ONVIF Snapshot Grab

Authenticate to ONVIF Media service, resolve GetSnapshotUri for the first profile, and download a JPEG snapshot. Prefers an ONVIF session. !/usr/bin/env python3 -- coding: utf-8 -- """Fetch an ONVIF snapshot JPEG via GetSnapshotUri.""" from kittysploit import from lib.protocols.onvif.session impo...

Matter Client

Discovers Matter/CHIP nodes via mDNS matterc.udp / matter.tcp, parses commissionable/operational TXT, optionally probes UDP/5540, and opens an interactive Matter shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Matter bind listener — DNS-SD discovery session for Matter / CHIP nodes."""...

RTSP Client

Connects to an RTSP/RTSPS endpoint, probes OPTIONS/DESCRIBE, and creates an interactive RTSP shell describe, setup/play interleaved, teardown. !/usr/bin/env python3 -- coding: utf-8 -- """RTSP bind listener — opens an interactive RTSP session toward a camera/NVR.""" from kittysploit import from...

MIPS LE reverse TCP shell (raw)

MIPS little-endian 32-bit connect-back stager: socket, connect, dup2 x3, execve //bin/sh. Common on OpenWrt/MIPSEL routers. Output is raw bytes not a command string. !/usr/bin/env python3 -- coding: utf-8 -- Linux/MIPS LE reverse TCP + dup2 + execve"//bin/sh" — based on public shellcode by rigan...

BusyBox Embedded HTTP Polling C2

POSIX/BusyBox ash HTTP polling implant for OpenWrt and embedded Linux. Pairs with listeners/multi/reversehttppolling base64 command protocol. from kittysploit import from lib.c2.embeddedhttpagent import buildembeddedhttpagentscript from lib.c2.embeddedsession import EmbeddedC2Mixin import uuid...

BACnet read property

ReadProperty against a BACnet object session preferred !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.bacnetclient import readproperty from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient...

DNP3 integrity dump

Integrity poll class 0–3 plus binary/analog sample counts session preferred !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import integritypolldnp3 from lib.protocols.ics.icsscannerclient...

DNP3 operate CROB

Sends a Control Relay Output Block g12v1 via Select/Operate or Direct Operate. Intrusive — OT lab / riskapproved only gated by otpolicy. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client...

IEC 61850 MMS directory dump

MMS Identify plus GetNameList for domains and named variables session preferred. !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS directory dump — Identify + GetNameList domains/variables.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

IEC 61850 MMS identify

MMS Identify request — extract vendor/model/revision strings session preferred !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS Identify via session or direct target.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

PostgreSQL login bruteforce

Attempts common and wordlist-based PostgreSQL credentials. Use only on authorized targets — rate-limited by default. !/usr/bin/env python3 -- coding: utf-8 -- """ PostgreSQL login bruteforce — tests username/password combinations. """ from future import annotations import itertools import os impo...

BACnet/IP Client

Discovers a BACnet/IP device Who-Is and creates an interactive BACnet shell session !/usr/bin/env python3 -- coding: utf-8 -- """BACnet/IP bind listener — opens a BACnet session for interactive device access.""" from kittysploit import from lib.protocols.ics.bacnetclient import BacnetClient from...

DNP3 TCP Client

Connects to a DNP3 outstation and creates an interactive DNP3 shell session !/usr/bin/env python3 -- coding: utf-8 -- """DNP3 TCP bind listener — opens a DNP3 session for interactive polling.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

IEC 61850 MMS Client

Connects to an IEC 61850 MMS server ISO-on-TCP, completes COTP + Initiate, and creates an interactive MMS shell session. !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS bind listener — opens an MMS session for identify / directory.""" from kittysploit import from...

CoAP Client

Connects to a CoAP/CoAPS UDP endpoint, probes .well-known/core, and creates an interactive CoAP shell session GET/POST/PUT/DELETE/Observe stream. !/usr/bin/env python3 -- coding: utf-8 -- """CoAP bind listener — opens an interactive CoAP session toward a device.""" from kittysploit import from...

MIPS BE reverse TCP shell (raw)

MIPS big-endian 32-bit connect-back stager: socket, connect, dup2 x3, execve //bin/sh. Typical on older big-endian routers. Output is raw bytes not a command string. !/usr/bin/env python3 -- coding: utf-8 -- Linux/MIPS BE reverse TCP + dup2 + execve"//bin/sh" — based on public shellcode by rigan...

BLE UART pivot probe

Detect Nordic NUS and common UART-over-GATT profiles on a BLE session for interactive pivot uartexec / shell commands. !/usr/bin/env python3 -- coding: utf-8 -- """Probe BLE UART / Nordic NUS channels for shell pivot.""" from kittysploit import from lib.protocols.ble.blesessionmixin import...

CoAP Resource Enum

Enumerate CoAP resources from .well-known/core and optionally GET discovered paths. Uses a CoAP session or rhost. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate CoAP resources via .well-known/core and optional path probes.""" from kittysploit import from lib.protocols.coap.client import...

Deploy Embedded HTTP C2

Generate and optionally execute a BusyBox/ash HTTP polling agent on an OpenWrt/embedded shell. Pairs with listeners/multi/reversehttppolling. !/usr/bin/env python3 -- coding: utf-8 -- """Deploy BusyBox embedded HTTP polling C2 from a live shell session.""" from kittysploit import from...

MQTT Broker Audit

Audit an MQTT broker from a session or rhost: anonymous access, $SYS exposure, retained messages, and rough ACL signals. !/usr/bin/env python3 -- coding: utf-8 -- """Audit MQTT broker exposure: anonymous auth, $SYS, retained, ACL signals.""" from kittysploit import from lib.post.mqtt.session impo...

MQTT Topic Dump

Subscribe to broker topics default and $SYS/ for a short window and dump messages seen — including retained. Works on MQTT sessions or with rhost/rport. !/usr/bin/env python3 -- coding: utf-8 -- """Dump MQTT topics / retained messages from a broker session or direct connect.""" from kittysploit...

RTSP describe dump

OPTIONS + DESCRIBE against an RTSP URL/session and dump SDP media tracks !/usr/bin/env python3 -- coding: utf-8 -- """RTSP DESCRIBE dump — SDP media inventory via session or URL.""" from kittysploit import from lib.protocols.rtsp.client import RTSPPORT, probertsp from lib.protocols.rtsp.session...

UPnP IGD Port Map Dump

Call IGD GetExternalIPAddress / GetStatusInfo / GetGenericPortMappingEntry to inventory NAT port forwards exposed by the gateway. !/usr/bin/env python3 -- coding: utf-8 -- """Dump IGD external IP and port mappings via UPnP WANIP/WANPPP actions.""" from kittysploit import from...

FTP FEAT Detection

Lists FTP features advertised via FEAT AUTH TLS, UTF8, EPSV, …. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FTP FEAT capabilities TLS, UTF8, EPSV, ….""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.ftp.detectors import probeftpfe...

FTP SYST Detection

Queries FTP SYST to fingerprint the remote system type. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FTP SYST response OS / server type.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.ftp.detectors import probeftpsyst class...

SSH Empty Password

Tests common usernames for empty-password SSH login. Requires Paramiko. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SSH accounts accepting an empty password.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

Matter device inventory

Full Matter node inventory from DNS-SD TXT vendor/product, device type, commissioning window, discriminator with optional JSON export. !/usr/bin/env python3 -- coding: utf-8 -- """Matter device inventory dump JSON via session or target.""" from kittysploit import from lib.protocols.matter.client...

Matter discover

Browse Matter commissionable/operational DNS-SD records and summarize vendor, device type, and commissioning mode session preferred. !/usr/bin/env python3 -- coding: utf-8 -- """Matter mDNS discovery via session or target.""" from kittysploit import from lib.protocols.matter.client import...

Deploy MQTT Reverse Agent

Generate and optionally execute a stdlib Python MQTT reverse agent from an existing shell session. Pairs with listeners/iot/reversemqttshell. !/usr/bin/env python3 -- coding: utf-8 -- """Post module: package/show MQTT reverse agent for delivery from a shell session.""" from kittysploit import fro...

ONVIF Events Probe

Query ONVIF Events GetEventProperties and extract topic hints. Uses an ONVIF session or rhost. !/usr/bin/env python3 -- coding: utf-8 -- """Probe ONVIF Events service GetEventProperties / topic list.""" from kittysploit import from lib.protocols.onvif.session import OnvifSessionMixin import json...

ONVIF Media Streams

List ONVIF media profiles and resolve GetSnapshotUri + GetStreamUri RTSP for RTSP handoff. Uses an ONVIF session or rhost. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate ONVIF media profiles, snapshot URIs, and RTSP stream URIs.""" from kittysploit import from lib.protocols.onvif.session...

ONVIF PTZ Status

Query ONVIF PTZ GetStatus for a media profile pan/tilt/zoom. Uses an ONVIF session or rhost. !/usr/bin/env python3 -- coding: utf-8 -- """Read ONVIF PTZ status for the first or selected media profile.""" from kittysploit import from lib.protocols.onvif.session import OnvifSessionMixin import json...

RTSP stream probe

DESCRIBE → SETUP RTP/AVP/TCP interleaved → PLAY and drain a short sample to confirm media delivery session preferred. !/usr/bin/env python3 -- coding: utf-8 -- """RTSP interleaved stream probe — SETUP/PLAY and drain a few RTP bytes.""" from kittysploit import from lib.protocols.rtsp.client import...

OpenWrt / BusyBox Dump Dropbear Keys

Locate and dump Dropbear host keys, authorizedkeys, and related SSH material on embedded Linux / OpenWrt targets. !/usr/bin/env python3 -- coding: utf-8 -- """Collect Dropbear / SSH keys from an OpenWrt / BusyBox shell.""" from kittysploit import from lib.post.linux.session import LinuxSessionMix...

OpenWrt / BusyBox Dump NVRAM UCI

Dump router configuration via nvram show, uci export, and common config paths /etc/config, /tmp/nvram. !/usr/bin/env python3 -- coding: utf-8 -- """Dump OpenWrt nvram / UCI configuration from an embedded shell.""" from kittysploit import from lib.post.linux.session import LinuxSessionMixin import...

OpenWrt / BusyBox Firmware Info

Collect firmware/board identity from an embedded Linux shell: openwrtrelease, board name, uname, and common version files. !/usr/bin/env python3 -- coding: utf-8 -- """Gather OpenWrt / embedded firmware identity from a BusyBox-style shell.""" from kittysploit import from lib.post.linux.session...

OpenWrt / BusyBox Network Recon

Enumerate interfaces, routes, ARP/neighbors, DNS, and listening sockets on an embedded Linux shell for LAN/WAN pivot planning. !/usr/bin/env python3 -- coding: utf-8 -- """Network / pivot recon for OpenWrt / BusyBox shells.""" from kittysploit import from lib.post.linux.session import...

UPnP Device Inventory

Dump UPnP device identity and service list from an SSDP session or direct LOCATION/rhost discover. !/usr/bin/env python3 -- coding: utf-8 -- """Inventory UPnP device description and services.""" from kittysploit import from lib.protocols.upnp.client import SSDPPORT from lib.protocols.upnp.session...

MySQL Empty Password

Tests common MySQL/MariaDB usernames for empty-password login. Requires pymysql. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect MySQL/MariaDB accounts with an empty password.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient...

PostgreSQL Auth Method

Identifies the PostgreSQL AuthenticationRequest type trust, cleartext, md5, scram/sasl, … for a username. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PostgreSQL authentication method from startup handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

Matter / CHIP Detection

Discovers Matter commissionable matterc.udp and operational matter.tcp nodes via mDNS, parses TXT VP/DT/DN/CM, and can probe UDP/5540 reachability. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Matter / CHIP nodes via mDNS and optional UDP/5540 probe.""" from kittysploit import from...

Firmware → adaptive payload plan

Detect firmware CPU architecture from ELF headers, select the best payload BusyBox/CMD vs raw and listener adaptive vs reversetcp, then emit a ready-to-run CLI command sequence. !/usr/bin/env python3 -- coding: utf-8 -- """ Firmware arch → adaptive payload/listener plan. Scans ELF headers, select...

Firmware architecture → payload suggest

Scan a local firmware blob for embedded ELF headers, infer architecture mipsle/mipsbe/armle/arm64/x86/x64/…, recommend payloads, and show an adaptive listener plan. !/usr/bin/env python3 -- coding: utf-8 -- """ Scan a firmware image for ELF headers, detect CPU architecture, and suggest matching...

IEC 60870-5-104 Client

Connects to an IEC 104 server and creates an interactive IEC 104 shell session !/usr/bin/env python3 -- coding: utf-8 -- """IEC 60870-5-104 bind listener — opens an IEC 104 session for interrogation.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

ONVIF Client

Discovers an ONVIF device service, loads Media/PTZ/Events capabilities, and creates an interactive ONVIF shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ONVIF bind listener — opens an interactive ONVIF camera session.""" from kittysploit import from lib.protocols.onvif.client import...

UPnP / SSDP Client

Discovers a UPnP device via SSDP M-SEARCH, fetches the device description, and opens an interactive UPnP shell IGD actions. !/usr/bin/env python3 -- coding: utf-8 -- """UPnP bind listener — SSDP discover + device description session.""" from kittysploit import from lib.protocols.upnp.client impor...

CoAP Observe Dump

Register RFC 7641 Observe on a resource and collect notifications for a duration ACK CON notifications, then deregister. !/usr/bin/env python3 -- coding: utf-8 -- """Collect CoAP Observe notifications for a resource over a time window.""" from kittysploit import from lib.protocols.coap.client...

CoAP Resource Write

Send PUT, POST, or DELETE to a CoAP resource. Intrusive — use only on authorized lab targets. !/usr/bin/env python3 -- coding: utf-8 -- """Write CoAP resources via PUT/POST/DELETE lab / authorized testing.""" from kittysploit import from lib.protocols.coap.client import COAPPORT from...

IEC104 double command

Sends an IEC 60870-5-104 double command CDCNA1. Intrusive — otpolicy gated + confirm latch. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

ONVIF Device Information

Query an IP camera ONVIF device service for manufacturer/model/firmware and Media service XAddr. Prefers an ONVIF session when set. !/usr/bin/env python3 -- coding: utf-8 -- """ONVIF device information gather HTTP SOAP.""" from kittysploit import from lib.protocols.onvif.session import...