cPassMan - downloadFile.php LFI Detection

Detects cPassMan path LFI via sources/downloadFile.php?path=../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects cPassMan path LFI via sources/downloadFile.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

D-Link DNS-320 - system_mgr.cgi RCE Detection (CVE-2020-25506)

Detects CVE-2020-25506 by injecting a command via /cgi-bin/systemmgr.cgi?cmd=cgintptime&fntpserver=cmd, writing output under /cgi-bin/.txt and reading it back. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320 systemmgr.cgi NTP command injection CVE-2020-25506.""" import re import secre...

KVM x86 Zapscape Guest Escape (CVE-2026-64561)

Runs the Zapscape PoC KVM/x86 mmupagezappte recursive-zap UAF with KASLR bypass on a KVM/AMD hypervisor host via /dev/kvm. Default payload starts a reverse TCP shell as root on the host new KittySploit session. Marker-only mode creates /Zapscape for lab verification. !/usr/bin/env python3 --...

KVM ARM64 vGIC-ITS Guest Escape (CVE-2026-46316)

Runs the ITScape PoC vgicitsinvalidatecache double-put UAF on a KVM/arm64 hypervisor host via /dev/kvm. Default payload starts a reverse TCP shell as root on the host new KittySploit session. Marker-only mode creates /ITScape for lab verification. !/usr/bin/env python3 -- coding: utf-8 --...

KVM Shadow MMU Host DoS (CVE-2026-53359)

Triggers CVE-2026-53359 from a nested VMX/EPT or SVM/NPT context on a KVM hypervisor host. Builds or reuses poc.ko, unloads kvmintel/kvmamd, then insmods the PoC. This is a denial-of-service — it does not grant a new session. !/usr/bin/env python3 -- coding: utf-8 -- """KVM/x86 host DoS via shado...

Supabase Client Key Exposure Detection

Scans HTML, runtime env JS, and SPA bundles for exposed Supabase project URLs and JWT API keys. Flags servicerole / secret keys in client-side code critical misconfiguration common in no-code / vibe-coded apps. !/usr/bin/env python3 -- coding: utf-8 -- """ Detect Supabase API keys and servicerole...

MCP Server Auth Abuse Detection

Probes Model Context Protocol SSE transports and JSON-RPC message endpoints for unauthenticated tools/list and exposed MCP admin surfaces. !/usr/bin/env python3 -- coding: utf-8 -- """MCP server authentication abuse: unauthenticated tools/list and SSE endpoints.""" from kittysploit import from...

tRPC / OpenAPI Procedure Enumeration

Probes /api/trpc for common procedures, batch amplification, and exposed openapi.json routes. Extracts dotted procedure names from JS bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate tRPC procedures and related OpenAPI routes on Next.js apps.""" from kittysploit import from...

SSH Client BIND

BIND payload for listeners/multi/sshclient !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "SSH Client BIND", "description": "BIND payload for listeners/multi/sshclient", "category":...

MySQL BIND Session

BIND payload for listeners/database/mysql. Operator connects to the target MySQL server after credential discovery no reverse agent. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.mysqlbind import buildmysqlbindhint, buildmysqludfexecsql class ModulePayload: info =...

Clerk / Auth0 Management API Enumeration

Uses leaked Clerk secret keys or Auth0 client credentials to enumerate users via Management APIs. Auto-discovers credentials from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate Clerk and Auth0 Management APIs using leaked secret keys. Follow-up for...

Windows Download Stager, curl.exe

curl.exe -fsSL download + execute Windows 10+. Host compiled stager.exe via hoststager generate. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildcurlexedownloadexec, buildstagerurl class ModulePayload: info = "name": "Windows Download...

MySQL BIND session launcher

Connect the framework MySQL BIND listener with supplied or session-stored credentials and register an interactive MySQL session. !/usr/bin/env python3 -- coding: utf-8 -- """ Open a MySQL BIND framework session using known credentials. Chains after auxiliary/scanner/mysql/mysqlloginbruteforce or...

tRPC Batch Amplification Detection

Sends batched tRPC requests with many duplicated procedures to detect amplification ratios indicative of DoS / resource exhaustion risk. !/usr/bin/env python3 -- coding: utf-8 -- """Detect tRPC batch endpoints vulnerable to request amplification.""" from kittysploit import from...

GitHub Actions Workflow Secrets Detection

Probes common /.github/workflows/.yml paths for exposed CI definitions and flags inline secrets, $ secrets. references, PATs, and private keys. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed GitHub Actions workflow files and CI secret references.""" from kittysploit import from...

PlanetScale Branch Enumeration

Uses leaked PlanetScale service tokens pscaletkn and connection URLs to list organizations, databases, and branches via the PlanetScale API. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate PlanetScale organizations, databases, and branches.""" from kittysploit import from...

Reverse ICMP Listener

Receives ICMP Echo Request packets from pythonreverseicmp agents. Requires scapy and CAPNETRAW / Administrator. Sends commands via ICMP Echo Reply payloads CMD:, PING, EXIT. !/usr/bin/env python3 -- coding: utf-8 -- """ICMP covert reverse shell listener pairs with pythonreverseicmp payload."""...

gRPC-Web Method Enumeration

Probes gRPC-Web and HTTP-transported gRPC paths for reflection, health checks, and service/method routes embedded in JS bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate gRPC-Web services and methods over HTTP.""" from kittysploit import from lib.protocols.http.httpclient import...

SMB Client BIND Session

BIND payload for listeners/smb/client !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "SMB Client BIND Session", "description": "BIND payload for listeners/smb/client", "category":...

Magic Link / Passwordless Auth Surface Detection

Probes common magic-link and passwordless paths NextAuth, custom APIs for exposed email submission endpoints and sign-in link flows. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed magic link and passwordless authentication endpoints.""" from kittysploit import from...

Convex / Appwrite / PocketBase API Enumeration

Enumerates PocketBase /api/collections, Appwrite /v1 databases, and Convex deployments discovered in client bundles. Auto-scrapes credentials when omitted. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate Convex, Appwrite, and PocketBase APIs from discovered credentials. Follow-up for...

Convex Deploy Key Enumeration

Uses leaked CONVEXDEPLOYKEY values to probe deployment APIs and query surfaces on .convex.cloud. Auto-discovers from SPA env vars. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Convex deployments using leaked deploy/admin keys.""" from kittysploit import from lib.protocols.http.httpclien...

Vibe Stack Client Secrets Detection

Multi-service scanner for secrets commonly forgotten in vibe-coded apps: Stripe, OpenAI/Anthropic/Groq, Clerk, Resend/SendGrid/Twilio, Mapbox, Cloudinary, UploadThing, Convex/Neon/PlanetScale/Turso DB URLs, AWS, and GitHub tokens in HTML, env.js, .env leaks, and JS bundles. !/usr/bin/env python3 ...

Unix Download Stager, wget | python (reverse TCP)

Downloads a hosted Python stager via wget and pipes to python3. Host stager.py from pythonthinstager on stagerport before running the exploit. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildstagerurl, buildwgetpipepython class...

Python Reverse UDP Shell

UDP connect-back shell KSUDPHELLO protocol. Pairs with listeners/multi/reverseudp !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Python Reverse UDP Shell", "description": "UDP connect-back shell KSUDPHELLO protocol...

Bash Reverse UDP Shell

UDP connect-back via bash /dev/udp KSUDPHELLO. Pairs with listeners/multi/reverseudp !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: info = "name": "Bash Reverse UDP Shell", "description": "UDP connect-back via bash /dev/udp KSUDPHELLO. Pairs with...

Vercel / Netlify Preview Production Secrets Detection

Detects Vercel git previews, Netlify deploy-preview URLs, and staging subdomains that embed production API keys, database URLs, or Supabase servicerole tokens in client-side assets. Also flags VERCELENV=production / NETLIFYCONTEXT=production on non-production deploys. !/usr/bin/env python3 --...

Unix Download Stager, python urllib

Download and exec stager via Python urllib — no curl/wget required. Host stager.py with hoststager generate. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildstagerurl class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Unix...

Windows Download Stager, rundll32 mshtml

rundll32 javascript mshtml RunHTMLApplication — loads remote .sct/.js. Host stager.sct see regsvr32sctstager delivery=sctcontent. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildrundll32mshtml, buildstagerurl class ModulePayload: info =...

Linux x64 Reverse TCP Stager (recv stage)

Minimal x64 stager: connect back, read 4-byte stage length + stage, execute. Framework auto-sends stage from stagepath on listener accept. Default stage: linuxx64shellstage dup2 + /bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Linux x64 reverse TCP stager — receives length-prefixed stage...

Windows Download Stager, regsvr32 SCT

regsvr32 /i:URL scrobj.dll squiblydoo. Host stager.sct on stagerport — use delivery=sctcontent to print a scriptlet that IEXs stager.ps1. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildregsvr32sct, buildsctiexwrapper, buildstagerurl class...

MongoDB BIND Session

BIND payload for listeners/database/mongodb !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "MongoDB BIND Session", "description": "BIND payload for listeners/database/mongodb", "category":...

LDAP BIND Session

BIND payload for listeners/database/ldap !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "LDAP BIND Session", "description": "BIND payload for listeners/database/ldap", "category":...

Covert Channel Agent Installer Pack

Writes email or Slack polling agent plus Linux systemd / Windows schtasks install scripts. Email: listeners/email/reverseemail. Slack: listeners/messaging/slacksocketmode. from kittysploit import from lib.c2.agentinstaller import buildinstallreadme, buildlinuxinstallsh,...

RPM Package Creator (Kitty Agent)

Builds a noarch RPM with Kitty HTTP polling agent and systemd persistence. Pure Python generation works on Windows/macOS/Linux. Controller: listeners/multi/reversehttppolling. from kittysploit import import os import shutil from pathlib import Path from lib.c2.agentinstaller import buildsystemdun...

GitLab API Token Abuse

Uses leaked glpat- tokens to enumerate GitLab user identity and accessible projects via /api/v4. Auto-discovers tokens from CI YAML and bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Abuse leaked GitLab personal access tokens against GitLab API.""" from kittysploit import from...

GCP Compute SSH BIND

BIND payload for listeners/gcp/computessh. Operator connects to a Compute Engine VM via gcloud compute ssh or direct Paramiko. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: info = "name": "GCP Compute SSH BIND", "description": "BIND payload for...

Python Reverse SSH Client

Connect back to listeners/multi/reversessh with username/password and spawn an interactive shell over the SSH channel. !/usr/bin/env python3 -- coding: utf-8 -- """Paramiko-based reverse SSH client for listeners/multi/reversessh.""" from kittysploit import class ModulePayload: CLIENTLANGUAGE =...

Windows Download Stager, PowerShell IEX (reverse TCP)

Downloads and executes a hosted PowerShell stager via IEX / WebClient. Host a .ps1 reverse shell script on stagerport, or set stagerurl. Pairs with listeners/multi/reversetcp. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import...

Pusher / Liveblocks Channel Enumeration

Uses leaked Pusher app credentials or Liveblocks secret keys to list active channels/rooms. Auto-discovers from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Pusher channels and Liveblocks rooms using leaked secrets.""" from kittysploit import from...

GraphQL Subscription / Alias Abuse

Probes GraphQL endpoints for subscription type introspection and alias amplification multi-typename batching signals. !/usr/bin/env python3 -- coding: utf-8 -- """ GraphQL subscription introspection and alias amplification abuse. Complements auxiliary/scanner/http/graphqlabuse.py. """ from future...

Supabase Realtime Channel Abuse

Joins Supabase Realtime Phoenix channels for PostgREST tables using a leaked anon or servicerole key — tests RLS bypass on live subscriptions. !/usr/bin/env python3 -- coding: utf-8 -- """ Abuse Supabase Realtime channels using leaked anon/servicerole JWT keys. Follow-up for...

LangSmith / Langfuse Key Abuse

Uses leaked LangSmith lsv2 or Langfuse lfpk/lfsk keys to query observability APIs for traces and sessions. Auto-discovers from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Abuse leaked LangSmith and Langfuse API keys to access traces and sessions.""" from kittysploit import from...

Elasticsearch BIND Session

BIND payload for listeners/database/elasticsearch !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "Elasticsearch BIND Session", "description": "BIND payload for...

Turso / Upstash API Enumeration

Uses leaked Turso API tokens to list databases and Upstash Redis REST URL/token pairs to verify live cache access. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate Turso databases and Upstash Redis REST using leaked tokens. Follow-up for scanner/http/vibestacksecretsdetect. """ from...

Neon Database URL Validation

Parses leaked Neon postgres:// URLs .neon.tech and validates Neon Management API keys against /api/v2/projects. Auto-discovers from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Validate leaked Neon database URLs and Management API keys.""" from kittysploit import from...

LLM Prompt Injection Surface Detection

Probes OpenAI-compatible /v1/chat/completions, Ollama, and generic /api/chat endpoints for unauthenticated inference — prompt injection and tool abuse entry points. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed LLM chat/completion endpoints prompt injection surface.""" from...

MSSQL BIND Session

BIND payload for listeners/database/mssql !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "MSSQL BIND Session", "description": "BIND payload for listeners/database/mssql", "category":...

Supabase OTP / Magic Link Abuse

Uses leaked Supabase anon keys to probe /auth/v1/otp and /auth/v1/magiclink for active passwordless flows. Auto-discovers project ref and keys from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Abuse Supabase Auth OTP and magic link endpoints using leaked anon keys.""" from kittysploit...

Strapi GraphQL Abuse

Probes Strapi GraphQL endpoints for open introspection and unauthenticated usersPermissionsUsers / users queries exposing emails. !/usr/bin/env python3 -- coding: utf-8 -- """Strapi GraphQL introspection and user enumeration.""" from kittysploit import from lib.protocols.http.httpclient import...