HTTP Chunked Mimic Transform

Wraps C2 bytes in HTTP/1.1 chunked transfer frames with initial HTTP-like headers. !/usr/bin/env python3 -- coding: utf-8 -- """ HTTP chunked mimic transform. The first server-side encode prepends an HTTP/1.1 response header, the first client-side encode generated for payloads prepends an HTTP PO...

Additive Stream Transform

Adds a repeating key to each byte mod 256. Symmetric encode/decode. Alternative to XOR for signature evasion. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import class ModuleTransform: """Additive stream transform - obfuscates C2 traffic by adding key byt...

PowerShell Base64 Frame Transform

Frames C2 chunks as length-prefixed Base64 lines and emits PowerShell client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.stream.base64frame import Module as PythonBase64FrameTransform class ModulePythonBase64FrameTransform:...

PHP WebSocket Mimic Transform

Wraps C2 bytes in WebSocket-like binary frames and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.websocketmimic import Module as PythonWebSocketTransform class ModulePythonWebSocketTransform: """PHP WebSocket...

PRTG Network Monitor CVE-2018-9276 detection

Detects PRTG Network Monitor instances below 18.2.39 vulnerable to authenticated command injection in EXE notification settings CVE-2018-9276. Fingerprints the Server header and optionally confirms administrator credentials. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import...

SMB share enumeration

Connects over SMB null session, guest, or supplied credentials and lists available shares with optional top-level directory listing. Intended for reconnaissance during an engagement, not as a one-shot vulnerability check. !/usr/bin/env python3 -- coding: utf-8 -- """Énumération des partages SMB...

PRTG Network Monitor < 18.2.39 - Authenticated Command Injection RCE

CVE-2018-9276 — authenticated remote code execution via command injection in PRTG EXE notification settings. Logs in as a PRTG administrator, stages an OutFile notification, then injects a command through message10 and triggers execution via /api/notificationtest.htm. Ensure a listener is...

ES File Explorer CVE-2019-6447 detection

Detects the unauthenticated ES File Explorer HTTP API on TCP 59777 CVE-2019-6447. Sends getDeviceInfo and fingerprints responses from affected builds = 4.1.9.7.4. !/usr/bin/env python3 -- coding: utf-8 -- import ast import json from typing import Optional, Union from kittysploit import from...

ES File Explorer <= 4.1.9.7.4 - Arbitrary File Read

CVE-2019-6447 — ES File Explorer exposes an unauthenticated HTTP API on TCP 59777 that allows listing device content and arbitrary file download via the getFile command. !/usr/bin/env python3 -- coding: utf-8 -- import ast import json from pathlib import Path from typing import Optional, Union fr...

WordPress Breeze Cache <= 2.4.4 - Unauthenticated RCE

CVE-2026-3844 — Unauthenticated arbitrary file upload via breezefetchgravatar when Breeze 'Host Files Locally - Gravatars' is enabled. Uploads PHP to wp-content/uploads/avatars/, gravatars/, or cache/breeze/. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import List, Optional,...

WordPress Breeze Cache CVE-2026-3844 detection

Detects Breeze Cache = 2.4.4 with unauthenticated arbitrary file upload via fetchgravatarfromremote / breezefetchgravatar when local Gravatar hosting is enabled. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Tuple from kittysploit import from lib.protocols.http.httpclient...

OpenSSL Heartbleed CVE-2014-0160 - Memory dump

Repeatedly triggers the TLS heartbeat over-read CVE-2014-0160 to collect server memory. Optional RSA private key reconstruction when the leaked buffer contains prime factors matching the service certificate modulus. !/usr/bin/env python3 -- coding: utf-8 -- """Exploit OpenSSL Heartbleed...

OpenSSL Heartbleed CVE-2014-0160 detection

Sends a malformed TLS heartbeat CVE-2014-0160 and reports whether the server returns more data than declared. Supports direct TLS e.g. HTTPS and cleartext services that upgrade with STARTTLS/STLS/AUTH TLS. !/usr/bin/env python3 -- coding: utf-8 -- """Detect OpenSSL Heartbleed CVE-2014-0160 via...

Redis Inject Backdoor Key

Plant a persistent marker or C2 callback key in Redis from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Inject Backdoor Key", "description": "Plant a persistent marker or C2 callback key in Redis", "author":...

Redis Inject Session

Overwrite a cached session key to hijack an application session from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Inject Session", "description": "Overwrite a cached session key to hijack an application session",...

Redis Set Key

Create or overwrite a string key in the current Redis database from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Set Key", "description": "Create or overwrite a string key in the current Redis database", "author":...

Shell Capability Profiler

Fingerprint an unusual shell and list available interpreters, transfer tools, TTY support, and execution constraints from kittysploit import class ModulePost: info = "name": "Shell Capability Profiler", "description": "Fingerprint an unusual shell and list available interpreters, transfer tools,...

Redis Keyspace Profiler

Profile Redis keys, TTLs, memory usage, and suspicious naming patterns without dumping values by default from kittysploit import from lib.protocols.redis.redisclient import RedisClient import re class ModulePost, RedisClient: info = "name": "Redis Keyspace Profiler", "description": "Profile Redis...

Redis Set Expiration

Set EXPIRE on a key or remove expiration with PERSIST from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Set Expiration", "description": "Set EXPIRE on a key or remove expiration with PERSIST", "author": "KittySploi...

Restricted Shell Audit

Identify restricted or atypical shell constraints, escape-capable binaries, sudo posture, and writable PATH risks from kittysploit import import re class ModulePost: info = "name": "Restricted Shell Audit", "description": "Identify restricted or atypical shell constraints, escape-capable binaries...

Redis ACL Audit

Review Redis ACL users and highlight risky permissions, weak user posture, and dangerous command access from kittysploit import from lib.protocols.redis.redisclient import RedisClient import re class ModulePost, RedisClient: info = "name": "Redis ACL Audit", "description": "Review Redis ACL users...

Enumerate Redis Configuration

Dump security-relevant Redis server configuration from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Enumerate Redis Configuration", "description": "Dump security-relevant Redis server configuration", "author": "KittySplo...

Check Redis Hardening

Audit common Redis security misconfigurations from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Check Redis Hardening", "description": "Audit common Redis security misconfigurations", "author": "KittySploit Team",...

Enumerate Redis Server Info

Dump Redis server, memory, replication, and persistence information from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Enumerate Redis Server Info", "description": "Dump Redis server, memory, replication, and persistence...

Redis Flush Database

Delete all keys in the current database FLUSHDB or all databases FLUSHALL from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Flush Database", "description": "Delete all keys in the current database FLUSHDB or all...

Redis Modify ACL

List, inspect, create, update, or delete Redis ACL users Redis 6+ from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Modify ACL", "description": "List, inspect, create, update, or delete Redis ACL users Redis 6+",...

Redis Delete Keys

Delete one or more Redis keys by name or SCAN pattern from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Delete Keys", "description": "Delete one or more Redis keys by name or SCAN pattern", "author": "KittySploit...

AgentTesla Config Extractor

Analyze AgentTesla .NET payloads: locate string-decryption methods, invoke them with IL-derived keys under a watchdog timeout, and extract likely C2 indicators HTTP, SMTP, FTP. Requires pythonnet and dnlib.dll. !/usr/bin/env python3 -- coding: utf-8 -- """ Extract C2 configuration from AgentTesla...

Azure VM Run Command Listener

Creates a command session backed by Azure VM Run Command. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import try: from azure.identity import DefaultAzureCredential from azure.mgmt.compute import ComputeManagementClient AZUREAVAILABLE = True except Exception: DefaultAzureCredential ...

GCP Firebase Hosting

Enumerate Firebase Hosting sites in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Hosting", "description": "Enumerate Firebase Hosting sites i...

GCP Firestore Collections

List top-level Firestore collection IDs in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firestore Collections", "description": "List top-level Firesto...

GCP Pub/Sub Inventory

Enumerate Pub/Sub topics and subscriptions in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Pub/Sub Inventory", "description": "Enumerate Pub/Sub topic...

GCP Cloud Function Sources Loot

Extract Cloud Functions source locations and download archives when accessible !/usr/bin/env python3 -- coding: utf-8 -- import json from urllib.parse import quote from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Function...

GCP Add SSH Key Metadata

Add an SSH public key to project or instance metadata for legacy SSH access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Add SSH Key Metadata", "description": "Add an SSH...

GCP Cloud Run Env Vars Loot

Extract environment variables from Cloud Run services and jobs !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Run Env Vars Loot", "description": "Extract environment...

WordPress GiveWP CVE-2024-5932 detection

Detects exposed GiveWP plugin versions affected by PHP object injection RCE. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "WordPre...

IKEv1 / IPsec endpoint detection (ike-scan)

Detects IKEv1 ISAKMP VPN endpoints on UDP 500/4500. Sends Main Mode and Aggressive Mode probes similar to ike-scan, parses SA transforms, vendor IDs XAUTH, DPD, Cisco Unity, and reports whether Aggressive Mode PSK capture may be possible. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit...

GCP Cloud SQL Instances

Enumerate Cloud SQL instances in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud SQL Instances", "description": "Enumerate Cloud SQL instances in t...

GCP Enabled Services

Enumerate enabled Google Cloud API services in the current project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Enabled Services", "description": "Enumerate enabled Google...

GCP GKE Clusters

Enumerate Google Kubernetes Engine clusters in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP GKE Clusters", "description": "Enumerate Google Kubernetes...

GCP Cloud SQL Connection Info Loot

Extract Cloud SQL connection endpoints, users, SSL material, and proxy connection strings !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud SQL Connection Info Loot", "description":...

GCP Cloud Build History Loot

Extract Cloud Build history, substitutions, images, and secret references !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Build History Loot", "description": "Extract Clou...

GCP Firebase Realtime Database Loot

Discover Firebase RTDB instances and read database JSON via authenticated REST access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Realtime Database Loot",...

GCP Storage HMAC Keys Loot

List Cloud Storage HMAC keys used for S3-compatible interoperability access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage HMAC Keys Loot", "description": "List Cloud...

AD Shadow Credentials Auto

Runs Certipy shadow auto against an account and surfaces the resulting TGT/NT hash output. !/usr/bin/env python3 -- coding: utf-8 -- import os import shlex import shutil import subprocess from kittysploit import class ModulePost: info = "name": "AD Shadow Credentials Auto", "description": "Runs...

runc Wrapper Bind-Mount Helper

Builds a minimal runc bundle through a sudo-allowed wrapper, adds a bind mount for a host path, and optionally reads a target file from inside the container. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.session import LinuxSessionMixin class ModulePost,...

Wing FTP Server CVE-2026-44403 (session poisoning RCE) detection

Detects Wing FTP Server = 8.1.2 admin panels vulnerable to authenticated session serialization abuse CVE-2026-44403. Fingerprints the web admin UI on the default port 5466 and extracts a version hint when available. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

GCP Compute Attack Surface

Map Compute Engine attack surface: public IPs, scopes, metadata, and weak controls !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute Attack Surface", "description": "Map Compute Engin...

GCP Network Paths

Map network exposure paths via firewalls, VPCs, GKE endpoints, and Cloud Run ingress !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Network Paths", "description": "Map network exposure pat...

GCP Attack Graph

Build an IAM and resource attack graph for the current principal and project !/usr/bin/env python3 -- coding: utf-8 -- import re from collections import defaultdict from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Attack Graph",...