Windows JScript Reverse TCP (csc on-box)

JScript/cscript delivery vector: writes a tiny C reverse shell, compiles with csc.exe .NET Framework, and runs it — no powershell.exe. Useful when .ps1 execution is restricted AppLocker. from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "jscript" info = "name": "Windows...

Windows MSBuild / InstallUtil Reverse TCP

AppLocker-style bypass: MSBuild inline C task or InstallUtil-compatible DLL running a C reverse shell. Pair with listeners/multi/reversetcp. from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "msbuild" info = "name": "Windows MSBuild / InstallUtil Reverse TCP",...

DNS Dynamic Update

Attempts an unauthenticated DNS UPDATE add+delete probe A record NSE dns-update. !/usr/bin/env python3 -- coding: utf-8 -- """Unauthenticated DNS dynamic update NSE dns-update.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.dns.detector...

DNS Zone Transfer (AXFR)

Attempts an unauthenticated DNS zone transfer AXFR against the target nameserver for a given domain NSE dns-zone-transfer. !/usr/bin/env python3 -- coding: utf-8 -- """DNS AXFR zone transfer check NSE dns-zone-transfer.""" from kittysploit import from lib.protocols.ics.icsscannerclient import...

HTTP PUT Writable

Attempts an HTTP PUT of a probe file and reports if the server accepts writes NSE http-put. Tries DELETE cleanup afterward. !/usr/bin/env python3 -- coding: utf-8 -- """HTTP PUT writable path check NSE http-put.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

HTTP Internal IP Disclosure

Looks for private RFC1918 / link-local addresses in HTTP headers and body NSE http-internal-ip-disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Internal IP disclosure in HTTP responses NSE http-internal-ip-disclosure.""" from kittysploit import from lib.protocols.http.httpclient import...

MSSQL NTLM Info

Performs TDS Login7 with NTLM SSPI negotiate and parses the Type-2 challenge NSE ms-sql-ntlm-info. !/usr/bin/env python3 -- coding: utf-8 -- """MSSQL NTLM info NSE ms-sql-ntlm-info.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

RDP NTLM Info

Negotiates RDP NLA/CredSSP and parses the NTLM Type-2 challenge for domain / computer identity NSE rdp-ntlm-info. !/usr/bin/env python3 -- coding: utf-8 -- """RDP NTLM info via CredSSP NSE rdp-ntlm-info.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient fr...

SMTP Commands

Issues EHLO and lists advertised SMTP capabilities NSE smtp-commands. !/usr/bin/env python3 -- coding: utf-8 -- """SMTP EHLO capability enum NSE smtp-commands.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.smtp.detectors import...

SMTP NTLM Info

Performs SMTP AUTH NTLM negotiate and parses the Type-2 challenge for Windows domain / computer identity NSE smtp-ntlm-info. !/usr/bin/env python3 -- coding: utf-8 -- """SMTP NTLM challenge info NSE smtp-ntlm-info.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

Broadcast DHCP Discover

Sends a DHCP DISCOVER and reports offers NSE broadcast-dhcp-discover. Requires scapy and typically elevated privileges. !/usr/bin/env python3 -- coding: utf-8 -- """DHCP broadcast discover NSE broadcast-dhcp-discover.""" from kittysploit import from lib.scanner.broadcast.detectors import...

WPAD Discover

Resolves WPAD hosts and fetches wpad.dat PAC files NSE broadcast-wpad-discover inspired; DNS+HTTP methods. !/usr/bin/env python3 -- coding: utf-8 -- """WPAD discovery NSE broadcast-wpad-discover inspired.""" from kittysploit import from lib.scanner.broadcast.detectors import probebroadcastwpad...

SNMP Win32 Users

Enumerates Windows local usernames via LANMANAGER-MIB over SNMP NSE snmp-win32-users. !/usr/bin/env python3 -- coding: utf-8 -- """Windows users via SNMP NSE snmp-win32-users.""" from kittysploit import from lib.scanner.snmp.detectors import probesnmpwin32users class ModuleScanner: info = "name":...

Oracle TNS Version

Queries Oracle TNS Listener for version/banner information NSE oracle-tns-version. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle TNS version NSE oracle-tns-version.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.oracle.detectors...

Broadcast WS-Discovery

Sends a WS-Discovery Probe to 239.255.255.250:3702 and collects ProbeMatches NSE broadcast-wsdd-discover. !/usr/bin/env python3 -- coding: utf-8 -- """WS-Discovery multicast probe NSE broadcast-wsdd-discover.""" from kittysploit import from lib.scanner.broadcast.detectors import probebroadcastwsd...

Filesystem Dropbox-like Polling Agent

Writes a Python implant that uses a shared directory as C2 dead-drop register/commands/results. Controller: listeners/filesystem/dropboxlikepolling. Requires a shared path SMB/NFS/sync — install as backdoor, not exploit payload. from kittysploit import class ModuleBackdoor: """Filesystem dead-dro...

Autofill Payment / Identity Harvest

Trigger browser autofill for payment and identity fields and collect filled values from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Autofill Payment / Identity Harvest", "description": "Trigger browser autofill for payment and identity fields and collect filled...

Node.js Reverse TCP Shell

Node.js reverse TCP command shell node -e one-liner. Ideal for Node/npm RCE chains. from kittysploit import import base64 import json class ModulePayload: CLIENTLANGUAGE = "javascript" info = "name": "Node.js Reverse TCP Shell", "description": "Node.js reverse TCP command shell node -e one-liner...

DNS NSID / BIND Version

Queries CHAOS TXT id.server / version.bind and EDNS NSID to fingerprint a nameserver NSE dns-nsid. !/usr/bin/env python3 -- coding: utf-8 -- """DNS NSID / CHAOS version probe NSE dns-nsid.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

HTTP BIG-IP Cookie

Detects F5 BIGipServer cookies and decodes classic pool-member IP:port NSE http-bigip-cookie. !/usr/bin/env python3 -- coding: utf-8 -- """F5 BIG-IP cookie decode NSE http-bigip-cookie.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.bigipput...

SMTP Open Relay

Tests whether an SMTP server accepts third-party relay MAIL FROM / RCPT TO to external domains without completing DATA NSE smtp-open-relay. !/usr/bin/env python3 -- coding: utf-8 -- """SMTP open relay check NSE smtp-open-relay.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient...

SNMP Cisco IOS Config Hints

Fingerprints Cisco IOS via SNMP and checks for config-copy MIB / image strings read-only subset of NSE snmp-ios-config; does not push config to TFTP. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco IOS SNMP config/info NSE snmp-ios-config inspired, read-only.""" from kittysploit import from...

Python AWS SQS Reverse Shell

Poll an SQS command queue for tasks and publish results to a response queue. Uses boto3 when available, otherwise falls back to aws CLI. Pairs with listeners/aws/reverseawssqs. from kittysploit import from lib.c2.awssqsreverseagent import buildawssqsreverseagentscript class ModulePayload: """AWS...

Python DNS Reverse Shell

Poll DNS TXT records for commands and exfil output via result queries stdlib UDP DNS — no dnspython required on target. Pairs with listeners/covert/dns. from kittysploit import from lib.c2.dnsreverseagent import buildpythondnsagentscript class ModulePayload: """DNS TXT polling agent — deliverable...

Python Reverse TCP (thin / EXE stager)

Minimal Python reverse TCP shell. generate returns a compact one-liner; set compileexe=true to build a Windows EXE via Zig getpythonscript. Designed as a thin stager for exploit chains. from kittysploit import class ModulePayload: """Thin Python reverse TCP payload with optional Zig compile-to-EX...

PowerShell Kitty Agent (typed tasks)

PowerShell HTTP polling agent with typed tasks shell/ls/pwd/whoami/cat/download/upload for listeners/multi/reversehttppolling from kittysploit import import base64 from lib.c2.beaconprofile import BeaconProfile from lib.c2.powershellhttppolling import buildpowershellhttppollingscript class...

PowerShell Command Shell, Reverse UDP

Connect-back UDP shell line-oriented. Pairs with listeners/multi/reverseudp from kittysploit import import base64 from lib.c2.stagerevasion import powershellprelude class ModulePayload: CLIENTLANGUAGE = "powershell" info = "name": "PowerShell Command Shell, Reverse UDP", "description":...

Python Reverse WebSocket Shell

Connect back over WebSocket and provide an interactive command shell stdlib only from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Python Reverse WebSocket Shell", "description": "Connect back over WebSocket and provide an interactive command she...

SMB Security Mode

Negotiates SMB2/3 and reports signing mode and selected dialect NSE smb2-security-mode / smb-protocols. !/usr/bin/env python3 -- coding: utf-8 -- """SMB2 security mode / dialect NSE smb2-security-mode / smb-protocols.""" from kittysploit import from lib.protocols.smb.smbscannerclient import...

File Upload Lure

Show a fake file-attach modal and exfiltrate selected file metadata and content from kittysploit import import base64 import json import os import time class ModuleBrowserAuxiliary: info = "name": "File Upload Lure", "description": "Show a fake file-attach modal and exfiltrate selected file...

Windows CMD Reverse TCP (csc on-box)

Pure cmd.exe one-liner: writes a tiny C reverse shell, compiles with csc.exe .NET Framework, and runs it — no powershell.exe from kittysploit import class ModulePayload: CLIENTLANGUAGE = "cmd" info = "name": "Windows CMD Reverse TCP csc on-box", "description": "Pure cmd.exe one-liner: writes a ti...

PowerShell Reverse WebSocket Shell

Connect back over WebSocket .NET ClientWebSocket and run commands from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "powershell" info = "name": "PowerShell Reverse WebSocket Shell", "description": "Connect back over WebSocket .NET ClientWebSocket and run commands",...

Slack Socket Mode / Web API Polling Agent

Writes a Python implant that polls a Slack channel for commands and posts results. Controller: listeners/messaging/slacksocketmode. Requires a Slack bot token on the implant — install as backdoor, not exploit payload. from kittysploit import class ModuleBackdoor: """Slack Web API polling implant ...

SOCKS Open Proxy

Tests whether a SOCKS4/5 service allows unauthenticated CONNECT to an external host NSE socks-open-proxy. !/usr/bin/env python3 -- coding: utf-8 -- """Open SOCKS4/5 proxy check NSE socks-open-proxy.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

Oracle SID Brute

Brute-forces common Oracle SIDs against a TNS listener NSE oracle-sid-brute. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle SID brute NSE oracle-sid-brute.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.oracle.detectors import...

SMB MS17-010 (EternalBlue)

Unauthenticated SMBv1 probe for MS17-010 CVE-2017-0143 / EternalBlue via PeekNamedPipe on FID 0 NSE smb-vuln-ms17-010. !/usr/bin/env python3 -- coding: utf-8 -- """MS17-010 / EternalBlue detection NSE smb-vuln-ms17-010.""" from kittysploit import from lib.protocols.smb.smbscannerclient import...

Lua / awk Reverse TCP

Reverse TCP shell via Lua or awk minimal hosts / CTF / constrained Unix from kittysploit import class ModulePayload: CLIENTLANGUAGE = "lua" info = "name": "Lua / awk Reverse TCP", "description": "Reverse TCP shell via Lua or awk minimal hosts / CTF / constrained Unix", "category":...

IIS Shortname Disclosure

Detects IIS tilde / 8.3 short-name enumeration vulnerability by comparing status codes for existing vs non-existing shortname probes NSE http-iis-short-name-brute. !/usr/bin/env python3 -- coding: utf-8 -- """IIS shortname 8.3 disclosure NSE http-iis-short-name-brute.""" from kittysploit import...

Windows x64 Reverse TCP Stager

Position-independent x64 reverse TCP shellcode that connects back and spawns cmd.exe from kittysploit import class ModulePayload: """Windows x64 reverse TCP stager cmd.exe. Compatible with listeners/multi/reversetcp.""" info = "name": "Windows x64 Reverse TCP Stager", "description":...

Samba CVE-2017-7494 (version check)

Non-intrusive SambaCry likelihood check based on disclosed Samba version NSE smb-vuln-cve-2017-7494 check-version mode. Does not upload libraries. !/usr/bin/env python3 -- coding: utf-8 -- """SambaCry CVE-2017-7494 version check NSE smb-vuln-cve-2017-7494 check-version.""" from kittysploit import...

WebSocket Reverse Tunnel

Open a WebSocket from the hooked browser and proxy HTTP fetch commands through it from kittysploit import import json import threading import time import queue try: import asyncio from websockets.server import serve as wsserve WEBSOCKETSAVAILABLE = True except ImportError: WEBSOCKETSAVAILABLE =...

Push Subscription Steal

Read or create a Web Push subscription endpoint + keys from the hooked origin from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Push Subscription Steal", "description": "Read or create a Web Push subscription endpoint + keys from the hooked origin", "author":...

Fake Session Expired

Show a session-expired / re-auth modal to harvest credentials and optional MFA from kittysploit import import json import uuid class ModuleBrowserAuxiliary: info = "name": "Fake Session Expired", "description": "Show a session-expired / re-auth modal to harvest credentials and optional MFA",...

CORS Reachability Matrix

Probe a list of URLs from the hooked browser cors / no-cors and report reachability from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "CORS Reachability Matrix", "description": "Probe a list of URLs from the hooked browser cors / no-cors and report reachability",...

Overlay / Clickjacking Kit

Inject clickjacking overlays: bait iframe, full-page click capture, or decoy button from kittysploit import import json import uuid class ModuleBrowserAuxiliary: info = "name": "Overlay / Clickjacking Kit", "description": "Inject clickjacking overlays: bait iframe, full-page click capture, or dec...

Third-Party Script Inventory

Inventory script tags, classify first vs third-party, and flag known CDN / tracker hosts from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Third-Party Script Inventory", "description": "Inventory script tags, classify first vs third-party, and flag known CDN /...

HTML Smuggling Download

Force a file download in the victim browser via Blob URL HTML smuggling from kittysploit import import base64 import json import os class ModuleBrowserAuxiliary: info = "name": "HTML Smuggling Download", "description": "Force a file download in the victim browser via Blob URL HTML smuggling",...

Internal Port Scan

Probe internal hosts/ports from the hooked browser Image/WebSocket/fetch timing from kittysploit import import json import ipaddress import re class ModuleBrowserAuxiliary: info = "name": "Internal Port Scan", "description": "Probe internal hosts/ports from the hooked browser Image/WebSocket/fetc...

Token / Secret Hunter

Hunt JWTs, Bearer tokens, API keys and session secrets across storage, cookies, URL and DOM from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Token / Secret Hunter", "description": "Hunt JWTs, Bearer tokens, API keys and session secrets across storage, cookies, URL...

postMessage Attack Surface Map

Map postMessage usage, iframes, and optionally capture live message events from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "postMessage Attack Surface Map", "description": "Map postMessage usage, iframes, and optionally capture live message events", "author":...