Enumerate PostgreSQL Configuration

Dump security-relevant server settings and paths from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Configuration", "description": "Dump security-relevant server settings and paths...

Enumerate PostgreSQL Extensions

List installed extensions and versions pgcrypto, etc. from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Extensions", "description": "List installed extensions and versions pgcrypt...

Check PostgreSQL Privileges

Review current role capabilities and notable grants from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Check PostgreSQL Privileges", "description": "Review current role capabilities and notable grants"...

Enumerate PostgreSQL Databases

Enumerate databases and tables/schemas in the current database from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Databases", "description": "Enumerate databases and tables/schemas...

Enumerate PostgreSQL Foreign Connections

List postgresfdw servers, user mappings, foreign tables, dblink sessions, and connection strings in function source from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Foreign...

Enumerate PostgreSQL Roles

Enumerate roles, login capability, and privilege flags from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Roles", "description": "Enumerate roles, login capability, and privilege...

Firebase Realtime Database — public REST access

GET /.json?shallow=true on the Realtime Database root to see if rules allow unauthenticated reads. Optionally PUT+GET+DELETE a random key when probewrite is enabled only on assets you are authorized to test. !/usr/bin/env python3 -- coding: utf-8 -- """ Inspired by FireSploit Shubham Sharma: RTDB...

Windows FodHelper UAC Bypass

HKCU ms-settings shell open command hijack + fodhelper.exe default value + empty DelegateExecute, then registry cleanup. sessionid comes from the Post base class. !/usr/bin/env python3 -- coding: utf-8 -- import time from kittysploit import REGKEY =...

Firebase stack & hosting init — detect

Passive recon: reads the configured path for Firebase SDK / API hints, checks response headers, and optionally GETs /firebase/init.json Firebase Hosting auto-config. Positive when init.json returns a project config or strong in-page markers FIREBASEDEFAULTS, etc.. !/usr/bin/env python3 -- coding:...

HTTP response — credential leak detect

Scans an HTTP response body for exposed credentials: PEM private keys, Google service account JSON, AWS keys. Returns leaked values in output. Use proxyflowid or responsebodyb64 for a captured KittyProxy flow. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json import re from...

Windows PSR capture

Records a brief Problem Steps Recorder psr.exe session to a ZIP on the target, then downloads the file through the current session base64 chunks and saves it under ./output. !/usr/bin/env python3 -- coding: utf-8 -- """ PSR psr.exe short recordings on the target; ZIP bytes are pulled through the...

Apache Tomcat Tribes EncryptInterceptor bypass (CVE-2026-34486)

Cleartext Tribes ChannelReceiver traffic may be deserialized after failed decryption EncryptInterceptor. Provide command CommonsCollections6, no JVM or serializedpath for a custom chain. Requires commons-collections 3.x on the target matching this gadget. !/usr/bin/env python3 -- coding: utf-8 --...

Next.js _rsc weak cache-busting hash collision (CVE-2026-44582)

Reimplements the legacy 32-bit FNV-style mix and runs a birthday search for a colliding state-tree, next-url tuple. Optional HTTP GET with RSC prefetch headers can probe CDN cache behaviour. CPU-heavy; patched Next.js uses a stronger mix = 16.2.5. !/usr/bin/env python3 -- coding: utf-8 -- import...

Next.js CSP-nonce reflected XSS (CVE-2026-44581)

GET with Content-Security-Policy: script-src 'nonce-' where the payload uses a TAB as separator so the legacy nonce parser accepts it; reflected nonce must not be attribute-escaped ' where the payload uses a TAB " "as separator so the legacy nonce parser accepts it; reflected nonce must not be "...

Next.js /_next/image OOM (GHSA-h64f) detection

Fingerprints Next.js and flags versions 16.2.5 potentially affected by GHSA-h64f-5h5j-jqjh /next/image OOM. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js RSC server-action DoS (CVE-2026-23870)

Form-encoded cyclic RSC reply with Next-Action + Accept: text/x-component. Pre-patch React Next.js 16.2.5 can spin CPU / blow the stack. Availability only. !/usr/bin/env python3 -- coding: utf-8 -- import time from concurrent.futures import ThreadPoolExecutor, ascompleted from urllib.parse import...

Next.js router-server WebSocket upgrade SSRF (CVE-2026-44578)

Exploits CVE-2026-44578: WebSocket upgrade handler proxies absolute http:// request-line URIs GET, port 80 without honouring finished/308 from normalizeRepeatedSlashes. Actions: test confirm, aws / azure IMDS harvest, custom ssrfurl. Self-hosted only; Vercel/nginx often block. Fixed in 15.5.16 /...

Bludit CMS < 3.18.4 - API Unrestricted File Upload to RCE

Bludit CMS API plugin allows an authenticated user with a valid API token to upload files of any type and extension via POST /api/files/. This module uploads a PHP webshell to achieve Remote Code Execution. from kittysploit import from lib.protocols.http.httpclient import Httpclient import random...

fruit_shell

Writes a PowerShell reverse TCP line shell using a dotted host/port encoding x for octet separators, underscore before port. from kittysploit import class ModuleBackdoor: info = "name": "fruitshell", "description": "Writes a PowerShell reverse TCP line shell using a dotted host/port " "encoding x...

Next.js RSC / HTML cache poisoning (GHSA-wfc6-r584-vfw7)

Three GETs on the same URL: baseline, then with loose RSC + Next-Router-Prefetch, then clean again. Pre-16.2.5 stacks may mis-classify Flight as text/html so CDNs cache RSC bytes under an HTML content-type key. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Next.js RSC server-action DoS (CVE-2026-23870) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-23870 expensive cyclic RSC server-action parsing. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionsca...

Next.js CSP-nonce reflected XSS (CVE-2026-44581) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44581 CSP nonce reflected XSS. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js Next-Resume DoS (GHSA-mg66) detection

Fingerprints Next.js and flags versions 16.2.5 potentially affected by GHSA-mg66-mrh9-m8jx Next-Resume DoS. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js dynamic-route param injection (CVE-2026-44574)

Probes GHSA-492v-c6pp-mqqv: inbound nxtP / nxtI internal search params plus proxy-style headers can skew App Router params vs middleware pathname; second probe uses %252F in a dynamic segment. Configure sentinel to a string only the protected page renders. !/usr/bin/env python3 -- coding: utf-8 -...

Next.js WebSocket upgrade SSRF (CVE-2026-44578) detection

Detects Next.js and flags CVE-2026-44578 router-server WebSocket upgrade SSRF. Affected: 13.4.13–15.5.15 and 16.0.0–16.2.4; fixed in 15.5.16 / 16.2.5. Self-hosted Node server only Vercel not affected. Optional active probe: absolute-URI WebSocket upgrade to AWS IMDSv1. Companion auxiliary confirm...

Bludit CMS < 3.18.4 - API Unrestricted File Upload (CVE-2026-25099)

Detects CVE-2026-25099 on Bludit when a valid API token is provided. Optional active probe uploads a harmless .txt file to confirm unrestricted upload behavior. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import random...

Next.js i18n data-route middleware bypass (CVE-2026-44573) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44573 i18n /next/data middleware bypass. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js dynamic-route param injection (CVE-2026-44574) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44574 dynamic route parameter injection. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js x-nextjs-data redirect cache poisoning (GHSA-3g8h) detection

Fingerprints Next.js and flags versions 16.2.5 affected by GHSA-3g8h-86w9-wvmq x-nextjs-data redirect cache poisoning. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionsc...

Next.js i18n Pages data-route middleware bypass (CVE-2026-44573)

Pages Router with i18n exposes /next/data///.json. On vulnerable Next.js, /next/data//.json no locale can skip the middleware matcher while x-nextjs-data: 1 forces the data handler — leaking getServerSideProps JSON that should have been gated. Set sentinel to a string your protected page embeds i...

Next.js Next-Resume DoS / cache-poisoning (GHSA-mg66-mrh9-m8jx)

POST a large text/plain JSON-shaped body with next-resume: 1 and x-next-resume-state-length: 1 to a PPR page. Pre-16.2.5 the renderer may accept the header and spend CPU/memory on resume. Builds a multi‑MiB body client-side — use only on systems you own. !/usr/bin/env python3 -- coding: utf-8 --...

PowerShell reverse TCP line shell

Writes a PowerShell script that connects back over TCP and executes each received line via Invoke-Expression line-oriented command channel. from kittysploit import class ModuleBackdoor: info = "name": "PowerShell reverse TCP line shell", "description": "Writes a PowerShell script that connects ba...

Next.js /_next/image optimizer OOM (GHSA-h64f-5h5j-jqjh)

GET /next/image?url=&w=&q= against a large same-origin asset. Pre-16.2.5 the optimizer may decode the full image into memory OOM / long wall. v16.2.5 adds limits. Streams the response in 64 KiB chunks; can stress the target — use only on systems you own. !/usr/bin/env python3 -- coding: utf-8 --...

Next.js x-nextjs-data redirect cache poisoning (GHSA-3g8h-86w9-wvmq)

Compares GET responses on a redirecting route with and without x-nextjs-data: 1. Pre-16.2.5 Next.js may return 2xx + x-nextjs-redirect without Location, breaking browsers and poisoning shared caches. Patched stacks keep a normal 3xx + Location. !/usr/bin/env python3 -- coding: utf-8 -- from...

Next.js next/script beforeInteractive XSS (GHSA-gx5p) detection

Fingerprints Next.js and flags versions 16.2.5 affected by GHSA-gx5p-jg67-6x7h next/script beforeInteractive XSS. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan...

Next.js next/script beforeInteractive XSS (GHSA-gx5p-jg67-6x7h)

GET the page with a reflected query param containing a breakout; checks whether it appears verbatim after self.nexts=....push unsafe JSON-in-script vs \u003c escapes patched. Requires a page that forwards the param into props. !/usr/bin/env python3 -- coding: utf-8 -- from urllib.parse import...

Next.js _rsc weak hash collision (CVE-2026-44582) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44582 weak rsc cache-busting hash. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...

Next.js RSC / HTML cache poisoning (GHSA-wfc6) detection

Fingerprints Next.js and flags versions 16.2.5 affected by GHSA-wfc6-r584-vfw7 RSC misclassified as text/html cache poisoning. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import...

DirtyFrag Local Privilege Escalation

Exploits the 'DirtyFrag' AFALG/rxrpc page cache corruption vulnerability to achieve local privilege escalation. This module compiles a C exploit, uploads it to the target, and executes it to gain root via /usr/bin/su or /etc/passwd corruption. from kittysploit import from core.framework.post impo...

NocoBase Workflow Script Node VM Sandbox Escape RCE

Exploits CVE-2026-34156 in NocoBase Workflow Script Node. The module leverages an exposed host-realm WritableWorkerStdio stream object console.stdout / console.stderr to traverse the prototype chain, obtain the host-realm's Function constructor, and execute arbitrary commands bypassing the Node.j...

Android adbd TLS auth bypass CVE-2026-0073 detection

Checks Android adbd over TCP for the STLS/TLS authentication bypass path and confirms command execution with a harmless id probe. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Android adbd STLS/TLS auth bypass CVE-2026-0073.""" import ssl from kittysploit import from core.framework.option...

Cisco RV340 SSL VPN unauthenticated RCE (CVE-2022-20699)

Stack buffer overflow in SSL VPN. Sends self.payload bytes ARM stager, optionally encoded by the framework padded to Metasploit layout, over TLS. !/usr/bin/env python3 -- coding: utf-8 -- import secrets import socket import ssl import string from kittysploit import from...

MindsDB CVE-2026-27483 - Path Traversal to RCE

MindsDB versions below 25.9.1.1 are vulnerable to a path traversal in /api/files upload. A crafted file write can overwrite pip internals and execute attacker-controlled code when a handler installation is triggered. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from...

PHP CGI Argument Injection (CVE-2024-4577) detection

Fingerprints PHP-CGI stacks and flags PHP versions in the CVE-2024-4577 affected ranges on Windows 8.1 8.1.29, 8.2 8.2.20, 8.3 8.3.8. Confirm exploitation with exploits/linux/http/phpcgicve20244577rce. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from...

ARM LE reverse TCP shell (raw)

Thumb ARM 32-bit connect-back stager: socket, connect, dup2 x3, execve /bin/sh. Null-free IPv4 handling per Flashback. Output is raw bytes not a command string. !/usr/bin/env python3 -- coding: utf-8 -- Null-free ARM LE reverse TCP + dup2 + execve"/bin/sh" — Flashback / Metasploit prepshelly. IPv...

Bricks Builder CVE-2024-25600 - Unauthenticated RCE

Exploits unauthenticated RCE in Bricks Builder by abusing the renderelement API with a leaked nonce and query editor/code execution settings. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit,...

Bricks Builder CVE-2024-25600 detection

Detects WordPress Bricks theme = 1.9.6 affected by CVE-2024-25600 unauthenticated renderelement RCE. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Tuple from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import...

PHP CGI Argument Injection RCE (CVE-2024-4577)

Exploits PHP-CGI argument injection via query-string option smuggling to set autoprependfile=php://input and execute attacker-supplied PHP code. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient:...

MindsDB CVE-2026-27483 detection

Detects MindsDB versions 25.9.1.1 potentially affected by CVE-2026-27483 path traversal in /api/files that can lead to RCE. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation...

n8n CVE-2026-21858 + CVE-2025-68613 detection

Detects n8n instances with version 1.121 potentially affected by CVE-2026-21858 and CVE-2025-68613 arbitrary file read, token forgery, workflow RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...