Exposed .env file detection

Detects publicly accessible .env files containing application secrets or environment configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Détection fichiers .env exposés.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/.env", "/.env.local",...

MySQL Info - Enumeration

Connects to a MySQL server and prints information such as protocol, version, TLS support, and transport. !/usr/bin/env python3 -- coding: utf-8 -- """Détection MySQL + récupération d'informations via handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

Generex NetMan 204 CVE-2022-47891 - Admin Password Reset

Generex NetMan 204 exposes enough device information to derive the recovery code and reset the administrator password to the default value. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.netman204 import NetMan204 class ModuleAuxiliary,...

Redis Info - Detect

Retrieves information such as version number, architecture, role, and resource usage from a Redis server. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Redis + récupération d'informations via INFO.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient...

Generex NetMan 204 CVE-2022-47892 - Sensitive Information Disclosure

Generex NetMan 204 exposes sensitive device information via netmandata.json, including MAC address and serial number which can be leveraged to derive the password recovery code. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.netman204 import...

Windows PowerShell Exec

Execute a PowerShell command or script on a Windows shell or Meterpreter session and return its output. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows...

Flask Debug Mode detection

Detects if Flask debug mode Werkzeug is enabled on the target, which may lead to RCE. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Flask Debug Mode detection', 'description':...

FortiClient EMS CVE-2026-21643 exposure detection

Conservatively detects likely exposure to CVE-2026-21643 by checking that FortiClient EMS is exposed, that /api/v1/initconsts is reachable without authentication, that SITESENABLED appears true, and that the visible version is exactly 7.4.4. No SQL injection payloads are sent. !/usr/bin/env pytho...

Generex CS141 CVE-2022-47189 - DoS via Firmware Upload

Generex UPS CS141 below 2.06 accepts a crafted firmware archive that can disrupt the device functionality after the update process. import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.cs141 import CS141 class ModuleAuxiliary, Httpclient...

Generex CS141 CVE-2022-47187 - XSS via File Upload

Generex UPS CS141 below 2.06 allows unauthenticated upload of HTML content into the upload directory, enabling stored XSS when a victim opens the uploaded file. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.cs141 import CS141 class...

Generex CS141 CVE-2022-47188 - Arbitrary Local File Read

Generex UPS CS141 below 2.06 allows a crafted backup archive containing a symlink to be restored, which can be abused to retrieve arbitrary local files from the device. from pathlib import Path import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

WordPress Advanced Custom Fields RFI

Advanced Custom Fields plugin ", "rastating", "KittySploit Team", "references": "http://secunia.com/advisories/51037/", "https://wpscan.com/vulnerability/6103/", "cve": "", "platform": Platform.PHP, "arch": Arch.PHP, "payload": "default": "payloads/singles/cmd/php/reversetcp", "arch": Arch.PHP,...

Invoke-ReflectivePEInjection

Reflectively loads a Windows PE file DLL/EXE into the PowerShell process, or injects a DLL into a remote process. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 import os class ModulePost: info = "name": "Invoke-ReflectivePEInjection", "description": "Reflectively...

WordPress Events <= 2.3.4 Authenticated Hash Dump

The WordPress Events plugin = 2.3.4 contains an authenticated SQL injection in the event editing workflow. Any user able to manage events can abuse it to extract WordPress password hashes from the database. from urllib.parse import urlencode import re from kittysploit import from...

Windows Gather Computer Detail

Runs Get-ComputerDetail on a Windows shell or Meterpreter session to collect logon, PowerShell, AppLocker, and RDP client artifacts. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin import re class ModulePost,...

Generex NetMan 204 CVE-2022-47893 - RCE via Firmware Upload

Generex NetMan 204 accepts a crafted firmware file upload that enables remote code execution. This module uploads the operator-supplied firmware and dispatches a real framework payload to obtain a session. import time from kittysploit import from lib.protocols.http.httpclient import Httpclient fr...

Generex CS141 CVE-2022-47190 - RCE via Firmware Upload

Generex UPS CS141 below 2.06 accepts a crafted firmware archive containing a webshell or equivalent command execution primitive, leading to remote code execution as root. import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.cs141 import...

Invoke-WmiCommand

Executes a PowerShell ScriptBlock on a target computer using WMI as a pure C2 channel. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 import os class ModulePost: info = "name": "Invoke-WmiCommand", "description": "Executes a PowerShell ScriptBlock on a target...

Exposed Git repository detection

Detects publicly accessible Git metadata such as /.git/HEAD or /.git/config. !/usr/bin/env python3 -- coding: utf-8 -- """Detect publicly accessible Git metadata /.git/HEAD, config, index, ….""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PROBEPATHS = "/.git/HEAD"...

PHPInfo exposure detection

Detects exposed phpinfo pages that disclose PHP configuration, modules, paths, and environment details. !/usr/bin/env python3 -- coding: utf-8 -- """Détection pages phpinfo exposées.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/phpinfo.php", "/info.php...

BusyBox Enumerate Host Names

For a session on an embedded BusyBox-style Linux shell, enumerate host names from common router/udhcpd paths: /var/hosts or /var/udhcpd/udhcpd.leases. !/usr/bin/env python3 -- coding: utf-8 -- Ported from Metasploit post/linux/busybox/enumhosts Msf::Post::Linux::BusyBox. Original author: Javier...

Spawn Reverse Shell Session

From the current session, open a reverse TCP listener lhost:lport and run a platform-appropriate one-liner so the target connects back; the new socket is registered as a separate shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ Spawn a second interactive shell session reverse TCP from...

Linux Keyboard Event Capture

Captures keyboard events for a short window using X11 xinput and/or evtest on /dev/input. Requires an interactive desktop session for X11 set DISPLAY, e.g. :0 or sufficient privileges for evtest on input devices. Wayland sessions are not supported by the X11 path. !/usr/bin/env python3 -- coding:...

Login Page Detector

Detects whether a target exposes login pages admin/login, email+password, username+password !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import finalizehttpscannerrun, targetbaseurl import...

Simple Login Scanner

Simple scanner that detects login forms on a web page !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re class ModuleAuxiliary, Httpclient: info = 'name': 'Simple Login Scanner', 'description': 'Simple scanner that...

Admin Login Bruteforce

Bruteforce an admin login page with username/password wordlists. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import os import re from urllib.parse import parseqsl, urlparse class ModuleAuxiliary, Httpclient: info = 'name':...

Jumbo Website Manager v1.3.7 Authenticated RCE (PHAR upload)

Authenticated RCE via backup manager upload PK + PHP in PHAR. Logs in, uploads the payload, then issues HTTP GET requests to likely paths under backupmanager/fileupload/uploads/ so the PHAR runs and the PHP reverse payload can connect back — use with payloads/singles/cmd/php/reversetcp and the...

Linux Flush IPTables Rules

Flush IPv4/IPv6 iptables rules and set default policies to ACCEPT from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Flush IPTables Rules", "description": "Flush...

Linux Gather Protection Enumeration

Enumerate Linux hardening mechanisms and installed security software from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import re class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Gather Protection Enumeration",...

Horilla HRM <= 1.3 Authenticated RCE

CVE-2025-48868: authenticated remote code execution via the project bulk archive endpoint injection in isactive. Logs in, creates a project, then POSTs to project-bulk-archive with a Python os.system reverse shell. Ensure a listener is available framework handler or e.g. nc -lvnp. !/usr/bin/env...

Fortinet FortiWeb CVE-2025-64446 API webshell reverse shell

Chains CVE-2025-64446 style API abuse: create local admin via path traversal in user API, login, upload PHP via maintenance backup, trigger callback, then remove the temporary account. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import...

WordPress Madara CVE-2025-4524 — LFI file read

Exploits CVE-2025-4524: unauthenticated local file inclusion through the madaraloadmore AJAX action. Uses lib.protocols.http.lfi fileread / shelllfi for one-shot reads or interactive LFI pseudo-shell. Pair with scanner/http/wordpressmadaracve20254524 when vulnerable. !/usr/bin/env python3 --...

WordPress Madara CVE-2025-4524 detection

Detects Madara theme/plugin versions = 1.6.0.5 affected by CVE-2025-4524 unauthenticated LFI via madaraloadmore template parameter. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2025-4524 — Madara theme/plugin version detection.""" import re from typing import Tuple from kittysploit import fro...

Diameter port detection

Detects open Diameter port 3868 - 3GPP LTE/5G S6a/S6d, authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Détection port Diameter 3GPP LTE/5G - authentification, abonnés.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class...

PFCP UDP detection

Detects PFCP port 8805 5G N4 - SMF/UPF control plane. !/usr/bin/env python3 -- coding: utf-8 -- """Détection PFCP UDP 8805 - 5G N4 interface SMF-UPF.""" import socket from kittysploit import from core.framework.option import OptPort from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient...

Telecom management interface detection

Detects telecom / 5G management UIs eNodeB, gNodeB, OSS, vendor panels. !/usr/bin/env python3 -- coding: utf-8 -- """Détection interfaces de gestion télécom eNodeB/gNodeB, OSS, équipementiers.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

GTP-U/GTP-C UDP detection

Detects GTP-U 2152 or GTP-C 2123 - 3GPP 4G/5G data/control plane. !/usr/bin/env python3 -- coding: utf-8 -- """Détection GTP-U / GTP-C UDP 2152 / 2123 - 3GPP 4G/5G user/control plane.""" import socket from kittysploit import from core.framework.option import OptPort from...

Grafana detection

Detects if Grafana is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Grafana.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Grafana detection", "description": "Detects if Grafana is...

AWS CloudFront detection

Detects AWS CloudFront CDN X-Amz-Cf- headers or CloudFront error pages. !/usr/bin/env python3 -- coding: utf-8 -- """Détection AWS CloudFront / CDN Amazon.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AWS CloudFro...

GraphQL detection

Detects GraphQL or GraphiQL endpoint introspection risk. !/usr/bin/env python3 -- coding: utf-8 -- """Détection endpoint GraphQL.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/graphql", "/graphiql", "/api/graphql", "/query", "/v1/graphql", "/altair" cla...

Cloud metadata path detection

Detects HTTP paths that may expose cloud metadata AWS/Azure/GCP/OpenStack. !/usr/bin/env python3 -- coding: utf-8 -- """Détection chemins métadonnées cloud risque SSRF / proxy vers metadata.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient Paths often proxied to clo...

Kubernetes API detection

Detects exposed Kubernetes API version, namespaces, healthz. !/usr/bin/env python3 -- coding: utf-8 -- """Détection API Kubernetes exposée.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import lookslikekuberneteshealth,...

AWS S3 bucket detection

Detects S3 bucket or S3-style API ListBucketResult, NoSuchKey, AccessDenied XML. !/usr/bin/env python3 -- coding: utf-8 -- """Détection bucket S3 / API S3 exposée.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AWS ...

Docker Registry detection

Detects Docker Registry API v2 image listing possible. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Docker Registry API v2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Docker Registry detection",...

Kibana detection

Detects if Kibana is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Kibana.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Kibana detection", "description": "Detects if Kibana is...

Azure Blob Storage detection

Detects Azure Blob Storage REST API x-ms- headers or Azure error body. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Azure Blob Storage exposé.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Azure Blob...

Jenkins detection

Detects if Jenkins CI is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Jenkins CI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Jenkins detection", "description": "Detects if...

Server banner detection

Detects revealing Server or X-Powered-By headers version disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Détection bannières serveur / versions exposées.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Serve...

GCP Storage detection

Detects Google Cloud Storage API XML/JSON listing or GCP error format. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Google Cloud Storage exposé.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "GCP Storage...

Elasticsearch detection

Detects exposed Elasticsearch REST API often unauthenticated. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Elasticsearch API REST exposée.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Elasticsearch...