GCP Firestore Collections

List top-level Firestore collection IDs in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firestore Collections", "description": "List top-level Firesto...

GCP Cloud SQL Connection Info Loot

Extract Cloud SQL connection endpoints, users, SSL material, and proxy connection strings !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud SQL Connection Info Loot", "description":...

GCP Cloud Build History Loot

Extract Cloud Build history, substitutions, images, and secret references !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Build History Loot", "description": "Extract Clou...

GCP Cloud Function Sources Loot

Extract Cloud Functions source locations and download archives when accessible !/usr/bin/env python3 -- coding: utf-8 -- import json from urllib.parse import quote from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Function...

GCP Storage HMAC Keys Loot

List Cloud Storage HMAC keys used for S3-compatible interoperability access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage HMAC Keys Loot", "description": "List Cloud...

WinRM Kerberos Client

Creates a WinRM session over HTTP/HTTPS using Kerberos tickets from KRB5CCNAME. !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import try: from pypsrp.client import Client PYPSRPAVAILABLE = True except Exception: Client = None PYPSRPAVAILABLE = False class ModuleListener: in...

MeiG FORGE_SLT711 CVE-2026-36356 (GoAhead blind OS command injection) detection

Detects unauthenticated blind OS command injection in MeiG Smart FORGESLT711 Ortel 4G LTE CPE and related MDM9607 GoAhead firmware. Fingerprints the web UI, then sends a timed sleep payload to POST /action/SetRemoteAccessCfg. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

MeiG FORGE_SLT711 GoAhead blind OS command injection (CVE-2026-36356)

Unauthenticated blind OS command injection in MeiG Smart FORGESLT711 Ortel 4G LTE CPE and related MDM9607 firmware. The GoAhead endpoint POST /action/SetRemoteAccessCfg passes the JSON password field to sprintf"echo root:"%s"|chpasswd" and system as root. !/usr/bin/env python3 -- coding: utf-8 --...

Wing FTP Server <= 8.1.2 Authenticated Session Poisoning RCE

CVE-2026-44403: an authenticated full Wing FTP administrator can inject Lua into domain-admin session serialization by poisoning the mydirectory basefolder field. The module logs in, creates or updates a poisoned domain admin, triggers execution by logging in as that account, and dispatches the...

GCP Compute Firewalls

Enumerate Compute Engine firewall rules in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute Firewalls", "description": "Enumerate Compute Engine...

GCP IAM Policy

Retrieve and display the IAM policy for the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP IAM Policy", "description": "Retrieve and display the IAM policy...

GCP Logging Sinks

Enumerate Cloud Logging sinks in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Logging Sinks", "description": "Enumerate Cloud Logging sinks in the...

GCP Service Accounts

Enumerate IAM service accounts in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Accounts", "description": "Enumerate IAM service accounts in th...

GCP Cloud Build Source Refs Loot

Extract Cloud Build source references GCS, CSR, Git, connected repos from build history !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Build Source Refs Loot",...

GCP Firestore Recursive Dump Loot

Recursively dump Firestore documents and nested subcollections from the default database !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firestore Recursive Dump Loot",...

GCP Impersonate Service Account

Validate and obtain short-lived credentials by impersonating a service account !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Impersonate Service Account", "description":...

GCP Cloud Run Deploy Command Pivot

Create and run a Cloud Run job that executes an arbitrary command under a chosen identity !/usr/bin/env python3 -- coding: utf-8 -- import json import re import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Run Deploy...

GCP Compute SSH Pivot via OS Login

Pivot to a VM by importing an SSH key through OS Login and preparing a Compute SSH session !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute SSH Pivot via OS...

Pivot PHP-CGI CVE-2012-1823 through PHP session

Uses an existing PHP session to POST a PHP-CGI argument injection payload to an internal URL, useful for Kubernetes/cluster lateral movement. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePost: info = "name": "Pivot PHP-CGI CVE-2012-1823 through PHP session",...

GCP Firebase Exposure

Analyze Firebase/Firestore exposure: apps, hosting, rules, remote config, and API keys !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Exposure", "description": "Analyze...

GCP Overprivileged Bindings

Find overprivileged IAM bindings: primitive roles, public principals, and broad group grants !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Overprivileged Bindings", "description": "Find...

GCP Secret Sprawl

Detect Secret Manager sprawl: stale secrets, many versions, and weak replication posture !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Secret Sprawl", "description": "Detect Secret Manage...

GCP Service Account Risk

Assess service account hygiene, key exposure, and privilege concentration !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Account Risk", "description": "Assess service account...

Fortinet FortiOS 8.x Firmware Decryptor (forticrack_v8)

Decrypt Fortinet .out firmware FortiOS 8.0 / kernel 4.19.13 build 0167, extract flatkc and rootfs.gz from the boot partition, decrypt rootfs with RSA + FORT-RC4, and unpack the CPIO initramfs. Pure Python — no gunzip, binwalk, or cpio required. !/usr/bin/env python3 -- coding: utf-8 -- """ Fortin...

PHP Command Shell, Bind TCP

Listen on the target and expose a command shell via PHP from kittysploit import class ModulePayload: CLIENTLANGUAGE = "php" info = 'name': 'PHP Command Shell, Bind TCP', 'description': 'Listen on the target and expose a command shell via PHP', 'category': PayloadCategory.SINGLE, 'arch': Arch.PHP,...

GCP Service Account Lateral Movement

Map service account impersonation and workload attachment chains for lateral movement !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Account Lateral Movement",...

GCP BigQuery Datasets

Enumerate BigQuery datasets in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP BigQuery Datasets", "description": "Enumerate BigQuery datasets in the...

Wing FTP Server CVE-2026-44403 - authenticated admin check

CVE-2026-44403: Wing FTP Server = 8.1.2 allows a full administrator to poison domain-admin session serialization via the mydirectory field, leading to Lua RCE. This auxiliary verifies admin panel presence, authenticates with supplied credentials, and reports whether the version hint is in the...

phpSysInfo CVE-2026-55584 - PSI_ALLOWED IP allowlist bypass (info disclosure)

CVE-2026-55584: phpSysInfo = 3.4.5 resolves the client IP from attacker-controlled X-Forwarded-For or Client-IP before REMOTEADDR when enforcing PSIALLOWED. Spoofing an allowlisted address bypasses the restriction and exposes full system information via xml.php. !/usr/bin/env python3 -- coding:...

IKEv1 IPsec VPN connect (PSK + XAUTH)

Brings up an IKEv1 IPsec VPN tunnel using a cracked or known pre-shared key and XAUTH user credentials. Generates a temporary strongSwan stroke configuration, runs ipsec up, and reports the assigned virtual IP. Requires root and a local strongSwan/libreswan install. Chain after ikepskcapture +...

Google Cloud API Console Listener

Creates an interactive GCP/Firebase API console from a token or service account. !/usr/bin/env python3 -- coding: utf-8 -- import json import os import time from urllib.parse import quote import requests from kittysploit import DEFAULTSCOPES = "https://www.googleapis.com/auth/cloud-platform",...

Google Cloud Compute SSH Listener

Creates a command session to a Google Compute Engine VM via gcloud or direct SSH. !/usr/bin/env python3 -- coding: utf-8 -- import json import os import shutil import subprocess import tempfile from kittysploit import DEFAULTSERVICEACCOUNTFILES = "service-account.json", "credentials.json",...

PHP Command Shell, Reverse TCP

Connect back and create a command shell via PHP from kittysploit import class ModulePayload: CLIENTLANGUAGE = "php" info = 'name': 'PHP Command Shell, Reverse TCP', 'description': 'Connect back and create a command shell via PHP', 'category': PayloadCategory.SINGLE, 'arch': Arch.PHP, 'platform':...

GCP Compute Instances

Enumerate Compute Engine instances in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute Instances", "description": "Enumerate Compute Engine...

GCP Project Summary

Summarize a Google Cloud project from the current GCP API session !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Project Summary", "description": "Summarize a Google Cloud...

GCP BigQuery Table Preview Loot

Enumerate BigQuery datasets/tables and preview row samples !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP BigQuery Table Preview Loot", "description": "Enumerate BigQuery...

GCP Firestore Documents Loot

List Firestore collections and read document payloads from the default database !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firestore Documents Loot", "description": "List...

GCP Cloud Build Pivot as Service Account

Run an arbitrary command in Cloud Build under a target service account identity !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Build Pivot as Service Account"...

GCP Compute SSH Pivot via Metadata

Pivot to a VM by injecting an SSH key into Compute metadata and preparing a Compute SSH session !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute SSH Pivot via...

GCP Cloud Function Deploy Command Pivot

Deploy a Gen2 Cloud Function via Cloud Build that executes an arbitrary command on HTTP invoke !/usr/bin/env python3 -- coding: utf-8 -- import json import re import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Functi...

phpSysInfo CVE-2026-55584 detection

Fingerprints phpSysInfo and flags versions = 3.4.5 affected by CVE-2026-55584 PSIALLOWED IP allowlist bypass via X-Forwarded-For / Client-IP. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.phpsysinfo...

GCP Secret Manager

Enumerate Secret Manager secrets metadata only in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Secret Manager", "description": "Enumerate Secret Manag...

GCP Storage Buckets

Enumerate Cloud Storage buckets in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage Buckets", "description": "Enumerate Cloud Storage buckets in t...

GCP Artifact Registry Pull Tokens Loot

Build Docker pull URIs and registry login material for Artifact Registry images !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Artifact Registry Pull Tokens Loot", "description...

GCP Storage Bucket Objects Loot

List and optionally preview objects from Cloud Storage buckets !/usr/bin/env python3 -- coding: utf-8 -- import json from urllib.parse import quote from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage Bucket Objects Loot",...

GCP Generate Access Token

Generate a short-lived OAuth2 access token for a target service account !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Generate Access Token", "description": "Generate a...

GCP OS Login Import SSH Key

Import an SSH public key into OS Login for persistent VM access !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP OS Login Import SSH Key", "description": "Import an S...

AD Object ACL Operations

Runs common bloodyAD object/ACL operations: set owner, add GenericAll, move DN, set password, enable account. !/usr/bin/env python3 -- coding: utf-8 -- import os import shlex import shutil import subprocess from kittysploit import try: from ldap3 import ALL, Connection, Server LDAP3AVAILABLE = Tr...

Kubernetes ServiceAccount Secret Reader

Reads a pod service-account token from a PHP session and uses it to query the Kubernetes API for secrets in a namespace. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import class ModulePost: info = "name": "Kubernetes ServiceAccount Secret Reader", "description": "Reads ...

WordPress DB User Takeover

Extracts WordPress DB credentials from wp-config.php through a PHP session, dumps wpusers, and optionally resets one user's password. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import class ModulePost: info = "name": "WordPress DB User Takeover", "description": "Extracts...