Cisco Prime License Manager - Detect

Detected exposed Cisco Prime License Manager portals !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Cisco Prime License Manager portals.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cisco Prime...

Telerik Report Server Login Panel - Detect

Telerik Report Server login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Telerik Report Server login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Telerik Report Server Login...

Dockge Panel - Detect

A fancy, easy-to-use and reactive self-hosted docker compose.yaml stack-oriented manager !/usr/bin/env python3 -- coding: utf-8 -- """A fancy, easy-to-use and reactive self-hosted docker compose.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Bofamet Stealer C2 Panel - Detect

Bofamet Stealer C2 Login Panel was discovered !/usr/bin/env python3 -- coding: utf-8 -- """Bofamet Stealer C2 Login Panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bofamet Stealer C2 Panel -...

Spotweb <= 1.5.1 - Cross Site Scripting Detection

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the mail parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting XSS vulnerability in...

WSO2 Carbon Management Console <=5.10 - Cross-Site Scripting Detection

WSO2 Management Console through 5.10 is susceptible to reflected cross-site scripting which can be exploited by tampering a request parameter in Management Console. This can be performed in both authenticated and unauthenticated requests. !/usr/bin/env python3 -- coding: utf-8 -- """WSO2 Manageme...

WordPress CDI <5.1.9 - Cross Site Scripting Detection

WordPress CDI plugin prior to 5.1.9 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the response of an AJAX action. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

Gradio - Open Redirect Detection

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...

Apache Storm Unauth Detection

Apache Storm instance is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Storm instance is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import lookslikeapachestormsummary, validatejsonprobe class...

Geddy <13.0.8 - Local File Inclusion Detection

Geddy prior to version 13.0.8 contains a directory traversal vulnerability in lib/app/index.js that allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the PATHINFO to the default URI. !/usr/bin/env python3 -- coding: utf-8 -- """Geddy prior to version 13.""" impo...

MaxSite CMS > V106 - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/ allows remote attackers to inject arbitrary web script to a page." !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/...

HUE Personal Wireless Lighting Panel Detection

HUE personal wireless lighting panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HUE personal wireless lighting panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HUE Personal Wireless...

FreshRSS - Installation Detection

FreshRSS Installation panel has been exposed. !/usr/bin/env python3 -- coding: utf-8 -- """FreshRSS Installation panel has been exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FreshRSS - Installation...

EasyCoder FTP Service - Detect

EasyCoder FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """EasyCoder FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'EasyCoder FTP Servic...

vsFTPd Service - Detect

vsFTPd FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """vsFTPd FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'vsFTPd Service - Detect',...

Firebase Storage Public Listing

Probe Firebase Storage REST /v0/b/bucket/o for anonymous object listing common misconfig when rules are open. !/usr/bin/env python3 -- coding: utf-8 -- """Detect publicly listable Firebase Storage / GCS buckets.""" import re from urllib.parse import quote from kittysploit import from...

Versa FlexVNF Server Detection

Versa FlexVNF Server Detection magic request params exposes Server signature/version !/usr/bin/env python3 -- coding: utf-8 -- """Versa FlexVNF Server Detection magic request params exposes Server signature/version.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Graphql Tartiflette Detect

Detects Graphql Tartiflette Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql Tartiflette Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import isspacatchall class ModuleScanner, Httpclient: info = 'name'...

SMTP Detection

SMTP is part of the application layer of the TCP/IP protocol. Using a process called “store and forward,” SMTP moves your email on and across networks. !/usr/bin/env python3 -- coding: utf-8 -- """SMTP is part of the application layer of the TCP/IP protocol.""" import socket from kittysploit impo...

Growatt Shinelink - Login Panel Detection

Growatt Shinelink is a web-based data logger and monitoring interface for Growatt solar inverters, providing real-time solar energy production data and system configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Growatt Shinelink is a web-based data logger and monitoring interface for...

ForgeRock IG Login/Welcome Page - Detect

Detects ForgeRock Identity Gateway login or welcome page and extracts version number !/usr/bin/env python3 -- coding: utf-8 -- """Detects ForgeRock Identity Gateway login or welcome page and extracts version number.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

WordPress WPS Hide Login - Error Log Disclosure Detection

Detected whether the WPS Hide Login plugin’s /classes/ directory was exposed with directory listing enabled due to server misconfiguration, potentially disclosing PHP error logs or source code. !/usr/bin/env python3 -- coding: utf-8 -- """Detected whether the WPS Hide Login plugin’s /classes/...

StyleCi Yaml File Disclosure Detection

Detects StyleCi Yaml File Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects StyleCi Yaml File Disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'StyleCi Yaml File Disclosure Detection',...

WordPress Plugin Media Gallery Pro Listing Detection

Searches for sensitive directories present in the easy-media-gallery-pro plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the easy-media-gallery-pro plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Brute Ratel C4 - Detect

Brute Ratel C4 BRc4 is a legit red-teaming tool designed from the ground up with evasion capabilities in mind, but in the wrong hands can cause significant damage. Learn how to protect your organization with our Brute Ratel C4 Spotlight. !/usr/bin/env python3 -- coding: utf-8 -- """Brute Ratel C4...

Squid Analysis Report Generator Detection

SARG is an open source tool that allows you to analyse the squid log files and generates beautiful reports in HTML format with information about users, IP addresses, top accessed sites, total bandwidth usage, elapsed time, downloads, access denied websites, daily reports, weekly reports and month...

Blockchain RPC - txpool_content Exposed Detection

The blockchain RPC endpoint exposes the txpoolcontent method, which returns all pending unmined transactions in the mempool including sender addresses, transaction data, gas prices, and values. This enables frontrunning attacks, sandwich attacks, and other MEV Maximal Extractable Value exploitati...

Wordpress Aspose Cloud eBook Generator - Local File Inclusion Detection

Wordpress Aspose Cloud eBook Generator is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Wordpress Aspose Cloud eBook Generator is vulnerable to local file inclusion.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

JavaScript Environment Configuration - Detect

Multiple common JavaScript environment configuration files were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple common JavaScript environment configuration files were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

RDWeb RemoteApp and Desktop Connections - Web Access Detection

RDWeb RemoteApp and Desktop Connections does not display. !/usr/bin/env python3 -- coding: utf-8 -- """RDWeb RemoteApp and Desktop Connections does not display.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'RDWeb...

Enigma NMS - Detection

Detects Enigma NMS - Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Enigma NMS - Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Enigma NMS - Detection', 'description': 'Detects Enigma NMS...

Gogs Login Panel - Detect

Gogs login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gogs login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Gogs Login Panel - Detect', 'description': 'Gogs login panel...

Looker Login Panel - Detect

Looker login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Looker login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Looker Login Panel - Detect', 'description': 'Looker logi...

Tolgee API - Detect

Tolgee API was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Tolgee API was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tolgee API - Detect', 'description': 'Tolgee API was detected.', 'author'...

Axxon Next Client Login - Detect

Axxon One is a limitlessly scalable video management software !/usr/bin/env python3 -- coding: utf-8 -- """Axxon One is a limitlessly scalable video management software.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

AirNotifier Login Panel - Detect

AirNotifier login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AirNotifier login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AirNotifier Login Panel - Detect', 'description...

Yonyou UFIDA NC - Information Exposure Detection

After logging in and visiting the address where the information was leaked, you will have permission to upload files. Then just go back to the homepage and view the published content directly. !/usr/bin/env python3 -- coding: utf-8 -- """After logging in and visiting the address where the...

Tongda OA v11.5 swfupload_new.php - SQL Injection Detection

There is a SQL injection vulnerability in the swfuploadnew.php file of Tongda OA v11.5. An attacker can obtain sensitive information of the server through the vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """There is a SQL injection vulnerability in the swfuploadnew.""" from kittysploi...

Alibaba Druid Panel - Detect

Alibaba Druid panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Alibaba Druid panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Alibaba Druid Panel - Detect', 'description': 'Alibaba...

WordPress Adaptive Images < 0.6.69 - Cross-Site Scripting Detection

WordPress Adaptive Images 0.6.69 is susceptible to cross-site scripting because the plugin does not sanitize and escape the REQUESTURI before outputting it back in a page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Adaptive Images 0.""" from kittysploit import from...

IBM Decision Server Runtime Panel- Detect

IBM Decision Server Runtime was detected. !/usr/bin/env python3 -- coding: utf-8 -- """IBM Decision Server Runtime was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IBM Decision Server Runtime Panel-...

Semi Arbitrary File Read in Dev Mode - Nuxt.js Detection

Arbitrary File Read in Dev Mode in Nuxt.js !/usr/bin/env python3 -- coding: utf-8 -- """Arbitrary File Read in Dev Mode in Nuxt.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Semi Arbitrary File Read in Dev Mode -...

Moodle Changelog File Detect

Moodle has a file which describes API changes in core libraries and APIs, and can be used to discover Moodle version. !/usr/bin/env python3 -- coding: utf-8 -- """Moodle has a file which describes API changes in core libraries and APIs, and can be used to discover Moodle v.""" from kittysploit...

MobiProxy Dashboard - Detect

MobiProxy dashboard was detected. !/usr/bin/env python3 -- coding: utf-8 -- """MobiProxy dashboard was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MobiProxy Dashboard - Detect', 'description': 'MobiProx...

QVidium Management System Exposed Detection

QVidium Management System is Exposed. !/usr/bin/env python3 -- coding: utf-8 -- """QVidium Management System is Exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'QVidium Management System Exposed Detection',...

Froxlor Server Management Backup File - Detect

Froxlor Server Management backup file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Froxlor Server Management backup file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Froxlor Server...

TecConnect OpenMessaging Webservice Detection

TecCom TecConnect OpenMessaging webservice was detected. !/usr/bin/env python3 -- coding: utf-8 -- """TecCom TecConnect OpenMessaging webservice was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'TecConnec...

NUUO Network Video Recorder Login Panel - Detect

NUUO Network Video Recorder login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO Network Video Recorder login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NUUO Network...

WordPress Plugin Safe SVG - Full Path Disclosure Detection

WordPress Safe SVG plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Safe SVG plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

Let's Encrypt - Cross-Site Scripting Detection

Let's Encrypt contains a cross-site scripting vulnerability when using the the ACME protocol to issue SSL certificates. !/usr/bin/env python3 -- coding: utf-8 -- """Let's Encrypt contains a cross-site scripting vulnerability when using the the ACME protocol to issue SSL cert.""" from kittysploit...