Kibana detection

Detects if Kibana is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Kibana.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Kibana detection", "description": "Detects if Kibana is...

Azure Blob Storage detection

Detects Azure Blob Storage REST API x-ms- headers or Azure error body. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Azure Blob Storage exposé.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Azure Blob...

SMB signing not required

Detects SMB signing disabled or not required NTLM relay possible. !/usr/bin/env python3 -- coding: utf-8 -- """Détection SMB signing désactivé ou non requis relais NTLM.""" from kittysploit import from lib.protocols.smb.smbscannerclient import Smbscannerclient class ModuleScanner, Smbscannerclien...

SMBv1 detection

Detects if SMBv1 is enabled EternalBlue, relay, deprecated. !/usr/bin/env python3 -- coding: utf-8 -- """Détection SMBv1 activé EternalBlue, relais, etc..""" from kittysploit import from lib.protocols.smb.smbscannerclient import Smbscannerclient class ModuleScanner, Smbscannerclient: info = "name...

SMB null session

Detects if anonymous null SMB session is accepted. !/usr/bin/env python3 -- coding: utf-8 -- """Détection null session accès SMB anonyme.""" from kittysploit import from lib.protocols.smb.smbscannerclient import Smbscannerclient class ModuleScanner, Smbscannerclient: info = "name": "SMB null...

HTTP Methods Enumeration

Enumerates allowed HTTP methods via OPTIONS Allow header and active probes of basic methods. Flags risky methods PUT/DELETE/TRACE/CONNECT/PATCH. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate allowed HTTP methods OPTIONS Allow header + active probes.""" from kittysploit import from...

AD unconstrained delegation

Detects computers and users trusted for unconstrained delegation. !/usr/bin/env python3 -- coding: utf-8 -- """Detect unconstrained delegation computers and users.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleScanner, Adclient: info = "name": "AD...

AD foreign security principals in privileged groups

Detects FSPs from trusted domains in sensitive local groups. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Foreign Security Principals in privileged groups.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleScanner, Adclient: info = "name": "AD foreign...

AD DES Kerberos encryption

Detects accounts restricted to DES Kerberos encryption weak. !/usr/bin/env python3 -- coding: utf-8 -- """Detect accounts using DES-only Kerberos encryption.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleScanner, Adclient: info = "name": "AD DES Kerberos...

AD RBCD on domain object

Detects msDS-AllowedToActOnBehalfOfOtherIdentity on domain NC critical. !/usr/bin/env python3 -- coding: utf-8 -- """Detect RBCD on the domain object full domain compromise path.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleScanner, Adclient: info =...

AD Kerberoastable accounts

Detects user accounts with SPNs Kerberoast targets. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Kerberoastable accounts users with SPNs.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from lib.protocols.ldap.adhelpers import UACDONTEXPIREPASSWD class...

Security headers detection

Detects missing HTTP security headers X-Frame-Options, CSP, HSTS, etc.. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient Security headers that should ideally be present SECURITYHEADERS = "X-Frame-Options", "low", "Clickjacking...

Sensitive files detection

Detects exposed sensitive files .env, .git, backups, config, etc.. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient Paths to probe; path, validator. Validator: None = any 200, or callableresponse - bool SENSITIVEPATHS = ".env",...

Admin panel detection

Detects exposed admin or login panels. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient ADMINPATHS = "/admin", "/administrator", "/login", "/user/login", "/wp-admin", "/wp-login.php", "/manager", "/admin.php", "/backend",...

AD SID History abuse

Detects accounts with privileged SIDs in sIDHistory persistence/backdoor. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SID History abuse privileged SIDs in sIDHistory.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from lib.protocols.ldap.adhelpers import...

AD shadow credentials

Detects accounts with msDS-KeyCredentialLink set PKINIT takeover possible. !/usr/bin/env python3 -- coding: utf-8 -- """Detect shadow credentials msDS-KeyCredentialLink on accounts.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleScanner, Adclient: info =...

robots.txt / sitemap detection

Detects exposed robots.txt and sitemap references; reports interesting paths. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'robots.txt / sitemap detection', 'description':...

AD Pre-Windows 2000 access

Detects Pre-Windows 2000 group with Everyone/Anonymous unauthenticated enumeration. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Pre-Windows 2000 Compatible Access group Everyone/Anonymous.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient Well-known SIDs EVERYONE...

Directory listing detection

Detects if directory listing is enabled on the server. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHSTOCHECK = "/", "/images/", "/img/", "/assets/", "/static/", "/backup/", "/uploads/", "/files/", "/media/" class...

AD password policy

Detects weak domain password policy min length, lockout, history, reversible encryption. !/usr/bin/env python3 -- coding: utf-8 -- """Check AD password policy min length, lockout, history, reversible encryption.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from...

AD AS-REP Roastable accounts

Detects accounts with Kerberos pre-authentication disabled AS-REP roasting. !/usr/bin/env python3 -- coding: utf-8 -- """Detect AS-REP Roastable accounts pre-auth disabled.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleScanner, Adclient: info = "name": "A...

PHP 8 TimeAfterFree disable_functions bypass

PHP 8 sandbox escape TimeAfterFree — engine-level memory corruption leading to disablefunctions bypass. Targets Unix-like systems. PHP 8.2–8.5. from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 8...

Drupal detection

Detects if Drupal is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re class ModuleScanner, Httpclient: info = 'name': 'Drupal detection', 'description': 'Detects if Drupal is installed on the...

phpMyAdmin detection

Detects if phpMyAdmin is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpMyAdmin detection', 'description': 'Detects if phpMyAdmin is installed on th...

Joomla detection

Detects if Joomla is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re class ModuleScanner, Httpclient: info = 'name': 'Joomla detection', 'description': 'Detects if Joomla is installed on the...

WordPress detection

Detects if WordPress is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re def extractwordpressversiontext: str - str: """Parse version from homepage HTML or feed XML.""" if not text: return ""...

Domain WHOIS

Retrieves domain registration details using standard WHOIS protocol. from kittysploit import import importlib from datetime import datetime class ModuleAuxiliary: info = 'name': 'Domain WHOIS', 'author': 'KittySploit Team', 'description': 'Retrieves domain registration details using standard WHOI...

URL Headers & Tech

Fetches HTTP headers and detects server/tech hints from a URL. from kittysploit import import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'URL Headers & Tech', 'author': 'KittySploit Team',...

Detect Tor

Detect if the browser victim is behind Tor by loading an image from an onion URL BeEF-style -- coding: utf-8 -- from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Detect Tor", "description": "Detect if the browser victim is behind Tor by loading an image from an onion URL...

Crt.sh Enumeration

Find subdomains via Cert Transparency crt.sh. from kittysploit import import sys import os import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Crt.sh Enumeration', 'author': 'KittySploit Team',...

IP Geolocation

Retrieves geolocation, ISP and ASN for an IP address ip-api.com. from kittysploit import import ipaddress import socket from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: """ IP geolocation and ISP info for KittyOSINT...

DNS Recon

Retrieves A, MX, NS records using DNS resolver. from kittysploit import import dns.resolver class ModuleAuxiliary: info = 'name': 'DNS Recon', 'author': 'KittySploit Team', 'description': 'Retrieves A, MX, NS records using DNS resolver.', 'tags': 'osint', 'passive', 'dns', target = OptString"",...

IP Reverse DNS

Retrieves PTR reverse DNS hostnames for an IP address. from kittysploit import import dns.resolver import dns.reversename import ipaddress class ModuleAuxiliary: info = 'name': 'IP Reverse DNS', 'author': 'KittySploit Team', 'description': 'Retrieves PTR reverse DNS hostnames for an IP address.',...

WPvivid Backup & Migration <= 0.9.123 - Unauthenticated RCE

CVE-2026-1357 - Unauthenticated arbitrary file upload via cryptographic fail-open null AES key and path traversal. Uploads PHP to wp-content/uploads/. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import hashlib import json from urllib.parse import urljoin from kittysploit import from...

Command Shell, Reverse Email (Python)

Command shell over email multi-OS: auto-detects Windows/Unix. Check-in via SMTP, receive commands via IMAP, send output via SMTP. Use with listeners/email/reverseemail. !/usr/bin/env python3 -- coding: utf-8 -- """ Python reverse shell over email IMAP/SMTP. Communicates with...

WebSocket Listener

Reverse WebSocket listener - accepts WebSocket connections for interactive shell !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket import threading import queue import time try: import asyncio import websockets from websockets.server import serve WEBSOCKETSAVAILABLE ...

Swarmer NTUSER.MAN persistence (Windows)

Export HKCU, inject a Run key for persistence, optionally run Swarmer to build NTUSER.MAN and drop it into %USERPROFILE%. User-level; no Reg APIs when using Swarmer. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.file import File from lib.post.windows.registry...

Web POST Listener

Web POST Listener payload in POST body from kittysploit import from lib.protocols.http.httpclient import Httpclient from base64 import b64encode class ModuleListener, Httpclient: info = 'name': 'Web POST Listener', 'description': 'Web POST Listener payload in POST body', 'author': 'KittySploit...

reverse email

Listens to a mailbox via IMAP for beacon/response emails, sends commands via SMTP !/usr/bin/env python3 -- coding: utf-8 -- """ Reverse Email IMAP/SMTP Listener Listens to a mailbox via IMAP for "check-in" or response emails, and sends commands via SMTP. - IMAP: read inbox, detect unread emails...

Web GET Listener

Web GET Listener payload in query parameter from kittysploit import from lib.protocols.http.httpclient import Httpclient from base64 import b64encode class ModuleListener, Httpclient: info = 'name': 'Web GET Listener', 'description': 'Web GET Listener payload in query parameter', 'author':...

Fake Update Notification (Payload + HTTP Smuggling)

Fake 'Update available' modal. Exe generated from payload PE or exepath, rebuilt in JS base64→Blob→download. Usable via HTTP smuggling. !/usr/bin/env python3 -- coding: utf-8 -- """ Fake Update Notification + payload delivery. Exe is generated from the payload PE-capable payload, e.g...

Upgrade Shell to Meterpreter (Windows)

Launch a Meterpreter stager from a Windows shell. Auto-detects or installs Python; starts listener automatically. !/usr/bin/env python3 -- coding: utf-8 -- """ Upgrade Shell to Meterpreter Windows. Uses the existing shell session to run a Python Meterpreter stager in background. Starts the...

HTTP Request Smuggling Scanner

Probes for HTTP request smuggling CL.TE / TE.CL by sending crafted requests that front-end and back-end parse differently. !/usr/bin/env python3 -- coding: utf-8 -- """ HTTP Request Smuggling scanner: detects desync between front-end and back-end by sending crafted requests with conflicting...

Zig Reverse TCP Shell (Windows)

Windows reverse shell in pure Zig - no shellcode. Requires Zig compiler. !/usr/bin/env python3 -- coding: utf-8 -- """ Zig Reverse TCP Shell Windows - Pure Zig, no shellcode. Uses framework Zig compiler; GUI subsystem no console window. For Linux use: payloads/singles/cmd/unix/zigreversetcp """...

MQTT Listener

Connects to an MQTT broker and creates interactive MQTT shell session publish/subscribe !/usr/bin/env python3 -- coding: utf-8 -- """ MQTT listener - connects to an MQTT broker and creates an interactive MQTT shell session. """ from kittysploit import class ModuleListener: """MQTT broker listener...

MSSQL Listener

Microsoft SQL Server listener - creates interactive MSSQL shell session !/usr/bin/env python3 -- coding: utf-8 -- """ MSSQL listener - connects to a Microsoft SQL Server and creates an interactive session. """ from kittysploit import import pymssql class ModuleListener: """MSSQL listener - create...

Elasticsearch Listener

Elasticsearch listener - creates interactive Elasticsearch shell session !/usr/bin/env python3 -- coding: utf-8 -- """ Elasticsearch listener - connects to an Elasticsearch cluster and creates an interactive session. """ from kittysploit import from elasticsearch import Elasticsearch from...

DNS C2 Listener

Listens for DNS queries on a subdomain C2 channel. Agent polls for commands, sends results in query names. Responds with TXT. !/usr/bin/env python3 -- coding: utf-8 -- """ DNS C2 Listener - Listens on UDP for DNS queries on a subdomain and creates sessions. Agent sends: poll.. to get commands,...

DNS C2 (Kittysploit DNS)

Uses Kittysploit DNS server API to send commands and receive agent output. Create URLs via API, no local UDP. !/usr/bin/env python3 -- coding: utf-8 -- """ DNS C2 Kittysploit DNS - Uses your Kittysploit DNS server API to send commands and receive agent output. No UDP listener: commands are pushed...

Windows Command Shell, Reverse TCP (via Python)

Connect back and create a command shell via Python ConPTY when usepty=true; Win10 1809+ from kittysploit import from lib.shell.ptyruntime import buildwindowsconptyscript class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Windows Command Shell, Reverse TCP via Python', 'description':...