KittySploit Framework
Modular offensive security console: modules, C2, marketplace installs and local execution. You keep the toolchain.
- Complete open-source framework
- Local and self-hosted operation
- 624 stars · 99 forks
CATALOG FREE AND PAID
Open-source tools you run yourself. Optional KittySploit Reports when the deliverable has to leave the lab. Every card says whether it is free or paid.
Framework and Reports Server are free. Reports SaaS and Reports Local are the paid publishing options.
Modular offensive security console: modules, C2, marketplace installs and local execution. You keep the toolchain.
Hosted KittySploit Reports. Editors are billed; viewers stay free. Encryption happens in the browser.
Desktop app for reports that stay on the machine. One license activates one desktop, and it can connect to your own server.
Share reports and users on infrastructure you control. The server download is free.
The catalog of extensions you install into your own Framework. First-party tools below are free; the public catalog also lists paid packages.
Browse modules, plugins, interfaces and middleware. Install with market install. Paid items check out once; they still run on your machine.
HTTP/HTTPS intercepting proxy with API, GraphQL and WebSocket discovery from live traffic.
View on GitHub ↗Modern web GUI for campaigns, proxy analysis and day-to-day operator workflows.
View on GitHub ↗Turn scattered OSINT signals into a connected graph — domains, emails, infra and relationships.
View on GitHub ↗PCAP protocol analysis and investigation UI for traffic that lives outside the browser.
View on GitHub ↗V8/Frida memory workbench with Chrome DevTools Protocol support for browser and runtime work.
View on GitHub ↗Real-time shared editor for scripts, notes and payloads — same session, same context, same target.
View on GitHub ↗Control hub for authorized nodes — topology map, health checks, and remote CLI dispatch across labs and field ops.
View on GitHub ↗Chat-style pentest workspace — plan first, then confirm module and command runs, with skills and durable memory.
View on GitHub ↗Public catalog, docs and the read-only Modules API. All free to use.
Read-only Search API for the live module index. Filter by type, CVE, author and date. No auth required.
Open API docs →Browse modules, CVEs and packages in the public catalog used by the Framework marketplace.
Open search.kittysploit.com ↗Install, usage, marketplace publishing and operator guides for the Framework and extensions.
Open docs ↗Need something that is not listed? Community packages live in the Marketplace. Partnerships are separate from product pricing.
START WHERE YOU NEED KEEP THE REST OPTIONAL
Install the Framework, self-host Reports Server, or pay for hosted Reports and the desktop license. Each product stays independent.
Reports Local · Linux
Debian and Ubuntu use .deb. CentOS, RHEL, Rocky and AlmaLinux use .rpm.
Reports Server · Linux
Debian and Ubuntu use .deb. CentOS, RHEL, Rocky and AlmaLinux use .rpm.
Installer integrity
90d92a373862038c44c3dedfa5b580adc786bd69bbedd879c1c796fc034b930d
92f78fc6a1b8253b481395eb890fe48c379308bd2d472381d2b67affe83e4046
d9fc4c70e6f275296cbcbe381efdba338be64431ee0e75ee6351cd61c5bb4412
2c6d6310693ba147ae7c105c408570e98baf4076788f380b80e673b50db44fca
8efbf7c69dd6355246c43f6f45bed41b7577b193a30a66c3dfd8716e7456c9fe
f7b904187859bf014de9f5a47f75d38ad1a47b25a6b4aebd554bc04db982f4bb