Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated)

This exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user. from kittysploit import from lib.protocols.http.httpclient import Httpclient import json class ModuleAuxiliary, Httpclient: info = "name": "Stra...

Brute Force DNS Subdomains

Brute force DNS subdomains from kittysploit import from lib.utils.threading import Threadmodule import socket class ModuleAuxiliary, Threadmodule: info = 'name': 'Brute Force DNS Subdomains', 'description': 'Brute force DNS subdomains', 'author': 'KittySploit Team', domain = OptString'', 'Domain...

Shell Php cookie

Shell Php cookie from kittysploit import class ModuleBackdoor: info = 'name': 'Shell Php cookie', 'description': 'Shell Php cookie', 'author': 'KittySploit Team', 'listener': 'listeners/web/phpcookie', 'sessiontype': SessionType.PHP, 'arch': Arch.PHP, cookiename = OptString"kittyshell", "Cookie...

D-Link 600M Add User CSRF

D-Link 600M router - Add user via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link 600M Add User CSRF", "description": "D-Link 600M router - Add user via CSRF POST", "author": "KittySploit Team", "browser":...

F5 BIG-IP iControl RCE via REST Authentication Bypass

This module exploits an authentication bypass vulnerability in the F5 BIG-IP iControl REST service to gain access to the admin account, which is capable of executing commandsthrough the /mgmt/tm/util/bash endpoint. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

F5 BIG-IP SSH Private Key Exposure

F5 ships a public/private key pair on BIG-IP appliances that allows passwordless authentication to any other BIG-IP box from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class ModuleExploit, Sshclient, Handler: info = 'name': 'F5...

Monsta FTP CVE-2025-34299

Monsta FTP - Arbitrary file download from malicious FTP server leading to RCE CVE-2025-34299 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpserver import Ftpserver import json import os import random import string import tempfile import threading impor...

Enumerate AWS Credentials

Enumerate AWS credentials from environment variables, credential files, and EC2 metadata !/usr/bin/env python3 -- coding: utf-8 -- """ AWS Credentials Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates AWS credentials from various sources: - Environment variables -...

CANBUS Listener

Listens to CAN bus messages and creates sessions for each detected CAN ID !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import threading import time import json class ModuleListener: """CANBUS Listener - Listens to CAN bus messages and creates sessions""" info = 'name': 'CANBU...

ChromeCast Discovery

Launch this module to discover chromecast within a Network from kittysploit import import pychromecast class ModuleAuxiliary: info = 'name': 'ChromeCast Discovery', 'description': 'Launch this module to discover chromecast within a Network', 'author': 'KittySploit Team', timeout = OptInteger5,...

Adive Framework 2.0.7

Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users editor or developer to create an administrator account via admin/user/add from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.httplogin import Httplogin class...

atx minicmts creds

LICA miniCMTS E8Ku/i/... devices allow remote attackers to obtain sensitive information via a direct POST request for the inc/user.ini file, leading to discovery of a password hash. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: inf...

D-Link 600L CSRF

D-Link 600L Wireless N-150 Home Cloud Router - Change admin password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link 600L CSRF", "description": "D-Link 600L Wireless N-150 Home Cloud Router - Change admin...

D-Link DCS-900 CSRF

D-Link DCS-900 camera - Change root password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DCS-900 CSRF", "description": "D-Link DCS-900 camera - Change root password via CSRF POST", "author": "KittySploit...

Metasploitable Environment

Metasploitable Linux - Intentionally vulnerable Linux distribution for penetration testing !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = 'name': 'Metasploitable Environment', 'description': 'Metasploitable Linux - Intentionally vulnerable...

Simple Workflow

Workflow basic demonstration of base features !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleWorkflow: info = 'name': 'Simple Workflow', 'description': 'Workflow basic demonstration of base features', 'author': 'KittySploit Team', Options target = OptString"", "Targ...

Dump CAN Messages

Dumps CAN messages from one CANBUS session or sibling sessions to file !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS Message Dumper - Dumps CAN messages from a session to file Author: KittySploit Team Version: 1.0.0 """ from kittysploit import from core.outputhandler import printinfo,...

Web site crawler

Crawl a web site and store information about what was found from kittysploit import from lib.protocols.http.httpcrawler import Httpcrawler from core.scanner.http.discovery import summarizecrawlurls class ModuleAuxiliary, Httpcrawler: info = 'name': 'Web site crawler', 'description': 'Crawl a web...

Nginx Vulnerability Scanner

Scans for Nginx-specific vulnerabilities, version information, misconfigurations, and exposed sensitive files !/usr/bin/env python3 -- coding: utf-8 -- """ Nginx Vulnerability Scanner Scans for Nginx-specific vulnerabilities, misconfigurations, and security issues """ from kittysploit import from...

Wordpress Plugin Ajax Multi Upload 1.1 - Shell Upload

WordPress Plugin Ajax Multi Upload is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context o...

MySQL Read File

Read files from filesystem using MySQL LOADFILE - requires FILE privilege from kittysploit import from core.framework.failure import ProcedureError, FailureType from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "MySQL Read File", "description":...

List running processes

List running processes from kittysploit import class ModulePost: info = "name": "List running processes", "description": "List running processes", "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2, 'reversible': False, 'approvalrequired': True,...

FTP Listener

FTP client listener - connects to FTP server and creates interactive FTP shell session from kittysploit import from ftplib import FTP class ModuleListener: info = 'name': 'FTP Listener', 'description': 'FTP client listener - connects to FTP server and creates interactive FTP shell session',...

Generic Reverse TCP Listener

Ultra-simple reverse TCP listener - framework handles session management !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket from lib.c2.tcpresilience import samplereconnectdelay class ModuleListener: info = 'name': 'Generic Reverse TCP Listener', 'description':...

Enumerate AWS Secrets

Enumerate secrets from AWS Secrets Manager and Systems Manager Parameter Store !/usr/bin/env python3 -- coding: utf-8 -- """ AWS Secrets Manager Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates secrets from AWS Secrets Manager and Parameter Store. """ from...