firefox 66.0.3

Exploit spidermonkey firefox 66.0.3 from kittysploit import class ModuleBrowserExploit: info = "name": "firefox 66.0.3", "description": "Exploit spidermonkey firefox 66.0.3", "cve": "2019-11707", "platform": Platform.LINUX, "arch": Arch.X64, "payload": "default":...

PHP 8.1.0-dev (backdoor)

PHP 8.1.0-dev backdoor from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = 'name': 'PHP 8.1.0-dev backdoor', 'description': 'PHP 8.1.0-dev backdoor', 'cve': '', 'platform': Platform.ALL, 'arch': Arch.X64, Arch.X86, 'payload':...

WordPress Plugin Backdoor

Generate a WordPress plugin backdoor that can be installed in wp-content/plugins/ from kittysploit import import zipfile import os class ModuleBackdoor: info = 'name': 'WordPress Plugin Backdoor', 'description': 'Generate a WordPress plugin backdoor that can be installed in wp-content/plugins/',...

CVE-2025-46652 - HawkTrace RCE

Remote Code Execution vulnerability in Microsoft Windows Server Update Services WSUS !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import requests import urllib3 import xml.etree.ElementTree as ET from datetime import...

PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlie...

PHP procfs disable_functions bypass

PHP 7.3.5 procfs disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP procfs disablefunctions bypass", "description": "PHP 7.3.5 procfs disablefunctions bypass", "arch": Arch.PHP,...

D-Link DCS-5300 CSRF

D-Link DCS-5300 camera - Change root password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DCS-5300 CSRF", "description": "D-Link DCS-5300 camera - Change root password via CSRF POST", "author":...

PHP 7.0-7.3 disable_functions bypass

PHP 7.0-7.3 disablefunctions bypass using UAF vulnerability from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.0-7.3 disablefunctions bypass", "description": "PHP 7.0-7.3 disablefunctions bypass using UAF...

Cisco UCS Director default scpuser password

The 'scpuser' has the password of 'scpuser', and allows an attacker to login to the virtual appliance via SSH from kittysploit import from lib.protocols.ssh.sshclient import Sshclient class ModuleExploit, Sshclient: info = 'name': 'Cisco UCS Director default scpuser password', 'description': "The...

FTP Listener

FTP client listener - connects to FTP server and creates interactive FTP shell session from kittysploit import from ftplib import FTP class ModuleListener: info = 'name': 'FTP Listener', 'description': 'FTP client listener - connects to FTP server and creates interactive FTP shell session',...

Meterpreter Reverse TCP

Advanced Meterpreter-like reverse TCP listener with post-exploitation capabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket import threading import time import struct class ModuleListener: """Meterpreter reverse TCP listener with advanced post-exploitation...

D-Link DI-524 CSRF (reboot)

D-Link DI-524 Wireless 150 router - Reboot via CSRF GET from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DI-524 CSRF reboot", "description": "D-Link DI-524 Wireless 150 router - Reboot via CSRF GET", "author": "KittySploit...

Wordpress plugin - 1 Flash Gallery

1 Flash Gallery Wordpress Plugin File Upload Exploit from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = "name": "Wordpress plugin - 1 Flash Gallery", "description": "1 Flash Gallery Wordpress Plugin File Upload Exploit", "cve": "",...

Pastejacking - Clipboard Hijacking

Modifies victim's clipboard content to inject malicious payload when they paste !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.js.generic import bundlewithgenericlib, jsstring class ModuleBrowserExploit: info = "name": "Pastejacking - Clipboard Hijacking", "description...

MySQL Write File

Write files to filesystem using MySQL INTO OUTFILE - requires FILE privilege from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "MySQL Write File", "description": "Write files to filesystem using MySQL INTO OUTFILE -...

Shell Php GET

Shell Php GET from kittysploit import class ModuleBackdoor: info = 'name': 'Shell Php GET', 'description': 'Shell Php GET', 'author': 'KittySploit Team', 'listener': 'listeners/web/phpget', 'sessiontype': SessionType.PHP, 'arch': Arch.PHP, paramname = OptString"kittyshell", "param name for...

WebGoat Environment

OWASP WebGoat - Learning platform for web application security testing !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = 'name': 'WebGoat Environment', 'description': 'OWASP WebGoat - Learning platform for web application security testing',...

FTP Honeypot Server

Advanced FTP honeypot that simulates a real FTP server and logs intrusion attempts from kittysploit import from lib.protocols.tcp.tcpserver import Tcpserver import socket import threading import datetime import os class ModuleAuxiliary, Tcpserver: info = 'name': 'FTP Honeypot Server',...

JavaScript Base64 Encoder

Encodes JavaScript code in base64 with atob decoder from kittysploit import import base64 class ModuleEncoder: info = "name": "JavaScript Base64 Encoder", "description": "Encodes JavaScript code in base64 with atob decoder", "author": "KittySploit Team", "platform": Platform.JAVASCRIPT, Options...

Python Base64 Encoder

Encodes Python code in base64 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Python Base64 Encoder", "description": "Encodes Python code in base64", "author": "KittySploit Team", "platform": Platform.PYTHON, def encodeself,...

Wordpress Plugin Ajax Multi Upload 1.1 - Shell Upload

WordPress Plugin Ajax Multi Upload is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context o...

Brute Force DNS Subdomains

Brute force DNS subdomains from kittysploit import from lib.utils.threading import Threadmodule import socket class ModuleAuxiliary, Threadmodule: info = 'name': 'Brute Force DNS Subdomains', 'description': 'Brute force DNS subdomains', 'author': 'KittySploit Team', domain = OptString'', 'Domain...

Brickcom Corp Network Camera Conf Disclosure

Brickcom Corporation Network Camera Configuration Dislosure vulnerability from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Brickcom Corp Network Camera Conf Disclosure", "description": "Brickcom Corporation Network...

Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated)

This exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user. from kittysploit import from lib.protocols.http.httpclient import Httpclient import json class ModuleAuxiliary, Httpclient: info = "name": "Stra...

ChromeCast Discovery

Launch this module to discover chromecast within a Network from kittysploit import import pychromecast class ModuleAuxiliary: info = 'name': 'ChromeCast Discovery', 'description': 'Launch this module to discover chromecast within a Network', 'author': 'KittySploit Team', timeout = OptInteger5,...

Brickcom Camera Credentials Disclosure

Allows remote credential disclosure by low-privilege user. from kittysploit import from lib.protocols.http.httpclient import Httpclient import re class ModuleAuxiliary, Httpclient: info = "name": "Brickcom Camera Credentials Disclosure", "description": "Allows remote credential disclosure by...

Master IP CAM credentials

MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers toobtain sensitive information via a crafted HTTP request, as demonstrated by the username, password, and configuration settings. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

Shell Php cookie

Shell Php cookie from kittysploit import class ModuleBackdoor: info = 'name': 'Shell Php cookie', 'description': 'Shell Php cookie', 'author': 'KittySploit Team', 'listener': 'listeners/web/phpcookie', 'sessiontype': SessionType.PHP, 'arch': Arch.PHP, cookiename = OptString"kittyshell", "Cookie...

Shell Php POST

Shell Php POST from kittysploit import class ModuleBackdoor: info = 'name': 'Shell Php POST', 'description': 'Shell Php POST', 'author': 'KittySploit Team', 'listener': 'listeners/web/phppost', 'sessiontype': SessionType.PHP, 'arch': Arch.PHP, paramname = OptString"kittyshell", "param name for...

dvwa csrf

DVWA CSRF attack - Change password via CSRF GET from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "dvwa csrf", "description": "DVWA CSRF attack - Change password via CSRF GET", "author": "KittySploit Team", "browser": Browser.ALL,...

Call+4 Dword XOR Encoder

Call+4 Dword XOR Encoder from kittysploit import class ModuleEncoder: info = "name": "Call+4 Dword XOR Encoder", 'description': 'Call+4 Dword XOR Encoder', 'author': 'KittySploit Team', 'arch': Arch.X86, 'platform': Platform.UNIX, def encodeself, payload: xorkey = b"\xc0\xb2\xf9\x99" buf =...

CORS Misconfiguration Scanner

Scans for common CORS Cross-Origin Resource Sharing misconfigurations that could allow unauthorized cross-origin requests !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import...

D-Link 600M Add User CSRF

D-Link 600M router - Add user via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link 600M Add User CSRF", "description": "D-Link 600M router - Add user via CSRF POST", "author": "KittySploit Team", "browser":...

Metasploitable Environment

Metasploitable Linux - Intentionally vulnerable Linux distribution for penetration testing !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = 'name': 'Metasploitable Environment', 'description': 'Metasploitable Linux - Intentionally vulnerable...

D-Link 600M Change Wireless Password CSRF

D-Link 600M router - Change wireless password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link 600M Change Wireless Password CSRF", "description": "D-Link 600M router - Change wireless password via CSRF POST"...

Linux x64 XOR Encoder

XOR encoder for Linux x64 payloads with 4-byte key !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleEncoder: info = "name": "Linux x64 XOR Encoder", "description": "XOR encoder for Linux x64 payloads with 4-byte key", "author": "KittySploit Team", "platform":...

Cacti v1.2.8 auth RCE

Cacti v1.2.8 authenticated Remote Code Execution !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.httplogin import Httplogin from bs4 import BeautifulSoup class ModuleExploit, Httpclient, Httplogin: info...

F5 BIG-IP iControl RCE via REST Authentication Bypass

This module exploits an authentication bypass vulnerability in the F5 BIG-IP iControl REST service to gain access to the admin account, which is capable of executing commandsthrough the /mgmt/tm/util/bash endpoint. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Nexus < 3.15.0 rce

Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = "name": "Nexus 3.15.0 rce", "description": "Sonatype Nexus Repository Manager before 3.15.0 has Incorre...

Sourcegraph Gitserver 3.36.3 Rce

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the gitserver service. The service acts as a git exec proxy, and fails to properly restrict calling git config. This allows an attacker to set the git core.sshCommand...

Unraid 6.8.0 Auth Bypass PHP Code Execution

This module exploits two vulnerabilities affecting Unraid 6.8.0An authentication bypass is used to gain access to the administrativeinterface, and an insecure use of the extract PHP function can be abusedfor arbitrary code execution as root. from kittysploit import from...

Symantec Messaging Gateway 9.5 Default SSH Password

The 'support' user has a known default password, which can be used to login to the SSH service, and gain privileged access from remote from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class ModuleExploit, Sshclient, Handler: info =...

rpc.py 0.6.0 - RCE

rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the 'serializer: pickle'HTTP header is sent. In other words, although JSON not Pickle is the default data format, an unauthenticated client can cause the data to be processed with unpickle. from kittysploit import...

reverse aws sqs

Reverse shell listener using AWS SQS Simple Queue Service !/usr/bin/env python3 -- coding: utf-8 -- """ AWS SQS Reverse Shell Listener Author: KittySploit Team Version: 1.0.0 This listener uses AWS SQS Simple Queue Service to establish a reverse shell connection. It requires two SQS queues: -...

CANBUS Listener

Listens to CAN bus messages and creates sessions for each detected CAN ID !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import threading import time import json class ModuleListener: """CANBUS Listener - Listens to CAN bus messages and creates sessions""" info = 'name': 'CANBU...

Zig Reverse TCP Shell

Simple reverse shell in Zig - cross-platform compilation requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import os import subprocess from pathlib import Path class ModulePayload: info = 'name': 'Zig Reverse TCP Shell', 'description': 'Simple reverse shell i...

Upload to S3

Upload files or directories to S3 buckets !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import os class ModulePost: info = "name": "Upload to S3", "description": "Upload files or directories to S3 buckets", "author": "KittySploit Team", "tags": "aws", "s3",...

Enumerate AWS IAM

Enumerate IAM users, roles, groups, and policies !/usr/bin/env python3 -- coding: utf-8 -- """ AWS IAM Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates IAM users, roles, policies, and permissions. """ from kittysploit import import json from core.outputhandler...

Enumerate AWS VPC

Enumerate VPCs, subnets, route tables, and network topology !/usr/bin/env python3 -- coding: utf-8 -- """ AWS VPC Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates VPCs, subnets, security groups, and network topology. """ from kittysploit import import json from...

List all users from /etc/passwd

List all users from /etc/passwd from kittysploit import from core.framework.failure import ProcedureError, FailureType class ModulePost: info = "name": "List all users from /etc/passwd", "description": "List all users from /etc/passwd", "author": "KittySploit Team", "arch": Arch.PHP, "tags": "php...