Advanced Networking --- Tor, Routes, Jobs, and Discovery

This page documents KittySploit's operational network layer beyond basic recon and post-exploitation pivoting: anonymization (Tor), transparent routing (SOCKS routes), job supervision, multi-protocol discovery, and manual HTTP requests from kittyconsole.

Network stack overview

                    +------------------+
                    |   kittyconsole   |
                    +--------+---------+
                             |
         +-------------------+-------------------+
         |                   |                   |
         v                   v                   v
    +---------+        +-----------+       +------------+
    |   tor   |        |   route   |       | network_   |
    | manager |        |  manager  |       | discover   |
    +---------+        +-----------+       +------------+
         |                   |                   |
         v                   v                   v
    SOCKS 9050         socket wrapper      ARP/ICMP/TCP/
    (global)           (pivot sessions)      UDP/NetBIOS/mDNS
         |                   |
         +--------+----------+
                  v
           modules / http / scanners

The http command and modules inherit the global proxy (Tor or KittyProxy) unless explicitly overridden (http --proxy, module options).

tor command

tor configures the framework's tor_manager: when Tor is enabled, framework network operations pass through the local SOCKS proxy (port 9050 by default for the Tor daemon, 9150 for Tor Browser).

Full syntax

tor check
tor status
tor enable
tor enable --host 127.0.0.1 --socks-port 9050
tor enable --host 127.0.0.1 --socks-port 9050 --control-port 9051
tor enable --no-check
tor enable --no-save
tor disable
tor disable --no-save
tor check --host 127.0.0.1 --port 9150

Subcommands in detail

enable options

• --host --- SOCKS proxy host (default 127.0.0.1).
• --socks-port --- SOCKS port (default 9050, auto-detection possible).
• --control-port --- Tor control port (default 9051).
• --no-check --- enables without testing prior availability.
• --no-save --- does not persist to the configuration file.

Interpreting tor status

tor status

Output typically includes:

• Enabled --- Yes/No.
• SOCKS Proxy --- host:port.
• Control Port --- for future extensions (circuits).
• Proxy URL --- socks5h URL used internally.
• Available --- SOCKS port accepts connections.
• Connection Test --- end-to-end validation request.

If Available: No, start the daemon:

# Linux (system service)
sudo systemctl start tor

# macOS (Homebrew)
brew services start tor

# Tor Browser: launch the application (SOCKS often on 9150)
tor check --host 127.0.0.1 --port 9150
tor enable --host 127.0.0.1 --socks-port 9150

When to use Tor in KittySploit

• OSINT or scans from a workstation whose IP must not appear in target logs (mandate required).
• Access to onion services (via compatible modules).
• Network identity separation in defensive research.

When not to use Tor

• Local isolated test targets (127.0.0.1, Docker bridge) --- latency and frequent failures.
• Internal pivot (route) --- traffic must egress via the compromised session, not Tor.
• High-rate scans --- Tor egress rate limiting.

route command --- pivot and subnets

route implements a Metasploit-style routing table: traffic to a subnet transits via the SOCKS proxy of an active session. See the pivot routing section for initial SOCKS deployment (post/shell/linux/pivot/socks_proxy).

Syntax

route
route list
route print
route add 192.168.1.0/24 <session_id>
route add 10.0.0.0/8 <session_id> 9050
route add 172.16.5.10 <session_id>
route del 192.168.1.0/24
route del 192.168.1.0/24 <session_id>
route flush
route help

Parameters

• subnet/cidr --- target network (10.10.0.0/16); a single IP becomes /32.
• session_id --- session UUID (see sessions list).
• proxy_port --- local SOCKS port (default 1080).

Complete pivot workflow

sessions list
use post/shell/linux/pivot/socks_proxy
set session <session_id>
set srvport 1080
run
route add 172.17.0.0/16 <session_id> 1080
route list
network_discover --range 172.17.0.0/24 --method tcp --threads 20
use auxiliary/scanner/portscan/tcp
set rhosts 172.17.0.5
run
route flush

Longest-prefix matching

Multiple routes can coexist. The most specific route wins: an entry 172.17.0.5/32 takes precedence over 172.17.0.0/16.

Socket wrapper

On each route add, KittySploit reinstalls the socket_wrapper so that all TCP modules honor the table. route flush or deleting the last route uninstalls the wrapper.

Pivot troubleshooting

• Timeout on internal scan --- SOCKS not started or wrong port in route add.
• Inactive session --- route appears as [inactive] in route list.
• Tor conflict --- disable Tor before pivoting; traffic must follow the session.
• Forgot flush --- at end of mission, route flush is mandatory.

jobs command --- background tasks

jobs queries the global_job_manager: listeners, collab servers, long-running tasks launched by the framework or certain plugins.

Syntax

jobs
jobs --list
jobs -l
jobs --info 1
jobs -i 1
jobs --kill 1
jobs -k 1
jobs --kill-all
jobs --clear
jobs --watch
jobs --json

Listing columns

Real-time monitoring

jobs --watch

Refreshes the screen every 2 seconds. Ctrl+C stops monitoring without killing jobs.

JSON export (automation)

jobs --json

Useful for CI scripts or dashboards; parse JSON with external jq.

Typical jobs to know

• TCP/HTTP listener --- after handler or exploit -j.
• collab_server --- the relevant documentation.
• Plugin listen --- may appear depending on thread implementation.
• Parallel scans --- certain modules in job mode.

End-of-mission hygiene

jobs --list
jobs --kill-all
jobs --clear

Do not leave listeners on public ports. Check ss -tlnp on the OS side if in doubt.

network_discover --- advanced mode

network_discover is a console command (not a module) combining ARP, ICMP, TCP, UDP, NetBIOS, and mDNS. It intelligently merges results (preserving MAC addresses discovered by ARP).

Basic syntax (recap)

network_discover
network_discover --range 192.168.1.0/24
network_discover --range 10.0.0.0/24 --threads 100 --timeout 2

Discovery methods

network_discover --method all
network_discover --method arp --threads 100
network_discover --method ping --timeout 2
network_discover --method tcp --threads 50
network_discover --method udp
network_discover --method netbios
network_discover --method mdns

Local network auto-detection

Without --range, the command deduces the CIDR via the local IP (ip addr on Linux, ipconfig on Windows). On failure:

network_discover --range 192.168.56.0/24

Output and columns

network_discover --range 192.168.1.0/24 --method all

Columns: IP, MAC, Vendor (data/vendors/oui.json database), Hostname, Services, Method.

Final summary per method (Discovery summary: ARP: 12, PING: 45…).

Strategies by environment

Authorized office network

network_discover --range 10.20.30.0/24 --method arp --threads 80
network_discover --range 10.20.30.0/24 --method tcp --threads 40 --timeout 1
host add 10.20.30.15 --note "File server"

Metasploitable Docker test environment

network_discover --range 127.0.0.1 --method ping --threads 5
network_discover --range 127.0.0.1 --method tcp --timeout 2

ARP is often empty; TCP on mapped ports (2222, 3306…) is more reliable.

Pivot via route

Once the route is active, target the internal subnet:

route add 172.17.0.0/16 <session_uuid> 1080
network_discover --range 172.17.0.0/24 --method tcp --threads 15

Privileges and limitations

• ARP and certain UDP scans benefit from sudo on Linux.
• Docker NAT can mask real MAC addresses.
• Tor enabled slows or blocks local discovery --- disable it.
• Respect scope: mentally filter IPs outside the mandate before host add.

Workspace consolidation

host services 192.168.1.10
host note 192.168.1.10 "NetBIOS: FILESERVER"
campaign update --phase recon

syscall command --- syscall database

syscall queries the embedded data/syscall database (shellcode development, post-exploitation, binary analysis). Architectures: x86_64, x86, arm64, arm32.

Syntax

syscall
syscall architectures
syscall info x86_64
syscall list x86_64
syscall list x86_64 20
syscall get x86_64 59
syscall get x86_64 execve
syscall search x86_64 exec
syscall search arm64 open

Actions

Example --- prepare an execve stub

syscall get x86_64 execve
syscall search x86_64 mmap
syscall list x86_64 15

Typical get output: number, name, hex, parameter list, source.

Unavailability

If the database is not installed:

Syscall database not available. Install kittysploit with bundled data assets.

Reinstall the full package or verify data/syscall/.

http command --- integrated HTTP client

http sends HTTP(S) requests from the console, with curl-like options. It respects Tor and KittyProxy unless explicit --proxy.

Syntax

http https://example.com/api/health
http example.com -X GET
http https://target.local/login -X POST -d "user=admin&pass=test"
http https://api.target.com/v1/users -X POST \
  -j '{"name":"audit"}' -H "Authorization: Bearer TOKEN"
http https://target.local -I
http https://target.local -i
http https://target.local -L
http https://target.local -k
http https://target.local -o /tmp/response.html
http https://target.local --timeout 30
http https://target.local --proxy http://127.0.0.1:8080
http https://target.local -A "KittySploit-Audit/1.0"
http https://target.local -v

Curl-like options

Tor and framework proxy integration

tor enable
http https://check.torproject.org/api/ip -v
tor disable

Without --proxy, http automatically uses the Tor proxy if enabled, otherwise KittyProxy if configured.

Pentest use cases

• Verify an endpoint before use scanner/....
• Replay a suspicious request from the proxy (complement to api_import).
• Test headers (-H "X-Forwarded-For: 127.0.0.1").
• Download a resource (-o) for offline analysis.

Common errors

• Malformed header --- mandatory format "Key: Value".
• -d and -j together --- mutually exclusive.
• Invalid JSON --- validate with python -m json.tool before -j.
• Self-signed certificate --- -k in isolated test environment only.

Integrated scenario --- internal recon after pivot

1. sessions list --- note the UUID.
2. use post/shell/linux/pivot/socks_proxy; set session ...; run.
3. route add 10.10.20.0/24 <uuid> 1080.
4. network_discover --range 10.10.20.0/24 --method tcp --threads 25.
5. For each interesting host: http http://10.10.20.5/ -I -k.
6. use auxiliary/scanner/portscan/tcp; set rhosts 10.10.20.5; run.
7. jobs --list --- verify active tasks.
8. End: route flush; jobs --kill-all.

OSINT scenario --- Tor + HTTP

1. tor check --- validate the local daemon.
2. tor enable --socks-port 9050.
3. tor status --- Connection Test: Passed.
4. http https://example.com -v -L.
5. plugin run osint -t example.com.
6. tor disable --- restore direct network.

Command combination --- cheat sheet

Performance and tuning

network_discover

• Increase --threads on /24 networks (50--100) if the mandate allows.
• Reduce --timeout on noisy networks to speed up (at the cost of false negatives).
• tcp method alone after ping to target live hosts (manual workflow).

jobs

Monitor zombie jobs after console crash:

jobs --info 3
jobs --kill 3
jobs --clear

Tor

SOCKS latency multiplies scan time; prefer http and targeted modules rather than full network_discover via Tor.

Operational security

1. Document each route add (who authorized which subnet).
2. Do not combine Tor and pivot --- contradictory network paths.
3. Export network_discover results to the workspace before route flush.
4. http -k requests bypass TLS --- mention this in the report.
5. jobs --kill-all before leaving a shared test VM.