Marketplace, Extensions, and Ecosystem

Marketplace philosophy

KittySploit separates the stable core from versioned contributions. The marketplace lets you install modules, plugins, UI interfaces, and middleware without forking the main repository.

market command

market list
market search <term>
market info <extension_id>
market install <path_or_url>
market uninstall <extension_id>
market update

After installation: sync now and reload if needed.

Extension types

extension.toml manifest

id = "isolated test environment-http-detector"
name = "Isolated test environment HTTP Detector"
version = "1.0.0"

[compatibility]
kittysploit_min = "1.0.0"
kittysploit_max = "2.0.0"

[permissions]
network_access = true
database_access = false
sandbox_level = "standard"
allowed_imports = ["requests"]
blocked_imports = []

Permissions

Request only what is necessary. An HTTP detection module does not need database_access. Internal reviews should block overly permissive extensions.

Example: KittyProxy

KittyProxy exists in apps/KittyProxy and can also be launched from the repository root:

market install ./apps/KittyProxy
python3 launch_kittyproxy.py

Use it for HTTP interception, request replay, endpoint inventory, and traffic capture within the authorized scope.

Team workflow

1. Fork or feature branch for the module.
2. Tests on dedicated isolated test environment.
3. inventory with no broken entries.
4. Code review + extension.toml permissions.
5. market install in staging then internal production.

Metasploit plugins

The metasploit plugin provides a bridge to MSF:

plugin load metasploit
plugin run metasploit connect --host 127.0.0.1 --port 55553
plugin run metasploit search eternal

Useful for tool transition; document which part of the engagement stays under KittySploit (workspace, reports) vs MSF (legacy exploits).