Module Type Ecosystem - KittySploit Docs

The root module directory is modules/. Two files strongly structure this catalog: core/lib/module_manager.py and core/utils/module_static_metadata.py. analysis and generated complete the official catalog.

Overview --- the sixteen families

Canonical type	Directory	Role in one sentence
`auxiliary`	`modules/auxiliary/`	Support: network scan, fuzz, servers, admin.
`exploits`	`modules/exploits/`	Exploits a flaw and delivers a payload.
`payloads`	`modules/payloads/`	Code executed on the target (shell, stager).
`listeners`	`modules/listeners/`	Receives reverse connections / callbacks.
`encoders`	`modules/encoders/`	Encodes the payload (signature evasion).
`transformers`	`modules/encoders/`	Obfuscates C2 flow between listener and agent.
`post`	`modules/post/`	Actions after compromise (gather, pivot).
`workflow`	`modules/workflow/`	Automates a sequence of modules.
`backdoors`	`modules/backdoors/`	Webshells and persistent access.
`browser_auxiliary`	`modules/browser_auxiliary/`	Browser support modules.
`browser_exploits`	`modules/browser_exploits/`	Client-side exploits (XSS, social eng.).
`docker_environments`	`modules/docker_environments/`	Docker isolated test environments (DVWA, WebGoat).
`analysis`	`modules/analysis/`	Forensic analysis outside live exploitation.
`shortcut`	`modules/shortcut/`	One-shot shortcuts to common workflows.
`generated`	`modules/generated/`	Generated modules (API import, skeletons).

inventory
search --type scanner --limit 5
search --type exploits --limit 5

Diagram --- how types connect

Typical attack chain (isolated test environment or authorized mission). Use this schema as a reference:

                    +------------------+
                    | docker_environments|
                    |  (dvwa, webgoat)   |
                    +---------+--------+
                              | target up
                              v
+----------+    +----------+  |  +------------------+
| auxiliary|    | scanner  |--+->| findings / vulns  |
| portscan |    | HTTP *   |     | (workspace vuln) |
| honeypot |    +----------+     +--------+---------+
+----------+                              |
                                          v
                               +--------------------+
                               | exploits (+ check) |
                               +----------+---------+
                                          |
          +-------------------------------+-------------------------------+
          |                               |                               |
          v                               v                               v
   +-------------+                 +-------------+                 +-------------+
   |  payloads   |                 |  encoders   |                 | transformers |
   | singles/... |                 | cmd/base64  |                 | python/xor  |
   +------+------+                 +------+------+                 +------+------+
          |                               |                               |
          +-------------------------------+-------------------------------+
                                          |
                                          v
                               +--------------------+
                               |     listeners      |
                               | multi/reverse_tcp  |
                               +----------+---------+
                                          | session
                                          v
                               +--------------------+
                               |        post        |
                               | gather / pivot     |
                               +----------+---------+
                                          |
          +-------------------------------+-------------------------------+
          |                               |                               |
          v                               v                               v
   +-------------+                 +-------------+                 +-------------+
   |  backdoors  |                 |  workflow   |                 |  shortcut   |
   | php_get     |                 | simple_wf   |                 | example_*   |
   +-------------+                 +-------------+                 +-------------+

Parallel branch (client-side):
  browser_server --> browser_exploits --> listener --> sessions
                 \-> browser_auxiliary (keylogger, harvest)

Outside the offensive chain:
  analysis/forensic/*  |  generated/api/*  |  plugins (extensions CLI)

Reading the diagram:

Environment --- docker_environments or real target in scope.
Discovery --- auxiliary (network) and scanner (application).
Exploitation --- exploits with payloads, optionally encoders and transformers.
C2 --- listeners before any reverse shell.
After access --- post, then optionally backdoors.
Orchestration --- workflow and shortcut chain the blocks.
Browser --- parallel branch via browser_server.

Type `scanner`

Role

Probe modules: HTTP, SMB, Bluetooth, etc. Produce ModuleResult with severity. Feed scanner -u, the agent, and campaign.

Workflow

use <scanner_path> --- e.g. use scanner/http/security_headers_detect.
show options --- target (rhost, rport, ssl, threads).
set rhost <target> --- authorized IP or hostname.
run --- execute the probe.

Tips: use the global scanner -u URL command to parallelize; use for a specific module and verbose output.

Real paths

modules/scanner/http/server_banner_detect.py
modules/scanner/http/security_headers_detect.py
modules/scanner/http/sensitive_files_detect.py
modules/scanner/http/phpinfo_detect.py
modules/scanner/smb/smbv1_detect.py

Search and inventory

search --type scanner --protocol http
search --type scanner --protocol smb
inventory --type scanner --protocol http --verbose
inventory --only gaps --type scanner