# Module Catalog

> Auto-generated from the inventory registry by `rustsploit --gen-module-catalog`. Do not edit by hand.
>
> **Stale snapshot.** This file last reflects 363 modules; the current build has **389** (the 2026-06-13 release added `scanners/jarm_scan` and others). Re-run `rustsploit --gen-module-catalog > docs/Module-Catalog.md` to regenerate the live list.

**Total registered modules: 363**

All modules support mass scan universally — `random` / CIDR / file targets / comma-separated lists fan out through `crate::scheduler::run` regardless of the module.

## scanners (45)

- 45 modules, 8 with `check()`

| Module | Description | Rank | Check |
|---|---|---|---|
| `scanners/api_endpoint_scanner` | Comprehensive REST API endpoint discovery and vulnerability scanner with fuzzing, authentication bypass, and injection detection. | Normal |  |
| `scanners/asterisk_fingerprint` | Connects to the Asterisk built-in HTTPS interface (default 8089/tcp), reads the Server header, and flags EOL major branches (1.x through 16.x). Detection only — no exploit traffic, no DoS vectors. | Excellent | ✓ |
| `scanners/cors_reflection_scanner` | Sends a battery of Origin headers (attacker, null, suffix/prefix confusion, scheme downgrade) plus an OPTIONS preflight, and reports any reflected or wildcard ACAO, especially when paired with Access-Control-Allow-Credentials: true. | Excellent |  |
| `scanners/cpanel_exposure` | Probes the cPanel control-plane ports (2082/2083, 2086/2087, 2095/2096) plus 8888/8889 for reachable HTTP(S) endpoints. Reports each panel that responds, its Server header, and any redirect chain — useful for finding management interfaces exposed to the internet without IP allow-lists. | Excellent | ✓ |
| `scanners/csp_audit_scanner` | Extracts Content-Security-Policy from headers or <meta> tags and flags unfilled placeholders, unsafe-inline/unsafe-eval, wildcard sources, missing frame-ancestors, mixed content, and overly broad CDN whitelists. | Excellent |  |
| `scanners/dir_brute` | HTTP directory and file enumeration via wordlist with multiple scan modes, evasion techniques, and concurrent requests. | Normal |  |
| `scanners/dmarc_check` | Queries _dmarc.<domain> TXT records to determine whether DMARC is missing, set to p=none (monitoring only), or enforced (p=quarantine / p=reject). Missing or non-enforcing DMARC enables email spoofing and phishing. | Excellent | ✓ |
| `scanners/dns_recursion` | Detects open DNS resolvers vulnerable to recursion and amplification attacks. | Normal |  |
| `scanners/honeypot_scanner` | Scans targets for honeypot indicators by probing 50 common TCP ports in parallel. Classifies hosts as Clean (0-5 open), Suspicious (6-10), Likely Honeypot (11-20), or Definite Honeypot (21+). Supports single IP, CIDR subnets, file-based target lists, and random/mass scanning. Results are stored to the workspace with honeypot notes. | Normal |  |
| `scanners/http_method_scanner` | Enumerates allowed HTTP methods on a target to identify dangerous or misconfigured endpoints. | Normal |  |
| `scanners/http_title_scanner` | Enumerates HTML page titles across HTTP and HTTPS endpoints for target fingerprinting. | Normal |  |
| `scanners/ipmi_enum_exploit` | Comprehensive IPMI scanner with version detection, cipher 0 bypass, default credential brute force, and RAKP hash dumping. | Normal |  |
| `scanners/iusb_virtualmedia_probe` | Probes a BMC for a reachable IUSB virtual-media service by sending the 12-byte protocol handshake (ASCII 'IUSB' + 4 spaces + 4 NUL) to ports 5120/5123/5124/5126/5127 in plaintext, then over TLS. Reports each port whose reply echoes the IUSB magic — those ports accept remote ISO mounts with valid BMC credentials, which paired with credential-leak or default-password issues is a full host-OS compromise vector. | Great | ✓ |
| `scanners/m365_userenum_scanner` | Confirms Azure AD / M365 tenant existence via OIDC .well-known, then enumerates user existence by POSTing GetCredentialType. Returns IfExistsResult (0=exists, 1=missing, 5=federated, 6=throttled). | Excellent |  |
| `scanners/mysql_exposure` | Connects to TCP/3306 (configurable), reads the server greeting handshake, and reports the protocol byte + advertised version. If the server replies with an ERR packet (host not allowed) the banner still confirms exposure. Detection only — no authentication is attempted. | Excellent | ✓ |
| `scanners/nbns_scanner` | Sends NBNS name queries to UDP port 137 to discover Windows hosts on a network. Extracts NetBIOS computer names, domain/workgroup memberships, MAC addresses, and service type flags. Useful for Windows network reconnaissance. | Excellent |  |
| `scanners/php_version_eol` | Reads the X-Powered-By header from /, then probes a small list of common Vicidial paths. Flags PHP major branches that have reached EOL (4.x, 5.x, 7.x — all unsupported as of 2026). Detection only — no exploitation. | Excellent | ✓ |
| `scanners/ping_sweep` | Single-host liveness probe — ICMP echo, then a small TCP connect pre-check on common ports. Used as a per-host probe inside the scheduler's CIDR / random / file fan-out, so the operator gets the same `up?` answer for one host or a /16 with no extra plumbing. | Excellent |  |
| `scanners/port_scanner` | Concurrent TCP and UDP port scanner with service detection, banner grabbing, and configurable scan ranges. | Normal |  |
| `scanners/proxy_scanner` | Scans for open proxy servers: HTTP CONNECT, SOCKS4, SOCKS5, and HTTP transparent. Identifies proxies that can be used for traffic relay without authentication. | Normal |  |
| `scanners/redfish_unauth_enum` | Walks the standard Redfish tree (Systems, Managers, Chassis, AccountService, SecurityService, UpdateService) against a BMC target and reports any endpoint that returns sensitive identity/firmware/policy data without authentication. Also probes vendor-aux endpoints like /cc/bmc_cc.xml that commonly leak capability catalogs and error-string enums. | Great | ✓ |
| `scanners/redis_scanner` | Scans for Redis instances with no authentication. Extracts server version, configuration, key count, and identifies potential exploitation vectors such as writable directories and empty requirepass. | Excellent |  |
| `scanners/reflect_scanner` | Scans for UDP amplification vulnerabilities (DNS open resolver, NTP monlist, SSDP M-SEARCH, Memcached stats). Identifies reflectors that could be abused for volumetric DDoS attacks. | Excellent |  |
| `scanners/s3_bucket_scanner` | Probes an S3 bucket via virtual-hosted and path-style URLs for public listing, ACL/policy disclosure, and bucket-existence (NoSuchBucket → registration takeover candidate). | Excellent |  |
| `scanners/sample_scanner` | Checks HTTP and HTTPS reachability and response codes for target hosts. | Normal |  |
| `scanners/security_headers_scanner` | Fetches a target URL, audits the security-relevant response headers, and reports missing/weak HSTS, CSP, X-Frame-Options, COOP/COEP/CORP, server banners, and insecure cookie attributes. | Excellent |  |
| `scanners/sequential_fuzzer` | Sequential character-based HTTP fuzzer with multiple encoding types, injection charsets, and concurrent request support. | Normal |  |
| `scanners/service_scanner` | Connects to common service ports and grabs banners/version strings using protocol-specific probes. Detects FTP, SSH, Telnet, SMTP, POP3, IMAP, MySQL, PostgreSQL, Redis, MongoDB, Memcached, RDP, VNC, and Elasticsearch. | Excellent |  |
| `scanners/sgbox_siem_recon` | Non-destructive recon of Securegate SGBox NG-SIEM consoles. | Excellent | ✓ |
| `scanners/smtp_user_enum` | Enumerates valid usernames on SMTP servers using VRFY commands with wordlist-based concurrent scanning. | Normal |  |
| `scanners/snmp_scanner` | Tests SNMP v1/v2c community strings against target devices. Builds raw SNMP GET packets using BER/ASN.1 encoding to extract sysDescr, sysName, and sysLocation from responding devices. | Excellent |  |
| `scanners/source_map_scanner` | Crawls the target HTML for <script src> URLs, then probes each .map companion to detect exposed JavaScript source-maps that leak original source code, internal API paths, and embedded secrets. | Excellent |  |
| `scanners/source_port_scanner` | Firewall bypass scanner that discovers which source ports are allowed to connect to a target IP and destination port. Useful for identifying firewall rules that permit traffic from specific source ports (e.g., DNS/53, HTTP/80). Supports parallel scanning with configurable concurrency. | Excellent |  |
| `scanners/ssdp_msearch` | Discovers UPnP devices on a network via SSDP M-SEARCH multicast and unicast probes. | Normal |  |
| `scanners/ssh_scanner` | Scans networks for SSH services with banner grabbing, CIDR range support, and concurrent scanning. | Normal |  |
| `scanners/ssl_scanner` | Analyzes SSL/TLS certificates and configuration. Detects expired certificates, self-signed certs, weak ciphers, and misconfigurations. | Excellent |  |
| `scanners/stalkroute_full_traceroute` | Advanced traceroute with ICMP, TCP, and UDP probes, OS fingerprint spoofing, and decoy packet generation. | Normal |  |
| `scanners/subdomain_scanner` | Brute-forces subdomains of a target domain using DNS resolution. Supports built-in wordlist or custom wordlist file. Uses concurrent asynchronous DNS lookups for fast enumeration. | Excellent |  |
| `scanners/subdomain_takeover_scanner` | Resolves the CNAME chain for a host, identifies the cloud provider, and probes the live URL for the provider-specific 'unclaimed' fingerprint. Covers CloudFront, Heroku, GitHub Pages, Azure, Netlify, WPEngine, Surge, Pantheon, Fastly, Vercel, Shopify, Statuspage, Zendesk, and 18 more. | Excellent |  |
| `scanners/vnc_scanner` | Scans VNC servers for protocol version and security type enumeration. Identifies servers with 'None' authentication (no password required) and reports all supported security mechanisms. | Excellent |  |
| `scanners/vuln_checker` | Runs fingerprint probes against a target to identify vulnerable products/services. | Excellent |  |
| `scanners/waf_detector` | Detects Web Application Firewalls and CDN providers by analyzing HTTP response headers, cookies, and body content. Sends benign and malicious payloads to trigger WAF signatures for higher-confidence detection. Identifies Cloudflare, AWS WAF, Akamai, Imperva, F5 BIG-IP, ModSecurity, Sucuri, Barracuda, Fortinet, and Citrix NetScaler. | Excellent |  |
| `scanners/wellknown_scanner` | Probes ~50 common discovery endpoints (security.txt, OIDC config, autodiscover, swagger, .env, .git, actuator, healthz) and reports reachable resources with status, content-type, length, and snippet. | Excellent |  |
| `scanners/wp_user_enum` | Three-vector WordPress user enumeration: /wp-json/wp/v2/users, ?author=N slug-leak via redirect, and /wp-json/oembed/1.0/embed author disclosure. | Excellent |  |
| `scanners/wp_xmlrpc_scanner` | Detects /xmlrpc.php exposure on WordPress sites, enumerates allowed methods via system.listMethods, and flags system.multicall (password-spray amplifier) and pingback.ping (SSRF / DDoS primitive). | Excellent |  |

## exploits (284)

- 284 modules, 137 with `check()`

| Module | Description | Rank | Check |
|---|---|---|---|
| `exploits/bluetooth/wpair` | Google Fast Pair pairing-mode-bypass exploitation (WhisperPair, CVE-2025-36911). Discovers Fast Pair accessories (service 0xfe2c), then performs the secp256r1 ECDH Key-Based Pairing handshake against the target's Anti-Spoofing key to force-pair out of pairing mode. Interactive sub-shell: scan/info/exploit/testall/exploitall/nonce/curve/pair/rename/switch/harvest, with nonce-replay (§4.3) and invalid-curve (§4.5) conformance tests. Requires `bluetooth` feature + a local BLE adapter. See the [Fast Pair / WhisperPair Guide](Fast-Pair-WhisperPair-Guide.md). | Excellent |  |
| `exploits/cameras/abus/abussecurity_camera_cve202326609variant1` | Probes ABUS security cameras for the path-traversal vulnerability in /webparam.cgi that allows reading /etc/passwd and similar local files. | Excellent |  |
| `exploits/cameras/acti/acm_5611_rce` | Probes ACTi ACM-5611 IP cameras for command injection in the iperf parameter on /cgi-bin/test. Sends a benign echo-marker payload. | Excellent |  |
| `exploits/cameras/avtech/cve_2024_7029_avtech_camera` | Exploits CVE-2024-7029 in AVTECH IP cameras for remote code execution. | Excellent |  |
| `exploits/cameras/galayou_g2_rtsp_bypass_cve_2025_9983` | Sends an unauthenticated RTSP DESCRIBE to the camera and detects | Great | ✓ |
| `exploits/cameras/hikvision/hikvision_rce_cve_2021_36260` | Sends a benign `echo $marker` payload to PUT /SDK/webLanguage with the XML command-injection vector from CVE-2021-36260. Vulnerable devices echo the marker. No destructive operations performed. | Excellent |  |
| `exploits/cameras/reolink/reolink_rce_cve_2019_11001` | Exploits CVE-2019-11001 authenticated OS command injection in Reolink cameras via TestEmail functionality. | Excellent |  |
| `exploits/cameras/uniview/uniview_nvr_pwd_disclosure` | Extracts and decodes user credentials from Uniview NVR devices via remote password disclosure vulnerability. | Good |  |
| `exploits/cameras/xiongmai_xm530` | Probes the proprietary Xiongmai XM530 control protocol on TCP/34567 for | Normal | ✓ |
| `exploits/cowrie/ansi_log_injection` | Injects ANSI/OSC escape sequences into cowrie's session log via unsanitized crontab command arguments. When an operator views the replay log on a real terminal, embedded escapes execute: title bar hijack, bell spam, cursor repositioning. | Normal |  |
| `exploits/cowrie/llm_prompt_injection` | Exploits cowrie's LLM mode where unsanitized attacker commands are concatenated into the same prompt context as the confidential system prompt containing real hostname and username. Injection can coerce the LLM to echo real configuration data. | Normal |  |
| `exploits/cowrie/ssrf_ipv6` | Demonstrates that cowrie's SSRF blocklist omits fc00::/7, fe80::/10, and ::ffff:0:0/96, allowing IPv6 SSRF to internal addresses. Also demonstrates the DNS-rebinding TOCTOU where check→re-resolve allows SSRF bypass via fast-flux DNS. | Normal |  |
| `exploits/crypto/geth_dos_cve_2026_22862` | Detects Go-Ethereum nodes vulnerable to CVE-2026-22862 by querying the JSON-RPC web3_clientVersion endpoint and parsing the version string. Does NOT send the destructive ECIES crash payload. | Normal |  |
| `exploits/crypto/heartbleed` | Tests for and exploits the OpenSSL Heartbleed vulnerability (CVE-2014-0160) to leak server memory contents. | Good |  |
| `exploits/dionaea/mqtt_underflow` | Sends a malformed MQTT PUBLISH packet to dionaea where TopicLength (255) exceeds MessageLength-2 (3), causing a negative length_from in scapy's MQTT_Publish parser. Triggers parser desync / UnicodeDecodeError exception. | Normal |  |
| `exploits/dionaea/mssql_dos` | Sends a crafted TDS7 LOGIN7 packet to dionaea's MSSQL honeypot where ibPassword=85 and cchPassword=2, causing the password slice to be 1 byte. Decoding 1 byte as UTF-16 raises UnicodeDecodeError outside the try block → unhandled exception → connection handler crash. | Normal |  |
| `exploits/dionaea/mysql_sqli` | Sends a MySQL COM_FIELD_LIST command to dionaea where the table name contains SQLite injection. Table 'sqlite_master)--' changes the PRAGMA query to return the honeypot's internal DB schema. Demonstrates the developer's comment 'I'm not afraid of SQLi here though.' | Normal |  |
| `exploits/dionaea/tftp_crash` | Sends a malformed TFTP RRQ to dionaea where the option name 'blksize' lacks a trailing NUL byte. dionaea's options parser builds a malformed struct format string → struct.error or UnicodeDecodeError in tftp.py:178-216. | Normal |  |
| `exploits/dos/apachebrpc_overflow_cve_2025_59789` | Detects Apache bRPC ports; deeply recursive JSON crashes the server. | Normal | ✓ |
| `exploits/dos/connection_exhaustion_flood` | Ultra-fast TCP connection flood that exhausts server connection tables and TIME_WAIT slots. | Normal |  |
| `exploits/dos/dns_amplification` | Sends spoofed DNS ANY queries to open resolvers, causing amplified responses (~100x) directed at the victim via raw UDP with IP_HDRINCL. | Normal |  |
| `exploits/dos/http2_rapidreset_cve_2023_44487` | Probes the target for HTTP/2 Rapid Reset DoS exposure by detecting | Normal | ✓ |
| `exploits/dos/http_flood` | High-speed HTTP GET/POST flood targeting web servers at the application layer with User-Agent rotation and cache-busting random parameters. | Normal |  |
| `exploits/dos/icmp_flood` | Raw ICMP echo request flood with proper checksums. Supports optional source IP spoofing via IP_HDRINCL or non-spoofed ICMP raw sockets. | Normal |  |
| `exploits/dos/memcached_amplification` | Sends spoofed memcached UDP stats requests to open servers, causing massively amplified responses (~51,000x) directed at the victim via raw UDP with IP_HDRINCL. | Normal |  |
| `exploits/dos/ntp_amplification` | Sends spoofed NTP MON_GETLIST_1 requests to NTP servers, causing amplified responses (~556x) directed at the victim via raw UDP with IP_HDRINCL. | Normal |  |
| `exploits/dos/null_syn_exhaustion` | High-performance SYN flood with null-byte payloads for resource exhaustion testing using native OS threads and sendmmsg batching. | Normal |  |
| `exploits/dos/px4_uav_dos` | Sends a benign MAVLink heartbeat to UDP/14550 to fingerprint PX4 autopilot exposure. | Normal | ✓ |
| `exploits/dos/rudy` | Opens HTTP POST connections with large Content-Length then drips the body one byte at a time, exhausting server connection pools. Supports optional TLS. | Normal |  |
| `exploits/dos/slowloris` | Keeps HTTP connections open by sending partial headers slowly, exhausting the server's connection pool. Supports optional TLS. | Normal |  |
| `exploits/dos/ssdp_amplification` | Sends spoofed SSDP M-SEARCH requests to UPnP/SSDP targets, causing amplified responses (~30x) directed at the victim via raw UDP with IP_HDRINCL. | Normal |  |
| `exploits/dos/syn_ack_flood` | Sends SYN packets to reflector servers with spoofed victim source IP, causing SYN-ACK responses directed at the victim for amplification. | Normal |  |
| `exploits/dos/tcp_connection_flood` | TCP connection flood with optional RST close and HTTP payload delivery for denial of service testing. | Normal |  |
| `exploits/dos/telnet_iac_flood` | Exploits unbounded IAC subnegotiation (SB without SE) and rapid WILL/DO option cycling to exhaust CPU and memory on telnet daemons, bruteforce tools, and honeypots. Four modes: WILL/DO storm, SB decompression bomb, NOP interleave, and combined. | Normal |  |
| `exploits/dos/udp_flood` | High-speed UDP flood with optional source IP spoofing via raw sockets. Supports random, null, and pattern payload modes. | Normal |  |
| `exploits/frameworks/apache_camel/cve_2025_27636_camel_header_injection` | Code injection via HTTP headers in Apache Camel routes that use the | Great |  |
| `exploits/frameworks/apache_tomcat/catkiller_cve_2025_31650` | Exploits CVE-2025-31650 memory leak in Apache Tomcat 10.1.10-10.1.39 via invalid HTTP/2 priority headers. | Normal |  |
| `exploits/frameworks/apache_tomcat/cve_2025_24813_apache_tomcat_rce` | Exploits CVE-2025-24813 deserialization vulnerability in Apache Tomcat for remote code execution. | Excellent |  |
| `exploits/frameworks/apache_tomcat/cve_2025_24813_tomcat_put_rce` | Unauthenticated RCE via partial PUT upload and Java deserialization. | Excellent | ✓ |
| `exploits/frameworks/exim/exim_etrn_sqli_cve_2025_26794` | Exploits CVE-2025-26794 time-based SQL injection in Exim ETRN command when using SQLite backend. | Good |  |
| `exploits/frameworks/h3c_bmc/h3c_websocket_dump` | H3C iBMC firmware accepts an unauthenticated WebSocket upgrade on TCP/8090 that immediately dumps a JSON chassis status block and proxies arbitrary Redfish GETs into the management plane — bypassing the auth gate on the :443 Redfish HTTPS API. Also supports a pipelined-frame race condition where a JSON command sent in the same TCP segment as the HTTP upgrade is processed before the WebSocket dispatcher attaches an auth context. | Excellent | ✓ |
| `exploits/frameworks/http2/cve_2023_44487_http2_rapid_reset` | Exploits CVE-2023-44487 HTTP/2 Rapid Reset vulnerability to cause denial of service via rapid stream creation and reset. | Normal |  |
| `exploits/frameworks/jenkins/jenkins_2_441_lfi` | Exploits CVE-2024-23897 CLI argument injection in Jenkins 2.441 and earlier for arbitrary file read. | Good |  |
| `exploits/frameworks/jenkins/jenkins_args4j_rce_cve_2024_24549` | Exploits the args4j parser via the connect-node CLI command with @-prefixed file paths to leak arbitrary file contents through error messages. | Great |  |
| `exploits/frameworks/jenkins/jenkins_cli_rce_cve_2024_23897` | Exploits the args4j argument parser in Jenkins CLI to read arbitrary files from the server via @-expansion in command arguments. Sends POST to /cli?remoting=false. | Great |  |
| `exploits/frameworks/mongo/mongobleed` | Exploits CVE-2025-14847 zlib decompression bug in MongoDB Server to leak uninitialized heap memory via BSON field names. | Good |  |
| `exploits/frameworks/nginx/nginx_pwner` | Checks for common Nginx misconfigurations and vulnerabilities including alias traversal, CRLF injection, and more. | Good |  |
| `exploits/frameworks/php/cve_2024_4577` | Exploits CVE-2024-4577 PHP CGI argument injection on Windows (XAMPP) for remote code execution. | Excellent |  |
| `exploits/frameworks/php/cve_2025_51373_php_rce` | PHP CGI argument injection on Windows via soft hyphen (0xAD) code-page | Excellent |  |
| `exploits/frameworks/wsus/cve_2025_59287_wsus_rce` | Unauthenticated RCE in Windows Server Update Services (WSUS). | Great | ✓ |
| `exploits/ftp/ftp_bounce_test` | Tests FTP servers for bounce attack vulnerability by attempting PORT commands to third-party hosts. | Good |  |
| `exploits/ftp/ftp_default_creds` | Tries a built-in (or user-supplied) list of common user:password pairs against an FTP service. On success it issues PWD then disconnects — no directory listing, transfer or write is performed. Designed for credential-hygiene checks during sanctioned engagements. | Good | ✓ |
| `exploits/ftp/pachev_ftp_path_traversal_1_0` | Exploits directory traversal vulnerability in Pachev FTP Server 1.0 to read files outside the FTP root. | Good |  |
| `exploits/honeytrap/docker_panic` | Sends POST /v1.40/images/create without a fromImage query parameter to honeytrap's Docker emulation. The handler indexes a nil map value → 'index out of range' panic. No recover() in the chain → daemon exit. | Good |  |
| `exploits/honeytrap/ftp_panic` | Sends a malformed FTP PORT command (`PORT 1,2,3` — only 4 fields) to honeytrap's FTP honeypot. The handler calls nums[4] without a length check → slice out of range panic → no recover() → daemon exits. | Good |  |
| `exploits/ipmi/ipmi_enum_exploit` | Comprehensive IPMI scanner with version detection, cipher 0 bypass, default credential brute force, and RAKP hash dumping. | Good |  |
| `exploits/network_infra/apache_modssl_bypass_cve_2025_23048` | Detects Apache HTTPD with mod_ssl by Server header; client-cert auth | Good | ✓ |
| `exploits/network_infra/arista_ngfw_disclose` | Probes Arista NGFW for the unauthenticated internal RPC endpoint. | Good | ✓ |
| `exploits/network_infra/checkpoint_fileread_cve_2024_24919` | Probes Check Point Security Gateway portals for the unauthenticated | Great | ✓ |
| `exploits/network_infra/cisco/cisco_ise_api_inject_cve_2025_20281` | Detects Cisco ISE 3.1/3.2 ERS API and probes the unauthenticated | Great | ✓ |
| `exploits/network_infra/citrix/cve_2025_5777_citrixbleed2` | Out-of-bounds read in Citrix NetScaler ADC/Gateway authentication endpoint. | Good | ✓ |
| `exploits/network_infra/commvault/cve_2025_34028_commvault_rce` | Pre-authentication remote code execution in Commvault Command Center | Excellent |  |
| `exploits/network_infra/f5/cve_2025_53521_f5_bigip_rce` | Unauthenticated remote code execution in F5 BIG-IP Access Policy Manager. | Great | ✓ |
| `exploits/network_infra/fortinet/forticloud_sso_auth_bypass_cve_2026_24858` | Authentication bypass via alternate path in Fortinet products with FortiCloud SSO enabled. Allows reusing SSO tokens to access other customers' appliances. | Normal |  |
| `exploits/network_infra/fortinet/fortigate_rce_cve_2024_21762` | Critical out-of-bounds write vulnerability in FortiOS SSL VPN allowing unauthenticated remote code execution via crafted HTTP requests to /remote/hostcheck_validate. | Normal |  |
| `exploits/network_infra/fortinet/fortimanager_rce_cve_2024_47575` | Critical missing authentication vulnerability in FortiManager fgfmd daemon allowing unauthenticated remote code execution via crafted FGFM registration requests on port 541. | Good |  |
| `exploits/network_infra/fortinet/fortios_auth_bypass_cve_2022_40684` | Authentication bypass on FortiOS/FortiProxy/FortiSwitchManager administrative interface via crafted HTTP headers, allowing unauthenticated API access. | Great |  |
| `exploits/network_infra/fortinet/fortios_heap_overflow_cve_2023_27997` | Pre-authentication heap-based buffer overflow in FortiOS SSL VPN allowing remote code execution via crafted requests to /remote/logincheck with oversized payload. | Normal |  |
| `exploits/network_infra/fortinet/fortios_ssl_vpn_cve_2018_13379` | Path traversal in FortiOS SSL VPN web portal to leak session files containing cleartext credentials. | Great |  |
| `exploits/network_infra/fortinet/fortisiem_rce_cve_2025_64155` | Unauthenticated remote code execution in FortiSIEM phMonitor service via argument injection in XML payload over SSL binary protocol. | Great |  |
| `exploits/network_infra/fortinet/fortiweb_rce_cve_2021_22123` | Authenticated command injection in FortiWeb SAML Server configuration via server-name parameter. Requires valid credentials. | Normal |  |
| `exploits/network_infra/fortinet/fortiweb_sqli_rce_cve_2025_25257` | Probes FortiWeb (≤ 7.0.10 / 7.2.10 / 7.4.7 / 7.6.3) for the unauthenticated SQLi that escalates to RCE via webshell deployment. Sends a benign UNION SELECT marker — no webshell write. | Great |  |
| `exploits/network_infra/hpe/cve_2025_37164_hpe_oneview_rce` | Unauthenticated RCE via REST API command injection in HPE OneView. | Excellent | ✓ |
| `exploits/network_infra/hpprocurve_disclose` | Detects HP ProCurve 4.00 admin web; reads /config/credentials disclosure. | Normal | ✓ |
| `exploits/network_infra/hpprocurve_snac_inject` | Detects HP ProCurve SNAC controller endpoints; PHP injection via management form. | Normal | ✓ |
| `exploits/network_infra/ivanti/cve_2025_0282_ivanti_preauth_rce` | Detects Ivanti Connect Secure gateways running pre-22.7R2.5 firmware vulnerable to CVE-2025-0282. Probe only — no payload sent. | Great | ✓ |
| `exploits/network_infra/ivanti/cve_2025_22457_ivanti_ics_rce` | Probes for the X-Forwarded-For stack overflow in Ivanti Connect Secure / Policy Secure / ZTA Gateway pre-22.7R2.6. Sends an oversized header and inspects the response banner. Probe only — no shellcode. | Great | ✓ |
| `exploits/network_infra/ivanti/ivanti_connect_secure_stack_based_buffer_overflow` | Critical stack-based buffer overflow in Ivanti Connect Secure, Policy Secure, and ZTA Gateways via crafted X-Forwarded-For header. CVSS 9.0. | Normal |  |
| `exploits/network_infra/ivanti/ivanti_epmm_cve_2023_35082` | Authentication bypass in Ivanti Endpoint Manager Mobile allowing unauthenticated access to user information via API endpoints. | Great |  |
| `exploits/network_infra/ivanti/ivanti_ics_auth_bypass_cve_2024_46352` | Authentication bypass in Ivanti Connect Secure via path traversal in the /api/v1/totp/user-backup-code endpoint, allowing unauthenticated access to protected resources. | Great |  |
| `exploits/network_infra/ivanti/ivanti_neurons_rce_cve_2025_22460` | Deserialization vulnerability in Ivanti Neurons for ITSM allowing unauthenticated remote code execution via crafted requests to the /api/now/ endpoint. | Normal |  |
| `exploits/network_infra/juniper_screenos_scanner` | Probes Juniper ScreenOS for the historical hard-coded backdoor. | Normal | ✓ |
| `exploits/network_infra/kubernetes/cve_2025_1974_ingress_nginx_rce` | The ingress-nginx admission webhook does not validate NGINX | Excellent |  |
| `exploits/network_infra/qnap/qnap_qts_rce_cve_2024_27130` | Stack buffer overflow in QNAP QTS No_Support_ACL function via share.cgi, allowing remote code execution. Affects QNAP QTS, QuTScloud, and QTS hero. | Normal |  |
| `exploits/network_infra/sonicwall/cve_2025_40602_sonicwall_sma_rce` | Detects SonicWall SMA1000 series management/auth surfaces vulnerable to CVE-2025-40602. Probe only — banner / endpoint check, no payload. | Great | ✓ |
| `exploits/network_infra/trend_micro/cve_2025_5777` | Unauthenticated command injection in Trend Micro Apex Central via Login.aspx endpoint. | Great |  |
| `exploits/network_infra/trend_micro/cve_2025_69258` | Unauthenticated DLL loading via Trend Micro MsgReceiver service on port 20001, allowing remote code execution. | Great |  |
| `exploits/network_infra/trend_micro/cve_2025_69259` | Denial of service via unchecked NULL return value in Trend Micro MsgReceiver service, causing service crash. | Normal |  |
| `exploits/network_infra/trend_micro/cve_2025_69260` | Denial of service via out-of-bounds read in Trend Micro MsgReceiver service, causing service crash. | Normal |  |
| `exploits/network_infra/vmware/esxi_auth_bypass_cve_2024_37085` | VMware ESXi authentication bypass via Active Directory group manipulation. Attackers with AD access can create the 'ESX Admins' group to gain full admin access to ESXi hosts. | Normal |  |
| `exploits/network_infra/vmware/esxi_vm_escape_check` | Checks ESXi hosts for vulnerability to VM escape chain (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226) and detects indicators of compromise. | Good |  |
| `exploits/network_infra/vmware/esxi_vsock_client` | VSOCK client for communicating with VSOCKpuppet backdoor on compromised ESXi hosts after successful VM escape exploitation. | Manual | ✓ |
| `exploits/network_infra/vmware/vcenter_backup_rce` | Authenticated remote code execution in VMware vCenter Server via flag injection in backup.validate API locationUser parameter. CVSS 7.2. | Great |  |
| `exploits/network_infra/vmware/vcenter_file_read` | Authenticated partial arbitrary file read in VMware vCenter Server via RVC command. CVSS 4.9. | Good |  |
| `exploits/network_infra/vmware/vcenter_rce_cve_2024_37079` | Critical heap-overflow vulnerability in VMware vCenter Server DCERPC protocol implementation allowing unauthenticated remote code execution via crafted packets to port 443. | Normal |  |
| `exploits/payloadgens/obfuscator` | Multi-layer payload obfuscator. Twenty-four methods (XOR / RC4 / base16/32/32hex/64/64url/85/91 / ROT13 / ROT47 / reverse / gzip / URL / Caesar / bit-rotate / Vigenère / zero-width / hex-split / UTF-16LE / char-substitution / ANSI-escape / chunk-permute) and seven output formats (raw, recipe, Python / PowerShell / Bash / JavaScript self-decoder, C array). Three modes: chain (explicit order), random (auto N rounds), same (one method N times). Default 4 rounds, user-overridable up to 32. All randomness from OS RNG; chains are reproducible via the recipe. Engine lives in native::obfuscator_engine; this module is the prompt-driven UI. | Normal | ✓ |
| `exploits/payloadgens/payloadgen` | Unified payload generator. Modes: bat (BAT chain dropper), lnk (malicious LNK for NTLMv2-SSP hash disclosure CVE-2025-50154 / CVE-2025-59214), narutto (polymorphic 3-stage LOLBAS dropper), polymorph (3-stage Task-Scheduler dropper), encode (multi-stage payload encoder — base16/32/64/url/shell/html/zero-width), or menu for an interactive selector. Same prompt keys as the previous individual modules so existing automation migrates with `mode=<bat\|lnk\|narutto\|polymorph\|encode>`. | Normal | ✓ |
| `exploits/routers/dlink/dlink_dcs_930l_auth_bypass` | Authentication bypass via unauthenticated configuration disclosure on D-Link DCS-930L/932L cameras. Retrieves and deobfuscates credentials from /frame/GetConfig. | Great |  |
| `exploits/routers/netgear/netgear_r6700v3_rce_cve_2022_27646` | Pre-authentication buffer overflow in Netgear R6700v3 circled daemon allowing remote code execution. Based on Pwn2Own Austin 2021 exploit. | Normal |  |
| `exploits/routers/palo_alto/panos_authbypass_cve_2025_0108` | Authentication bypass in Palo Alto Networks PanOS via path traversal in the authentication mechanism, allowing unauthenticated access to administrative functions. | Great |  |
| `exploits/routers/palo_alto/panos_expedition_rce_cve_2024_9463` | Unauthenticated OS command injection in Palo Alto Expedition | Excellent |  |
| `exploits/routers/palo_alto/panos_globalprotect_rce_cve_2024_3400` | Unauthenticated OS command injection in PAN-OS GlobalProtect gateway. | Excellent |  |
| `exploits/routers/ruijie/ruijie_auth_bypass_rce_cve_2023_34644` | Authentication bypass leading to remote code execution on Ruijie RG-EW routers, RG-NBS/RG-S1930 switches, RG-EG VPN routers, and EAP/RAP access points. CVSS 9.8. | Excellent |  |
| `exploits/routers/ruijie/ruijie_reyee_ssrf_cve_2024_48874` | Server-Side Request Forgery in Ruijie Reyee cloud-connected devices. Part of the Open Sesame vulnerability chain discovered by Claroty Team82. CVSS 8.6. | Good |  |
| `exploits/routers/ruijie/ruijie_rg_ew_login_bypass_cve_2023_4415` | Authentication bypass on Ruijie RG-EW1200G routers via crafted JSON login request to /api/sys/login. CVSS 9.8. | Great |  |
| `exploits/routers/ruijie/ruijie_rg_ew_password_reset_cve_2023_4169` | Unauthenticated admin password reset on Ruijie RG-EW1200G routers via /api/sys/set_passwd endpoint. CVSS 9.8. | Great |  |
| `exploits/routers/ruijie/ruijie_rg_ew_update_version_rce_cve_2021_43164` | Remote code execution via command injection in firmware update function on Ruijie RG-EW Series routers up to ReyeeOS 1.55.1915. CVSS 9.8. | Excellent |  |
| `exploits/routers/ruijie/ruijie_rg_uac_ci_cve_2024_4508` | Critical unauthenticated command injection in Ruijie RG-UAC via static_route_edit_ipv6.php route parameters. CVSS 9.8. | Great |  |
| `exploits/routers/ruijie/ruijie_rsr_router_ci_cve_2024_31616` | Authenticated command injection via backtick in Ruijie RSR10-01G-T-S router diagnostic endpoints. CVSS 8.8. | Great |  |
| `exploits/routers/tenda/tenda_cp3_rce_cve_2023_30353` | Command injection in Tenda CP3 IP Camera via YGMP_CMD message on UDP port 5012, allowing unauthenticated remote code execution. | Excellent |  |
| `exploits/routers/tplink/tapo_c200_vulns` | Multiple vulnerabilities in TP-Link Tapo C200 including pre-auth WiFi network scanning info leak (CVE-2025-14300), WiFi hijacking, ONVIF SOAP XML parser memory overflow (CVE-2025-8065), and HTTPS Content-Length integer overflow (CVE-2025-14299). | Good |  |
| `exploits/routers/tplink/tp_link_vn020_dos` | Denial of service via malformed AddPortMapping SOAP request on TP-Link VN020 F3v(T) UPnP service. | Normal |  |
| `exploits/routers/tplink/tplink_archer_c2_c20i_rce` | Authenticated command injection via host parameter in diagnostic POST request on TP-Link Archer C2 and C20i routers. | Great |  |
| `exploits/routers/tplink/tplink_archer_c9_password_reset` | Exploits predictable PRNG for password reset code on TP-Link Archer C9/C60 routers, allowing unauthenticated admin password reset. | Great |  |
| `exploits/routers/tplink/tplink_archer_rce_cve_2024_53375` | Authenticated command injection in TP-Link Archer, Deco, and Tapo series routers via OwnerId parameter in /admin/smart_network endpoint. | Great |  |
| `exploits/routers/tplink/tplink_ax1800_rce_cve_2024_53375` | Authenticated command injection in TP-Link Archer AX1800 via the NTP server configuration field. The NTP server value is passed to os.execute() without sanitization. | Great |  |
| `exploits/routers/tplink/tplink_deco_m4_rce` | Tests default admin:admin credentials on TP-Link Deco M4, then exploits the diagnostic ping field for command injection via /cgi-bin/luci/admin/network/diagnostics. | Great |  |
| `exploits/routers/tplink/tplink_tapo_c200` | Probes TP-Link Tapo C200 IP cameras for command injection via the setLanguage JSON-RPC method on TCP/8800. Probe-only echo-marker. | Excellent |  |
| `exploits/routers/tplink/tplink_vigi_c385_rce_cve_2026_1457` | Detects TP-Link VIGI C385 V1 web UI vulnerable to the authenticated set_resolution buffer overflow. Probe only — requires creds, sourced separately. | Great |  |
| `exploits/routers/tplink/tplink_wdr740n_backdoor` | Exploits a debug page on TP-Link WDR740ND/WDR740N routers that allows command execution with hardcoded credentials (osteam/5up). | Great |  |
| `exploits/routers/tplink/tplink_wdr740n_path_traversal` | Path traversal on TP-Link WDR740ND/WDR740N routers allowing arbitrary file read from the filesystem via /help/ endpoint. | Good |  |
| `exploits/routers/tplink/tplink_wdr842n_configure_disclosure` | Downloads and decrypts configuration from TP-Link WDR842ND/WDR842N routers via /config.bin, extracting credentials using DES decryption. | Good |  |
| `exploits/routers/tplink/tplink_wr740n_dos` | Buffer overflow denial of service in TP-Link TL-WR740N router web server, crashing the HTTP service and requiring physical reboot. | Normal |  |
| `exploits/routers/ubiquiti/ubiquiti_edgerouter_ci_cve_2023_2376` | Command injection in Ubiquiti EdgeRouter X Web Management Interface affecting versions up to 2.0.9-hotfix.6. | Great |  |
| `exploits/routers/zte/zte_zxv10_h201l_rce_authenticationbypass` | Authentication bypass and remote code execution on ZTE ZXV10 H201L routers via configuration leak, credential extraction, and DDNS command injection. | Great |  |
| `exploits/routers/zyxel/zyxel_cpe_ci_cve_2024_40890` | Probes legacy Zyxel CPE devices for HTTP-based unauthenticated command injection. EOL hardware — no patches. Probe sends a benign echo-marker. | Great |  |
| `exploits/safeline/cookie_attributes` | Sends one POST /api/Login with an invalid passcode to observe the Set-Cookie header. The session cookie lacks HttpOnly, Secure, and SameSite attributes — enabling XSS-based session theft, CSRF, and plaintext transmission when TLS is upstream-terminated. | Normal |  |
| `exploits/safeline/nginx_injection` | Sends an authenticated POST /api/Website to SafeLine with a malicious Ports field. The tcontrollerd process inserts the value verbatim into an nginx config template via fmt.Sprintf → arbitrary directive injection. On nginx reload the injected config takes effect on the WAF host. | Great |  |
| `exploits/safeline/no_auth_probe` | Sends unauthenticated GET requests to protected SafeLine endpoints. If the operator has set the NO_AUTH env var, main.go:162 uses `len(noAuth) >= 0` (always true), disabling the auth middleware. A 200 response with data confirms the bypass. | Good |  |
| `exploits/safeline/pre_auth_tfa` | On fresh SafeLine installs (LastLoginTime == 0), GET /api/OTPUrl is unauthenticated and rotates the TFA secret, returning the new otpauth:// URL. This module fetches the secret, computes the current TOTP code, and logs in as super-user — account takeover without credentials. | Excellent |  |
| `exploits/safeline/session_secret_entropy` | SafeLine generates its JWT/session signing secret with math/rand seeded by time.Now().UnixNano(). Effective entropy is log2(install_window_ns) — as low as 39 bits for a known 10-minute window. This module prints the entropy analysis and optionally probes the Set-Cookie header to confirm the signed cookie mechanism is in use. | Normal |  |
| `exploits/safeline/unauth_writes` | POST /api/Behaviour and POST /api/FalsePositives are in SafeLine's publicRouters (no auth required). Any client can write arbitrary data to the behaviour analytics DB and trigger per-request outbound HTTPS calls via /api/FalsePositives — analytics pollution, storage DoS, and request amplification. | Good |  |
| `exploits/sample_exploit` | A demonstration exploit that checks if a target endpoint is vulnerable. | Normal | ✓ |
| `exploits/snare/cookie_dos` | Sends an HTTP GET with a Cookie header that has no '=' separator to snare. The tanner_handler.py dict comprehension calls `cookie.split('=')[1]` unconditionally → IndexError → worker crash. | Normal |  |
| `exploits/snare/tanner_version_mitm` | Binds a rogue HTTP server on port 8090 that returns a forged {"version": "X.Y.Z"} response to GET /version. When snare is launched with --tanner pointing to this host, it accepts the forged version and starts up — demonstrating that the version check has no cryptographic authenticity guarantee. | Normal |  |
| `exploits/ssh/asyncssh_beginauthpass` | Exploits AsyncSSH servers whose SSHServer.begin_auth() returns False, causing USERAUTH_SUCCESS to be sent immediately. Opens a session after bypass and runs an arbitrary command. | Great |  |
| `exploits/ssh/erlang_otp_ssh_rce_cve_2025_32433` | Unauthenticated RCE in Erlang/OTP SSH server. | Great | ✓ |
| `exploits/ssh/libssh2_rogue_server` | Starts a rogue SSH server that accepts ALL authentication attempts regardless of credentials. Exploits libssh2 clients that accept USERAUTH_SUCCESS without verifying KEX state (userauth.c:201,396,1714). Captures username, password, and public key fingerprints. | Excellent |  |
| `exploits/ssh/libssh_auth_bypass_cve_2018_10933` | Authentication bypass in libSSH server. | Excellent | ✓ |
| `exploits/ssh/openssh_regresshion_cve_2024_6387` | Signal handler race condition in OpenSSH sshd allows unauthenticated | Normal | ✓ |
| `exploits/ssh/opensshserver_9_8p1race_condition` | Exploits a race condition in OpenSSH server 9.8p1 for remote code execution via heap-based glibc exploitation. | Normal |  |
| `exploits/ssh/paramiko_authnonepass` | Exploits Paramiko-based SSH servers that mistakenly return AUTH_SUCCESSFUL from check_auth_none(). Sends an SSH2 'none' userauth request and, if the server accepts it, opens a session channel and runs an arbitrary command. Tested against paramiko 4.0.0. | Great |  |
| `exploits/ssh/paramiko_unknown_method` | Exploits Paramiko-based SSH servers where an unrecognized auth method falls through to check_auth_none() (auth_handler.py:721-724). If check_auth_none() returns AUTH_SUCCESSFUL, any bogus method name authenticates the client. Tested against paramiko 4.0.0. | Great |  |
| `exploits/ssh/sshpwn_auth_passwd` | Exploits OpenSSH auth2-passwd.c vulnerabilities including password length DoS, password change info leak, and timing-based user enumeration. | Normal |  |
| `exploits/ssh/sshpwn_pam` | Exploits OpenSSH auth-pam.c vulnerabilities including environment variable injection, memory leak DoS, and username length validation bypass. | Normal |  |
| `exploits/ssh/sshpwn_scp_attacks` | Exploits OpenSSH SCP vulnerabilities including path traversal via filename manipulation, command injection, and brace expansion DoS. | Normal |  |
| `exploits/ssh/sshpwn_session` | Exploits OpenSSH session.c and sshd-session.c vulnerabilities including forced command bypass, environment variable injection, and privilege separation issues. | Good |  |
| `exploits/ssh/sshpwn_sftp_attacks` | Exploits OpenSSH SFTP server vulnerabilities including symlink injection, chmod setuid abuse, path traversal, and partial write issues. | Normal |  |
| `exploits/telnet/telnet_auth_bypass_cve_2026_24061` | Exploits CVE-2026-24061 to bypass telnet authentication on vulnerable devices. | Excellent |  |
| `exploits/vnc/libvnc_checkrect_overflow` | LibVNCClient vncviewer.c:115-117 uses signed 32-bit bounds checks (x+w > fb_width). At x=0x7FFFFFFF, w=1: x+w wraps to INT_MIN — negative, bypasses check. Raw pixel data is then written past the allocated framebuffer → heap overflow → RCE. This module acts as a malicious VNC server. | Normal | ✓ |
| `exploits/vnc/libvnc_tight_filtergradient` | LibVNCClient tight.c:468-522 reads numRows from the decompressed Tight stream and drives the gradient filter loop without clamping to the rect height. A crafted stream claiming numRows=10000 for a 20-row rect writes far past the allocated heap buffer → OOB write → RCE. Malicious server module. | Normal | ✓ |
| `exploits/vnc/libvnc_ultrazip` | LibVNCClient ultra.c:100-150 (CVE-2018-20750) reads numCacheRects from the UltraZip wire stream and loops that many times memcpy-ing into a fixed-size rect cache (~200 entries) without bounds-checking. numCacheRects=0xFFFF with 1 real entry → heap overflow → RCE. Malicious server module. | Normal | ✓ |
| `exploits/vnc/libvnc_websocket_overflow` | LibVNCServer ws_decode.c:219-254 reads a 64-bit WebSocket frame payloadLen and uses it without bounding against the receive buffer size. Sending a binary frame with payloadLen=0xFFFFFFFFFFFF and 0 bytes of actual data triggers a heap overflow → server crash / RCE. | Good |  |
| `exploits/vnc/libvnc_zrle_tile` | LibVNCClient zrle.c:201-209 does not track bytes consumed per tile during decompression. A truncated RLE tile provides only 1 pixel run but the tile covers 64×64 pixels; the client reads ~4095 extra runs from beyond the decompressed buffer → heap over-read → potential info-leak or RCE. Malicious server module. | Normal | ✓ |
| `exploits/vnc/tigervnc_rre_overflow` | TigerVNC's RRE decoder reads numSubrects from the wire as u32 and loops that many times, reading 4+bpp bytes per subrect without bounds-checking the received buffer. numSubrects=0xFFFFFFFF with a minimal body forces the client to read past the heap buffer → RCE. Malicious server module. | Normal | ✓ |
| `exploits/vnc/tigervnc_timing_oracle` | TigerVNC's VNC auth handler may exhibit measurable timing differences between a correct and incorrect first-block DES response. Repeated auth attempts with crafted 16-byte responses and RTT measurement can leak partial key information. Highly noisy — requires low-latency controlled network. Rank: Low. | Low |  |
| `exploits/vnc/tightvnc_decompression_bomb` | TightVNC's FileUploadData handler (FileTransferRequestHandler.cpp:582-590) uses the wire `uncompressedSize` field without any cap. Sending a tiny zlib payload (~13 bytes) claiming 2 GiB uncompressed forces the server to allocate gigabytes → heap exhaustion → process crash / OOM-kill. DESTRUCTIVE. | Normal |  |
| `exploits/vnc/tightvnc_des_hardcoded_key` | TightVNC stores the VNC password encrypted with a hardcoded 8-byte DES key (VncPassCrypt.cpp:29-44). The 8-byte ciphertext lives in the Windows registry at HKLM\SOFTWARE\TightVNC\Server\Password. Any user who can read that value can recover the plaintext offline in microseconds. No network interaction required. | Excellent | ✓ |
| `exploits/vnc/tightvnc_ft_path_traversal` | Detects TightVNC servers exposing the file-transfer extension. The full exploit needs an authenticated session; this probe only confirms the surface is reachable. | Excellent |  |
| `exploits/vnc/tightvnc_predictable_challenge` | TightVNC fills the 16-byte RFB challenge with srand(time(0))+rand(). Two connections in the same wall-clock second receive identical challenges, allowing replay attacks or offline PRNG reconstruction. Bug: RfbInitializer.cpp:173-175. | Good |  |
| `exploits/vnc/tightvnc_rect_overflow` | TightVNC Rect::area() uses signed int32 multiplication (Rect.h:172). At 0x8001×0x8001 the product wraps, causing TightEncoder to allow a 300-entry palette write past the 256-entry heap buffer → RCE. This module acts as a malicious VNC server; point a TightVNC/LibVNCClient viewer at the listen address. | Normal | ✓ |
| `exploits/vnc/x11vnc_dns_injection` | x11vnc connections.c:1665-1670 calls gethostbyaddr() on the connecting client IP and passes the result UNSANITISED to system() when -accept xmessage is set. A crafted PTR record containing shell metacharacters achieves RCE as the x11vnc user. Requires a rogue DNS server — this module prints the setup recipe. Rank: Manual. | Manual |  |
| `exploits/vnc/x11vnc_env_injection` | x11vnc populates the RFB_CLIENT_IP environment variable from the connecting client's source IP address and passes it to hook scripts. If hook scripts interpolate this variable unsafely (e.g. in shell `exec $RFB_CLIENT_IP`), and the attacker controls the source IP routing, shell injection achieves RCE. This module prints the setup recipe. Rank: Manual. | Manual |  |
| `exploits/vnc/x11vnc_unixpw_inject` | x11vnc -unixpw mode sends a plaintext username+password challenge over the VNC channel without stripping newlines from the username field. Injecting \n in the username can confuse the PAM interaction, potentially bypassing authentication or creating unexpected auth state. | Normal |  |
| `exploits/voip/cve_2025_64328_freepbx_cmdi` | Post-authentication command injection in FreePBX filestore module. | Great | ✓ |
| `exploits/voip/magnusbilling_ssrf_cve_2023_30258` | Detects MagnusBilling 6 panel; multiple unauth weaknesses including SSRF and traversal. | Good | ✓ |
| `exploits/voip/xorcompbx_rce` | Detects Xorcom CompletePBX login portal; auth-required RCE via shell injection in admin endpoints. | Normal | ✓ |
| `exploits/webapps/aiplugins_rce_cve_2025_23968` | Detects unauthenticated arbitrary file upload in Cibeles AI, | Great | ✓ |
| `exploits/webapps/api_attack_suite` | Active offensive sweep covering every API attack category in PortSwigger's Web Security Academy. Accepts either a target URL OR a raw captured HTTP request (Burp 'Copy as raw request'); when a captured request is provided, fingerprints the stack, walks every fuzzable parameter (query, JSON body recursive, headers, cookies), auto-detects already-privileged fields (`admin: true`, `role: ...`) and flips them, then runs verb tampering, auth bypass, HPP, mass-assign, BOLA, content-type confusion, GraphQL attacks, JWT none-alg, rate-limit, and sensitive-field exposure. Two interaction modes (interactive / auto) — same surface across shell / CLI / API / MCP. | Normal | ✓ |
| `exploits/webapps/azureapim_checker` | Probes Azure APIM developer portal endpoints for cross-tenant signup | Normal | ✓ |
| `exploits/webapps/azuriom_csti_cve_2025_65271` | Detects Azuriom admin dashboard; client-side template injection enables | Normal | ✓ |
| `exploits/webapps/beego_traversal_lfi` | Detects Beego applications vulnerable to %5c-encoded path traversal. | Good | ✓ |
| `exploits/webapps/cacti_graph_rce_cve_2025_24367` | Detects Cacti ≤ 1.2.29 and verifies authenticated access | Good | ✓ |
| `exploits/webapps/casdoor_traversal_cve_2023_34927` | Detects Casdoor 2.95.0 vulnerable to %5c-encoded path traversal. | Good | ✓ |
| `exploits/webapps/cbitrix_translate_upload_cve_2025_67887` | Detects 1C-Bitrix CMS ≤ 25.100.500 exposing the Translate module | Good | ✓ |
| `exploits/webapps/cinnamon_kotaemon_zip_dos_cve_2025_63914` | Detects Cinnamon kotaemon ≤ 0.11.0 by Gradio fingerprint. | Normal | ✓ |
| `exploits/webapps/cleo_harmony_filewrite_cve_2024_55956` | Detects Cleo Harmony / VLTrader / LexiCom MFT 5.8.0.23 by web banner. | Great | ✓ |
| `exploits/webapps/clipbucket_rce_cve_2025_55911` | Detects ClipBucket 5.5.2 build 90 video platform. | Good | ✓ |
| `exploits/webapps/cloudbleed_scanner` | Sends malformed HTML probes and inspects responses for | Normal | ✓ |
| `exploits/webapps/commvault_cli_rce_cve_2025_57788` | Probes Commvault Command Center for the unauth RCE chain | Great | ✓ |
| `exploits/webapps/convio_sqli` | Probes Convio CMS endpoints for SQL error markers in `id` parameter. | Normal | ✓ |
| `exploits/webapps/coohom_xss` | Detects Coohom application; reflected XSS via input parameters. | Normal | ✓ |
| `exploits/webapps/cpms_authbypass` | Detects CPMS 2.0 admin login; SQLi or hardcoded credentials enable unauth admin access. | Normal | ✓ |
| `exploits/webapps/craftcms_key_rce_cve_2025_23209` | RCE in Craft CMS when the application security key is known or leaked. | Normal | ✓ |
| `exploits/webapps/craftcms_logicflaw` | Detects Craft CMS 5.0; image-transform endpoint authenticates via | Normal | ✓ |
| `exploits/webapps/craftcms_rce_cve_2025_47726` | Remote Code Execution via Server-Side Template Injection in Craft CMS. | Great | ✓ |
| `exploits/webapps/craftcms_ssti_scanner` | Submits {{7*7}} via search/path parameters and looks for "49" reflection. | Normal | ✓ |
| `exploits/webapps/crafty_controller_rce_cve_2025_14700` | Detects Crafty Controller; auth-required SSTI in template configuration enables RCE. | Good | ✓ |
| `exploits/webapps/dify/cve_2025_56157_dify_default_creds` | Checks for default PostgreSQL credentials in Dify deployments. | Great | ✓ |
| `exploits/webapps/django_sqli_cve_2025_64459` | Probes Django apps for the QuerySet/Lookup SQLi affecting 5.1.x ≤ 5.1.13. | Good | ✓ |
| `exploits/webapps/dnnplatform_upload_cve_2025_64095` | Detects DNN (DotNetNuke) <10.1.1 with the HTML editor upload endpoint | Great | ✓ |
| `exploits/webapps/dotcms_blind_sqli_cve_2025_8311` | Authenticated time-based blind SQL injection in dotCMS 25.07.02-1 | Good | ✓ |
| `exploits/webapps/dotcms_scanner` | Detects dotCMS instances and reads /api/v1/system/version disclosure. | Normal | ✓ |
| `exploits/webapps/drupal11_pathdisclose_cve_2024_45440` | Triggers Drupal error responses that disclose the absolute filesystem path. | Normal | ✓ |
| `exploits/webapps/eduplus_idor` | Detects EduplusCampus student portal IDOR by enumerating | Normal | ✓ |
| `exploits/webapps/elementor_wb_sqli_cve_2023_0329` | Detects Elementor WP plugin <3.12.2; admin SQL injection in template endpoint. | Good | ✓ |
| `exploits/webapps/eramba_grc_rce_cve_2023_36255` | Detects Eramba GRC by login fingerprint; download-test-pdf is | Good | ✓ |
| `exploits/webapps/ffcw_inject` | Detects FileCatalyst Workflow login; PHP injection via workflow params. | Normal | ✓ |
| `exploits/webapps/flask_command_injection` | Probes a Flask app for SSTI and command-injection markers in | Normal | ✓ |
| `exploits/webapps/flatcore_upload_cve_2019_13961` | Detects flatCore 1.5 by login fingerprint; chained file upload to PHP RCE. | Good | ✓ |
| `exploits/webapps/flatpress_xsrf_shell` | Detects FlatPress 1.3 admin endpoints; CSRF + auth shell upload. | Good | ✓ |
| `exploits/webapps/flowise/cve_2024_31621` | Unauthenticated access to Flowise /API/V1/credentials endpoint, bypassing authentication in Flowise <= 1.6.5. | Great |  |
| `exploits/webapps/flowise/cve_2025_59528_flowise_rce` | Authenticated RCE in Flowise < 3.0.5 via customMCP endpoint expression injection. | Great |  |
| `exploits/webapps/flowise_js_inject_cve_2025_59528` | Detects Flowise UI/API; JS parsing injection allows code | Good | ✓ |
| `exploits/webapps/foxcms_inject_cve_2025_29306` | Detects FoxCMS 1.0 by admin fingerprint; PHP code injection in admin actions. | Good | ✓ |
| `exploits/webapps/fuguhub_rsakey_disclose_cve_2025_65790` | Probes FuguHub web-accessible documentation for an embedded RSA | Good | ✓ |
| `exploits/webapps/getsimple_csrf_cve_2021_28976` | Detects GetSimple CMS 3.3.16; missing anti-CSRF tokens on backup | Normal | ✓ |
| `exploits/webapps/gnuboard5_install` | Detects exposed /install/ endpoint of Gnuboard 5; if reachable, attacker can compromise installation parameters. | Good | ✓ |
| `exploits/webapps/gravcms_sandbox_bypass_cve_2025_66294` | Detects Grav CMS by the X-Generator header / login page; Twig sandbox bypass | Good | ✓ |
| `exploits/webapps/guppycms_shell` | Detects GuppY CMS via /admin login and probes for PHP injection in admin endpoints. | Normal | ✓ |
| `exploits/webapps/headlamp_unauth_disclose_cve_2025_14269` | Probes the Headlamp Kubernetes dashboard for unauthenticated | Good | ✓ |
| `exploits/webapps/hestia_inject` | Detects Hestia CP login portal; auth-required PHP code injection in admin scripts. | Normal | ✓ |
| `exploits/webapps/highcms_sqli` | Probes legacy HighCMS / HighPortal endpoints for blind SQL injection markers. | Normal | ✓ |
| `exploits/webapps/hpe_oneview_rce` | Probes HPE OneView REST API; authenticated Java deserialization | Normal | ✓ |
| `exploits/webapps/ias25_idor` | Detects IAS 2.5 admin panel; enumerates student record IDs via IDOR. | Normal | ✓ |
| `exploits/webapps/ias25_sqli` | Detects IAS 2.5 SQL injection via the login form parameters. | Normal | ✓ |
| `exploits/webapps/ias25_upload` | Detects IAS 2.5 admin upload form; chained with default creds → PHP RCE. | Normal | ✓ |
| `exploits/webapps/ibmbigfix_disclose` | Detects IBM BigFix Platform port and probes for unauth disclosure paths. | Normal | ✓ |
| `exploits/webapps/ictbroadcast_rce` | Detects ICTBroadcast 7.0 admin endpoint; auth RCE via DBC (Dynamic Broadcast Configuration). | Normal | ✓ |
| `exploits/webapps/iemm_eli_inject_cve_2025_4427` | Probes Ivanti EPM Mobile (formerly MobileIron Core) for the | Great | ✓ |
| `exploits/webapps/invision_csti_cve_2025_ic506` | Detects Invision Community 5.0.6; auth-required Expression Injection (SSTI) in customCss. | Normal | ✓ |
| `exploits/webapps/invoiceninja_inject` | Detects Invoice Ninja by the api/v1/ping endpoint; PHP code injection via auth-required template editor. | Normal | ✓ |
| `exploits/webapps/ioncube_loader_scanner` | Detects exposed ionCube wizard helper files (loader-wizard.php). | Normal | ✓ |
| `exploits/webapps/jenkins_fileread` | Detects Jenkins ≤ 2.441 vulnerable to arbitrary file read via the | Great | ✓ |
| `exploits/webapps/jsonpath_plus_rce_cve_2025_1302` | Submits a JSONPath expression that triggers JS evaluation; reflection | Normal | ✓ |
| `exploits/webapps/kalmia_user_enum_cve_2025_65899` | JWT auth endpoint leaks user existence based on returned message. | Normal | ✓ |
| `exploits/webapps/langflow/cve_2026_33017_build_public_tmp_rce` | Pre-auth RCE on Langflow ≤ 1.8.2 via `/api/v1/build_public_tmp/{flow_id}/flow`. The endpoint executes attacker-controlled Python code embedded in flow nodes during graph preparation. Default-deployed Langflow has `AUTO_LOGIN=true`, which the chain leverages to mint the required public-flow id without creds. | Excellent | ✓ |
| `exploits/webapps/langflow_rce_cve_2025_3248` | Unauthenticated RCE via Python exec() in Langflow code validation. | Excellent | ✓ |
| `exploits/webapps/laravel_livewire_rce_cve_2025_47949` | Remote Code Execution via unsafe deserialization in Laravel Livewire. | Great | ✓ |
| `exploits/webapps/laravel_pulse_inject_cve_2024_55661` | Detects Laravel Pulse dashboard at /pulse; remote_ip header / route | Normal | ✓ |
| `exploits/webapps/lepton_xss_rce` | Detects LEPTON CMS 7.4.0 admin endpoints; chained Stored XSS into | Normal | ✓ |
| `exploits/webapps/lgsimpleeditor_inject` | Detects LG Simple Editor by /login fingerprint; PHP code injection in editor endpoints. | Normal | ✓ |
| `exploits/webapps/librenms_inject` | Detects LibreNMS by /login fingerprint; auth-required PHP code injection. | Normal | ✓ |
| `exploits/webapps/limesurvey_filedownload` | Detects LimeSurvey 2.0 export endpoint that exposes uploaded files | Normal | ✓ |
| `exploits/webapps/magento_session_reaper_cve_2025_54236` | Probes Magento 2 / Adobe Commerce REST API for vulnerable build banners | Great | ✓ |
| `exploits/webapps/mangosweb_xss` | Probes mangosweb search/login endpoints for unsanitised reflection. | Normal | ✓ |
| `exploits/webapps/mantisbt_exec` | Detects Mantis Bug Tracker 2.30; auth RCE via filter/admin paths. | Normal | ✓ |
| `exploits/webapps/mcpjam/cve_2026_23744_mcpjam_rce` | Detects MCPJam Inspector ≤ 1.4.2 listening on a non-loopback interface. The Inspector accepts unauthenticated MCP server registrations, which is RCE in practice. Probe only. | Great |  |
| `exploits/webapps/misp_rce_cve_2025_27364` | Authenticated file upload to RCE in MISP < 2.5.3. The /events/upload_sample endpoint accepts arbitrary MIME types, allowing upload of PHP webshells when combined with a permissive server configuration. CVSS 8.8 High. | Normal |  |
| `exploits/webapps/mobiledetect_xss` | Probes endpoints that echo User-Agent for XSS reflection markers. | Normal | ✓ |
| `exploits/webapps/n8n/n8n_form_afr_cve_2026_21858` | POSTs `files.filepath` to a known n8n form-trigger workflow on n8n ≤ 1.65.0. Operator supplies the form path via `setg n8n_form_path /form/...` and the file via `setg n8n_target_file /etc/passwd`. Probe-only — does not chain into RCE. | Good | ✓ |
| `exploits/webapps/n8n/n8n_rce_cve_2025_68613` | Authenticated RCE in n8n 0.211.0-1.120.3/1.121.0 via expression injection in workflow Set nodes. CVSS 10.0 Critical. | Great |  |
| `exploits/webapps/nextjs_middleware_bypass_cve_2025_29927` | Bypasses Next.js middleware (auth, RBAC, redirects) by sending the | Great |  |
| `exploits/webapps/openrepeater_inject` | Detects OpenRepeater web UI; authenticated injection in audio/network configuration endpoints. | Normal | ✓ |
| `exploits/webapps/opensisce_sqli` | Detects openSIS classic; auth-bypass / SQLi via login form. | Normal | ✓ |
| `exploits/webapps/phpipam_sqli` | Detects phpIPAM and probes parameterised endpoints for SQL error markers. | Normal | ✓ |
| `exploits/webapps/phpmyadmin_sqli` | Detects phpMyAdmin and probes for known SQLi via designer endpoints. | Normal | ✓ |
| `exploits/webapps/phpmyfaq_xss` | Detects phpMyFAQ; reflected XSS via search and CSRF on admin endpoints. | Normal | ✓ |
| `exploits/webapps/pihole_redis_rce_cve_2024_34361` | Detects Pi-hole admin UI; authenticated SSRF + Redis abuse for RCE. | Good | ✓ |
| `exploits/webapps/piwigo_sqli` | Detects Piwigo gallery; SQLi via parameter abuse in admin endpoints. | Normal | ✓ |
| `exploits/webapps/pluck_upload` | Detects Pluck CMS; auth admin upload chained to PHP code execution. | Normal | ✓ |
| `exploits/webapps/react/react2shell` | Detects exposed React Server Components Flight endpoints (`?_rsc=` query parameter) that may be vulnerable to deserialization-based RCE on patched-but-misconfigured Next.js installations. Probe only. | Excellent |  |
| `exploits/webapps/react_rsc_rce_cve_2025_55182` | Detects React Server Components fingerprint; server-side serialisation | Good | ✓ |
| `exploits/webapps/redash_rce_hash` | Detects Redash via /api/admin/status; auth-required RCE via SQL data source helper. | Normal | ✓ |
| `exploits/webapps/rosariosis_xss` | Detects RosarioSIS login page; reflected XSS via search parameter. | Normal | ✓ |
| `exploits/webapps/roundcube/roundcube_postauth_rce` | Authenticated RCE in Roundcube webmail via PHP deserialization (Crypt_GPG_Engine gadget) in file upload. Affects versions 1.1.0-1.5.9 and 1.6.0-1.6.10. | Great |  |
| `exploits/webapps/sap_netweaver_rce_cve_2025_31324` | Unauthenticated file upload to RCE in SAP NetWeaver Visual Composer. | Excellent | ✓ |
| `exploits/webapps/sharepoint/cve_2024_38094` | Authenticated remote code execution in SharePoint Server via deserialization of malicious .bdcm file upload. Requires Site Owner privileges. CVSS 7.2. | Great |  |
| `exploits/webapps/sharepoint/cve_2025_53770_sharepoint_toolpane_rce` | Unauthenticated deserialization RCE in SharePoint on-premises. | Great | ✓ |
| `exploits/webapps/sharepoint_toolpane_cve_2025_53770` | Probes SharePoint Server for the ToolPane.aspx endpoint and missing | Excellent | ✓ |
| `exploits/webapps/smartermail/admin_password_reset_cve_2026_23760` | Probes SmarterTools SmarterMail < 9511 for the IsSysAdmin client-trust bypass on /api/v1/auth/force-reset-password. By default, only checks whether the endpoint accepts the unauthenticated payload — does NOT change the live admin password unless `setg smartermail_keep y` is set. | Excellent | ✓ |
| `exploits/webapps/solarwinds/cve_2025_40551_solarwinds_whd_rce` | Detects SolarWinds Web Help Desk ≤ 12.8.8 Hotfix 1 vulnerable to the unauth Java deserialization RCE. Probe only — fingerprints the login page version banner. | Excellent | ✓ |
| `exploits/webapps/spotube/spotube` | Unauthenticated access to Spotube API enabling path traversal via WebSocket and denial of service attacks against the desktop music client. | Good |  |
| `exploits/webapps/termix/termix_xss_cve_2026_22804` | Stored Cross-Site Scripting in Termix File Manager (1.7.0-1.9.0) via malicious SVG file upload. Executes JavaScript in Electron context when previewed. | Normal |  |
| `exploits/webapps/textpattern_xss` | Detects Textpattern admin; auth-required stored XSS in /textpattern/index.php?event=pref. | Normal | ✓ |
| `exploits/webapps/varnish_styx_smuggling` | Detects Varnish-fronted edge cache; TE.CL request smuggling via inconsistent | Normal | ✓ |
| `exploits/webapps/visualstudio_debugger` | Connects to TCP/5858 (Node Inspector / VS Code debugger) and verifies a debug session is exposed. | Good | ✓ |
| `exploits/webapps/vite_path_traversal_cve_2025_30208` | Path traversal in Vite dev server /@fs/ endpoint. Appending ?import&raw bypasses allowed-path checks and returns arbitrary files from the host filesystem. Affects Vite < 6.2.3 / 6.1.2 / 6.0.12 / 5.4.15 / 4.5.10. | Great |  |
| `exploits/webapps/wfentlm_disclose` | Generates a UNC trigger HTML payload that leaks NTLMv2 hashes when | Normal | ✓ |
| `exploits/webapps/wordpress/vitepos_file_upload_cve_2025_13156` | Authenticated arbitrary file upload in Vitepos POS for WooCommerce plugin <= 3.3.0, allowing PHP shell upload via missing file type validation. | Great |  |
| `exploits/webapps/wordpress/wp_bricks_rce_cve_2024_25600` | Exploits the bricks/v1/render_element REST endpoint in Bricks Builder for WordPress to achieve unauthenticated remote code execution via crafted element data with PHP code injection. | Excellent |  |
| `exploits/webapps/wordpress/wp_litespeed_rce_cve_2024_28000` | Exploits weak hash generation in the LiteSpeed Cache crawler feature to brute-force the security hash and escalate to WordPress administrator. | Normal |  |
| `exploits/webapps/wordpress/wp_royal_elementor_rce_cve_2024_32suspended` | Exploits the unauthenticated file upload handler in Royal Elementor Addons for WordPress to upload a PHP webshell via multipart POST to /wp-admin/admin-ajax.php?action=wpr_addons_upload. | Excellent |  |
| `exploits/webapps/wp_storychief_rce_cve_2025_7441` | Detects the StoryChief WP plugin; unauthenticated REST endpoint allows | Good | ✓ |
| `exploits/webapps/wpcpi_upload` | Detects WP for CPI plugin readme; upload endpoint is unauth. | Good | ✓ |
| `exploits/webapps/wpgivewp_inject` | Detects GiveWP plugin via readme; PHP object injection via donation form. | Good | ✓ |
| `exploits/webapps/wpomnipress_xss` | Detects WP OmniPress plugin via readme; auth admin XSS in widget config. | Normal | ✓ |
| `exploits/webapps/xwiki/cve_2025_24893_xwiki_rce` | Unauthenticated RCE via Groovy template injection in XWiki SolrSearch. | Excellent | ✓ |
| `exploits/webapps/yourls_sqli_cve_2022_0088` | Detects YOURLS instance; SQLi in admin/upgrade.php that allows compromise. | Good | ✓ |
| `exploits/webapps/yourls_xsrf_idor` | Probes YOURLS /admin/ajax.php for unauthenticated CSRF/IDOR on link mgmt. | Normal | ✓ |
| `exploits/webapps/zabbix/zabbix_7_0_0_sql_injection` | Time-based SQL injection in Zabbix 7.0.0 API endpoints allowing arbitrary SQL execution and potential remote code execution. | Great |  |
| `exploits/webapps/zimbra_postjournal_rce` | Detects Zimbra ZCS by SMTP banner / 7071 admin port; postjournal | Great | ✓ |
| `exploits/webapps/zimbra_sqli_auth_bypass_cve_2025_25064` | SQL injection in Zimbra ZCS ZimbraSync endpoint allows unauthenticated | Great |  |
| `exploits/windows/windows_dwm_cve_2026_20805` | Exploits CVE-2026-20805 in Windows Desktop Window Manager to leak kernel object pointers for KASLR bypass. | Good |  |

## creds (30)

- 30 modules, 0 with `check()`

| Module | Description | Rank | Check |
|---|---|---|---|
| `creds/camera/acti/acti_camera_default` | Tests default credentials across FTP, SSH, Telnet, and HTTP on ACTi IP cameras. | Normal |  |
| `creds/camxploit/camxploit` | Comprehensive IP camera discovery, fingerprinting, and default credential testing across RTSP, HTTP, and HTTPS. Supports Hikvision, Dahua, Axis, CP Plus, Foscam, Vivotek, and generic cameras. | Great |  |
| `creds/generic/couchdb_bruteforce` | Tests CouchDB authentication via POST /_session. Single-target — scheduler does CIDR / random / file fan-out. | Normal |  |
| `creds/generic/elasticsearch_bruteforce` | Tests Elasticsearch HTTP Basic auth on the cluster root endpoint. Single-target — scheduler does fan-out. | Normal |  |
| `creds/generic/enablebruteforce` | Raises file descriptor limits (ulimit) for the current process to support high-concurrency brute-force operations. Provides guidance for persistent system configuration. | Normal |  |
| `creds/generic/fortinet_bruteforce` | POSTs `username=&secretkey=` to /remote/logincheck on a FortiGate SSL VPN portal and inspects the response body for the redirect / error markers. Single-target — scheduler does fan-out. | Normal |  |
| `creds/generic/ftp_anonymous` | Checks for anonymous FTP access on targets. Supports plain FTP and FTPS, IPv4/IPv6, and mass scanning (hose mode). | Normal |  |
| `creds/generic/ftp_bruteforce` | Brute-force FTP authentication with support for FTPS (TLS), combo mode, concurrent connections, and subnet/mass scanning. | Normal |  |
| `creds/generic/h3c_oem_kvm_bruteforce` | Brute-forces the H3C iBMC vendor-specific KVM session login at POST /api/oem_kvm/session, which has no rate limiting on default firmware builds. Tests every (user, password) pair in plaintext, base64, and double-base64 encodings — the endpoint silently accepts all three. A successful hit yields an X-Auth-Token that grants virtual-media + reboot equivalents (full host compromise). | Excellent |  |
| `creds/generic/http_basic_bruteforce` | Brute-force HTTP Basic Authentication using username/password wordlists. Supports HTTPS with invalid certificate acceptance, default credential testing, combo mode, concurrent connections, and subnet/mass scanning. | Normal |  |
| `creds/generic/imap_bruteforce` | Brute-force IMAP authentication using raw TCP protocol with TLS/IMAPS support. Sends IMAP LOGIN commands, handles greeting banners, and supports default credential testing, combo mode, concurrent connections, and subnet/mass scanning. | Normal |  |
| `creds/generic/l2tp_bruteforce` | Sends an L2TPv2 SCCRQ on UDP/1701 and reports whether the gateway responds with SCCRP / StopCCN. Single-target — scheduler does fan-out. NOTE: real L2TP credential brute-force needs a full PPP+CHAP stack, which is out of scope; this module detects reachable gateways only. | Manual |  |
| `creds/generic/memcached_bruteforce` | Probes Memcached SASL PLAIN auth via the binary protocol (cmd 0x21). Single-target — scheduler does fan-out. | Normal |  |
| `creds/generic/mqtt_bruteforce` | Tests MQTT v3.1.1 CONNECT authentication. Reads CONNACK return code to classify accepted / bad-credentials / not-authorized. Single-target — scheduler does fan-out. | Normal |  |
| `creds/generic/mysql_bruteforce` | Tests MySQL/MariaDB authentication via the HandshakeV10 → HandshakeResponse41 (mysql_native_password) flow. Reads the OK/ERR packet to classify the result. Single-target — scheduler does fan-out. | Normal |  |
| `creds/generic/pop3_bruteforce` | Brute-force POP3 authentication with SSL/TLS support. Tests credentials against POP3 mail servers with combo mode, retry logic, and subnet/mass scanning. | Normal |  |
| `creds/generic/postgres_bruteforce` | Tests PostgreSQL authentication via the protocol v3 startup flow. Cleartext (R 3) and MD5 (R 5) auth methods supported; SASL/GSS/SSPI fall through as unsupported. Tries common defaults first, then operator-supplied wordlists. Single-target — scheduler does CIDR / random / file fan-out. | Normal |  |
| `creds/generic/proxy_bruteforce` | Bruteforces proxy authentication for HTTP CONNECT (Basic auth), SOCKS5 (username/password), and HTTP forward proxies. Supports combo, spray, and credential file modes. | Normal |  |
| `creds/generic/rdp_bruteforce` | Tests RDP authentication via the X.224 → MCS → CredSSP / Standard RDP flows. Negotiates Hybrid (NLA) → TLS → Standard. Single-target — scheduler does fan-out. | Normal |  |
| `creds/generic/redis_bruteforce` | Brute-force Redis authentication using raw TCP protocol. Supports both legacy password-only AUTH and Redis 6+ ACL mode (AUTH username password). Tests default credentials, gathers server info on success, and supports subnet/mass scanning. | Normal |  |
| `creds/generic/rtsp_bruteforce` | Tests RTSP DESCRIBE auth (HTTP-Basic) on a given path. Single-target — scheduler does fan-out. | Normal |  |
| `creds/generic/sample_cred_check` | Sample module that tests HTTP Basic Auth with default admin:admin credentials. Serves as a template for building custom credential checking modules — uses the native ModuleCtx/ModuleOutcome shape so credential findings flow into LootStore. | Normal |  |
| `creds/generic/smtp_bruteforce` | Brute-force SMTP authentication supporting PLAIN and LOGIN mechanisms. Tests credentials against mail servers with combo mode and subnet scanning. | Normal |  |
| `creds/generic/snmp_bruteforce` | Tests SNMPv2c community strings via a sysDescr.0 GetRequest. Single-target — scheduler does fan-out. | Normal |  |
| `creds/generic/ssh_bruteforce` | Brute-force SSH authentication using username/password wordlists. Supports default credential testing, combo mode, concurrent connections, and subnet/mass scanning. | Normal |  |
| `creds/generic/ssh_spray` | Sprays a single password across multiple SSH targets and usernames. Avoids account lockouts by distributing attempts across hosts with configurable concurrency and delays. | Normal |  |
| `creds/generic/ssh_user_enum` | Enumerates valid SSH usernames via timing-based side-channel attack. Measures authentication response time differences to identify valid accounts, inspired by CVE-2018-15473. | Normal |  |
| `creds/generic/telnet_bruteforce` | Wordlist-driven Telnet credential probe with IAC handling. Single-target — scheduler does fan-out. | Normal |  |
| `creds/generic/telnet_hose` | Rapidly tests default credentials against Telnet services across large IP ranges. Supports mass scanning with concurrent connections and multiple default port checks. | Normal |  |
| `creds/generic/vnc_bruteforce` | Tests VNC RFB 3.x security-type 2 (DES challenge-response). Password-only — server silently truncates to 8 bytes. Single-target — scheduler does fan-out. | Normal |  |

## osint (3)

- 3 modules, 1 with `check()`

| Module | Description | Rank | Check |
|---|---|---|---|
| `osint/cert_transparency` | Queries crt.sh for every TLS certificate issued to the target domain or its subdomains, then extracts unique subdomain names from the CN / SAN fields. Pure OSINT — no traffic to the target. | Normal | ✓ |
| `osint/cname_chain` | Recursively follows CNAMEs for a single host (or a newline-separated file of hosts), tags terminal records that match known cloud providers, and flags hosts whose CNAME does not resolve to an A record (dangling). | Excellent |  |
| `osint/jwks_inspector` | Discovers JWKS endpoints under common paths, parses the key set, prints a per-key audit (kid/kty/alg/use/modulus length), and optionally exports each RSA public key as PEM (input for jwt_tool RS256→HS256 alg-confusion). | Excellent |  |

## plugins (1)

- 1 modules, 0 with `check()`

| Module | Description | Rank | Check |
|---|---|---|---|
| `plugins/sample_plugin` | Template plugin demonstrating the RustSploit native plugin API — uses ModuleCtx + ModuleOutcome and emits a Note finding per invocation. | Normal |  |