WebKitty

A modular collection of WebKit-based exploit chains for the PlayStation 4.

(Formerly known as PSFree Enhanced)

Features • Firmware Compatibility • Deployment • Screenshots • Contributing • Credits

Features

Core Exploit & Execution

• Auto-detection: Automatically detects console type and firmware version.
• WebKit Exploits: Entry point via the console's web browser using PSFree, Bad Hoist, CSSFontFace or slopkit.
• Kernel Exploits: Escalates privileges to kernel level using Lapse, Netctrl, Relapse, or Sleirsgoevy's 6.7x.
• Payload Loader: After successful kernel exploitation, payloads or listens for incoming payloads on port 9020.
• Barebone Jailbreak Experience option: Executes the exploit in a minimal DOM footprint and automatically redirects back to the main page upon completion.
• Firmware-Based Caching: Caches only what your specific firmware version requires instead of caching everything offline.

Interface & Customization

• Themes & Layouts: Customizable layout modes with independent theme options.
• HEN Flavor Selector: Toggle between HEN and GoldHEN, with integrated GoldHEN version selection.
• Descriptive Payload Selection: Clear descriptions and unsupported payload loading protection.
• Multilingual Support: Dynamic language switcher.

Advanced Local & Network Features

• Network Scanner: Ability to scan the local network to find the PS4.
• Remote Payload Delivery: Send the available or custom payloads from any smart device directly to the PS4.

Supported by this Repository

This table indicates firmware versions for which the current version of this repository provides a functional and tested exploit chain.

| Userland | Kernel | Firmware | | :--- | :---: | :--- | | Have A Bad Time &
Stack Unitialized Read | Bpf Double Free | 4.50 - 5.07 | | Bad Hoist | sleirsgoevy's kexploit | 6.70 - 6.72 | | PSFree | Lapse | 7.00 - 9.60 | | CSSFontFace | Lapse | 7.00 - 11.02 | | CSSFontFace | Netctrl | 9.00 - 11.02 | | Slopkit | Lapse | 11.00 - 12.02 | | Slopkit | Netctrl | 12.50 - 13.00 | | Slopkit | Relapse | 13.02 - 13.52 | | Payload Loader | - | 5.05 - latest |

Deployment & Hosting

Option 1: Access via Remote Host

In case the above link can not be resolved or similarly, you may want to attempt to use the following mirror of WebKitty: arabpixel.gitlab.io/WebKitty

Option 2: Local Hosting (PC / PS4 Server)

1. Clone the repository:

git clone https://github.com/ArabPixel/WebKitty.git

1. Serve the directory using any standard Web server (e.g., Nginx, Apache, Python HTTP server, or PS4-Websrv).
2. Open the browser on your PS4, that's it!

TODO List

• [ ] Support lower firmwares by adding other exploits

Screenshots

📸 Click here to view Screenshots & Previews

Default Layout: Initial Screen	Default Layout: Exploit Screen
Compact Layout (Combined)	Compact Layout (Vibrant)
Settings	About
Customization	About Catppuccino
Catppuccino: Initial Screen	Catppuccino: Exploit Screen

Contribution

You can contribute to WebKitty by:

• Creating pull requests for new translations in the languages folder.
• Modifying, updating, or implementing new host features.
• Reporting bugs or suggesting enhancements via issues.
• In case your PR has edits inside jailbreak.js file, do not forget to generate jailbreak-legacy.js by typing

npm install # in case you didn't install them already.
npm run build

Important: If your PR includes a new file, don't forget to add it to the respective firmware-based manifest files!

Copyright and Authors

AGPL-3.0-or-later (see LICENSE). Part of this repo belongs to the group anonymous. We refer to anonymous contributors as "anonymous" as well.

Credits in alphabetical order

• abc: For PSFree userland and Lapse kernel exploits.
• Al-Azif: For the modular (multi-file) PSFree Lapse and AIO workaround implementations.
• anonymous: For PS4 firmware kernel dumps.
• Dr.Yenyen: For intensive multi-firmware testing.
• Egycnq: Porting Netctrl to slopkit.
• Feyzee61: For the PSFree lapse bundle (single file) and 6.7x exploit implementations.
• Fire30: For Bad Hoist userland exploit.
• Flatz: Duh
• GattoDev: For the WebKitty logo.
• Jordy and Sonic-Iso: Original Slopkit project.
• Nathan Fargo and ufm42: For CSSFontFace userland exploit.
• Payload developers: For their payloads.
• Nazky: For being the first host I took a peek at.
• qwertyoruiopz: for BPF Double Free
• Raw Game: For implementing a PS4 port for the Slopkit Lapse and Netctrl and also SlopKit Relapse.
• sleirsgoevy: For 6.7x kernel exploit.
• TheFlow: For Netctrl kernel exploit.
• ufm42: For CSSFontFace Netctrl and Lapse implementation.