AWS S3 Sensitive Pattern Scan

List and scan exposed S3 objects for sensitive patterns keys, tokens, credentials. from kittysploit import import json import re import time import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

Azure Blob Sensitive Pattern Scan

List and scan exposed blob files for sensitive patterns keys, secrets, credentials. from kittysploit import import json import re import time from urllib.parse import urlparse import xml.etree.ElementTree as ET from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient...

GCP GCS Exposure Audit

Audit multiple GCS buckets for anonymous listing/public exposure indicators. from kittysploit import import json from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "GCP GCS Exposure Audit", "author": "KittySploi...

Attack Path Prioritizer

Correlate OSINT, identity and cloud findings into prioritized probable attack paths. from kittysploit import import json import re class ModuleAuxiliary: info = "name": "Attack Path Prioritizer", "author": "KittySploit Team", "description": "Correlate OSINT, identity and cloud findings into...

Email Infra Pivot

Pivot on email infrastructure MX/SPF/DMARC/DKIM for a target domain. from kittysploit import import json import dns.resolver class ModuleAuxiliary: info = "name": "Email Infra Pivot", "author": "KittySploit Team", "description": "Pivot on email infrastructure MX/SPF/DMARC/DKIM for a target...

Hidden Metadata Hunter

Extract sensitive metadata from public files using exiftool/pdfinfo/olevba when available. from kittysploit import import json import os import subprocess from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Hidd...

IAM PrivEsc Paths

Identify practical IAM privilege escalation paths for the current principal !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import fnmatch class ModulePost: info = "name": "IAM PrivEsc Paths", "description": "Identify practical IAM privilege escalation paths for the...

Identity Handle Hunter

Discover likely public profiles for a username/email/name and score confidence. from kittysploit import import json import os import re from urllib.parse import urlparse from core.osint.identityhandles import APIVERIFIEDPLATFORMS, extracthandles, isgenerichandle, isvalidhandleforplatform,...

Hop proxy PHP generator

Generates a standalone PHP hop proxy with custom upstream server and Hop-Name value. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import PHPPROXYTEMPLATE = r""" array 'method' = 'GET' , 'ssl'=array "verifypeer"=false, "verifypeername"=false, , ; $headers = array'Hop-Name' = $hopName...

AWS S3 Bucket Access Check

Check anonymous read/list exposure indicators on an AWS S3 bucket. from kittysploit import import json from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "AWS S3 Bucket Access Check", "author": "KittySploit Team...

Azure Blob Exposure Audit

Audit multiple Azure blob containers for anonymous exposure and listing. from kittysploit import import json from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Azure Blob Exposure Audit", "author": "KittySploit...

GCP GCS Bucket File List

List files from a Google Cloud Storage bucket using anonymous access. from kittysploit import import json import xml.etree.ElementTree as ET from urllib.parse import quote, urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "GCP GCS...

Domain Surface Mapper

Map domain attack surface using DNS, WHOIS, CT subdomains, and HTTP security headers. from kittysploit import import json import dns.resolver from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Domain Surface...

Shadow Asset Business Mapper

Discover shadow assets and map them to business risk contexts. from kittysploit import import json import re from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Shadow Asset Business Mapper", "author":...

Subdomain Takeover Hint

Detect possible subdomain takeover indicators from DNS CNAME and HTTP fingerprints. from kittysploit import import json import dns.resolver from urllib.parse import urlparse from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Subdomain Takeover...

Azure Blob public object read detect

Checks anonymous read access to a user-provided blob path no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Détection lecture anonyme blob Azure check-only.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

Enumerate MySQL Users

Enumerate MySQL users, hosts, password status, and privileges from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "Enumerate MySQL Users", "description": "Enumerate MySQL users, hosts, password status, and privileges",...

DVWA SQLi shell (lab)

Login to DVWA CSRF token, set security low, UNION SQLi on /vulnerabilities/sqli/; uses lib Sqli pseudo-shell shellsqli or singlesql. !/usr/bin/env python3 -- coding: utf-8 -- """ DVWA SQL Injection lab helper authorized testing only. Authenticates like other DVWA KittySploit modules, forces...

OpenEclass RCE (CVE-2026-22241) Detection

Detects GUnet OpenEclass instances vulnerable to Remote Code Execution CVE-2026-22241 by checking the platform version. Versions prior to 4.2 are vulnerable to an unrestricted file upload in the theme import functionality. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

PackageKit TOCTOU Local Privilege Escalation (CVE-2026-41651)

This module exploits a TOCTOU vulnerability in PackageKit to achieve local privilege escalation. It compiles a Zig exploit, uploads it to the target, and executes it. from kittysploit import from core.framework.post import Post from core.lib.compiler.zigcompiler import ZigCompiler from...

SUSE Manager / Uyuni WebSocket unauthenticated remote command (CVE-2025-46811)

Unauthenticated access to /rhn/websocket/minion/remote-commands allows listing registered Salt minions preview and scheduling arbitrary shell commands on a chosen minion. Affects Uyuni 2025.05, SUSE Manager 5.0.4, SUSE Manager 4.3.15 and related releases as described in the advisory. !/usr/bin/en...

Linux Cloud Metadata Check

Check if cloud instance metadata endpoints are reachable from target host from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import json class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Cloud Metadata Check",...

Credential Exposure Check

Check common locations for accidentally exposed credentials on Linux or Windows sessions !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re class ModulePost: info = "name": "Credential Exposure Check", "description": "Check common locations for accidentally exposed...

Linux Persistence Audit

Audit common Linux persistence locations systemd, cron, startup scripts, shell profiles !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info...

Process Analyzer

Analyze running processes and highlight suspicious execution patterns from kittysploit import import re class ModulePost: info = "name": "Process Analyzer", "description": "Analyze running processes and highlight suspicious execution patterns", "platform": Platform.MULTI, "author": "KittySploit...

WordPress Highlight and Share <= 5.2.0 Broken Access Control

Abuses an unauthenticated AJAX action in Highlight and Share to trigger the 'Share via Email' flow when a valid post nonce is known. import json from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress class ModuleAuxiliary,...

Python Hex Encoder

Encodes payload to hex format !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Python Hex Encoder", "description": "Encodes payload to hex format", "author": "KittySploit Team", "platform": Platform.PYTHON, def encodeself, payloa...

Perl Base64 Encoder

Encodes perl payload in base64 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Perl Base64 Encoder", "description": "Encodes perl payload in base64", "author": "KittySploit Team", "platform": Platform.PERL, def encodeself,...

Windows Get GPP Autologon

Search SYSVOL Registry.xml files for Group Policy Preferences autologon credentials on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import wincompatfailuretype, winprobepowershell import base64 import re...

Langflow RCE (CVE-2026-27966)

Authenticated RCE in Langflow CSV Agent allowdangerouscode=True via prompt injection. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json import random import string from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info ...

Command History Analyzer

Analyze shell history for suspicious command patterns and incident-response indicators !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re class ModulePost: info = "name": "Command History Analyzer", "description": "Analyze shell history for suspicious command patterns and...

Linux Service Controller

Manage Linux services status, start, stop, restart, enable, disable from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Service Controller", "description": "Manage...

WordPress Highlight and Share CVE-2025-67586

Detects vulnerable Highlight and Share plugin versions = 5.2.0 exposed to unauthenticated email share abuse via admin-ajax. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress cla...

llama.cpp RPC b8487 exposure detection

Detects reachable llama.cpp RPC servers and identifies builds that may be affected by the pre-PR 20908 null-buffer bypass issue. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed llama.cpp RPC server and vulnerable pre-fix builds.""" import socket import struct from kittysploit import...

Perl Hex Encoder

Encodes perl payload in hex format !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Perl Hex Encoder", "description": "Encodes perl payload in hex format", "author": "KittySploit Team", "platform": Platform.PERL, def encodeself,...

Php UrlEncode Encoder

Encodes php payload using URL encoding !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from urllib.parse import quote class ModuleEncoder: info = "name": "Php UrlEncode Encoder", "description": "Encodes php payload using URL encoding", "author": "KittySploit Team", "platform":...

Php Gzinflate Base64 Encoder

Encodes php payload using deflate compression and base64 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 import zlib class ModuleEncoder: info = "name": "Php Gzinflate Base64 Encoder", "description": "Encodes php payload using deflate compression and base64",...

Windows Find AV Signature

Locate tiny AV signatures by generating progressive binary splits on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: DEFAULTBUFFERLEN...

Linux Package Vulnerability Hint

Collect installed package versions and highlight potentially outdated security-sensitive software from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Package...

Php Hex Encoder

Encodes php payload in hex format !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Php Hex Encoder", "description": "Encodes php payload in hex format", "author": "KittySploit Team", "platform": Platform.PHP, def encodeself,...

Php Base64 Encoder

Encodes php payload in base64 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Php Base64 Encoder", "description": "Encodes php payload in base64", "author": "KittySploit Team", "platform": Platform.PHP, def encodeself, payload:...

Langflow CSV Agent RCE detection

Detects Langflow instances affected by CVE-2026-27966 by checking version 1.8.0 and optionally validating API key access. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Langflo...

KittyReport Generator

Generates a professional, high-design PDF report of all findings Hosts, Vulns, Creds, Loot. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.models.models import Host, Service, Vulnerability, Credential, Note, Loot import os from datetime import datetime ReportLab impor...

Firmware Extractor (Advanced)

Scan and extract firmware images: TRX headers, gzip/lzma layers, ELF blobs, squashfs detection extraction squashfs non implémentée. Nested structures are partially handled TRX → gzip. !/usr/bin/env python3 -- coding: utf-8 -- """ Module avancé : détection multi-formats TRX, gzip, lzma, ELF,...

Firmware .bin signature scan and decompress

Detects common firmware signatures gzip, lzma, xz, squashfs, ELF, etc. on a local file and recursively decompresses supported compressed formats. !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.analysis.binary.firmwareextractor import PyFirmwareExtractor class...

WordPress Wordfence <= 7.4.5 Local File Disclosure

Wordfence = 7.4.5 exposes a local file disclosure primitive in lib/wordfenceClass.php via the file GET parameter. The vulnerable code prepends ABSPATH and strips traversal prefixes, allowing reads of files located inside the WordPress installation. !/usr/bin/env python3 -- coding: utf-8 -- from...

x64 Polymorphic XOR Encoder

A fully polymorphic XOR encoder that generates a randomized, dependency-free decoder stub on the fly to bypass static signatures. !/usr/bin/env python3 -- coding: utf-8 -- import os import random from kittysploit import from lib.compile.minix64 import MiniX64 class ModuleEncoder, MiniX64: info =...

Django Debug Mode detection

Detects if Django debug mode is enabled on the target, which may lead to information disclosure or RCE. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient def lookslikedjangodebugpageresponse - bool: """Match Django's real...

Windows PowerShell Exec

Execute a PowerShell command or script on a Windows shell or Meterpreter session and return its output. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows...

MySQL Info - Enumeration

Connects to a MySQL server and prints information such as protocol, version, TLS support, and transport. !/usr/bin/env python3 -- coding: utf-8 -- """Détection MySQL + récupération d'informations via handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...