PDF CVE-2026-25755 jsPDF Object Injection

Generate PDF PoC for CVE-2026-25755: jsPDF addJS object injection with /AA /O auto-action URI callback. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writejspdfobjectinjection class ModuleAuxiliary...

PDF XXE Payload Generator

Generate PDFs with XML external entity callbacks in XMP metadata, XFA forms, Acrobat JavaScript XMLData.parse, and OOB parameter entities targeting server-side parsers PDFBox, iText, Apache Tika. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import...

Reverse WHOIS Org Mapper

Find related domains from a registrant organization/email string using passive reverse WHOIS sources. !/usr/bin/env python3 -- coding: utf-8 -- """Reverse WHOIS pivot by organization, email, or registrant string.""" from future import annotations import json from urllib.parse import urlparse from...

Search Engine Footprint

Run passive search-engine dorks site:, filetype:, inurl: and collect indexed URLs, titles, and sensitive path hints. !/usr/bin/env python3 -- coding: utf-8 -- """Passive search-engine footprinting via HTML search results.""" from future import annotations import json import re from typing import...

Linux Debian Evasion Packaging

Generate an obfuscated .deb package whose postinst decodes and executes an embedded encrypted ELF loader. Extends debpackaging for stealth delivery. !/usr/bin/env python3 -- coding: utf-8 -- """ Obfuscated Debian package with embedded loader. Builds an encrypted ELF shellcode loader, embeds it...

Linux ELF Shellcode Loader

Generate a static Linux x64 ELF that decrypts embedded shellcode in memory and executes it via mmap + mprotect RX. Compiled with Zig to x8664-linux-gnu. !/usr/bin/env python3 -- coding: utf-8 -- """ Static Linux ELF shellcode loader. Decrypts embedded shellcode ChaCha20/RC4, maps with mmap, flips...

Zig Linux Reverse Evasion

Generate a Linux x64 reverse shell compiled from pure Zig no shellcode. Supports startup sleep delay and XOR-encoded LHOST string. !/usr/bin/env python3 -- coding: utf-8 -- """ Pure Zig Linux reverse shell with evasion options. Compiles a static reverse shell no embedded shellcode with optional...

Module Stomping Evasion

Generate a Windows x64 EXE that loads a benign DLL default: version.dll, stomps its .text section with decrypted shellcode, and executes in-place. !/usr/bin/env python3 -- coding: utf-8 -- """ Module stomping evasion loader. Loads a legitimate DLL locally, overwrites its .text section with...

Elasticsearch Indices Search

List Elasticsearch indices and optionally run search queries import json from kittysploit import from lib.protocols.elasticsearch.elasticsearchclient import ElasticsearchClient class ModulePost, ElasticsearchClient: info = "name": "Elasticsearch Indices Search", "description": "List Elasticsearch...

Cron Job Persistence

Installs persistence via /etc/cron.d, user crontab, or /etc/crontab entry running a generated payload on a schedule. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

PHP user.ini Persistence

Deploys a PHP webshell via .user.ini autoprependfile / autoappendfile. Works with PHP-FPM and Apache when userini is enabled. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

Systemd Unit Persistence

Creates and enables a systemd service unit that executes a payload on boot and restarts on failure. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost, LinuxPersistenceMixin: info...

Windows Gather RunAsPPL & LSASS Protection Audit

Audit LSA RunAsPPL, LSASS protection level, Credential Guard / VBS, and recommend an LSASS dump technique comsvcs, external tool, or PS fallback. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost,...

Azure Functions Detection

Detects Azure Functions hosts and platform response headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Microsoft Azure Functions apps.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

Open WebUI Unauth Verification

Confirms Open WebUI /api/config or /api/models without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Verify Open WebUI unauthenticated config and model access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation...

MQTT TLS Broker Detection

Detects MQTTS brokers and anonymous subscribe access on TCP 8883. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MQTT brokers over TLS on port 8883.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.mqtt.detectors import...

Samba CVE-2026-4480 detection

Fingerprints Samba and flags versions affected by CVE-2026-4480 print-command %J command injection. Fixed upstream in 4.22.10, 4.23.8, and 4.24.3. Actual exploitability also requires a custom print command that references %J and is not using cups/iprint. !/usr/bin/env python3 -- coding: utf-8 --...

WinRM Gather System Information

Enumerate Windows system information through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePost: info = "name": "WinRM Gather System Information", "description": "Enumerate Windows system information through a WinRM session", "author": "KittySploit...

Citrix Gateway Detection

Detects Citrix ADC/Gateway VPN and logon pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Citrix ADC / Gateway login surfaces.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

Open WebUI Detection

Detects Open WebUI config API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Open WebUI LLM chat interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse, ishtmlresponse class...

Splunk Detection

Detects Splunk management REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Splunk Enterprise web/API interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlresponse, ishtmlresponse...

Apache Tomcat CVE-2026-43512 DIGEST authentication bypass

CVE-2026-43512: when DIGEST authentication is enabled, RealmBase.getDigest concatenates the literal string "null" for unknown usernames. A client digest computed with password="null" matches the server hash. Note: standard UserDatabaseRealm may still reject unknown users in getPrincipal;...

PDF CVE-2014-8452 XMLData XXE Callback

Generate PDF PoC for CVE-2014-8452: Acrobat JavaScript XMLData.parse external entity resolution phone-home. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.javascript import writejsxxexmldata class ModuleAuxiliary,...

PDF CVE-2024-4367 PDF.js FontMatrix RCE PoC

Generate PDF PoC for CVE-2024-4367: arbitrary JavaScript via unsanitized Type1 FontMatrix in PDF.js fetch callback for validation. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.viewercve import writepdfjsfontmatrix...

PDF CVE-2018-5158 PDF.js PostScript Staged Delivery

Generate CVE-2018-5158 PDF with PostScript calculator JavaScript injection and staged payloads callback, fetch+eval, WebSocket. Uses CALLBACKURL. For authorized testing against legacy Firefox PDF.js 60. !/usr/bin/env python3 -- coding: utf-8 -- from pathlib import Path from typing import List fro...

Cross Transform Correlator

Ingest JSON outputs from multiple OSINT transforms, correlate shared entities domains, IPs, emails, endpoints, score confidence, and suggest next pivots. !/usr/bin/env python3 -- coding: utf-8 -- """Correlate entities across multiple OSINT transform JSON outputs.""" from future import annotations...

OpenAPI Swagger Finder

Probe common OpenAPI/Swagger paths and validate exposed API specifications for version, title, and sensitive endpoint inventory. !/usr/bin/env python3 -- coding: utf-8 -- """Discover exposed OpenAPI and Swagger documentation endpoints.""" from future import annotations import json import re from...

Person to Usernames

Generate likely username candidates from a person's full name, structured name fields, display name, and aliases. !/usr/bin/env python3 -- coding: utf-8 -- """Generate likely usernames from a person's name and aliases.""" from future import annotations import json import os from kittysploit impor...

LFI Log Poisoning Probe

Chains LFI confirmation with access-log User-Agent poisoning and re-inclusion to validate log-poison → code execution paths. !/usr/bin/env python3 -- coding: utf-8 -- """ LFI log poisoning probe authorized testing only. Confirms a local file inclusion primitive, poisons a web server access log vi...

GPO Inheritance Map

Enumerate GPO links on domains and OUs, compute inheritance order, and map which computers are affected by each GPO. !/usr/bin/env python3 -- coding: utf-8 -- """Map Active Directory GPO inheritance and affected computers.""" from future import annotations import json from typing import Dict, Lis...

Linux eBPF Evasion Loader

Generate a Linux x64 ELF that installs eBPF map/program hooks to register process and port hide rules, then decrypts and runs embedded shellcode. Root privileges are required on the target host. !/usr/bin/env python3 -- coding: utf-8 -- """ eBPF-assisted Linux evasion loader. Loads a minimal BPF...

Direct Windows Syscall Evasion

Generate a Windows x64 EXE that evades userland hooks by calling direct syscalls NtAllocateVirtualMemory, NtWriteVirtualMemory, etc.. Shellcode is encrypted ChaCha20 or RC4 and base64-encoded. Prefer HTTPS/RC4 payloads and high SLEEP values for better evasion. !/usr/bin/env python3 -- coding: utf...

Clipboard Monitor

Monitor clipboard copy/cut/paste events and poll readable clipboard text from the victim browser from kittysploit import import json import time import uuid class ModuleBrowserAuxiliary: info = "name": "Clipboard Monitor", "description": "Monitor clipboard copy/cut/paste events and poll readable...

Adobe ColdFusion RDS path traversal RCE (CVE-2026-48282)

CVE-2026-48282: Adobe ColdFusion Remote Development Service RDS exposes /CFIDE/main/ide.cfm without authentication on affected builds. Path traversal allows arbitrary file read/write and CFML webshell deployment for remote code execution. Affected: ColdFusion 2025 = Update 9, ColdFusion 2023 =...

Enumerate Azure Resources

List Azure resources visible to the current Run Command session identity !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.azure import AzurePostMixin class ModulePost, AzurePostMixin: info = "name": "Enumerate Azure Resources", "description": "List Azure...

Email Inbox Search

Search the operator mailbox attached to an email reverse session via IMAP !/usr/bin/env python3 -- coding: utf-8 -- from email import policy from email.header import decodeheader from email.parser import BytesParser from typing import Any, Dict, List, Optional from kittysploit import try: import...

LDAP Delegation Audit

Audit unconstrained, constrained, and resource-based constrained delegation from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient from lib.protocols.ldap.adhelpers import UACTRUSTEDFORDELEGATION, UACTRUSTEDTOAUTHFORDELEGATION, class ModulePost, LdapPostClient: info ...

LD_PRELOAD Persistence

Builds a shared library with a constructor that runs a payload, installs it on disk, and adds its path to /etc/ld.so.preload. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost,...

Shell Profile Persistence

Persists a payload in shell startup files: /.bashrc, /.profile, /etc/profile.d/, or a custom profile path. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.persistencehelpers import LinuxPersistenceMixin, PERSISTENCEAGENT class ModulePost, LinuxPersistenceMixi...

Purple Team Detection Export

Generate Sigma/EDR detection packs for post-exploitation modules Windows & Linux using the post telemetry registry. !/usr/bin/env python3 -- coding: utf-8 -- """Generate detection packs for post-ex modules purple team.""" from kittysploit import import os from core.detection import...

Windows Defender Exclusion / Disable

Add a Defender exclusion path preferred, lower noise or optionally disable real-time protection components via Set-MpPreference. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info =...

Azure Storage Service Probe

Probe Azure Queue, Table, and File endpoints for anonymous listing or readable responses complements blob-focused modules. !/usr/bin/env python3 -- coding: utf-8 -- """Probe Azure Queue, Table, and File storage services for anonymous exposure.""" from future import annotations import json from...

ActiveMQ Jolokia Verification

Confirms unauthenticated Jolokia list/read on ActiveMQ web console. !/usr/bin/env python3 -- coding: utf-8 -- """Verify ActiveMQ Jolokia read access without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation...

Grafana Unauthenticated API Verification

Confirms anonymous Grafana datasources/org/search API access. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated Grafana API access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse...

Redis Unauthenticated Write Detection

Tests whether Redis accepts unauthenticated SET/DEL commands. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Redis instances allowing unauthenticated writes.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.redis.detectors import...

Zookeeper Unauthenticated Enumeration

Collects Zookeeper srvr/stat/conf output via unauthenticated four-letter commands. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Zookeeper four-letter-word admin commands without authentication.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient fr...

CoAP Service Detection

Detects CoAP endpoints responding to a .well-known/core GET request. !/usr/bin/env python3 -- coding: utf-8 -- """Detect CoAP services via UDP well-known/core probe.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.coap.detectors import...

CVE-2026-26128 Windows SMB improper authentication detection

CVE-2026-26128: improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally. Detects exposure factors for SMB improper-authentication privesc abuse: LDAP/ADIDNS reachability, AD CS HTTP enrollment, and SMB signing posture on coercion targets...

Windows Command Shell, P2P Relay (via Python)

P2P relay agent KSRL v2 E2E + Ed25519 identity + ConPTY. Win10 1809+. Requires cryptography on target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.relay.payloadstub import buildrelayconptyagentscript class ModulePayload: CLIENTLANGUAGE = "python" info = "name":...

BACnet Who-Is discovery

Sends BACnet/IP Who-Is requests UDP/47808 and collects I-Am responses for BMS / building controller discovery. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import whois from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...