Python RCE

Remote Code Execution exploit for Python applications including code injection, template injection, and command injection !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse class ModuleExploit, Httpclient: inf...

API Fuzzer

Fuzzes API endpoints to discover vulnerabilities, misconfigurations, exposed endpoints, and test various HTTP methods !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import...

WordPress Vulnerability Scanner

Scans for WordPress-specific vulnerabilities, version information, exposed files, and security misconfigurations !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re import urllib.parse class ModuleAuxiliary, Httpclient:...

Django SQL Injection Scanner

Scans for SQL injection vulnerabilities in Django applications, including ORM injection and raw SQL queries !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re import urllib.parse import time class ModuleAuxiliary,...

Drupal RCE

Remote Code Execution exploit for Drupal vulnerabilities including Drupalgeddon and other RCE vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import urllib.parse class ModuleExploit, Httpclient: info = "name":...

HTTP Debug Information Leak Scanner

Scans for debug information leaks in HTTP responses including stack traces, error messages, version information, and sensitive data exposure !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult...

403 bypass tester

Try to bypass 403 forbidden on a web resource. Homepage collapses e.g. /admin/../, ignored rewrite headers are filtered out. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.bypassconfirm import...

404 bypass tester

Try to bypass 404 on a web resource. Candidates that merely collapse to the homepage e.g. /admin/../ are discarded. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.bypassconfirm import isconfirmedbypass...

GuppY CMS 6.00.10 - Remote Code Execution

GuppY CMS version 6.00.10 suffers from an authenticated remote shell upload vulnerability. An attacker can authenticate with default credentials and upload a PHP shell to execute arbitrary commands. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclie...

Exclusive Addons for Elementor ≤ 2.6.9 - Stored XSS

The plugin fails to sanitize the s parameter, allowing contributors or higher roles to inject persistent JavaScript that executes when victims view affected pages. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Fortinet FortiWeb Unauthenticated RCE

Exploits CVE-2025-64446 auth bypass to create admin account, then uses CVE-2025-58034 command injection via WebSocket CLI for RCE !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.websocketclient import...

Flowise JS Injection RCE

Exploits CVE-2025-59528 - JavaScript code injection in customMCP endpoint allowing remote code execution !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import json import re class ModuleExploit, Httpclient: info = "name":...

Unix Command Shell, Reverse TCP (via Bash)

Connect back and create a command shell via Bash /dev/tcp PTY via Python when usepty=true from kittysploit import from lib.shell.ptyruntime import buildunixptyscript class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Unix Command Shell, Reverse TCP via Bash', 'description': 'Connect...

FreePBX - Unauth SQLi to RCE (CVE-2025-57819)

Exploits CVE-2025-57819: unauthenticated stacked SQLi on /admin/ajax.php brand inserts a cronjobs row that runs a simple bash /dev/tcp reverse shell on the next FreePBX cron tick 60s. The framework listener starts automatically disablePayloadHandler=false. Set LHOST/LPORT only — no PTY payload...

Fortinet FortiWeb CVE-2025-64446 Authentication Bypass

FortiWeb v8.0.0 - Authentication bypass via CGI parsing vulnerability allowing unauthorized admin access CVE-2025-64446 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import json import base64 import random import string clas...

Python Meterpreter, Reverse TCP

Meterpreter-like payload that connects back via TCP requires Python on target !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import base64 import struct class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Python Meterpreter, Reverse TCP', 'description':...

WordPress Annonces 1.2.0.1 Shell Upload

WordPress Annonces plugin version 1.2.0.1 suffers from a remote shell upload vulnerability. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = "name": "WordPress Annonces 1.2.0.1 Shell Upload", "description": "WordPress Annonces...

PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlie...

MySQL Trigger Backdoor

Create a malicious MySQL trigger that executes commands - requires TRIGGER privilege from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "MySQL Trigger Backdoor", "description": "Create a malicious MySQL trigger that execut...

MySQL Write File

Write files to filesystem using MySQL INTO OUTFILE - requires FILE privilege from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "MySQL Write File", "description": "Write files to filesystem using MySQL INTO OUTFILE -...

Enumerate MySQL Databases

Enumerate all databases, tables, and columns in MySQL from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "Enumerate MySQL Databases", "description": "Enumerate all databases, tables, and columns in MySQL", "author":...

Check MySQL User Privileges

Check current MySQL user privileges and capabilities from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "Check MySQL User Privileges", "description": "Check current MySQL user privileges and capabilities", "author":...

PHP 7.3.5 disable_functions bypass

PHP 7.3.5 json disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.3.5 disablefunctions bypass", "description": "PHP 7.3.5 json disablefunctions bypass", "arch": Arch.PHP, 'agent':...

PHP 7.0-7.4 disable_functions bypass

PHP 7.0-7.4 disablefunctions bypass 7.0 - all versions 7.1 - all versions 7.2 - all versions 7.3 7.3.15 7.4 7.4.3 from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.0-7.4 disablefunctions bypass",...

PHP procfs disable_functions bypass

PHP 7.3.5 procfs disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP procfs disablefunctions bypass", "description": "PHP 7.3.5 procfs disablefunctions bypass", "arch": Arch.PHP,...

Check Disable Functions

Check Disable Functions from kittysploit import class ModulePost: info = "name": "Check Disable Functions", "description": "Check Disable Functions", "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2, 'reversible': False, 'approvalrequired':...

Collect system information

Collect system information from kittysploit import class ModulePost: info = "name": "Collect system information", "description": "Collect system information", "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2, 'reversible': False,...

Show PHP config

Show PHP config from kittysploit import class ModulePost: info = "name": "Show PHP config", "description": "Show PHP config", "author": "KittySploit Team", "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2, 'reversible': False,...

Collect PHP and webserver extension list

Collect PHP and webserver extension list from kittysploit import class ModulePost: info = "name": "Collect PHP and webserver extension list", "description": "Collect PHP and webserver extension list", "sessiontype": SessionType.PHP, "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects':...

Reverse UDP Listener

UDP reverse shell listener one session at a time. Waits for KSUDPHELLO, then exchanges line commands with chunked responses. !/usr/bin/env python3 -- coding: utf-8 -- """Reverse UDP listener with a socket-like wrapper for ClassicShell.""" from future import annotations import socket import...

Python Reverse ICMP Shell

Covert reverse shell over ICMP Echo packets requires scapy + root/CAPNETRAW !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import ICMPAGENTTEMPLATE = r'''import subprocess import os import sys import time import queue import platform try: from scapy.all import IP, ICMP, sniff, send, R...

Enumerate AWS Lambda

Enumerate Lambda functions, configurations, and code !/usr/bin/env python3 -- coding: utf-8 -- """ AWS Lambda Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates AWS Lambda functions, their configurations, and code. """ from kittysploit import import json from...

CVE-2025-46652 - HawkTrace RCE

Remote Code Execution vulnerability in Microsoft Windows Server Update Services WSUS !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import requests import urllib3 import xml.etree.ElementTree as ET from datetime import...

D-Link DI-524 CSRF (reboot)

D-Link DI-524 Wireless 150 router - Reboot via CSRF GET from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DI-524 CSRF reboot", "description": "D-Link DI-524 Wireless 150 router - Reboot via CSRF GET", "author": "KittySploit...

Cacti v1.2.8 auth RCE

Cacti v1.2.8 authenticated Remote Code Execution !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.httplogin import Httplogin from bs4 import BeautifulSoup class ModuleExploit, Httpclient, Httplogin: info...

kramer_VIAware RCE

KRAMER VIAware through August 2021 allows remote attackers to execute arbitrarycode because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = 'name':...

IBM Data Risk Manager a3user Default Password

The 'a3user' has the default password 'idrm' and allows an attacker to log in to the virtual appliance via SSH from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class ModuleExploit, Sshclient, Handler: info = 'name': 'IBM Data Risk...

Loadbalancer.org Enterprise VA SSH Private Key Exposure

Loadbalancer.org ships a public/private key pair on Enterprise virtual appliances version 7.5.2 that allows passwordless authentication to any other LB Enterprise box from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class...

VMware VDP Known SSH Key

VMware vSphere Data Protection appliances 5.5.x through 6.1.x contain a knownssh private key for the local user admin who is a sudoer without password from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class ModuleExploit, Sshclient,...

Upload to S3

Upload files or directories to S3 buckets !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import os class ModulePost: info = "name": "Upload to S3", "description": "Upload files or directories to S3 buckets", "author": "KittySploit Team", "tags": "aws", "s3",...

Enumerate AWS S3

Enumerate S3 buckets, list objects, and check permissions !/usr/bin/env python3 -- coding: utf-8 -- """ AWS S3 Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates S3 buckets and their contents. """ from kittysploit import import json from core.outputhandler import...

Web Cookie Listener

Web Cookie Listener from kittysploit import from lib.protocols.http.httpclient import Httpclient from base64 import b64encode class ModuleListener, Httpclient: info = 'name': 'Web Cookie Listener', 'description': 'Web Cookie Listener', 'author': 'KittySploit Team', 'arch': Arch.PHP, 'handler':...

Tenda HG9 Router auth RCE

Tenda ONT GPON AC1200 Dual band WiFi HG9 v1.0.1 is vulnerable to Command Injection via the Ping function. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.httplogin import Httplogin from lib.exploit.handler import Handler from urllib.parse impor...

Ceragon FibeAir IP-10 SSH Private Key Exposure

Ceragon FibeAir IP-10 have a default SSH public key in the authorizedkeys file for the mateidu user, which allows remote attackers to obtain SSH acces by leveraging knowledge of the private key. from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler...

Cisco UCS Director default scpuser password

The 'scpuser' has the password of 'scpuser', and allows an attacker to login to the virtual appliance via SSH from kittysploit import from lib.protocols.ssh.sshclient import Sshclient class ModuleExploit, Sshclient: info = 'name': 'Cisco UCS Director default scpuser password', 'description': "The...

Quantum DXi V1000 SSH Private Key Exposure

Quantum ships a public/private key pair on DXi V1000 2.2.1 appliances that allows passwordless authentication to any other DXi box from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class ModuleExploit, Sshclient, Handler: info =...

Linux x64 Reverse TCP Stager

Linux x64 Reverse TCP Stager from kittysploit import class ModulePayload: info = 'name': 'Linux x64 Reverse TCP Stager', 'description': 'Linux x64 Reverse TCP Stager', 'author': 'KittySploit Team', 'category': PayloadCategory.STAGER, 'arch': Arch.X64, 'platform': Platform.LINUX, 'listener':...

Zig Reverse TCP Shell

Simple reverse shell in Zig - cross-platform compilation requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import os import subprocess from pathlib import Path class ModulePayload: info = 'name': 'Zig Reverse TCP Shell', 'description': 'Simple reverse shell i...

Download from S3

Download files or entire buckets from S3 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import os class ModulePost: """Download files or buckets from S3""" info = "name": "Download from S3", "description": "Download files or entire buckets from S3", "author":...

Enumerate AWS VPC

Enumerate VPCs, subnets, route tables, and network topology !/usr/bin/env python3 -- coding: utf-8 -- """ AWS VPC Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates VPCs, subnets, security groups, and network topology. """ from kittysploit import import json from...