Cloud Misconfig Chains

Correlate AWS misconfigurations into practical compromise chains. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import fnmatch class ModulePost: info = "name": "Cloud Misconfig Chains", "description": "Correlate AWS misconfigurations into practical compromise...

Identity Handle Hunter

Discover likely public profiles for a username/email/name and score confidence. from kittysploit import import json import os import re from urllib.parse import urlparse from core.osint.identityhandles import APIVERIFIEDPLATFORMS, extracthandles, isgenerichandle, isvalidhandleforplatform,...

Advanced Exposed Credentials Detector

Detect likely exposed credentials from public text sources using dynamic regex and correlation scoring. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Advanced...

AWS S3 Bucket Access Check

Check anonymous read/list exposure indicators on an AWS S3 bucket. from kittysploit import import json from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "AWS S3 Bucket Access Check", "author": "KittySploit Team...

Azure Exposure Path Prioritizer

Correlate Azure blob findings into prioritized exposure-to-impact paths. from kittysploit import import json import re from urllib.parse import urlparse import xml.etree.ElementTree as ET from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Azure...

AWS S3 Sensitive Pattern Scan

List and scan exposed S3 objects for sensitive patterns keys, tokens, credentials. from kittysploit import import json import re import time import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

Azure Blob Container File List

List blobs from an Azure container using anonymous or SAS access. from kittysploit import import json from urllib.parse import urlparse import xml.etree.ElementTree as ET from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Azure Blob Container...

ASN Network Profile

Profile ASN/network context from a domain or IPv4 target ASN, org, geo, prefixes. from kittysploit import import json import ipaddress import dns.resolver from lib.protocols.http.httpclient import Httpclient from urllib.parse import urlparse class ModuleAuxiliary, Httpclient: info = "name": "ASN...

Attack Path Prioritizer

Correlate OSINT, identity and cloud findings into prioritized probable attack paths. from kittysploit import import json import re class ModuleAuxiliary: info = "name": "Attack Path Prioritizer", "author": "KittySploit Team", "description": "Correlate OSINT, identity and cloud findings into...

Hidden Metadata Hunter

Extract sensitive metadata from public files using exiftool/pdfinfo/olevba when available. from kittysploit import import json import os import subprocess from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Hidd...

Secret Leak to Access Validator

Detect leaked secret patterns in public artifacts and validate probable access safely. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Secret Leak to Access...

SSL TLS Certificate Change Tracker

Track certificate transparency changes and trust-chain anomalies for a domain. from kittysploit import import json from datetime import datetime, timezone from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "SSL...

Typosquat Detector

Generate likely typosquatted domains and test DNS/HTTP activity. from kittysploit import import json import dns.resolver from lib.protocols.http.httpclient import Httpclient from urllib.parse import urlparse class ModuleAuxiliary, Httpclient: info = "name": "Typosquat Detector", "author":...

Copy Fail Local Privilege Escalation (CVE-2026-31431)

CVE-2026-31431 Copy Fail: AFALG authencesn + splice page-cache write. Modes: su overwrite setuid su with tiny root shell ELF, passwd clear root password in /etc/passwd page cache, write arbitrary page-cache write. su mode launches an interactive root shell on SSH PTY / classic socket. from...

SUSE Manager / Uyuni CVE-2025-46811 WebSocket detection

Detects unauthenticated exposure of /rhn/websocket/minion/remote-commands by requesting a preview of Salt minions CVE-2025-46811. Affected stacks include Uyuni 2025.05, SUSE Manager 5.0.4, SUSE Manager 4.3.15 per public advisories. !/usr/bin/env python3 -- coding: utf-8 -- import json import...

Pyload unauthenticated RCE via Js2Py sandbox escape

CVE-2024-39205: pyLoad ≤ 0.5.0b3.dev85 exposes Js2Py evaluation on POST /flash/addcrypted2. Localhost-only checks are bypassed by sending Host: 127.0.0.1:. CVE-2024-28397: Js2Py ≤ 0.74 sandbox escape via Object.getOwnPropertyNames to reach subprocess.Popen. !/usr/bin/env python3 -- coding: utf-8 ...

Android Network Audit

Audit Android network posture: interfaces, IPs, routes, DNS, Wi-Fi, proxy, VPN from kittysploit import import re class ModulePost: info = "name": "Android Network Audit", "description": "Audit Android network posture: interfaces, IPs, routes, DNS, Wi-Fi, proxy, VPN", "author": "KittySploit Team",...

Craft CMS CVE-2025-32432 Pre-Auth RCE

Exploits Craft CMS CVE-2025-32432, a pre-authentication remote code execution issue in the assets/generate-transform endpoint. The module poisons the active PHP session and triggers a Yii gadget chain to include the session file through yii\rbac\PhpManager. !/usr/bin/env python3 -- coding: utf-8 ...

PackageKit TOCTOU Local Privilege Escalation (CVE-2026-41651)

This module exploits a TOCTOU vulnerability in PackageKit to achieve local privilege escalation. It compiles a Zig exploit, uploads it to the target, and executes it. from kittysploit import from core.framework.post import Post from core.lib.compiler.zigcompiler import ZigCompiler from...

Langflow RCE (CVE-2026-27966)

Authenticated RCE in Langflow CSV Agent allowdangerouscode=True via prompt injection. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json import random import string from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info ...

Perl Base64 Encoder

Encodes perl payload in base64 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Perl Base64 Encoder", "description": "Encodes perl payload in base64", "author": "KittySploit Team", "platform": Platform.PERL, def encodeself,...

WordPress Highlight and Share <= 5.2.0 Broken Access Control

Abuses an unauthenticated AJAX action in Highlight and Share to trigger the 'Share via Email' flow when a valid post nonce is known. import json from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress class ModuleAuxiliary,...

Php Hex Encoder

Encodes php payload in hex format !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Php Hex Encoder", "description": "Encodes php payload in hex format", "author": "KittySploit Team", "platform": Platform.PHP, def encodeself,...

Linux Package Vulnerability Hint

Collect installed package versions and highlight potentially outdated security-sensitive software from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Package...

Command History Analyzer

Analyze shell history for suspicious command patterns and incident-response indicators !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re class ModulePost: info = "name": "Command History Analyzer", "description": "Analyze shell history for suspicious command patterns and...

Perl Hex Encoder

Encodes perl payload in hex format !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Perl Hex Encoder", "description": "Encodes perl payload in hex format", "author": "KittySploit Team", "platform": Platform.PERL, def encodeself,...

Php UrlEncode Encoder

Encodes php payload using URL encoding !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from urllib.parse import quote class ModuleEncoder: info = "name": "Php UrlEncode Encoder", "description": "Encodes php payload using URL encoding", "author": "KittySploit Team", "platform":...

Langflow CSV Agent RCE detection

Detects Langflow instances affected by CVE-2026-27966 by checking version 1.8.0 and optionally validating API key access. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Langflo...

Linux Cloud Metadata Check

Check if cloud instance metadata endpoints are reachable from target host from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import json class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Cloud Metadata Check",...

Linux Persistence Audit

Audit common Linux persistence locations systemd, cron, startup scripts, shell profiles !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info...

Credential Exposure Check

Check common locations for accidentally exposed credentials on Linux or Windows sessions !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re class ModulePost: info = "name": "Credential Exposure Check", "description": "Check common locations for accidentally exposed...

Linux Service Controller

Manage Linux services status, start, stop, restart, enable, disable from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Service Controller", "description": "Manage...

Process Analyzer

Analyze running processes and highlight suspicious execution patterns from kittysploit import import re class ModulePost: info = "name": "Process Analyzer", "description": "Analyze running processes and highlight suspicious execution patterns", "platform": Platform.MULTI, "author": "KittySploit...

Windows Get GPP Autologon

Search SYSVOL Registry.xml files for Group Policy Preferences autologon credentials on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import wincompatfailuretype, winprobepowershell import base64 import re...

Php Base64 Encoder

Encodes php payload in base64 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Php Base64 Encoder", "description": "Encodes php payload in base64", "author": "KittySploit Team", "platform": Platform.PHP, def encodeself, payload:...

Php Gzinflate Base64 Encoder

Encodes php payload using deflate compression and base64 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 import zlib class ModuleEncoder: info = "name": "Php Gzinflate Base64 Encoder", "description": "Encodes php payload using deflate compression and base64",...

Python Hex Encoder

Encodes payload to hex format !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Python Hex Encoder", "description": "Encodes payload to hex format", "author": "KittySploit Team", "platform": Platform.PYTHON, def encodeself, payloa...

WordPress Highlight and Share CVE-2025-67586

Detects vulnerable Highlight and Share plugin versions = 5.2.0 exposed to unauthenticated email share abuse via admin-ajax. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress cla...

llama.cpp RPC b8487 exposure detection

Detects reachable llama.cpp RPC servers and identifies builds that may be affected by the pre-PR 20908 null-buffer bypass issue. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed llama.cpp RPC server and vulnerable pre-fix builds.""" import socket import struct from kittysploit import...

Windows Find AV Signature

Locate tiny AV signatures by generating progressive binary splits on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: DEFAULTBUFFERLEN...

KittyReport Generator

Generates a professional, high-design PDF report of all findings Hosts, Vulns, Creds, Loot. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.models.models import Host, Service, Vulnerability, Credential, Note, Loot import os from datetime import datetime ReportLab impor...

Firmware .bin signature scan and decompress

Detects common firmware signatures gzip, lzma, xz, squashfs, ELF, etc. on a local file and recursively decompresses supported compressed formats. !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.analysis.binary.firmwareextractor import PyFirmwareExtractor class...

Firmware Extractor (Advanced)

Scan and extract firmware images: TRX headers, gzip/lzma layers, ELF blobs, squashfs detection extraction squashfs non implémentée. Nested structures are partially handled TRX → gzip. !/usr/bin/env python3 -- coding: utf-8 -- """ Module avancé : détection multi-formats TRX, gzip, lzma, ELF,...

WordPress Wordfence <= 7.4.5 Local File Disclosure

Wordfence = 7.4.5 exposes a local file disclosure primitive in lib/wordfenceClass.php via the file GET parameter. The vulnerable code prepends ABSPATH and strips traversal prefixes, allowing reads of files located inside the WordPress installation. !/usr/bin/env python3 -- coding: utf-8 -- from...

x64 Polymorphic XOR Encoder

A fully polymorphic XOR encoder that generates a randomized, dependency-free decoder stub on the fly to bypass static signatures. !/usr/bin/env python3 -- coding: utf-8 -- import os import random from kittysploit import from lib.compile.minix64 import MiniX64 class ModuleEncoder, MiniX64: info =...

WordPress Advanced Custom Fields RFI

Advanced Custom Fields plugin ", "rastating", "KittySploit Team", "references": "http://secunia.com/advisories/51037/", "https://wpscan.com/vulnerability/6103/", "cve": "", "platform": Platform.PHP, "arch": Arch.PHP, "payload": "default": "payloads/singles/cmd/php/reversetcp", "arch": Arch.PHP,...

Exposed .env file detection

Detects publicly accessible .env files containing application secrets or environment configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Détection fichiers .env exposés.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/.env", "/.env.local",...

Windows Gather Computer Detail

Runs Get-ComputerDetail on a Windows shell or Meterpreter session to collect logon, PowerShell, AppLocker, and RDP client artifacts. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin import re class ModulePost,...

Exposed Git repository detection

Detects publicly accessible Git metadata such as /.git/HEAD or /.git/config. !/usr/bin/env python3 -- coding: utf-8 -- """Detect publicly accessible Git metadata /.git/HEAD, config, index, ….""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PROBEPATHS = "/.git/HEAD"...

MySQL Info - Enumeration

Connects to a MySQL server and prints information such as protocol, version, TLS support, and transport. !/usr/bin/env python3 -- coding: utf-8 -- """Détection MySQL + récupération d'informations via handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...