Host Header Injection Probe

Tests Host and X-Forwarded-Host manipulation for reflection in responses, redirects, and cache/password-reset style poisoning signals. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Host header and X-Forwarded-Host injection misconfigurations.""" from future import annotations import json fr...

Linux proc_mem / vm_writev Evasion

Generate a Linux x64 ELF that injects shellcode via processvmwritev or /proc/pid/mem instead of PTRACEPOKEDATA — fewer ptrace write traces. !/usr/bin/env python3 -- coding: utf-8 -- """ /proc/pid/mem and processvmwritev injection evasion. Spawns a host process, remote-mmaps via ptrace syscall...

Windows UAC Bypass — ComputerDefaults

ms-settings hijack + ComputerDefaults.exe same key family as FodHelper. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import REGMSSETTINGS, UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name": "Windows UAC Bypass —...

Citrix NetScaler CVE-2026-8451 - Memory Overread Artifact Generator

CVE-2026-8451: crafts oversized SAML AuthnRequest payloads against /saml/login to trigger a memory overread reflected in the NSCTASS cookie ACSURL field. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import ssl from requests.adapters import HTTPAdapter from kittysploit import from...

LDAP Kerberoastable Users

Native LDAP enum of users with servicePrincipalName kerberoast targets. For live $krb5tgs$ hashes use post/ldap/gather/kerberoast. from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient from lib.protocols.ldap.adhelpers import UACDONTEXPIREPASSWD class ModulePost,...

WAF/CDN Fingerprint

Identify WAF or CDN products from response headers and blocking behavior. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprint WAF/CDN products using benign malicious probes.""" from future import annotations import json from kittysploit import from lib.protocols.http.httpclient import...

Privesc Suggester

Combine shell capability profiling with local privilege escalation hints from kittysploit import class ModulePost: info = "name": "Privesc Suggester", "description": "Combine shell capability profiling with local privilege escalation hints", "platform": Platform.MULTI, "author": "KittySploit Team...

HTTP SQLi Shell

Read-only SQL extraction via confirmed HTTP SQLi: union-based scalar or boolean-blind oracle. Starts Sqli pseudo-shell or runs singlesql. !/usr/bin/env python3 -- coding: utf-8 -- """ Generic HTTP SQL injection post-exploitation authorized testing only. After confirming SQLi scanner / manual,...

Apache Superset Detection

Detects Superset health API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Superset BI dashboard.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse, parsejsonresponse class...

SSH authorized_keys Persistence

Adds an SSH public key to authorizedkeys for persistent key-based access. Optionally prefixes command= restrictions. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

IEC 61850 MMS Identify

Probe TCP/102 for IEC 61850 MMS COTP + initiate and distinguish from Siemens S7comm on the same port. !/usr/bin/env python3 -- coding: utf-8 -- """Detect IEC 61850 MMS servers on ISO-on-TCP port 102.""" from future import annotations import json from kittysploit import from...

Samba CVE-2026-4480 detection

Fingerprints Samba and flags versions affected by CVE-2026-4480 print-command %J command injection. Fixed upstream in 4.22.10, 4.23.8, and 4.24.3. Actual exploitability also requires a custom print command that references %J and is not using cups/iprint. !/usr/bin/env python3 -- coding: utf-8 --...

QNX qconn identify

Detects the QNX Neutrino qconn remote debug service on TCP/8000 and fingerprints launcher availability without spawning a shell. !/usr/bin/env python3 -- coding: utf-8 -- """ QNX qconn service identification TCP/8000. Read-only probe for the QNX Neutrino qconn debug service before exploitation. "...

Citrix Gateway Detection

Detects Citrix ADC/Gateway VPN and logon pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Citrix ADC / Gateway login surfaces.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

SAMR user enumeration

Enumerate SAM accounts through MS-SAMR / NetUserEnum on port 445 without LDAP or Impacket. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate domain/local SAM accounts via native SAMR/NetAPI port 445, no LDAP bind. """ from kittysploit import from lib.protocols.samr import SamEnumerationErro...

AWS Public Endpoint Detection

Detects AWS Lambda Function URLs and API Gateway execute-api endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect publicly exposed AWS Lambda Function URLs and API Gateway endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

etcd Unauthenticated Write Verification

Tests reversible etcd v3 KV put/delete when write probe is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated etcd key-value writes reversible probe.""" import base64 import json import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient...

ARM LE bind TCP shell (raw)

Thumb ARM 32-bit bind shell: socket, bind, listen, accept, dup2 x3, execve /bin/sh. Null-free port encoding when possible. !/usr/bin/env python3 -- coding: utf-8 -- """ Thumb ARM bind TCP shell raw bytes for embedded Linux targets. Derived from the Xiaomi C400 factory-mode PoC bind shell Botond...

Multi Python HTTP Polling Beacon

HTTP polling implant with beacon profile jitter, kill date, working hours, cover traffic, optional daisy-chain hop, and Ed25519 implant identity from kittysploit import from lib.c2.beaconprofile import BeaconProfile from lib.c2.httppollingagent import buildhttppollingagentscript class...

Spring Boot Actuator Detection

Detects exposed Spring Boot Actuator health, env, and heapdump endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Spring Boot Actuator endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import...

ActiveMQ Console Detection

Detects ActiveMQ web admin console on port 8161. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache ActiveMQ web console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanner,...

Cockpit Detection

Detects Cockpit Project web console on /cockpit or port 9090. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cockpit Linux server management UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse clas...

Exchange OWA Detection

Detects Outlook Web App and Exchange Control Panel endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft Exchange OWA/ECP exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Exchange OWA...

Keycloak Detection

Detects Keycloak OpenID configuration and admin console. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Keycloak identity provider.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

Netlify Detection

Detects Netlify CDN/deploy platform response headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Netlify-hosted sites via platform headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Netlify Detection",...

Rocket.Chat Detection

Detects Rocket.Chat info API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Rocket.Chat collaboration server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Apache Struts Detection

Detects Struts2 action extensions and OGNL error fingerprints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Struts2 framework indicators.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse...

HashiCorp Vault Detection

Detects Vault /v1/sys/health and UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HashiCorp Vault API and UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

WebLogic Console Detection

Detects Oracle WebLogic administration console login pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Oracle WebLogic console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "WebLogic Console...

DNP3 unsolicited enabled

Checks whether a DNP3 outstation accepts unsolicited response configuration !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import probednp3unsolicited from...

DNP3 operate enabled

Tests whether a DNP3 outstation accepts SELECT or Direct Operate CROB commands without authentication group 12. Uses control code 0x00 NULL. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client...

S7 protection level check

Detects Siemens S7 PLCs with weak or missing access protection protection level 1 / no password. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

PROFINET DCP device IP setup

Reconfigures a PROFINET device's IP address, subnet mask, and gateway via unauthenticated Layer-2 DCP Set requests on an Ethernet interface. !/usr/bin/env python3 -- coding: utf-8 -- """ PROFINET DCP device IP configuration. Uses Layer-2 PROFINET DCP Set requests to reconfigure a target device's ...

Modbus TCP identify

Actively probes Modbus TCP port 502 by scanning unit IDs and reading holding registers. Safe read-only reconnaissance for PLC/RTU discovery. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

IEC104 single command

Sends an IEC 60870-5-104 single command CSCNA1. Intrusive — otpolicy gated + confirm latch. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

Apache Solr CVE-2026-44825 Velocity Template RCE

CVE-2026-44825: affected Apache Solr versions may allow remote command execution via Velocity template injection on /collection/select. When authentication is enabled, common default credentials are attempted before exploitation. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import re...

SharePoint Taxonomy SQLi -> AppLifecycle NDCS RCE (CVE-2026-26114)

CVE-2026-26114 full-chain authenticated exploit for Microsoft SharePoint Server. Abuses a Taxonomy CSOM CustomSortOrder SQL injection to insert AppInstallations, AppJobs and AppTasks rows, then triggers OWSTIMER to deserialize a TypeConfuseDelegate NetDataContractSerializer gadget for remote code...

S7 read DB

Reads bytes from a Siemens PLC data block via an active S7comm session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.icssessionmixin import S7SessionMixin class ModulePost, S7SessionMixin: info = "name": "S7 read DB", "description": "Reads bytes from a...

Modbus map registers

Maps Modbus holding/input registers or coils/discrete inputs via an active session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.icssessionmixin import ModbusSessionMixin class ModulePost, ModbusSessionMixin: info = "name": "Modbus map registers",...

S7 download block

Downloads an MC7 block OB/FB/FC/DB/SDB from a Siemens PLC via an active S7comm session. Requires python-snap7. !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.ics.icssessionmixin import S7SessionMixin from lib.protocols.ics.s7client import...

Enumerate MongoDB Collections

Enumerate MongoDB databases, collections, and optional document samples from kittysploit import from lib.protocols.mongodb.mongodbclient import MongoDBClient class ModulePost, MongoDBClient: info = "name": "Enumerate MongoDB Collections", "description": "Enumerate MongoDB databases, collections,...

PHP mail() / sendmail RCE Chain

Checks mail availability and sendmailpath, then attempts sendmail argument injection -X to write a PHP file into a writable directory. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.php.helpers import PhpPostHelper class ModulePost, PhpPostHelper: info = "name":...

Pivot Autoroute

Discover reachable internal subnets from the active session and add framework pivot routes from kittysploit import import ipaddress import re class ModulePost: info = "name": "Pivot Autoroute", "description": "Discover reachable internal subnets from the active session and add framework pivot...

Windows LSASS Dump Chain

Run RunAsPPL audit, optional AMSI bypass, then attempt LSASS dump via comsvcs, external operator tool, and PowerShell MiniDump fallback. !/usr/bin/env python3 -- coding: utf-8 -- """ Orchestrate LSASS credential extraction: protection audit, optional AMSI bypass, comsvcs dump, optional external...

FTP Banner Detection

Detects FTP services and fingerprints common server products. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FTP service via welcome banner.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.ftp.detectors import probeftpbanner class...

ClickHouse Unauthenticated Query Verification

Confirms anonymous ClickHouse HTTP queries via SELECT version and SELECT 1. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated ClickHouse SQL queries over HTTP.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

Citrix NetScaler CVE-2026-8451 detection

Detects Citrix NetScaler/ADC instances vulnerable to CVE-2026-8451 by sending crafted SAML requests to /saml/login and checking the NSCTASS cookie for memory overread artifacts. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import ssl from requests.adapters import HTTPAdapter from...

SNMP Service Detection

Detects SNMP agents responding to the public community sysDescr OID. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SNMP service via public community sysDescr.""" from kittysploit import class ModuleScanner: info = "name": "SNMP Service Detection", "description": "Detects SNMP agents...

PDF CVE-2025-66516 Tika XFA OOB XXE

Generate PDF PoC for CVE-2025-66516: blind OOB XXE via parameter entity in XFA targeting Apache Tika Confluence, Jira, etc.. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import writetikaxfaxxeoob class...

ImageMagick PDF/SVG Polyglot Server-Side RCE

Generate an SVG/MSL polyglot that executes a framework payload when processed by vulnerable ImageMagick/GraphicsMagick delegate chains. By default only the file is generated disablePayloadHandler=true; set disablePayloadHandler false to listen immediately after generation. Upload the generated fi...