FTP Upload File

Uploads a local file to the FTP server !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os class ModulePost, FTPClientMixin: """FTP File Upload Module""" info = "name": "FTP Upload File", "description": "Uploads a loca...

Fake CAPTCHA Permissions

Generate a fake CAPTCHA modal that hides permission requests geolocation, camera photo capture, clipboard from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Fake CAPTCHA Permissions", "description": "Generate a fake CAPTCHA modal that hides permission requests geolocation, came...

Example Shortcut - Scan and Exploit

Example shortcut that scans a target and automatically exploits found vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleShortcut: info = 'name': 'Example Shortcut - Scan and Exploit', 'description': 'Example shortcut that scans a target and automaticall...

Linux Execute Command

Execute commands on Linux sessions with support for short/long responses and fire-and-forget mode !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import time import threading class...

Linux SOCKS Proxy

Create a SOCKS proxy through a compromised Linux session for network pivoting from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import time class ModulePost, System, LinuxSessionMixin: info = "name": "Linux SOCKS Proxy",...

Windows Gather System Information

Enumerates Windows system information including OS details, users, processes, services, network configuration, and security settings !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re class ModulePost: """Windows System Enumeration Module""" info = "name": "Windows Gather...

Notification Spam

Send multiple push notifications to the browser victim with optional redirect URL or custom JavaScript action on click from kittysploit import import time import json class ModuleBrowserAuxiliary: info = "name": "Notification Spam", "description": "Send multiple push notifications to the browser...

dvwa upload

dvwa upload !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from bs4 import BeautifulSoup from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.httplogin import Httplogin class ModuleExploit, Httpclient, Httplogin: info = "name": "dvwa upload",...

Android Install APK

Install an APK on an Android device from kittysploit import import os class ModulePost: info = 'name': 'Android Install APK', 'description': 'Install an APK on an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects':...

Android MAC Address

Get the MAC address of an Android device from kittysploit import import re class ModulePost: info = 'name': 'Android MAC Address', 'description': 'Get the MAC address of an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects':...

FTP Server Enumeration Scanner

Connect to FTP server and enumerate files, directories and server information Direct mode - no session required !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPOptions, FTPClientMixin class ModuleAuxiliary, FTPClientMixin: """ FTP Serve...

Damn Vulnerable Web Application rce

Damn Vulnerable Web Application rce !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from bs4 import BeautifulSoup from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.httplogin import Httplogin class ModuleExploit, Httpclient, Httplogin: info = "name":...

Android Screenshot

Take a screenshot of an Android device from kittysploit import import os import time from typing import Any, Optional from core.lib.adbsessionutils import getadbdeviceinfo class ModulePost: info = 'name': 'Android Screenshot', 'description': 'Take a screenshot of an Android device', 'author':...

Android Wifi Manage

Manage WiFi connections on an Android device from kittysploit import from core.framework.option.optionchoice import OptChoice class ModulePost: info = 'name': 'Android Wifi Manage', 'description': 'Manage WiFi connections on an Android device', 'author': 'KittySploit Team', 'sessiontype':...

Android ADB Listener

Listens for connections from Android devices using ADB from kittysploit import from ppadb.client import Client as AdbClient class ModuleListener: info = 'name': 'Android ADB Listener', 'description': 'Listens for connections from Android devices using ADB', 'author': 'KittySploit Team', 'version'...

Android List Apps

List all apps on an Android device from kittysploit import import re class ModulePost: info = 'name': 'Android List Apps', 'description': 'List all apps on an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects':...

Android Recovery Mode

Enter recovery mode on an Android device from kittysploit import class ModulePost: info = 'name': 'Android Recovery Mode', 'description': 'Enter recovery mode on an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects':...

Android Battery Level

Get the battery level of an Android device from kittysploit import import re class ModulePost: info = 'name': 'Android Battery Level', 'description': 'Get the battery level of an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive',...

Android Get Info

Get information about an Android device from kittysploit import class ModulePost: info = 'name': 'Android Get Info', 'description': 'Get information about an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects':...

Android Extract Contact

Extract contacts from an Android device from kittysploit import import re class ModulePost: info = 'name': 'Android Extract Contact', 'description': 'Extract contacts from an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects'...

Android Reboot

Reboot an Android device from kittysploit import class ModulePost: info = 'name': 'Android Reboot', 'description': 'Reboot an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2,...

Django Debug Mode RCE

Remote Code Execution exploit for Django applications with DEBUG=True enabled, exploiting error pages and template injection !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse class ModuleExploit, Httpclient:...

Python Injection Scanner

Scans for Python injection vulnerabilities including code injection, template injection Jinja2, Mako, command injection, and pickle deserialization !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse import tim...

React XSS Scanner

Scans for React-specific XSS vulnerabilities including JSX injection, dangerouslySetInnerHTML, and unsafe prop handling !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re import urllib.parse class ModuleAuxiliary,...

WordPress Plugin Scanner

Scans for WordPress plugins, their versions, and known vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re import urllib.parse class ModuleAuxiliary, Httpclient: info = 'name': 'WordPress Plugin Scanner',...

Java Deserialization Scanner

Scans for Java deserialization vulnerabilities including unsafe deserialization in web applications, Java RMI, and JMX !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import base64 import urllib.parse import json import re cla...

Joomla Vulnerability Scanner

Scans for Joomla-specific vulnerabilities, version information, exposed files, and security misconfigurations !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re import urllib.parse class ModuleAuxiliary, Httpclient: inf...

SPA Scanner

Scans for vulnerabilities and misconfigurations in Single Page Applications including exposed API endpoints, authentication issues, and client-side vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re impo...

CSP Bypass Scanner

Scans for Content Security Policy CSP misconfigurations and tests various bypass techniques !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re import urllib.parse class ModuleAuxiliary, Httpclient: info = 'name': 'CSP...

SSRF Scanner

Scans for Server-Side Request Forgery SSRF vulnerabilities including internal network access, cloud metadata endpoints, and protocol handlers !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult...

Express.js RCE

Remote Code Execution exploit for Express.js applications including template injection and code injection vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse import json class ModuleExploit,...

Java RCE

Remote Code Execution exploit for Java applications including deserialization, Struts, and other Java framework vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse import base64 class...

Node.js RCE

Remote Code Execution exploit for Node.js applications including template injection, code injection, and command injection !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse import json class ModuleExploit,...

Node.js Injection Scanner

Scans for injection vulnerabilities in Node.js applications including NoSQL injection, command injection, and template injection !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import json import re import urllib.parse import...

Angular XSS Scanner

Scans for Angular-specific XSS / template expression injection. Requires Angular indicators and confirmed expression evaluation reflection alone is not treated as a finding. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import re import urllib.parse from typing import...

PHP Injection Scanner

Scans for PHP injection vulnerabilities including code injection, command injection, file inclusion, and deserialization !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import...

SQL Injection Scanner

Scans for SQL injection vulnerabilities including union-based, boolean-based, time-based, and error-based SQL injection !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import...

Flask Debug Mode RCE

Remote Code Execution exploit for Flask applications with debug mode enabled, exploiting Werkzeug console PIN vulnerability !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse class ModuleExploit, Httpclient:...

n8n Full Chain RCE (CVE-2026-21858 + CVE-2025-68613)

Chains arbitrary file read via public Form Trigger CVE-2026-21858 to forge an n8n-auth owner JWT, then executes commands through either Execute Command workflows or expression evaluation CVE-2025-68613. Note: some public PoCs mislabel this chain as CVE-2026-1357 that CVE is WPvivid. !/usr/bin/env...

Debug Mode RCE

Remote Code Execution exploit for applications with debug/development mode enabled Django, Flask, etc. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse class ModuleExploit, Httpclient: info = "name": "Debug...

Joomla RCE

Remote Code Execution exploit for Joomla vulnerabilities including template injection and file upload vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse class ModuleExploit, Httpclient: info =...

PHP RCE

Remote Code Execution exploit for PHP applications including code injection, command injection, and file inclusion vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse import base64 class...

RCE Scanner

Generic Remote Code Execution scanner and exploit that tests multiple RCE vectors !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse class ModuleExploit, Httpclient: info = "name": "RCE Scanner", "description"...

Apache Vulnerability Scanner

Scans for Apache-specific vulnerabilities, version information, misconfigurations, and exposed sensitive files !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re import urllib.parse class ModuleAuxiliary, Httpclient: in...

XSS Scanner

Scans for Cross-Site Scripting XSS vulnerabilities including reflected, stored, and DOM-based XSS !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import finalizehttpscannerrun import re impor...

XXE Scanner

Scans for XML External Entity XXE injection vulnerabilities including file disclosure, SSRF, and denial of service !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import finalizehttpscannerru...

Drupal Vulnerability Scanner

Scans for Drupal-specific vulnerabilities, version information, exposed files, and security misconfigurations !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re import urllib.parse class ModuleAuxiliary, Httpclient: inf...

Apache HTTP Server RCE

Remote Code Execution exploit for Apache HTTP Server vulnerabilities including modcgi, modrewrite, and other module vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse class ModuleExploit,...

WordPress RCE

Remote Code Execution exploit for WordPress vulnerabilities including plugin vulnerabilities and core RCE !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse class ModuleExploit, Httpclient: info = "name":...

FastAPI Injection RCE

Remote Code Execution exploit for FastAPI applications including template injection and code injection vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse import json class ModuleExploit,...