Developer Tools and Advanced Console

This chapter groups the commands that contributors and advanced operators use daily. Unlike operational commands (use, run), these modify the framework itself, troubleshoot it, or accelerate module development. They are essential before shipping a module to the marketplace or debugging a complex scan on mission.

Module Development Cycle: new, edit, reload

Scaffolding with new module

The new command generates a complete skeleton: Python file, JSON metadata, and unit test. It avoids copy-pasting an old module and forgetting __info__.

new module acme_sqli_scanner --type scanner --path scanner/http \
  --tag acme --author "Your Name" --description "Scanner SQLi Acme CMS"
new module acme_rce --type exploit --cve CVE-2026-12345 --preview
new module tcp_probe --type auxiliary --path auxiliary/scanner/portscan --no-http-mixin
new module bash_rev --type payload --path payloads/singles/cmd/unix
new module bind_tcp --type listener --preview

Supported types (--type): scanner, auxiliary, exploit, post, payload, listener. Generated files:

• modules/<path>/<slug>.py --- Module class with typed options.
• modules/<path>/<slug>.metadata.json --- tags, CVE, protocol for sync.
• tests/modules/<path>/test_<slug>.py --- unittest test skeleton.

Useful options:

• --http-mixin / --no-http-mixin --- Http_client mixin for HTTP modules.
• --preview --- displays the plan without writing (review before generation).
• --force --- overwrites existing files (caution).

After generation:

sync now
use scanner/http/security_headers_detect
show options
python -m unittest tests/modules/scanner/http/test_<slug>.py

In-Console Editing with edit

edit opens the built-in editor (prompt_toolkit + Pygments highlighting) on the currently loaded module file via use.

use scanner/http/security_headers_detect
edit

Behavior:

1. Read source file from module_loader.discover_modules().
2. Multiline editing; Ctrl+D ends input.
3. Confirmation before save; automatic backup <file>.backup.
4. Reminder: reload the module to apply changes in memory.

Prerequisites: pip install prompt_toolkit pygments. Without a selected module, edit fails with No module selected.

Hot Reload: reload

reload reimports the Python module from disk without restarting KittySploit.

use exploits/http/flask_debug_rce
set target http://127.0.0.1:5000
run
# ... failure, file correction ...
reload
set target http://127.0.0.1:5000
run

Warning: all module options are reset to default values after reload. Re-enter set before run.

The module_loader.modules_cache cache is updated; current_module points to the new instance.

Comparison of the Three Commands

Cyclic Patterns: pattern

pattern implements Metasploit-style cyclic string generation, essential for buffer overflows and crash analysis.

Syntax

pattern create 200
pattern offset Aa0
pattern offset 0x634241
pattern offset 0x306141

Pattern Format

The generator produces a [A-Z][a-z][0-9] sequence: Aa0, Aa1, Aa2…{} Aa9, Ab0…{} up to Zz9, then repetition. Maximum length: 20 280 bytes.

pattern create 20
# Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3

Offset Calculation

After a crash, EIP/RIP often contains a portion of the pattern (or its little-endian hex representation):

# Crash with EIP = 0x41326341  ("Ac1A" in memory, x86 endianness)
pattern offset 0x41326341
# Pattern found at offset: 12

For direct text search:

pattern offset Ac1A

Integration in a KittySploit Exploit

1. pattern create 500 → copy into set buffer ... or payload.
2. Trigger the crash on the isolated test target.
3. Note the 4--8 bytes at the control register offset.
4. pattern offset <value> → exact size before overwrite.
5. Replace with set buffer <padding> + <return_address>.