Zen Cart Log File Exposure Detection

Detected exposed Zen Cart log files that may contain sensitive information including error messages, file paths, database queries, and customer data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Zen Cart log files that may contain sensitive information including error messages,...

phpCollab Login Panel - Detect

phpCollab login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """phpCollab login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpCollab Login Panel - Detect', 'description':...

Drupal JSON:API Username Listing - Detect

Drupal JSON:API username listing was detected via the /user/user endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal JSON:API username listing was detected via the /user/user endpoint.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Chainlit Panel - Detect

Chainlit panel was detected. Chainlit is an open-source framework for building production-ready conversational AI applications. !/usr/bin/env python3 -- coding: utf-8 -- """Chainlit panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Keycloak OpenID Configuration - Detect

Keycloak Openid configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Keycloak Openid configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Keycloak...

Beszel Unfinished Installation Detection

Detected Beszel server monitoring hub had an unfinished installation with no admin account configured, allowing attackers to create an admin account and gain full control. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Beszel server monitoring hub had an unfinished installation with no adm...

Odoo OpenERP Database Selector Panel - Detect

Odoo OpenERP database selector panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Odoo OpenERP database selector panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Odoo OpenERP Database...

elFinder 2.1.58 - Remote Code Execution Detection

elFinder 2.1.58 is vulnerable to remote code execution. This can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. !/usr/bin/env python3 -- coding: utf-8 -- """elFinder 2.""" from kittysploit import from...

Open Game Panel Login Panel - Detect

Open Game Panel login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Open Game Panel login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Open Game Panel Login Panel - Detect',...

Cobbler WebGUI Login Panel - Detect

Cobbler WebGUI login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cobbler WebGUI login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cobbler WebGUI Login Panel - Detect',...

Craft CMS Admin Login Panel - Detect

Craft CMS admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Craft CMS admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Craft CMS Admin Login Panel - Detect',...

PHPUnit Result Cache File Exposure Detection

PHPUnit cache file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """PHPUnit cache file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHPUnit Result Cache File Exposure Detection', 'description':...

Joomla! Configuration File - Detect

Joomla! configuration.php-dist file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla! configuration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Joomla! Configuration File - Detect', 'description...

WebSwing REST API Version - Detection

WebSwing REST API version via the /rest/version endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """WebSwing REST API version via the /rest/version endpoint.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WebSwin...

Apache Kylin - Exposed Configuration File Detection

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without...

WordPress CDI <5.1.9 - Cross Site Scripting Detection

WordPress CDI plugin prior to 5.1.9 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the response of an AJAX action. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

SonicWall Appliance Management Console Login Panel - Detect

SonicWall Appliance Management Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall Appliance Management Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Qualtrics Login Panel - Detect

Qualtrics login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Qualtrics login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Qualtrics Login Panel - Detect', 'description':...

XWiki WYSIWYG API - Open Redirect Detection

A vulnerability in XWiki's WYSIWYG API allows an attacker to redirect users to arbitrary external URLs through the xerror parameter. This could be used in phishing attacks to redirect users to malicious websites. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in XWiki's WYSIWYG API...

XWiki REST API - Private Pages Disclosure Detection

A vulnerability in XWiki's REST API allows unauthenticated users to access information about private pages through the pages endpoint. This could lead to disclosure of sensitive information and page metadata. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in XWiki's REST API allows...

Nginx HTTP Server Amazon Linux Detection

Detects Nginx HTTP Server Amazon Linux. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Nginx HTTP Server Amazon Linux.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx HTTP Server Amazon Linux Detection',...

Apache JSPWiki - User IP Enumeration Detection

Enumerates the IP Address and users that is currently accessing an Apache JSPWiki web application, leading open source WikiWiki engine, feature-rich and built around standard JEE components Java, servlets, JSP. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerates the IP Address and users that ...

Flask Debug Toolbar - Exposure Detection

Detected Flask Debug Toolbar was exposed in production, potentially leaking sensitive application information, SQL queries, request data, and configuration details. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Flask Debug Toolbar was exposed in production, potentially leaking sensitive...

NetMizer LogManagement System cmd.php - Remote Code Execution Detection

Remote Command Execution vulnerability in the NetMizer log management system cmd.php, and the attacker can execute the command by passing in the cmd parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Remote Command Execution vulnerability in the NetMizer log management system cmd.""" import ...

ngSurvey Login Panel - Detect

ngSurvey products was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ngSurvey products was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ngSurvey Login Panel - Detect', 'description': 'ngSurvey...

Boa Web Server - Detect

Boa is a single-tasking HTTP server. That means that unlike traditional web servers, it does not fork for each incoming connection, nor does it fork many copies of itself to handle multiple connections. !/usr/bin/env python3 -- coding: utf-8 -- """Boa is a single-tasking HTTP server.""" import re...

XWiki < 4.10.15 - Sensitive Information Disclosure Detection

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are...

Aurelia-Path < 1.1.7 - Prototype Pollution Detection

Aurelia-path before 1.1.7 contains a prototype pollution caused by parsing malicious URL parameters, letting attackers modify Object.prototype, exploit requires the application to parse user-controlled URLs. !/usr/bin/env python3 -- coding: utf-8 -- """Aurelia-path before 1.""" from kittysploit...

Spinnaker Detect

Detects the Spinnaker continuous delivery software !/usr/bin/env python3 -- coding: utf-8 -- """Detects the Spinnaker continuous delivery software.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Spinnaker Detect',...

Otobo - Open Redirect Detection

Otobo contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """Otobo contains an open redirect vulnerability.""" import ...

EXPN Mail Server Detect

The "EXPN" can be used by attackers to learn about valid usernames on the target system. On some SMTP servers, EXPN can be used to show the subscribers of a mailing list subscription lists are generally considered to be sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """The "EXPN...

Bottle debug mode enabled Detection

Detects Bottle debug mode enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Bottle debug mode enabled.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bottle debug mode enabled Detection', 'description':...

Vista Web Login Panel Detection

Vista Web login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Vista Web login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Vista Web Login Panel Detection', 'description':...

SAP NetWeaver Portal - Detect

SAP NetWeaver Portal login has been detected. Note that NetWeaver has multiple default passwords as listed in the references. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Portal login has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

HP Media Vault Detect

Detects HP Media Vault Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects HP Media Vault Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HP Media Vault Detect', 'description': 'Detects HP Media Vaul...

Jakefile Build Configuration - Disclosure Detection

Detected Jakefile build configuration was found to be exposed, potentially having contained sensitive information including database credentials, API keys, and server configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Jakefile build configuration was found to be exposed,...

Prometheus Config API Endpoint Discovery Detection

A Prometheus config API endpoint was discovered. The config endpoint returns the loaded Prometheus configuration file along with the addresses of targets and alerting/discovery services alongside the credentials required to access them. Usually, Prometheus replaces the passwords in the credential...

Alibaba Anyproxy fetchBody File - Path Traversal Detection

Alibaba Anyproxy is vulnerable to Path Traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Alibaba Anyproxy is vulnerable to Path Traversal.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Alibaba...

Azure Container Instance Default Page Detection

Detects Azure Container Instance Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Azure Container Instance Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Azure Container Instance...

Adobe AEM CRX Browser Exposure Detection

Detects Adobe AEM CRX Browser Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe AEM CRX Browser Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM CRX Browser Exposure Detection',...

cgit Web Interface - Detection

Detects cgit web interface for Git repositories. cgit is a hyperfast web frontend for Git repositories written in C. It provides a web-based interface to browse Git repositories, view commits, diffs, and files. cgit is designed to be publicly accessible for open source projects. However, detectin...

Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal Detection

Carel pCOWeb HVAC BACnet Gateway 2.1.0 contains an unauthenticated arbitrary file disclosure caused by improper verification of the 'file' GET parameter in logdownload.cgi, letting attackers disclose sensitive files via directory traversal, exploit requires no authentication. !/usr/bin/env python...

JBoss detected

Detects JBoss detected. !/usr/bin/env python3 -- coding: utf-8 -- """Detects JBoss detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JBoss detected', 'description': 'Detects JBoss detected.',...

Hack5 Cloud C2 - Detect

Cloud C² is a self-hosted web-based command and control suite for networked Hak5 gear that lets you pentest from anywhere. Linux, Mac and Windows computers can host the Cloud C² server while Hak5 gear such as the WiFi Pineapple, LAN Turtle and Packet Squirrel can be provisioned as clients...

BeyondTrust Privileged Access Management Login - Detect

BeyondTrust Privileged Access Management login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """BeyondTrust Privileged Access Management login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Tenable Nessus Panel - Detect

Tenable Nessus panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Tenable Nessus panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tenable Nessus Panel - Detect', 'description': 'Tenab...

Tailon Panel - Detect

Detects Tailon Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Tailon Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tailon Panel - Detect', 'description': 'Detects Tailon Panel ...

DeleGate PROXY-FTP Service - Detect

DeleGate PROXY-FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """DeleGate PROXY-FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'DeleGate...

Network Camera FTP Service - Detect

Network Camera FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Network Camera FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'Network...

Apache Kafka Control Center Login Panel - Detect

Apache Kafka Control Center login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Kafka Control Center login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache Kafka...