ARM LE Thumb XOR Encoder

Prepends a compact Thumb decoder stub and XOR-encodes raw ARM little-endian payload bytes with a one-byte key. !/usr/bin/env python3 -- coding: utf-8 -- """Thumb ARM little-endian single-byte XOR encoder.""" import re from kittysploit import class ModuleEncoder: info = "name": "ARM LE Thumb XOR...

Android adbd TLS Auth Bypass (CVE-2026-0073)

Uses the adbd STLS/TLS EVPPKEYcmp authentication bypass to create an Android shell session over ADB TCP. !/usr/bin/env python3 -- coding: utf-8 -- """Android adbd EVPPKEYcmp TLS authentication bypass session module.""" import socket import time from kittysploit import from lib.protocols.adb.adbtl...

Camaleon CMS CVE-2024-46987 detection

Fingerprints Camaleon CMS and flags versions = 2.9.0 affected by CVE-2024-46987 authenticated path traversal in /admin/media/downloadprivatefile. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.camaleoncve202446987 import camaleonpagepath,...

Camaleon CMS authenticated path traversal (CVE-2024-46987)

Camaleon CMS ≤ 2.9.0 allows authenticated administrators to read arbitrary local files via GET /admin/media/downloadprivatefile with a path traversal in the file parameter and a valid authtoken cookie. Uses lib.protocols.http.lfi execute hook + optional shell. !/usr/bin/env python3 -- coding: utf...

Breach Exposure Score

Estimate exposure risk for a domain/email using passive public breach signals. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Breach Exposure Score", "author":...

FUXA CVE-2025-69985 detection

Fingerprints FUXA SCADA/HMI and flags versions = 1.2.8 affected by CVE-2025-69985 unauthenticated /api/runscript RCE. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

FUXA <= 1.2.8 Authentication Bypass + RCE (CVE-2025-69985)

Unauthenticated access to the protected /api/runscript endpoint when authentication is enabled, followed by remote command execution via Node.js childprocess.execSync in script code. Fixed in FUXA 1.2.8. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from...

AWS Security Posture

Audit AWS account security posture IAM, root safeguards, MFA, and S3 public exposure !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json class ModulePost: info = "name": "AWS Security Posture", "description": "Audit AWS account security posture IAM, root safeguards, MFA,...

Android Network Audit

Audit Android network posture: interfaces, IPs, routes, DNS, Wi-Fi, proxy, VPN from kittysploit import import re class ModulePost: info = "name": "Android Network Audit", "description": "Audit Android network posture: interfaces, IPs, routes, DNS, Wi-Fi, proxy, VPN", "author": "KittySploit Team",...

Android Permissions Audit

Audit installed apps for sensitive Android permissions and risky flags from kittysploit import import re class ModulePost: info = "name": "Android Permissions Audit", "description": "Audit installed apps for sensitive Android permissions and risky flags", "author": "KittySploit Team",...

AWS S3 Bucket File List

List files from an AWS S3 bucket using anonymous access. from kittysploit import import json import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "AWS S3 Bucket File List"...

Azure Blob Container File List

List blobs from an Azure container using anonymous or SAS access. from kittysploit import import json from urllib.parse import urlparse import xml.etree.ElementTree as ET from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Azure Blob Container...

GCP GCS Exposure Path Prioritizer

Correlate GCS findings into prioritized exposure-to-impact paths. from kittysploit import import json import re import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "GCP G...

GCP GCS Sensitive Pattern Scan

List and scan exposed GCS files for sensitive patterns keys, tokens, credentials. from kittysploit import import json import re import time import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

AWS S3 Exposure Path Prioritizer

Correlate AWS S3 findings into prioritized exposure-to-impact paths. from kittysploit import import json import re import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "AW...

AWS S3 Exposure Audit

Audit multiple AWS S3 buckets for anonymous listing and public read exposure signals. from kittysploit import import json from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "AWS S3 Exposure Audit", "author":...

Azure Exposure Path Prioritizer

Correlate Azure blob findings into prioritized exposure-to-impact paths. from kittysploit import import json import re from urllib.parse import urlparse import xml.etree.ElementTree as ET from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Azure...

Azure Blob ACL Misconfig Hint

Analyze blob exposure findings and provide prioritized remediation guidance. from kittysploit import import json from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Azure Blob ACL Misconfig Hint", "author":...

GCP GCS File Download

Download a file from a GCS bucket via anonymous access. from kittysploit import import os import json from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "GCP GCS File Download", "author": "KittySploit...

ASN Network Profile

Profile ASN/network context from a domain or IPv4 target ASN, org, geo, prefixes. from kittysploit import import json import ipaddress import dns.resolver from lib.protocols.http.httpclient import Httpclient from urllib.parse import urlparse class ModuleAuxiliary, Httpclient: info = "name": "ASN...

Identity Exposure Graph

Link human and machine identity artifacts and score real exploitability. from kittysploit import import json import re class ModuleAuxiliary: info = "name": "Identity Exposure Graph", "author": "KittySploit Team", "description": "Link human and machine identity artifacts and score real...

Public Bucket Hunter

Hunt likely public cloud storage buckets S3/GCS/Azure Blob from domain naming patterns. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Public Bucket Hunter",...

SUSE Manager / Uyuni CVE-2025-46811 WebSocket detection

Detects unauthenticated exposure of /rhn/websocket/minion/remote-commands by requesting a preview of Salt minions CVE-2025-46811. Affected stacks include Uyuni 2025.05, SUSE Manager 5.0.4, SUSE Manager 4.3.15 per public advisories. !/usr/bin/env python3 -- coding: utf-8 -- import json import...

Enumerate MySQL Roles

Enumerate MySQL roles and role assignments to users from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "Enumerate MySQL Roles", "description": "Enumerate MySQL roles and role assignments to users", "author": "KittySploit...

AWS S3 public listing detect

Checks if S3 ListBucket is anonymously accessible no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Détection listing public AWS S3 check-only.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AWS S3 publi...

AWS S3 public object read detect

Checks anonymous read access to a user-provided object path no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Détection lecture anonyme d'objet S3 check-only.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name"...

Check MySQL Hardening

Audit common MySQL security hardening controls and risky configurations from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "Check MySQL Hardening", "description": "Audit common MySQL security hardening controls and risky...

Android Security Posture

Assess Android security posture debug, root, encryption, boot integrity, network exposure from kittysploit import class ModulePost: info = "name": "Android Security Posture", "description": "Assess Android security posture debug, root, encryption, boot integrity, network exposure", "author":...

Azure Blob File Sampler

Sample high-value blob files by extension/name and rank by likely sensitivity. from kittysploit import import json import re from urllib.parse import urlparse import xml.etree.ElementTree as ET from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name":...

Mail Security Posture

Assess outbound email security posture MX stack, SPF, DMARC, DKIM and classify likely SaaS mail providers Microsoft 365, Google Workspace, SEGs for an organization domain. from kittysploit import import json import re import dns.resolver class ModuleAuxiliary: info = "name": "Mail Security...

SSL TLS Certificate Change Tracker

Track certificate transparency changes and trust-chain anomalies for a domain. from kittysploit import import json from datetime import datetime, timezone from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "SSL...

Typosquat Detector

Generate likely typosquatted domains and test DNS/HTTP activity. from kittysploit import import json import dns.resolver from lib.protocols.http.httpclient import Httpclient from urllib.parse import urlparse class ModuleAuxiliary, Httpclient: info = "name": "Typosquat Detector", "author":...

Craft CMS CVE-2025-32432 Pre-Auth RCE

Exploits Craft CMS CVE-2025-32432, a pre-authentication remote code execution issue in the assets/generate-transform endpoint. The module poisons the active PHP session and triggers a Yii gadget chain to include the session file through yii\rbac\PhpManager. !/usr/bin/env python3 -- coding: utf-8 ...

Azure Blob File Download

Download selected blob files from Azure container manual list or flagged scan results. from kittysploit import import json import os import re from urllib.parse import urlparse import xml.etree.ElementTree as ET from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclien...

Azure Blob Write Access Check

Check whether blob upload is possible dry-run by default, controlled write test optional. from kittysploit import import json import time from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Azure Blob Write Acce...

Cloud Misconfig Exposure Detector

Identify likely exposed AWS/Azure/GCP cloud resources from passive URL and naming signals. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Cloud Misconfig Exposu...

SaaS Tenant Discovery

Passive discovery of public SaaS / IdP signals for an organization domain: Microsoft 365 realm, autodiscover, Google Workspace, Okta, Auth0, Atlassian, Slack, Notion, and common mail/SaaS SPF-MX hints via DNS and optional certificate transparency. from kittysploit import import json import re fro...

Secret Leak to Access Validator

Detect leaked secret patterns in public artifacts and validate probable access safely. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Secret Leak to Access...

Terraform State Exposure Detector

Passive detection of Terraform state exposure indicators: tfstate paths/URLs, remote backends S3, GCS, Azure, HTTP, Consul, Terraform Cloud, and bucket or state file names in fetched text. from kittysploit import import json import re from urllib.parse import urlparse from...

Webhook and Forgotten API Leak Analyzer

Discover exposed webhook/API endpoints from JavaScript files and perform lightweight validation. from kittysploit import import json import re from urllib.parse import urljoin, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Webhook...

Pyload unauthenticated RCE via Js2Py sandbox escape

CVE-2024-39205: pyLoad ≤ 0.5.0b3.dev85 exposes Js2Py evaluation on POST /flash/addcrypted2. Localhost-only checks are bypassed by sending Host: 127.0.0.1:. CVE-2024-28397: Js2Py ≤ 0.74 sandbox escape via Object.getOwnPropertyNames to reach subprocess.Popen. !/usr/bin/env python3 -- coding: utf-8 ...

IAM Attack Surface Mapping

Map dangerous IAM permissions on current principal to identify privilege escalation paths !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import fnmatch class ModulePost: info = "name": "IAM Attack Surface Mapping", "description": "Map dangerous IAM permissions on...

Copy Fail Local Privilege Escalation (CVE-2026-31431)

CVE-2026-31431 Copy Fail: AFALG authencesn + splice page-cache write. Modes: su overwrite setuid su with tiny root shell ELF, passwd clear root password in /etc/passwd page cache, write arbitrary page-cache write. su mode launches an interactive root shell on SSH PTY / classic socket. from...

Pyload Js2Py RCE detection (CVE-2024-39205 / CVE-2024-28397)

Sends a timed sleep via POST /flash/addcrypted2 with a Host: 127.0.0.1: bypass and a CVE-2024-28397 Js2Py sandbox-escape payload. Vulnerable hosts exhibit a delayed response consistent with command execution. !/usr/bin/env python3 -- coding: utf-8 -- import random import time import requests from...

Azure Blob public listing detect

Checks if Azure Blob container listing is anonymously accessible no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Détection listing public Azure Blob container check-only.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

JS Endpoint Extractor

Extract JS files and discover API endpoints/domains/keys from public client-side code. from kittysploit import import json import re from urllib.parse import urljoin, urlparse from lib.protocols.http.httpclient import Httpclient from lib.osint.jssecrets import extractsecrethints class...

GUnet OpenEclass < 4.2 - Remote Code Execution (RCE)

CVE-2026-22241 - OpenEclass Unrestricted File Upload RCE via malicious theme upload. This module exploits a vulnerability where an authenticated administrator can upload a ZIP file containing a PHP web shell, which is then extracted to a predictable location. !/usr/bin/env python3 -- coding: utf-...

Cloud Misconfig Chains

Correlate AWS misconfigurations into practical compromise chains. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import fnmatch class ModulePost: info = "name": "Cloud Misconfig Chains", "description": "Correlate AWS misconfigurations into practical compromise...

Advanced Exposed Credentials Detector

Detect likely exposed credentials from public text sources using dynamic regex and correlation scoring. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Advanced...

AWS S3 File Download

Download a file from an AWS S3 bucket via anonymous access. from kittysploit import import os import json from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "AWS S3 File Download", "author": "KittySploit...