GCP Whoami

Display the identity and scopes of the current GCP API session !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Whoami", "description": "Display the identity and scopes of the...

IKEv1 Aggressive Mode PSK capture

Captures IKEv1 Aggressive Mode handshake material for offline pre-shared key cracking. Outputs a hashcat-compatible line gxr:gxi:ckyr:ckyi:saib:idirb:nib:nrb:hashr suitable for modes 5300 MD5, 5400 SHA1, or 5410 SHA256. Equivalent to ike-scan --aggressive --pskcrack. !/usr/bin/env python3 --...

PostgreSQL NOTIFY Shell Listener

C2 over PostgreSQL LISTEN/NOTIFY channels. !/usr/bin/env python3 -- coding: utf-8 -- import json import select import threading import time from kittysploit import class ModuleListener: info = "name": "PostgreSQL NOTIFY Shell Listener", "description": "C2 over PostgreSQL LISTEN/NOTIFY channels.",...

GCP IAM PrivEsc Paths

Identify practical IAM privilege escalation paths for the current GCP principal !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP IAM PrivEsc Paths", "description": "Identify practical IAM...

GCP API Keys

Enumerate API keys and their restrictions in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP API Keys", "description": "Enumerate API keys and their...

GCP Cloud Functions

Enumerate Cloud Functions Gen1 and Gen2 in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Functions", "description": "Enumerate Cloud Functions Ge...

GCP Cloud Run Services

Enumerate Cloud Run services in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Run Services", "description": "Enumerate Cloud Run services in the...

D-Link / ZynOS ROM-0 admin password disclosure

Unauthenticated download of /rom-0 on ZynOS / RomPager-based routers exposes a compressed configuration blob. LZS decompression at offset 8568 reveals the device administrator password in plaintext. Tested on D-Link DSL-2600U firmware v1.08; affects multiple D-Link, TP-Link, ZyXEL, and ZTE models...

Filesystem Dropbox-like Polling C2

Uses a shared directory as a dead-drop C2: agents read commands and write results. !/usr/bin/env python3 -- coding: utf-8 -- import time import uuid from pathlib import Path from kittysploit import class ModuleListener: info = "name": "Filesystem Dropbox-like Polling C2", "description": "Uses a...

PHP Meterpreter, Reverse TCP

Meterpreter-like PHP payload that connects back via TCP !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: CLIENTLANGUAGE = "php" info = 'name': 'PHP Meterpreter, Reverse TCP', 'description': 'Meterpreter-like PHP payload that connects back via TCP', 'author':...

phpSysInfo CVE-2026-55584 detection

Fingerprints phpSysInfo and flags versions = 3.4.5 affected by CVE-2026-55584 PSIALLOWED IP allowlist bypass via X-Forwarded-For / Client-IP. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.phpsysinfo...

GCP Secret Manager

Enumerate Secret Manager secrets metadata only in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Secret Manager", "description": "Enumerate Secret Manag...

GCP Service Account Keys

Enumerate keys for IAM service accounts in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from urllib.parse import quote from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Account Keys",...

GCP Artifact Registry Images Loot

List Artifact Registry repositories, packages, and image versions !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Artifact Registry Images Loot", "description": "List Artifact...

GCP Artifact Registry Pull Tokens Loot

Build Docker pull URIs and registry login material for Artifact Registry images !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Artifact Registry Pull Tokens Loot", "description...

GCP Secret Versions Loot

List Secret Manager secrets and access secret version payloads !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Secret Versions Loot", "description": "List Secret...

GCP OS Login Import SSH Key

Import an SSH public key into OS Login for persistent VM access !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP OS Login Import SSH Key", "description": "Import an S...

AD Object ACL Operations

Runs common bloodyAD object/ACL operations: set owner, add GenericAll, move DN, set password, enable account. !/usr/bin/env python3 -- coding: utf-8 -- import os import shlex import shutil import subprocess from kittysploit import try: from ldap3 import ALL, Connection, Server LDAP3AVAILABLE = Tr...

Kubernetes ServiceAccount Secret Reader

Reads a pod service-account token from a PHP session and uses it to query the Kubernetes API for secrets in a namespace. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import class ModulePost: info = "name": "Kubernetes ServiceAccount Secret Reader", "description": "Reads ...

Slack Socket Mode Polling Shell

Uses Slack Socket Mode as a command/result transport for lab agents. !/usr/bin/env python3 -- coding: utf-8 -- import time from kittysploit import try: from slackbolt import App from slackbolt.adapter.socketmode import SocketModeHandler SLACKAVAILABLE = True except Exception: App =...

Reverse HTTP Polling Listener

HTTP polling C2 with beacon profiles, daisy-chain hops, cover-traffic decoys, and implant identity verification. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json import random import threading import time from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer from...

Python Meterpreter, Bind TCP

Meterpreter-like payload that listens on the target via TCP requires Python on target !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import base64 import struct class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Python Meterpreter, Bind TCP',...

Zig Meterpreter Linux, Bind TCP (compat)

Linux Meterpreter bind TCP payload in Zig compatibility path; requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- """ Compatibility module for the Linux Zig Meterpreter bind TCP payload. Prefer payloads/singles/cmd/unix/zigmeterpreterlinuxbindtcp. """ from kittysploit import from...

Zig Meterpreter Linux, Bind TCP

Linux Meterpreter bind TCP payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterbindtcp import ZigMeterpreterBindTcpBase class ModuleZigMeterpreterBindTcpBase, Payload: info = 'name': 'Zig Meterpreter Linux...

Zig Meterpreter Linux, Reverse TCP

Linux Meterpreter payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterreversetcp import ZigMeterpreterReverseTcpBase class ModuleZigMeterpreterReverseTcpBase, Payload: info = 'name': 'Zig Meterpreter Linux...

Unix File Writer (via Python)

Write base64-decoded content to a local file without opening a network connection from kittysploit import class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Unix File Writer via Python', 'description': 'Write base64-decoded content to a local file without opening a network connection'...

Unix Command Shell, Bind TCP (via Perl)

Listen on the target and expose an interactive command shell via Perl IO::Socket from kittysploit import class ModulePayload: info = 'name': 'Unix Command Shell, Bind TCP via Perl', 'description': 'Listen on the target and expose an interactive command shell via Perl IO::Socket', 'author':...

Zig Meterpreter Windows, Reverse TCP

Windows Meterpreter payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterreversetcp import ZigMeterpreterReverseTcpBase class ModuleZigMeterpreterReverseTcpBase, Payload: info = 'name': 'Zig Meterpreter...

Zig Meterpreter macOS, Bind TCP

macOS Meterpreter bind TCP payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterbindtcp import ZigMeterpreterBindTcpBase class ModuleZigMeterpreterBindTcpBase, Payload: info = 'name': 'Zig Meterpreter macOS...

Meterpreter Bind TCP

Meterpreter bind TCP handler with post-exploitation capabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket import threading import time import struct class ModuleListener: """Meterpreter bind TCP handler — connects to a bind payload on the target""" info =...

Unix Command Shell, Reverse TCP (via Ruby)

Connect back and create a command shell via Ruby TCPSocket from kittysploit import class ModulePayload: info = 'name': 'Unix Command Shell, Reverse TCP via Ruby', 'description': 'Connect back and create a command shell via Ruby TCPSocket', 'author': 'KittySploit Team', 'category':...

Zig Meterpreter macOS, Reverse TCP

macOS Meterpreter payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterreversetcp import ZigMeterpreterReverseTcpBase class ModuleZigMeterpreterReverseTcpBase, Payload: info = 'name': 'Zig Meterpreter macOS...

Zig Meterpreter Windows, Bind TCP

Windows Meterpreter bind TCP payload in Zig requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.payloadtemplates.zigmeterpreterbindtcp import ZigMeterpreterBindTcpBase class ModuleZigMeterpreterBindTcpBase, Payload: info = 'name': 'Zig Meterpreter...

Windows Python Meterpreter, Bind TCP

Small Meterpreter stager for Windows - bind TCP requires Python on target !/usr/bin/env python3 -- coding: utf-8 -- """ Windows Python Meterpreter Bind TCP Payload Author: KittySploit Team Version: 2.0.0 This payload creates a small Meterpreter stager that listens on the target, accepts a...

Meterpreter Reverse TCP (compat alias)

Compatibility alias for listeners/multi/meterpreterreversetcp. Prefer meterpreterreversetcp for new configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Compatibility alias for the Meterpreter reverse TCP listener.""" from kittysploit import Listener from...

PowerShell Command Shell, Bind TCP

Listen on the target and expose a command shell via PowerShell !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 from lib.c2.stagerevasion import powershellprelude class ModulePayload: CLIENTLANGUAGE = "powershell" info = 'name': 'PowerShell Command Shell, Bind TCP',...

Unix Command Shell, Bind TCP (via Python)

Listen on the target and expose an interactive command shell via Python from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Unix Command Shell, Bind TCP via Python', 'description': 'Listen on the target and expose an interactive command shell via...

Unix Command Shell, Reverse TCP (via Perl)

Connect back and create a command shell via Perl IO::Socket from kittysploit import class ModulePayload: info = 'name': 'Unix Command Shell, Reverse TCP via Perl', 'description': 'Connect back and create a command shell via Perl IO::Socket', 'category': PayloadCategory.CMD, 'arch': Arch.PERL,...

Email Pattern Harvester

Harvest organizational email addresses and patterns from passive sources: DMARC/SPF TXT records, RDAP contacts, and certificate transparency naming hints. from kittysploit import import json import os import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient...

Wayback Surface Hunter

Mine Internet Archive Wayback CDX for historical URLs and flag forgotten sensitive endpoints — admin panels, configs, backups, API docs, and debug paths. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class...

Joomla JCE CVE-2026-48907 (unauthenticated RCE) detection

Detects Joomla sites running JCE Editor 2.9.99.5 vulnerable to CVE-2026-48907 unauthenticated arbitrary file upload leading to RCE. Combines JCE version fingerprinting with an optional active probe that uploads a harmless PHP math verifier no shell. !/usr/bin/env python3 -- coding: utf-8 -- impor...

Joomla JCE < 2.9.99.5 - Unauthenticated RCE (CVE-2026-48907)

Exploits CVE-2026-48907 in Joomla JCE Editor 2.9.99.5: unauthenticated arbitrary file upload via profile import or JCE browser chain, followed by PHP webshell execution. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

GitHub Org Exposure Scanner

Discover public GitHub repositories tied to a target domain/org, scan README and workflow files for secret patterns, and surface CI/CD misconfigurations. from kittysploit import import json import re from urllib.parse import quote from lib.protocols.http.httpclient import Httpclient class...

Persona Password Profiler

Collect OSINT on a person name/email or company domain, then propose 20 contextually relevant password candidates for authorized assessments. from kittysploit import import json import os import re from urllib.parse import urlparse from core.osint.passwordprofiling import applyrdapcompanyname,...

CDN Origin IP Finder

Find probable origin server IPs hidden behind CDNs Cloudflare, Fastly, Akamai by correlating DNS on direct/staging subdomains, MX records, and CT enumeration. from kittysploit import import ipaddress import json import re from urllib.parse import urlparse import dns.resolver from...

Frigate NVR blind RCE (CVE-2026-25643)

Exploits CVE-2026-25643 in Frigate NVR = 0.16.3 by injecting a malicious go2rtc stream and camera entry into the configuration, triggering blind command execution during service restart authenticated or unauthenticated. !/usr/bin/env python3 -- coding: utf-8 -- import json import time import yaml...

WordPress The Events Calendar blind SQLi (CVE-2026-49772)

Exploits unauthenticated blind SQL injection in The Events Calendar 6.15.12–6.16.2 via ORDER BY on /wp-json/tec/v1/events. Read-only extraction users, recon, custom SELECT. !/usr/bin/env python3 -- coding: utf-8 -- import time from urllib.parse import urlencode from kittysploit import from...

WiFi Deauth Detector

Passively detect 802.11 deauthentication and disassociation frames on a monitor-mode interface to spot deauth floods or rogue disconnect attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Detect 802.11 deauthentication and disassociation frames passive WIDS.""" from future import annotations...

AD honeytoken hunt (lastLogon oracle)

Flags probable AD honeytokens/decoys via empty auth history lastLogon=0, logonCount=0 and feeds Guardian. !/usr/bin/env python3 -- coding: utf-8 -- """ Repérage de honeytokens AD via l'oracle lastLogon historique comportemental. Préférer le module SMB SAMR, port 445 : scanner/smb/honeytokenhunt C...

Windows LSASS Memory Dump

Dump the LSASS process to a minidump file using PowerShell's internal MiniDumpWriteDump wrapper on a Windows shell or Meterpreter session, then download the dump through the session. !/usr/bin/env python3 -- coding: utf-8 -- """ Dump LSASS process memory via PowerShell MiniDumpWriteDump on a...