts and score real...

Mail Security Posture

Assess outbound email security posture MX stack, SPF, DMARC, DKIM and classify likely SaaS mail providers Microsoft 365, Google Workspace, SEGs for an organization domain. from kittysploit import import json import re import dns.resolver class ModuleAuxiliary: info = "name": "Mail Security...

Public Bucket Hunter

Hunt likely public cloud storage buckets S3/GCS/Azure Blob from domain naming patterns. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Public Bucket Hunter",...

SaaS Tenant Discovery

Passive discovery of public SaaS / IdP signals for an organization domain: Microsoft 365 realm, autodiscover, Google Workspace, Okta, Auth0, Atlassian, Slack, Notion, and common mail/SaaS SPF-MX hints via DNS and optional certificate transparency. from kittysploit import import json import re fro...

Shadow Asset Business Mapper

Discover shadow assets and map them to business risk contexts. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Shadow Asset Business Mapper", "author":...

Terraform State Exposure Detector

Passive detection of Terraform state exposure indicators: tfstate paths/URLs, remote backends S3, GCS, Azure, HTTP, Consul, Terraform Cloud, and bucket or state file names in fetched text. from kittysploit import import json import re from urllib.parse import urlparse from...

Webhook and Forgotten API Leak Analyzer

Discover exposed webhook/API endpoints from JavaScript files and perform lightweight validation. from kittysploit import import json import re from urllib.parse import urljoin, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Webhook...

JS Endpoint Extractor

Extract JS files and discover API endpoints/domains/keys from public client-side code. from kittysploit import import json import re from urllib.parse import urljoin, urlparse from lib.protocols.http.httpclient import Httpclient from lib.osint.jssecrets import extractsecrethints class...

Pyload unauthenticated RCE via Js2Py sandbox escape

CVE-2024-39205: pyLoad ≤ 0.5.0b3.dev85 exposes Js2Py evaluation on POST /flash/addcrypted2. Localhost-only checks are bypassed by sending Host: 127.0.0.1:. CVE-2024-28397: Js2Py ≤ 0.74 sandbox escape via Object.getOwnPropertyNames to reach subprocess.Popen. !/usr/bin/env python3 -- coding: utf-8 ...