Monit - Default Credentials Detection

Tries admin:monit against Monit Basic auth WWW-Authenticate realm=monit and looks for Monit: in a 200 response. !/usr/bin/env python3 -- coding: utf-8 -- """Monit default credentials admin:monit.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Tiki Wiki - flv_stream.php File Download Detection

Detects Tiki Wiki arbitrary file download via /vendor/player/flv/flvstream.php?file=../../../db/local.php. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki flvstream.php arbitrary file download.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ZYCOO IP Phone - system_cmd.cgi RCE Detection

Detects ZYCOO unauthenticated command injection via /cgi-bin/systemcmd.cgi?cmd='cat /etc/passwd'. !/usr/bin/env python3 -- coding: utf-8 -- """ZYCOO IP Phone System systemcmd.cgi RCE.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import...

BloodHound.py collect

Run bloodhound-python / bloodhound-ce-python against a Domain Controller from Linux or Windows, produce a zip, and merge into the agent attack graph. Default collection=DCOnly LDAP-only, good from Kali. Use All for fuller Session/LocalAdmin fan-out when the network allows. !/usr/bin/env python3 -...

distcc - Remote Command Execution (CVE-2004-2687)

Exploits CVE-2004-2687 by injecting shell commands into distcc ARGV. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """distcc RCE CVE-2004-2687 — opens execute session.""" import re import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient impo...

AWStats Totals - sort Parameter RCE (CVE-2008-3922)

Exploits CVE-2008-3922 by injecting PHP into the sort parameter of awstatstotals.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats Totals sort parameter RCE CVE-2008-3922.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Spring Cloud Function - routing-expression RCE (CVE-2022-22963)

Exploits CVE-2022-22963 by injecting SpEL into the spring.cloud.function.routing-expression header to run a reverse CMD payload. Waits for a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud Function routing-expression RCE CVE-2022-22963 — reverse session.""" import base64...

Traq - Unauthenticated Plugin Hook RCE

Exploits Traq by installing an unauthenticated plugin hook that executes attacker PHP, then cleans up the plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Traq unauthenticated plugin hook RCE.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

WordPress is-human - passthru RCE (CVE-2011-10033)

Exploits CVE-2011-10033 by injecting PHP into the type parameter of is-human/engine.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress is-human plugin RCE CVE-2011-10033.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handl...

ApPHP MicroBlog - index.php RCE Detection

Detects ApPHP MicroBlog RCE via index.php?b;phpinfo;echo...=/ style parameter injection. !/usr/bin/env python3 -- coding: utf-8 -- """ApPHP MicroBlog index.php parameter RCE.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Barracuda - view_help.cgi Directory Traversal Detection (CVE-2010-20109)

Detects CVE-2010-20109 via viewhelp.cgi?locale=/../../../../mail/snapshot/config.snapshot%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-20109 via viewhelp.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

TCExam - Unauthenticated File Upload RCE Detection (CVE-2010-2153)

Detects CVE-2010-2153 by uploading a phpinfo shell via tcefunctionstcecodeeditor.php. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-2153 by uploading a phpinfo shell via tcefunctionstcecodeeditor.""" import re from kittysploit import from lib.protocols.http.httpclient import...

phpMyFAQ - Compromised Package Backdoor Detection (CVE-2010-4558)

Detects CVE-2010-4558 via index.php?phpmyfaqnew=cGhwaW5mbygpOwo= phpinfo;. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ backdoor CVE-2010-4558.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpMyFAQ -...

ManageEngine SDP - FILENAME Traversal Detection (CVE-2011-2757)

Detects CVE-2011-2757 via FileDownload.jsp?module=agent&FILENAME=../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-2757 via FileDownload.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

D-Link DIR-300/600 - command.php RCE Detection (CVE-2013-10048)

Detects CVE-2013-10048/10069 by POSTing cmd=ls -l /; to /command.php with Cookie uid=vttest. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300/600 command.php RCE CVE-2013-10048 / CVE-2013-10069.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

OpenX - flowplayer Backdoor Detection (CVE-2013-4211)

Detects CVE-2013-4211 by POSTing encoded phpinfo payload to fc.php flowplayer deliveryLog endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """OpenX flowplayer backdoor phpinfo CVE-2013-4211.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

D-Link - User-Agent Backdoor Detection (CVE-2013-6026)

Detects CVE-2013-6026 by comparing unauthorized responses with and without User-Agent xmlsetroodkcableoj28840ybtide on thttpd-alphanetworks. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link string-reversed User-Agent backdoor CVE-2013-6026.""" from kittysploit import from...

DirPHP - phpfile LFI Detection (CVE-2014-5115)

Detects CVE-2014-5115 by requesting index.php?phpfile=/etc/passwd on DirPHP. !/usr/bin/env python3 -- coding: utf-8 -- """DirPHP phpfile local file inclusion CVE-2014-5115.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Elasticsearch - Groovy Script RCE Detection (CVE-2015-1427)

Detects CVE-2015-1427 by POSTing a Groovy scriptfields payload to /search that executes id via Runtime.exec. !/usr/bin/env python3 -- coding: utf-8 -- """Elasticsearch Groovy scripting engine RCE CVE-2015-1427.""" import re from kittysploit import from lib.protocols.http.httpclient import...

vBulletin - decodeArguments RCE Detection (CVE-2015-7808)

Detects CVE-2015-7808 by sending a crafted serialized payload to /ajax/api/hook/decodeArguments that triggers phpinfo. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin 5.x pre-auth object injection RCE CVE-2015-7808.""" from urllib.parse import quote from kittysploit import from...

Zikula - jcss.php Path Traversal Detection (CVE-2016-9835)

Detects CVE-2016-9835 by requesting jcss.php?f=......\jcss.php and matching ERROR: Corrupted file without Requested file not readable. !/usr/bin/env python3 -- coding: utf-8 -- """Zikula jcss.php directory traversal CVE-2016-9835.""" from kittysploit import from lib.protocols.http.httpclient...

D-Link SharePort - Auth Bypass Detection (CVE-2018-9032)

Detects CVE-2018-9032 by requesting SharePort folderview.php / categoryview.php without auth and matching SharePort Web Access markers. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link SharePort Web Access unauthenticated exposure CVE-2018-9032.""" from kittysploit import from...

D-Link DIR-816L - getcfg.php Account Disclosure (CVE-2020-15894)

Detects CVE-2020-15894 by requesting getcfg.php with a crafted SERVICES payload that dumps DEVICE.ACCOUNT including password fields. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-816L getcfg.php account disclosure CVE-2020-15894.""" import re from kittysploit import from...

HiSilicon Encoder - Path Traversal Detection (CVE-2020-24219)

Detects CVE-2020-24219 by reading /etc/passwd via /../../sys/devices/media/13070000.jpgd/../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """HiSilicon encoder /sys/devices/media path traversal CVE-2020-24219.""" import re from kittysploit import from lib.protocols.http.httpclient...

D-Link DNS-320 - system_mgr.cgi RCE Detection (CVE-2020-25506)

Detects CVE-2020-25506 by injecting a command via /cgi-bin/systemmgr.cgi?cmd=cgintptime&fntpserver=cmd, writing output under /cgi-bin/.txt and reading it back. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320 systemmgr.cgi NTP command injection CVE-2020-25506.""" import re import secre...

AWStats - Config File Disclosure Detection (CVE-2020-29600/35176)

Detects AWStats file/config disclosure by requesting awstats.pl?config=/etc/passwd and awstats.pl?config=passwd and looking for AWStats syntax-error warnings that echo the path CVE-2020-29600 / CVE-2020-35176. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats config file disclosure...

Spring Cloud Gateway - Actuator SpEL RCE Detection (CVE-2022-22947)

Detects CVE-2022-22947 by creating a Gateway route with a SpEL AddResponseHeader filter via /actuator/gateway/routes, refreshing, and reading command output from the route definition. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud Gateway Actuator SpEL RCE CVE-2022-22947.""" import jso...

Synology BeeStation Drive Server - Auth Bypass Token Leak (CVE-2024-50630)

Synology Drive Server on BeeStation BSM allows unauthenticated attackers to read Drive logs via RedirectURI and obtain user access tokens via SYNO.SynologyDrive.Authentication CVE-2024-50630 / SA-24:21. Also indicates CVE-2024-50631. !/usr/bin/env python3 -- coding: utf-8 -- """Synology Drive...

Buffalo LinkStation - Arbitrary File Read (CVE-2025-26167)

Buffalo LinkStation exposes /rpc/cat/?inter=1 without authentication, allowing remote attackers to read arbitrary files e.g. password hashes. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo LinkStation unauthenticated arbitrary file read via /rpc/cat/ CVE-2025-26167.""" import re from...

D-Link DIR-816 - SystemCommand RCE Detection

Detects DIR-816 A2 command injection by extracting tokenid from /dirlogin.asp then POSTing sleep commands to /goform/SystemCommand and timing the response. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-816 SystemCommand RCE Jul 2019.""" import re import time from kittysploit import from...

EasyIO - bacnet.php RCE Detection

Detects EasyIO command injection via /sdcard/cpt/scripts/bacnet.php timeout=0%26cat%20/etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """EasyIO bacnet.php command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Edimax Router - Default Credentials (admin/1234)

Detects Edimax and similar routers advertising Basic realm "Default: admin/1234" and accepts login with those credentials CVE-2004-1791. !/usr/bin/env python3 -- coding: utf-8 -- """Edimax router HTTP Basic default credentials admin:1234 CVE-2004-1791.""" import base64 from kittysploit import fro...

Jenkins - Default Credentials Detection

Tries known Jenkins default credentials admin:password, admin:admin, admin:jenkins, jenkins:jenkins against jspringsecuritycheck / jacegisecuritycheck and verifies Dashboard access. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins default credentials detection admin/password, admin/admin,...

Magento - local.xml Config Disclosure Detection

Detects exposed Magento /app/etc/local.xml containing database username/password. !/usr/bin/env python3 -- coding: utf-8 -- """Magento app/etc/local.xml configuration disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

MantisBT - Default Credentials Detection

Tries the known MantisBT default credentials administrator:root against /login.php and looks for MANTISSTRINGCOOKIE / logincookietest redirect. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT default credentials administrator/root.""" from kittysploit import from lib.protocols.http.httpclie...

OSSIM - repository/download.php LFI Detection

Detects OSSIM LFI via repository/download.php?file=../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OSSIM LFI via repository/download.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Caucho Resin - Legacy WEB-INF Path Traversal Detection

Detects classic Caucho Resin path-traversal tricks that expose WEB-INF/resin-web.xml: /.jsp/WEB-INF/ CVE-2001-0399, /WEB-INF../ CVE-2004-0281, and /%20../WEB-INF/ CVE-2007-2440. !/usr/bin/env python3 -- coding: utf-8 -- """Caucho Resin legacy WEB-INF path traversal CVE-2001-0399 / 2004-0281 /...

tcPbX - tcpbx_lang LFI Detection

Detects tcPbX LFI via Cookie tcpbxlang=../../../../etc/passwd%00 on /tcpbx/. !/usr/bin/env python3 -- coding: utf-8 -- """tcPbX tcpbxlang cookie local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

vtiger CRM - graph.php OrganizationConfig Auth Bypass Detection

Detects vtiger = 5.2.1 auth bypass by requesting graph.php?module=Settings&action=OrganizationConfig and matching Company Details. !/usr/bin/env python3 -- coding: utf-8 -- """Detects vtiger = 5.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

MySQL/MariaDB - Auth Bypass Detection (CVE-2012-2122)

Detects CVE-2012-2122 by repeatedly attempting root login with a wrong password until memcmp returns success or max attempts. !/usr/bin/env python3 -- coding: utf-8 -- """MySQL/MariaDB memcmp authentication bypass CVE-2012-2122.""" import socket import struct from kittysploit import from...

OpenSMTPD - MAIL FROM Command Injection Detection (CVE-2020-7247)

Detects OpenSMTPD CVE-2020-7247 by sending a crafted MAIL FROM address containing shell metacharacters MAIL FROM: and checking whether the server accepts it with a 250 Ok response. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSMTPD MAIL FROM command injection CVE-2020-7247.""" import secrets...

nostromo nhttpd - Directory Traversal Detection (CVE-2011-0751)

Detects CVE-2011-0751 by requesting /..%2f..%2f..%2f..%2f..%2fetc/passwd and matching root:x:0:0. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-0751 by requesting /.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Drupal RESTWS - passthru RCE Detection

Detects Drupal RESTWS RCE via /index.php?q=taxonomyvocabulary/X/passthru/id SA-CONTRIB-2016-040. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal RESTWS taxonomyvocabulary passthru RCE.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Elastix - graph.php LFI Detection

Detects Elastix vtigercrm/graph.php currentlanguage LFI to /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Elastix vtigercrm graph.php LFI.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Elastix ...

ARRIS Router - Arbitrary File Read (CVE-2022-31793)

Reads arbitrary files from ARRIS routers via GET /a/ CVE-2022-31793. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ARRIS router arbitrary file read via /a/ CVE-2022-31793.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

nostromo nhttpd - Directory Traversal File Read (CVE-2011-0751)

Reads arbitrary files via CVE-2011-0751 /..%2f traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via CVE-2011-0751 /.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class ModuleAuxiliary, Httpclien...

Play Framework - public Path Traversal File Read

Reads arbitrary files via Play Framework /public/..%2f traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via Play Framework /public/.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class...

D-Link DWR - EXCU_SHELL Command Injection (CVE-2018-19300)

Exploits unauthenticated OS command injection on D-Link DWR devices via /EXCUSHELL headers cmdnum/command1/confirm1. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR EXCUSHELL unauthenticated RCE CVE-2018-19300 — opens execute session.""" import re from kittysploit import from...

FreePBX - API handler system() RCE (CVE-2014-1903)

Exploits CVE-2014-1903 via /admin/config.php handler=api function=system. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX API handler system RCE CVE-2014-1903 — opens execute session.""" import re from urllib.parse import quote from kittysploit import fr...

ManageEngine SDP - FileDownload.jsp Path Traversal Detection

Detects ManageEngine ServiceDesk Plus FileDownload.jsp fName path traversal to /etc/passwd via null-byte truncation. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus FileDownload.jsp path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient...