SAMR user enumeration

Enumerate SAM accounts through MS-SAMR / NetUserEnum on port 445 without LDAP or Impacket. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate domain/local SAM accounts via native SAMR/NetAPI port 445, no LDAP bind. """ from kittysploit import from lib.protocols.samr import SamEnumerationErro...

Confluence Detection

Detects Confluence wiki UI and status endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Atlassian Confluence instances.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Confluence Detection",...

Gitea Detection

Detects Gitea version API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Gitea git forge.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner, Httpclient: info =...

Mattermost Detection

Detects Mattermost system ping API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Mattermost team collaboration server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class...

Neo4j Browser Detection

Detects Neo4j HTTP status/version endpoints and browser UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Neo4j Browser and HTTP management API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse...

Nextcloud Detection

Detects Nextcloud status endpoint and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Nextcloud file sync and collaboration instance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse cla...

Apache Solr CVE-2026-44825 detection

Detects Apache Solr instances in the CVE-2026-44825 affected version range 9.4.x through 9.10.x before 9.10.2, and 10.0.0 and reports whether admin endpoints require authentication. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient impo...

Traefik Dashboard Detection

Detects Traefik reverse-proxy dashboard and /api/overview exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Traefik dashboard and API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Traefik...

WAF/CDN Fingerprint

Identify WAF or CDN products from response headers and blocking behavior. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprint WAF/CDN products using benign malicious probes.""" from future import annotations import json from kittysploit import from lib.protocols.http.httpclient import...

Zipkin Detection

Detects Zipkin /api/v2/services endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zipkin distributed tracing UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

S7 program transfer detect

Actively probes whether Siemens S7 program-transfer jobs appear reachable upload/download channel. Complements passive sniffer detections. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

GraphQL Introspection Abuse

Confirm GraphQL introspection, enumerate schema types/fields, and flag sensitive queries users, admin, secrets for follow-up exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """ GraphQL introspection and lightweight abuse probe. Runs full introspection when enabled, surfaces sensitive...

IEC 61850 MMS Identify

Probe TCP/102 for IEC 61850 MMS COTP + initiate and distinguish from Siemens S7comm on the same port. !/usr/bin/env python3 -- coding: utf-8 -- """Detect IEC 61850 MMS servers on ISO-on-TCP port 102.""" from future import annotations import json from kittysploit import from...

Modbus session acquire

Opens a Modbus TCP session and registers it in the framework session list for follow-on OT modules and the Modbus shell. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.framework.basemodule import ModuleResult from lib.protocols.ics.constants import ICSPROTOCOLPORTS fr...

ICS Passive Sniffer

Passively discover OT/ICS assets by sniffing traffic with Scapy on a SPAN/TAP interface or by replaying a PCAP. Parses Modbus TCP, S7comm, DNP3, BACnet/IP, and IEC 104; flags write paths and Purdue violations; exports JSON and syncs the workspace. No packets are sent to the network. !/usr/bin/env...

S7comm identify

Connects to Siemens S7 PLCs over ISO-on-TCP port 102 and reads CPU / module identification plus protection level via SZL. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import...

Spring4Shell Detection

Probes Spring Framework class.module.classLoader parameter binding behavior indicative of CVE-2022-22965 safe fingerprint, no RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Spring4Shell CVE-2022-22965 parameter binding indicators.""" from kittysploit import from...

MOVEit Transfer Detection

Detects Progress MOVEit Transfer login and portal pages. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Progress MOVEit Transfer web interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class...

Windows Token Impersonation Helper

Basic Incognito-style token and privilege audit with optional RunAs test !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModulePost: info = "name": "Windows Token Impersonation Helper", "description": "Basic Incognito-style token and privilege audit with...

SMB Upload File

Uploads a local file to a remote SMB share via an active SMB session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import ProcedureError, FailureType from lib.protocols.smb.smbsessionmixin import SMBSessionMixin class ModulePost,...

InfluxDB Unauthenticated Read Verification

Confirms anonymous InfluxDB HTTP queries via SHOW DATABASES. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated InfluxDB database listing.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.influxdb.detectors import...

Neo4j Unauthenticated Query Verification

Confirms anonymous Neo4j HTTP transaction commits with RETURN 1. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated Neo4j Cypher queries.""" import json from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import...

PowerShell Stager Evasion

Writes a PowerShell backdoor with optional AMSI bypass and ETW patch. Supports reverse-shell mode or shellcode stager mode VirtualAlloc + CreateThread. !/usr/bin/env python3 -- coding: utf-8 -- """ PowerShell stager with AMSI/ETW evasion prelude. Generates a .ps1 script with optional in-process...

Windows Disable PowerShell Logging

Disable PowerShell Script Block, Module, and Transcription logging. Modes: registry admin GPO keys or sessioncache in-process cachedGroupPolicySettings + PS ETW provider — no admin required. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.stagerevasion import...

LDAP Kerberoastable Users

Native LDAP enum of users with servicePrincipalName kerberoast targets. For live $krb5tgs$ hashes use post/ldap/gather/kerberoast. from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient from lib.protocols.ldap.adhelpers import UACDONTEXPIREPASSWD class ModulePost,...

Joomla SP LMS CVE-2026-48909 (PHP object injection) detection

Detects JoomShaper SP LMS comsplms = 4.1.3 affected by unauthenticated PHP object injection via the lmsOrders cookie CVE-2026-48909. Full RCE requires Joomla 5.2.2 FormattedtextLogger gadget chain. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from...

HTTP SQLi Shell

Read-only SQL extraction via confirmed HTTP SQLi: union-based scalar or boolean-blind oracle. Starts Sqli pseudo-shell or runs singlesql. !/usr/bin/env python3 -- coding: utf-8 -- """ Generic HTTP SQL injection post-exploitation authorized testing only. After confirming SQLi scanner / manual,...

Apache Superset Detection

Detects Superset health API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Superset BI dashboard.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse, parsejsonresponse class...

Fortinet FortiSandbox CVE-2026-25089 OS command injection

CVE-2026-25089: unauthenticated OS command injection in the FortiSandbox web UI VNC start handler. Attacker-controlled JSON fields vmname, extra are interpolated into startvnc.sh without sanitisation CWE-78. !/usr/bin/env python3 -- coding: utf-8 -- import json import re from typing import...

WordPress Profile Builder Pro <= 3.14.5 - PHP Object Injection RCE

Unauthenticated PHP object injection in Profile Builder Pro via the wppbrequestuserspins admin-ajax action args parameter. Full RCE requires a POP gadget chain; this module chains The Events Calendar Monolog ProcessHandler Monolog/RCE10 when that plugin is present. !/usr/bin/env python3 -- coding...

AWS Public Endpoint Detection

Detects AWS Lambda Function URLs and API Gateway execute-api endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect publicly exposed AWS Lambda Function URLs and API Gateway endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

etcd Unauthenticated Write Verification

Tests reversible etcd v3 KV put/delete when write probe is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Verify unauthenticated etcd key-value writes reversible probe.""" import base64 import json import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient...

ARM LE bind TCP shell (raw)

Thumb ARM 32-bit bind shell: socket, bind, listen, accept, dup2 x3, execve /bin/sh. Null-free port encoding when possible. !/usr/bin/env python3 -- coding: utf-8 -- """ Thumb ARM bind TCP shell raw bytes for embedded Linux targets. Derived from the Xiaomi C400 factory-mode PoC bind shell Botond...

HTTPS Mimic Transform

Sends fake TLS 1.2 Client/Server Hello at start, then TLS Application Data. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import TLS record: type 1 + version 2 + length 2 + fragment TLSHEADERLEN = 5 TLSHANDSHAKE = 0x16 TLSAPPLICATIONDATA = 0x17 TLSVERSION1...

Zlib Base64 Frame Transform

Compresses each C2 chunk with zlib, then frames it as a length-prefixed Base64 line. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import struct import zlib from typing import Optional from kittysploit import FRAMEPREFIX = b"KZ64 " FRAMESUFFIX = b"\n" MAXFRAMESIZE = 1024 1024 class...

Cascade Stream Transform

Multi-layer: XOR + Additive + ROT with a single master key. High obfuscation strength, stream-offset aware. !/usr/bin/env python3 -- coding: utf-8 -- """ Cascade stream transform: multi-layer encoding XOR + Additive + ROT with a single master key. Designed for strong C2 traffic obfuscation and...

PHP XOR Stream Transform

XORs the C2 stream with a repeating key and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.xor import Module as PythonXorTransform class ModulePythonXorTransform: """PHP XOR stream transform."""...

PHP HTTP Chunked Mimic Transform

Wraps C2 bytes in HTTP/1.1 chunked transfer frames and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import from modules.transforms.python.protocol.httpchunked import Module as PythonHttpChunkedTransform class...

PHP HTTPS Mimic Transform

Sends a fake TLS ClientHello then wraps C2 bytes in TLS Application Data records. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.httpsmimic import CLIENTHELLOBYTES, Module as PythonHttpsTransform, class ModulePythonHttpsTransform:...

PowerShell HTTPS Mimic Transform

Sends a fake TLS ClientHello then wraps C2 bytes in TLS Application Data records. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.httpsmimic import CLIENTHELLOBYTES, Module as PythonHttpsTransform, class ModulePythonHttpsTransform:...

PowerShell HTTP Chunked Mimic Transform

Wraps C2 bytes in HTTP/1.1 chunked transfer frames and emits PowerShell client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.httpchunked import Module as PythonHttpChunkedTransform class ModulePythonHttpChunkedTransform:...

PowerShell XOR Stream Transform

XORs the C2 stream with a repeating key and emits PowerShell client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.xor import Module as PythonXorTransform class ModulePythonXorTransform: """PowerShell XOR stream transform."""...

PowerShell WebSocket Mimic Transform

Wraps C2 bytes in WebSocket-like binary frames and emits PowerShell client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.websocketmimic import Module as PythonWebSocketTransform class ModulePythonWebSocketTransform: """PowerShe...

PHP Base64 Frame Transform

Frames C2 chunks as length-prefixed Base64 lines and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.base64frame import Module as PythonBase64FrameTransform class ModulePythonBase64FrameTransform: """PHP Base64...

TLS/HTTPS Mimic Transform

Wraps C2 stream in TLS 1.2 Application Data records so traffic looks like HTTPS on the wire plain TCP. !/usr/bin/env python3 -- coding: utf-8 -- """ TLS/HTTPS mimic transform: wraps C2 traffic in TLS Application Data records so the stream looks like HTTPS TLS 1.2 on the wire while using plain TCP...

Base64 Frame Transform

Frames each C2 chunk as a length-prefixed Base64 line. Handles fragmented TCP reads. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import struct from typing import Optional from kittysploit import FRAMEPREFIX = b"K64 " FRAMESUFFIX = b"\n" MAXFRAMESIZE = 1024 1024 class ModuleTransform:...

ROT Stream Transform

Shifts each byte by a fixed value mod 256. Encode: add shift, decode: subtract. Simple Caesar-style obfuscation. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import class ModuleTransform: """ROT Caesar stream transform - shifts each byte by a fixed value...

PHP WebSocket Mimic Transform

Wraps C2 bytes in WebSocket-like binary frames and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.websocketmimic import Module as PythonWebSocketTransform class ModulePythonWebSocketTransform: """PHP WebSocket...

PowerShell Base64 Frame Transform

Frames C2 chunks as length-prefixed Base64 lines and emits PowerShell client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.base64frame import Module as PythonBase64FrameTransform class ModulePythonBase64FrameTransform:...

HTTP Chunked Mimic Transform

Wraps C2 bytes in HTTP/1.1 chunked transfer frames with initial HTTP-like headers. !/usr/bin/env python3 -- coding: utf-8 -- """ HTTP chunked mimic transform. The first server-side encode prepends an HTTP/1.1 response header, the first client-side encode generated for payloads prepends an HTTP PO...