API Fuzzer

Fuzzes API endpoints to discover vulnerabilities, misconfigurations, exposed endpoints, and test various HTTP methods !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import...

Angular XSS Scanner

Scans for Angular-specific XSS / template expression injection. Requires Angular indicators and confirmed expression evaluation reflection alone is not treated as a finding. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import re import urllib.parse from typing import...

XSS Scanner

Scans for Cross-Site Scripting XSS vulnerabilities including reflected, stored, and DOM-based XSS !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import finalizehttpscannerrun import re impor...

HTTP Debug Information Leak Scanner

Scans for debug information leaks in HTTP responses including stack traces, error messages, version information, and sensitive data exposure !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult...

404 bypass tester

Try to bypass 404 on a web resource. Candidates that merely collapse to the homepage e.g. /admin/../ are discarded. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.bypassconfirm import isconfirmedbypass...

403 bypass tester

Try to bypass 403 forbidden on a web resource. Homepage collapses e.g. /admin/../, ignored rewrite headers are filtered out. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.bypassconfirm import...

Unix Command Shell, Reverse TCP (via Bash)

Connect back and create a command shell via Bash /dev/tcp PTY via Python when usepty=true from kittysploit import from lib.shell.ptyruntime import buildunixptyscript class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Unix Command Shell, Reverse TCP via Bash', 'description': 'Connect...

Fortinet FortiWeb Unauthenticated RCE

Exploits CVE-2025-64446 auth bypass to create admin account, then uses CVE-2025-58034 command injection via WebSocket CLI for RCE !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.websocketclient import...

Exclusive Addons for Elementor ≤ 2.6.9 - Stored XSS

The plugin fails to sanitize the s parameter, allowing contributors or higher roles to inject persistent JavaScript that executes when victims view affected pages. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

FreePBX - Unauth SQLi to RCE (CVE-2025-57819)

Exploits CVE-2025-57819: unauthenticated stacked SQLi on /admin/ajax.php brand inserts a cronjobs row that runs a simple bash /dev/tcp reverse shell on the next FreePBX cron tick 60s. The framework listener starts automatically disablePayloadHandler=false. Set LHOST/LPORT only — no PTY payload...

GuppY CMS 6.00.10 - Remote Code Execution

GuppY CMS version 6.00.10 suffers from an authenticated remote shell upload vulnerability. An attacker can authenticate with default credentials and upload a PHP shell to execute arbitrary commands. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclie...

Fortinet FortiWeb CVE-2025-64446 Authentication Bypass

FortiWeb v8.0.0 - Authentication bypass via CGI parsing vulnerability allowing unauthorized admin access CVE-2025-64446 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import json import base64 import random import string clas...

Flowise JS Injection RCE

Exploits CVE-2025-59528 - JavaScript code injection in customMCP endpoint allowing remote code execution !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import json import re class ModuleExploit, Httpclient: info = "name":...

CMSUno 1.6 csrf

CMSUno 1.6 csrf from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "CMSUno 1.6 csrf", "description": "CMSUno 1.6 csrf", "browser": Browser.ALL, "platform": Platform.ALL, "sessiontype": SessionType.BROWSER, target =...

Linux x64 Command Shell Stage

Linux x64 shell stage - expects socket fd 3 to be connected staged !/usr/bin/env python3 -- coding: utf-8 -- """ Linux x64 Command Shell Stage Author: KittySploit Team Version: 1.0.0 This payload is a "stage" that expects a socket to already be connected. It performs: - dup2 loop to redirect...

Enumerate AWS Lambda

Enumerate Lambda functions, configurations, and code !/usr/bin/env python3 -- coding: utf-8 -- """ AWS Lambda Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates AWS Lambda functions, their configurations, and code. """ from kittysploit import import json from...

PHP 7.3.5 disable_functions bypass

PHP 7.3.5 json disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.3.5 disablefunctions bypass", "description": "PHP 7.3.5 json disablefunctions bypass", "arch": Arch.PHP, 'agent':...

Collect PHP and webserver extension list

Collect PHP and webserver extension list from kittysploit import class ModulePost: info = "name": "Collect PHP and webserver extension list", "description": "Collect PHP and webserver extension list", "sessiontype": SessionType.PHP, "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects':...

Enumerate MyImunify360 Configuration

Extract MyImunify360 configuration, credentials, whitelist, and rules from kittysploit import from core.framework.failure import ProcedureError, FailureType class ModulePost: info = "name": "Enumerate MyImunify360 Configuration", "description": "Extract MyImunify360 configuration, credentials,...

Wordpress Plugin ACF Frontend Display

Wordpress Plugin ACF Frontend Display = 2.0.6 - Arbitrary File UploadThe ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php. from kittysploit import from...

Wordpress Plugin Ad Inserter rce

The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress class ModuleExploit, Httpclient, Wordpress: info = "name": "Wordpress Plugin Ad Inserter...

Wordpress Plugin Accesspress - Shell Upload

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and...

FTP Gather File Listing

Enumerates files and directories on FTP server, optionally downloading interesting files !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os class ModulePost, FTPClientMixin: """FTP File Enumeration Module""" info =...

Enumerate EC2 Metadata

Retrieve metadata from EC2 Instance Metadata Service IMDS !/usr/bin/env python3 -- coding: utf-8 -- """ AWS EC2 Metadata Enumeration Module Author: KittySploit Team Version: 1.0.0 This module retrieves metadata from EC2 Instance Metadata Service IMDS. """ from kittysploit import import json from...

flatCore CVE-2019-13961 CSRF

flatCore CMS - CSRF vulnerability in file upload endpoint CVE-2019-13961 from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "flatCore CVE-2019-13961 CSRF", "description": "flatCore CMS - CSRF vulnerability in file upload endpoint...

Nginx Vulnerability Scanner

Scans for Nginx-specific vulnerabilities, version information, misconfigurations, and exposed sensitive files !/usr/bin/env python3 -- coding: utf-8 -- """ Nginx Vulnerability Scanner Scans for Nginx-specific vulnerabilities, misconfigurations, and security issues """ from kittysploit import from...

atx minicmts creds

LICA miniCMTS E8Ku/i/... devices allow remote attackers to obtain sensitive information via a direct POST request for the inc/user.ini file, leading to discovery of a password hash. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: inf...

Wordpress user enumeration

Try to extract wordpress user enumeration from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Wordpress user enumeration', 'description': "Try to extract wordpress user enumeration", 'tags': 'web', 'scanner', 'wordpress',...

Python Meterpreter, Reverse TCP

Meterpreter-like payload that connects back via TCP requires Python on target !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import base64 import struct class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Python Meterpreter, Reverse TCP', 'description':...

Artica Proxy 4.3.0 - Auth Bypass/OS Command Injection

Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Webmin password_change.cgi Backdoor

An issue was discovered in Webmin =1.920. The parameter old in passwordchange.cgi contains a command injection vulnerability. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = 'name': "Webmin passwordchange.cgi Backdoor",...

LFI Fuzzer

Fuzzing module for Local File Inclusion vulnerabilities. Tests various LFI bypass techniques and payloads. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.scanner.http.moduleresult import finalizehttpscannerrun, targetbaseurl from lib.protocols.http.httpclient import...

Web site crawler

Crawl a web site and store information about what was found from kittysploit import from lib.protocols.http.httpcrawler import Httpcrawler from core.scanner.http.discovery import summarizecrawlurls class ModuleAuxiliary, Httpcrawler: info = 'name': 'Web site crawler', 'description': 'Crawl a web...

Generic Reverse TCP Listener

Ultra-simple reverse TCP listener - framework handles session management !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket from lib.c2.tcpresilience import samplereconnectdelay class ModuleListener: info = 'name': 'Generic Reverse TCP Listener', 'description':...

MS08-067 Microsoft Server Service Relative Path Stack Corruption

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild ...

WordPress Annonces 1.2.0.1 Shell Upload

WordPress Annonces plugin version 1.2.0.1 suffers from a remote shell upload vulnerability. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = "name": "WordPress Annonces 1.2.0.1 Shell Upload", "description": "WordPress Annonces...

JavaScript Unicode Encoder

Encodes JavaScript code into Unicode escape sequences \uXXXX from kittysploit import class ModuleEncoder: info = "name": "JavaScript Unicode Encoder", "description": "Encodes JavaScript code into Unicode escape sequences \uXXXX", "author": "KittySploit Team", "platform": Platform.JAVASCRIPT,...

Collect system information

Collect system information from kittysploit import class ModulePost: info = "name": "Collect system information", "description": "Collect system information", "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2, 'reversible': False,...

GetSimple CMS 1.6 csrf

GetSimple CMS Plugin Multi User v1.8.2 - Cross-Site Request Forgery Add Admin from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "GetSimple CMS 1.6 csrf", "description": "GetSimple CMS Plugin Multi User v1.8.2 - Cross-Site Request...

Sony Bravia Smart TV get wifi password

Retrieve the static Wi-Fi password in Sony Bravia Smart TV by using the Photo Sharing from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Sony Bravia Smart TV get wifi password', 'description': 'Retrieve the static Wi-Fi...

Supra Smart Cloud TV rfi

Supra Smart Cloud TV allows remote file inclusion in the openLiveURL from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Supra Smart Cloud TV rfi', 'description': 'Supra Smart Cloud TV allows remote file inclusion in the...

Pop-Under Tab Closing

Create a pop-under window on user's tab closing from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Pop-Under Tab Closing", "description": "Create a pop-under window on user's tab closing", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL,...

D-Link 600L CSRF

D-Link 600L Wireless N-150 Home Cloud Router - Change admin password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link 600L CSRF", "description": "D-Link 600L Wireless N-150 Home Cloud Router - Change admin...

WordPress Admin for New User CSRF

WordPress - Create admin user via CSRF GET vulnerability from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "WordPress Admin for New User CSRF", "description": "WordPress - Create admin user via CSRF GET vulnerability", "author":...

Warehouse Inventory System 1.0 csrf

Warehouse Inventory System 1.0 change admin password csrf from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": " Warehouse Inventory System 1.0 csrf", "description": " Warehouse Inventory System 1.0 change admin password csrf",...

D-Link DCS-2000 CSRF

D-Link DCS-2000 camera - Change root password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DCS-2000 CSRF", "description": "D-Link DCS-2000 camera - Change root password via CSRF POST", "author":...

PHP 7.4 > ffi disable_functions bypass

PHP 7.4 ffi disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.4 ffi disablefunctions bypass", "description": "PHP 7.4 ffi disablefunctions bypass", "arch": Arch.PHP, 'agent': 'risk...

Casdoor CVE-2023-34927 CSRF

Casdoor v2.95.0 and below - CSRF vulnerability in /api/set-password endpoint CVE-2023-34927 from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "Casdoor CVE-2023-34927 CSRF", "description": "Casdoor v2.95.0 and below - CSRF...

DVWA - Damn Vulnerable Web Application

Start a Docker environment containing DVWA for security web tests !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = 'name': 'DVWA - Damn Vulnerable Web Application', 'description': 'Start a Docker environment containing DVWA for security web...

Reboot a Chromecast

With this module you can reboot a specified chromecast from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Reboot a Chromecast', 'description': 'With this module you can reboot a specified chromecast', 'author':...