postMessage Attack Surface Map

Map postMessage usage, iframes, and optionally capture live message events from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "postMessage Attack Surface Map", "description": "Map postMessage usage, iframes, and optionally capture live message events", "author":...

Browser Extension Detect

Best-effort detection of installed Chromium extensions via web-accessible resources from kittysploit import import json Common Chromium extension IDs and a representative web-accessible resource path. Detection is best-effort: MV3 + locked resources produce many false negatives. DEFAULTEXTENSIONS...

Browser HTTP Pivot (Fetch Proxy)

Issue HTTP requests from the hooked browser and return status/headers/body intranet pivot from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Browser HTTP Pivot Fetch Proxy", "description": "Issue HTTP requests from the hooked browser and return status/headers/body...

Docker Daemon Exposed (HTTP)

Detects an unauthenticated Docker Engine API via /version and /vApiVersion/containers/json. Typical port: 2375. !/usr/bin/env python3 -- coding: utf-8 -- """Docker Daemon exposed over HTTP API.""" import json import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

HTTP TRACE Method Enabled

Sends an HTTP TRACE request and checks whether the server echoes the request, which can enable Cross-Site Tracing XST style attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HTTP TRACE method reflection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

FTP Anonymous Login

Checks whether the FTP service allows anonymous or guest login and optionally lists the landing directory. !/usr/bin/env python3 -- coding: utf-8 -- """Detect anonymous FTP login.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

Windows AS-REP Roast (optional Rubeus)

OPTIONAL fallback: requires Rubeus.exe for live $krb5asrep$ hashes. Prefer native post/ldap/gather/asreproast. !/usr/bin/env python3 -- coding: utf-8 -- """AS-REP roast via Rubeus loadmodule — accounts without Kerberos pre-auth.""" from kittysploit import from lib.post.windows.hashloot import...

LDAP AS-REP Roast (native)

Native AS-REP roasting: LDAP enum of UFDONTREQUIREPREAUTH accounts, then request live $krb5asrep$ hashes from the KDC port 88. No Rubeus / Impacket required. from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient from lib.protocols.ldap.adhelpers import UACNOPREAUTH...

Windows Kerberoast (optional Rubeus)

OPTIONAL fallback: requires Rubeus.exe for live $krb5tgs$ hashes. Prefer native post/ldap/gather/kerberoast. !/usr/bin/env python3 -- coding: utf-8 -- """Kerberoast via Rubeus loadmodule — request TGS and extract hashcat lines.""" from kittysploit import from lib.post.windows.hashloot import...

Windows Seatbelt Recon (optional external)

OPTIONAL: requires Seatbelt.exe in data/assemblies/. Prefer native post/shell/windows/gather modules enumsystem, privilegeescalationsurface, edraudit, …. Seatbelt is a broad C host checklist, not a credential dumper. !/usr/bin/env python3 -- coding: utf-8 -- """Host situational awareness via...

List Windows Assemblies Catalog

List .NET tools under data/assemblies/ for use with post/shell/windows/manage/runassembly loadmodule. !/usr/bin/env python3 -- coding: utf-8 -- """List .NET assemblies available for loadmodule / runassembly.""" from kittysploit import from lib.post.windows.assemblyloader import assembliesdir,...

WebDAV Enabled

Detects WebDAV by issuing PROPFIND and looking for Multi-Status / DAV response markers. !/usr/bin/env python3 -- coding: utf-8 -- """Detect enabled WebDAV PROPFIND.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/", "/webdav/", "/DavWWWRoot/",...

Kitty Agent (typed tasks)

HTTP polling agent with typed tasks: shell, ls, pwd, whoami, cat, download, upload. Uses the same reversehttppolling listener as the classic beacon. from kittysploit import from lib.c2.beaconprofile import BeaconProfile from lib.c2.kittyagent import buildkittyagentscript class ModulePayload:...

phpMyAdmin Default Login

Attempts common default phpMyAdmin credentials after extracting CSRF tokens. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin default credentials.""" import re from urllib.parse import urljoin from kittysploit import from lib.protocols.http.httpclient import Httpclient BASES = "/",...

SharpHound Collect (optional external)

OPTIONAL: requires SharpHound.exe in data/assemblies/. Prefer native LDAP/GPO modules scanner/ldap/, post/ldap/gather/ for AD mapping. When you need a full CE-style zip: loadmodule SharpHound, pull loot, set bloodhoundexportpath, merge into attackgraph, optional BHCE upload. !/usr/bin/env python3...

Grafana Default Login

Detects Grafana default admin credentials via /login JSON API. !/usr/bin/env python3 -- coding: utf-8 -- """Grafana default login.""" import json from kittysploit import from lib.protocols.http.httpclient import Httpclient CREDS = "admin", "prom-operator", "admin", "admin", PATHS = "/login",...

Spring Boot Actuator Heap Dump

Detects exposed Spring Boot Actuator heapdump endpoints that can leak JVM memory, secrets, and HTTP traffic. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Actuator heapdump exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS = "/heapdump",...

LDAP Kerberoast (native)

Native kerberoasting: LDAP enum of user SPNs, then request live $krb5tgs$ hashes from the KDC using session or explicit credentials. No Rubeus / Impacket required. from kittysploit import from lib.protocols.ldap.ldappostclient import LdapPostClient from lib.protocols.ldap.adhelpers import...

Windows loadmodule (alias)

Alias of post/shell/windows/manage/runassembly — set module= then run. !/usr/bin/env python3 -- coding: utf-8 -- """Alias module: loadmodule → same as runassembly.""" from kittysploit import from modules.post.shell.windows.manage.runassembly import Module as RunAssemblyModule class...

Tomcat Manager Default Login

Detects Apache Tomcat Manager default credentials via HTTP Basic. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat Manager default login.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient Common Tomcat Manager credential pairs CREDS = "tomcat"...

SNMP Default Community

Probes SNMP v1/v2c agents for common default community strings e.g. public/private via sysDescr. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SNMP agents accepting default community strings.""" from kittysploit import DEFAULTCOMMUNITIES = "public", "private", "community", "snmp", "snmpd",...

Laravel .env disclosure

Detects publicly accessible Laravel .env files that may leak database credentials, APPKEY, and other secrets. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel .env sensitive information disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS...

SharePoint CVE-2026-50522 Trust Endpoint Detection

Detects an exposed on-prem SharePoint WS-Federation trust endpoint /trust/default.aspx associated with CVE-2026-50522 unauthenticated BinaryFormatter deserialization RCE. Surface detection only — no gadget payload is sent. !/usr/bin/env python3 -- coding: utf-8 -- """ Detect exposed SharePoint...

FastCGI Echo Endpoint Script - Detect

FastCGI echo endpoint script was detected, which lists several kinds of sensitive information such as port numbers, server software versions, port numbers, and IP addresses. !/usr/bin/env python3 -- coding: utf-8 -- """FastCGI echo endpoint script was detected, which lists several kinds of...

User Control Panel - Detect

User Control Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """User Control Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'User Control Panel - Detect', 'description': 'User Contro...

QNAP Turbo NAS Login Panel - Detect

QNAP QTS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP QTS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'QNAP Turbo NAS Login Panel - Detect', 'description':...

OurMGMT3 Admin Login Panel - Detect

OurMGMT3 admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OurMGMT3 admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OurMGMT3 Admin Login Panel - Detect',...

STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion Detection

STAGIL Navigation for Jira Menu & Themes plugin before 2.0.52 is susceptible to local file inclusion via modifying the fileName parameter to the snjCustomDesignConfig endpoint. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This...

Hospital Management System 1.0 - SQL Injection Detection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/user-login.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site...

WP Cerber < 8.9.3 - Broken Access Control Detection

WP Cerber 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints, exploit requires sending a request with a trailing '?'. !/usr/bin/env python3 -- coding: utf-8 -- """WP Cerber 8."""...

mooSocial v.3.1.8 - Cross-Site Scripting Detection

Cross-Site Scripting XSS vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-Site Scripting XSS vulnerability in mooSocial v.""" fr...

MeteoBridge <= 6.1 - Remote Code Execution Detection

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote...

ETQ Reliance - Reflected XSS via SQLConverterServlet Detection

A reflected cross-site scripting XSS vulnerability exists in ETQ Reliance CG legacy platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The...

HyperComments <= 1.2.2 - Arbitrary Options Update Detection

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to...

1 Click WordPress Migration <= 2.2 - Unauthenticated Information Disclsoure Detection

1 Click WordPress Migration = 2.2 contains an information disclosure caused by uncleared debug information, letting attackers retrieve embedded sensitive data, exploit requires no specific privileges. !/usr/bin/env python3 -- coding: utf-8 -- """1 Click WordPress Migration = 2.""" from kittysploi...

Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal Detection

Windmill 1.603.3 contains a path traversal caused by unsanitized filename parameter in getlogfile endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Windmill 1.""" from kittysploit import...

Openfire Administration Console - Authentication Bypass Detection

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup...

TeamPass 2.1.27.36 - Improper Authentication Detection

TeamPass 2.1.27.36 is susceptible to improper authentication. An attacker can retrieve files from the TeamPass web root, which may include backups or LDAP debug files, and therefore possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -...

ActiveAdmin Admin Dasboard Exposure Detection

An ActiveAdmin Admin dashboard was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """An ActiveAdmin Admin dashboard was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ActiveAdmin Admin Dasboard...

ADFS Detect

Detects ADFS with forms-based authentication enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ADFS with forms-based authentication enabled.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ADFS Detect',...

SAP Internet Graphics Server (IGS) Detection

Detection of SAP Internet Graphics Server IGS !/usr/bin/env python3 -- coding: utf-8 -- """Detection of SAP Internet Graphics Server IGS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SAP Internet Graphics Server I...

AWStats Listing Detection

Searches for exposed awstats Internal Information. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for exposed awstats Internal Information.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWStats Listing...

PhpMyAdmin Scripts - Remote Code Execution Detection

PhpMyAdmin Scripts 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 are susceptible to a remote code execution in setup.php that allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. Combined with the ability to save files on server, this can allow...

IIS Windows Server Default Page Detection

Detects IIS Windows Server Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects IIS Windows Server Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IIS Windows Server Default Page Detection...

DedeCMS 5.8.1-beta - Remote Code Execution Detection

DedeCMS 5.8.1-beta is susceptible to remote code execution via a variable override vulnerability that allows an attacker to construct malicious code with template file inclusion without proper authorization, thus possibly obtaining sensitive information, modifying data, and/or gaining full contro...

Trust Center Page - Detect

Detected the presence of Trust Center pages or subdomains provided by Safebase, Vanta, or TrustCloud. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of Trust Center pages or subdomains provided by Safebase, Vanta, or TrustCloud.""" from kittysploit import from...

Acrolinx Dashboard Detection

An Acrolinx Analytics dashboard was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Acrolinx Analytics dashboard was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Acrolinx Dashboard Detection',...

Poste.io Admin Panel - Detect

Poste.io login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Poste.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Poste.io Admin Panel - Detect', 'description': 'Poste.io login panel was...

Twonky Server - Exposure Detection

Twonky Server is a media server software that allows streaming of multimedia content over DLNA/UPnP protocols. When exposed to the internet or an untrusted network without proper authentication or access restrictions, it may allow unauthorized users to browse and access media files, interact with...

Adobe AEM Sling User Info Servlet Exposure Detection

Detects Adobe AEM Sling User Info Servlet Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe AEM Sling User Info Servlet Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM Sling Use...