KittySploit

From recon to shell — in one console.

Autonomous agent for web/API testing. 8,000+ modules. Built-in C2. Local LLM. Scope-aware. Automation-ready.

Quick start · Docs · Website · Discord

# Web/API mission (lab) — one command, quick profile by default
kittysploit> agent https://lab.local
Parallel OWASP specialists (advanced)
kittysploit> agent https://lab.local --profile owasp-web-parallel
Go for a shell (authorized lab only)
kittysploit> agent http://192.168.56.10 \
  --profile internal-lab \
  --goal obtain-shell \
  --approve-risk intrusive \
  --shell-hunter

Why KittySploit?

Most stacks force you to jump between a scanner, an exploit framework, a C2, a proxy, and a notebook.

KittySploit keeps the engagement in one place — modules, sessions, scope, and an autonomous agent that plans and executes against authorized targets.

| | | |---|---| | Agent | Local LLM (Ollama) plans and drives missions with safety profiles, evidence gates, and parallel web specialists | | Modules + C2 | 8,000+ scanners/exploits/post modules, listeners, payloads, and live sessions in the same console | | Automation | CLI, RPC, REST API, and MCP for IDE / CI-style operators |

Quick Start

Linux and macOS

git clone https://github.com/SIA-IOTechnology/Kittysploit-framework.git
cd Kittysploit-framework
./install/install.sh
python3 kittyconsole.py

One-line installer:

curl -fsSL https://raw.githubusercontent.com/SIA-IOTechnology/kittysploit-framework/main/install/install-standalone.sh | bash

Windows

git clone https://github.com/SIA-IOTechnology/Kittysploit-framework.git
cd Kittysploit-framework
install\install.bat
python kittyconsole.py

First 60 seconds

kittysploit> doctor
kittysploit> agent https://lab.local
kittysploit> search wordpress
kittysploit> agent https://lab.local --profile owasp-web-parallel --plan-only
kittysploit> agent http://192.168.56.10 --profile internal-lab --goal obtain-shell --approve-risk intrusive --shell-hunter

Bare agent uses the quick profile (web validation, read/active modules). Ollama on 127.0.0.1:11434 is picked up automatically when reachable.

Use --plan-only / --dry-run until you are ready for live actions. Always test against systems you own or are authorized to assess.

Autonomous agent

Drive a mission with a local model — no cloud key required:

# Easiest path (quick profile; enables local LLM when Ollama is up)
kittysploit> agent https://lab.local
Plan only (safe preview)
kittysploit> agent lab.local \
  --profile owasp-web-parallel \
  --plan-only
Obtain a shell (lab / authorized targets only)
kittysploit> agent http://192.168.56.10 \
  --profile internal-lab \
  --goal obtain-shell \
  --approve-risk intrusive \
  --shell-hunter \
  --llm-local \
  --llm-model llama3.1:8b

| Flag | Role | | --- | --- | | --goal obtain-shell | Campaign objective is an interactive session | | --approve-risk intrusive | Required to run exploits (blocked otherwise) | | --shell-hunter | Push harder toward a shell | | --approve-post-exploit | Optional read-only collection after a session | | --plan-only / --dry-run | Preview without live intrusive actions |

• Mission profiles (safe-web, owasp-web-parallel, internal-lab, bug-bounty-safe, …)
• Evidence-gated exploit handoff (reduce speculative false positives)
• Parallel specialists by OWASP class (injection, XSS, SSRF, auth, authz)
• Scope, budgets, and risk approvals stay under operator control

Core platform

• Modular console — search / use / set / run across scanners, exploits, auxiliary, and post modules
• Built-in C2 — listeners, payloads, sessions, pivots, and post-exploitation
• Workspaces & scope — engagement boundaries, hosts, and findings organized per job
• Workflows & playbooks — repeatable recon and attack chains
• Extensions — proxy, OSINT, GUI, protocols via the marketplace
• Mobile companion — QR pair for read-only engagement monitoring

Ecosystem

| Project | Purpose | | --- | --- | | KittyProxy | Web traffic capture and analysis | | KittyCosmic | Graphical interface and marketplace | | KittyOsint | Visual OSINT investigation | | KittyProtocol | Protocol analysis | | KittyV8Debugger | V8 debugging and analysis |

Demo video · More screenshots · Full usage guide

Documentation

• Usage guide
• Project wiki
• Extension marketplace
• Issues

Project status

KittySploit 1.x is the foundation of a broader offensive platform and is still evolving. Validate new releases in a lab before using them on an engagement.

Community

• Star the repo to help others discover it
• Join Discord
• Open an issue for bugs or ideas
• Support development on Liberapay

Acknowledgments

Thanks to Woody for their contributions.

License

KittySploit is released under the MIT License.