FreeSWITCH - /api/system RCE Detection (CVE-2018-19911)

Detects CVE-2018-19911 by requesting /api/system/?id and related paths and looking for uid= in the response. !/usr/bin/env python3 -- coding: utf-8 -- """FreeSWITCH unauthenticated /api/system command execution CVE-2018-19911.""" import re from kittysploit import from lib.protocols.http.httpclien...

QNAP - pingping.cgi Command Injection (CVE-2013-0143)

Exploits CVE-2013-0143 via /cgi-bin/pingping.cgi?pingip=1;;. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP pingping.cgi RCE CVE-2013-0143 — opens execute session.""" import base64 import re from urllib.parse import quote from kittysploit import from...

CasaOS - Arbitrary File Read via users/image (CVE-2024-24765)

Reads arbitrary files through CasaOS-UserService /v1/users/image?path= CVE-2024-24765, fixed in 0.4.7. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS arbitrary file read via /v1/users/image CVE-2024-24765.""" import re from kittysploit import from...

Seagate Personal Cloud - getPhotoPlaylistPhotos LFI (CVE-2017-18263)

Detects CVE-2017-18263 by requesting /getPhotoPlaylistPhotos.psp?url=/etc/passwd and checking for passwd contents. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate Personal Cloud Media Server path traversal CVE-2017-18263.""" import re from kittysploit import from lib.protocols.http.httpclien...

FreePBX ARI - Cookie Auth Bypass Detection (CVE-2014-7235)

Detects CVE-2014-7235 by sending crafted ariauth cookie to /recordings/index.php and matching authenticated UI markers. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX ARI recordings auth bypass CVE-2014-7235.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

NUUO NVRmini 2 - File Upload Detection (CVE-2018-11523)

Detects CVE-2018-11523 by uploading a PHP phpinfo payload to /upload.php and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini 2 unauthenticated PHP upload CVE-2018-11523.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Synology Drive Server - Unauth Access Token Leak (CVE-2024-50630)

Reads Synology Drive logs via CVE-2024-50629 RedirectURI abuse, extracts usernames, then calls SYNO.SynologyDrive.Authentication to obtain access tokens without credentials CVE-2024-50630 / SA-24:21. !/usr/bin/env python3 -- coding: utf-8 -- """Synology Drive Server unauthenticated access-token...

ASUS RT - AICloud smb Traversal Detection (CVE-2013-4937)

Detects CVE-2013-4937 by requesting /smb/tmp/etc/shadow and matching passwd-style entries. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS RT AICloud smb path traversal CVE-2013-4937.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Dahua Devices - webCapsConfig Information Disclosure (CVE-2019-9680)

Multiple Dahua devices and OEMs expose /webcaps/webCapsConfig without authentication, disclosing deviceType and vendor metadata. CVE-2024-13131 was rejected as a duplicate of CVE-2019-9680. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua and OEM unauthenticated webCapsConfig information...

GlassFish - Admin Console TRACE Bypass Detection (CVE-2011-1511)

Detects CVE-2011-1511 by issuing TRACE to manageUserNew.jsf and matching ConfirmPassword / NewPassword form fields. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle GlassFish Admin Console TRACE auth bypass CVE-2011-1511.""" from kittysploit import from lib.protocols.http.httpclient import...

FreePBX - API handler system() Detection (CVE-2014-1903)

Detects CVE-2014-1903 by calling /admin/config.php handler=api function=system with args=id and matching uid=. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX admin API handler system RCE CVE-2014-1903.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Apache HTTPD - Optionsbleed Detection (CVE-2017-9798)

Detects CVE-2017-9798 by sending repeated OPTIONS requests and looking for malformed Allow headers double commas / numeric garbage. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OPTIONS Allow header memory leak / Optionsbleed CVE-2017-9798.""" import re from kittysploit import from...

ZENworks - UploadServlet RCE Detection (CVE-2015-0779)

Detects CVE-2015-0779 by uploading a JSP via UploadServlet path traversal into zenworks/jsp/core/upload and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """Novell ZENworks UploadServlet arbitrary JSP upload CVE-2015-0779.""" from kittysploit import from...

GoAhead - ../.x/ Path Traversal Detection (CVE-2014-9707)

Detects CVE-2014-9707 by requesting /../../../.x/.x/.x/.x/.x/.x/etc/passwd style paths on Embedthis GoAhead. !/usr/bin/env python3 -- coding: utf-8 -- """Embedthis GoAhead ../.x/ path traversal CVE-2014-9707.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

PHP Utility Belt - ajax.php RCE

Exploits PHP Utility Belt by evaluating PHP via ajax.php code= parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Utility Belt ajax.php RCE — opens execute session.""" import base64 import re from kittysploit import from lib.protocols.http.httpclient...

Apache HTTP Server 2.4.49-2.4.50 - Path Traversal / RCE Detection (CVE-2021-42013)

Detects CVE-2021-42013 incomplete fix for CVE-2021-41773 using double-encoded .%%32%65/ traversal to read /etc/passwd or execute via CGI bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49-2.4.50 double-encoded path traversal / CGI RCE CVE-2021-42013.""" import re from...

Bash Shellshock - HTTP CGI RCE (CVE-2014-6271)

Exploits Shellshock via User-Agent injection against a CGI path. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Bash Shellshock HTTP CGI RCE CVE-2014-6271 — opens execute session.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Bash Shellshock - HTTP CGI Detection (CVE-2014-6271)

Detects Shellshock by injecting :;; id into User-Agent/Referer/Cookie against common CGI paths and matching uid=/gid=. !/usr/bin/env python3 -- coding: utf-8 -- """GNU Bash Shellshock HTTP CGI RCE CVE-2014-6271 / CVE-2014-6278.""" import re from kittysploit import from lib.protocols.http.httpclie...

Monitorix - Pipe Command Injection Detection (CVE-2013-7070)

Detects CVE-2013-7070/7071 by requesting /monitorix/|id| style paths. !/usr/bin/env python3 -- coding: utf-8 -- """Monitorix HTTP server pipe command injection CVE-2013-7070.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

QNAP Photo Station - Path Traversal Detection (CVE-2019-7192)

Detects QNAP Photo Station NAS-201911-25 CVE-2019-7192/7193/7194/7195 by creating a slideshow album, extracting access code, then reading /etc/passwd via /p/api/video.php filename traversal. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP Photo Station album API path traversal...

Apache Tomcat AJP - Ghostcat Detection (CVE-2020-1938)

Detects CVE-2020-1938 Ghostcat by sending a crafted AJP13 FORWARDREQUEST that includes /WEB-INF/web.xml via javax.servlet.include.servletpath. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat AJP Ghostcat file read / include CVE-2020-1938.""" import socket import struct from kittysploit...

ProFTPD - mod_copy CPFR/CPTO Detection (CVE-2015-3306)

Detects CVE-2015-3306 by issuing unauthenticated SITE CPFR /etc/passwd then SITE CPTO /tmp/passwd.copy and matching copy success. !/usr/bin/env python3 -- coding: utf-8 -- """ProFTPD modcopy unauthenticated SITE CPFR/CPTO CVE-2015-3306.""" import socket from kittysploit import from...

Symantec Web Gateway - pbcontrol.php RCE (CVE-2012-2953)

Exploits CVE-2012-2953 command injection in pbcontrol.php filename. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Symantec Web Gateway pbcontrol.php RCE CVE-2012-2953 — opens execute session.""" import re from urllib.parse import quote from kittysploit import...

EyesOfNetwork - user_id Cookie Blind SQLi Detection (CVE-2020-9465)

Detects CVE-2020-9465 by sending two userid cookies with RLIKE CASE WHEN payloads: false condition yields HTTP 500, true condition yields HTTP 302. !/usr/bin/env python3 -- coding: utf-8 -- """EyesOfNetwork userid cookie blind SQL injection CVE-2020-9465.""" from kittysploit import from...

Synology DSM/BSM - File Disclosure via RedirectURI (CVE-2024-50629)

Exploits improper encoding in SYNO.API.Auth.RedirectURI to inject an X-Accel-Redirect header and read limited internal files default: Synology Drive cloud-workerd.log. Works on vulnerable DSM and BeeStation. !/usr/bin/env python3 -- coding: utf-8 -- """Synology DSM/BSM limited file read via...

HP Data Protector - EXEC_CMD RCE Detection (CVE-2011-0923)

Detects CVE-2011-0923 by sending an EXECCMD omniback request that runs windows\system32\ipconfig.exe and matching IP configuration output. !/usr/bin/env python3 -- coding: utf-8 -- """HP Data Protector EXECCMD RCE CVE-2011-0923.""" import socket import time from kittysploit import from...

ManageEngine DC - agentLogUploader Detection (CVE-2013-7390)

Detects CVE-2013-7390/2014-5007 by POSTing to agentLogUploader and matching X-dc-header: yes. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central agentLogUploader upload CVE-2013-7390.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

PrestaShop Mega Menu - ajax_phpcode.php RCE (CVE-2018-8823)

Exploits CVE-2018-8823 by passing PHP code to /modules/bamegamenu/ajaxphpcode.php?code=. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PrestaShop Responsive Mega Menu ajaxphpcode.php RCE CVE-2018-8823 — opens execute session.""" import re from urllib.parse...

Netcore/Netis - UDP Backdoor Detection (CVE-2025-34117)

Detects Netcore/Netis UDP backdoor on port 53413 by sending XXXXXXXXnetcore and matching Login successed. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore/Netis UDP backdoor on port 53413 CVE-2025-34117 / 2014 disclosure.""" import socket from kittysploit import from...

BlueDragon - cfchart Path Traversal Detection (CVE-2014-5370)

Detects CVE-2014-5370 by requesting /cfchart.cfchart?../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """BlueDragon CFChart servlet path traversal CVE-2014-5370.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

jQuery File Upload - Unauth Upload RCE Detection (CVE-2018-9206)

Detects CVE-2018-9206 by uploading a PHP one-liner via blueimp jQuery-File-Upload endpoints and executing id. !/usr/bin/env python3 -- coding: utf-8 -- """Blueimp jQuery File Upload unauthenticated RCE CVE-2018-9206.""" import re from urllib.parse import urlparse from kittysploit import from...

Movable Type - XML-RPC Command Injection (CVE-2021-20837)

Exploits CVE-2021-20837 by sending mt.handlertocoderef XML-RPC calls with base64-encoded backtick OS commands to /mt/mt-xmlrpc.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Movable Type XML-RPC mt.handlertocoderef RCE CVE-2021-20837 — opens execute...

PHP File Manager - Backdoor Login Detection

Detects PHP File Manager backdoor account DONOTREMOVETHISENTRY / travan44 via multipart login. !/usr/bin/env python3 -- coding: utf-8 -- """PHP File Manager hardcoded backdoor credentials.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

rConfig - commands.inc.php SQLi Detection (CVE-2020-10220)

Detects CVE-2020-10220 by injecting UNION SELECT of a marker into commands.inc.php searchColumn and looking for id="" in the response. !/usr/bin/env python3 -- coding: utf-8 -- """rConfig commands.inc.php SQL injection CVE-2020-10220.""" from kittysploit import from lib.protocols.http.httpclient...

Joomla - com_fields SQLi Detection (CVE-2017-8917)

Detects CVE-2017-8917 by sending UpdateXML payload via comfields list fullordering and matching XPATH syntax error .255. in a 500 response. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla comfields SQLi CVE-2017-8917.""" import re from kittysploit import from lib.protocols.http.httpclient...

TerraMaster TOS - GetTest.php RCE Detection (CVE-2017-9328)

Detects CVE-2017-9328 by injecting a PHP webshell write via /include/ajax/GetTest.php and executing id. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS GetTest.php unauthenticated RCE CVE-2017-9328.""" import re from kittysploit import from lib.protocols.http.httpclient import...

MyBB - Compromised Package Backdoor Detection (CVE-2011-10018)

Detects CVE-2011-10018 by sending Cookie collapsed=...|phpinfo? and matching phpinfo title. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-10018 by sending Cookie collapsed=.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

GoAhead - CGI LD_DEBUG Injection Detection (CVE-2017-17562)

Detects CVE-2017-17562 by POSTing to common CGI endpoints with ?LDDEBUG=help and looking for dynamic linker help output. !/usr/bin/env python3 -- coding: utf-8 -- """Embedthis GoAhead CGI environment injection CVE-2017-17562.""" from kittysploit import from lib.protocols.http.httpclient import...

ASUSTOR ADM - aggrecate_js.cgi RCE Detection (CVE-2018-11510)

Detects CVE-2018-11510 by injecting ls into /portal/apis/aggrecatejs.cgi?script=launcher"&CMD&" and matching directory listing. !/usr/bin/env python3 -- coding: utf-8 -- """ASUSTOR ADM aggrecatejs.cgi unauthenticated RCE CVE-2018-11510.""" import re from kittysploit import from...

Express.js - Debug Mode Stack Trace Disclosure

Detects Express apps running with NODEENV=development or similar debug error handlers by sending a GET with Content-Type: application/json and a non-JSON body, then looking for a 400 response that leaks a SyntaxError stack / nodemodules path. !/usr/bin/env python3 -- coding: utf-8 -- """Express.j...

VMware - SDK Directory Traversal Detection (CVE-2009-3733)

Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port.""" import re from kittysploit import from...

Drupal - SA-CORE-2014-005 SQLi Detection (CVE-2014-3704)

Detects Drupageddon CVE-2014-3704 by POSTing crafted name0; SELECT ... to the login form and matching mbstrlen warning. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal 7.x SA-CORE-2014-005 SQLi detection CVE-2014-3704.""" from kittysploit import from lib.protocols.http.httpclient import...

MantisBT - db_type LFI Detection (CVE-2010-4348)

Detects CVE-2010-4348 via admin/upgradeunattended.php?dbtype=..%2f..%2fetc/passwd%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-4348 via admin/upgradeunattended.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

EMC CTA - XXE File Read Detection (CVE-2014-0644)

Detects CVE-2014-0644 by POSTing XXE to /api/login with Password= pointing at file:///etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """EMC Cloud Tiering Appliance XXE file read CVE-2014-0644.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link/TOTOLINK - ExportSettings.sh Unauth Config Download

Various D-Link and TOTOLINK devices expose /cgi-bin/ExportSettings.sh without authentication, allowing download of device configuration backups CVE-2018-17786 / CVE-2022-32993 / CVE-2023-53896. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link / TOTOLINK unauthenticated ExportSettings.sh config...

DroboPix - demo API Command Injection Detection (CVE-2018-14706)

Detects DroboPix RCE by injecting into /DroboPix/api/drobopix/demo JSON enabled field, writing id output under /DroboPix/, then reading it. !/usr/bin/env python3 -- coding: utf-8 -- """DroboPix demo API command injection CVE-2018-14706.""" import re import secrets from kittysploit import from...

vBulletin - install/upgrade.php Exposure Detection (CVE-2013-6129)

Detects CVE-2013-6129 style install exposure by finding reachable /install/upgrade.php with Customer Number form. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin install/upgrade.php authentication bypass exposure CVE-2013-6129.""" from kittysploit import from lib.protocols.http.httpclient...

OpenMRS - dataexchange export.form Disclosure Detection (CVE-2020-5732)

Detects OpenMRS unauthenticated data export by POSTing conceptIds=1 to /module/dataexchange/export.form and looking for HTTP 201 with conceptdatatypeid. !/usr/bin/env python3 -- coding: utf-8 -- """OpenMRS dataexchange export.form unauthenticated access CVE-2020-5732...""" from kittysploit import...

A2Billing - Unauth SQL Dump Detection

Detects A2Billing backup abuse by triggering A2Bentitybackup.php dump to a guessable .sql path and downloading it. !/usr/bin/env python3 -- coding: utf-8 -- """A2Billing unauthenticated SQL dump via A2Bentitybackup.php.""" import time from kittysploit import from lib.protocols.http.httpclient...

Redis - Lua Sandbox Escape Detection (CVE-2022-0543)

Detects CVE-2022-0543 on Debian/Ubuntu-packaged Redis by EVAL-loading liblua5.1 via package.loadlib and executing id/cat via io.popen. !/usr/bin/env python3 -- coding: utf-8 -- """Redis Lua sandbox escape RCE on Debian/Ubuntu packages CVE-2022-0543.""" import socket from kittysploit import from...