Traditional offensive security frameworks have hit a wall built out of memory overhead, noisy runtimes, and outdated target expectations. Heavy runtimes written in Ruby or Java struggle against modern endpoint defenses that flag generic, unoptimized binaries on arrival. Meanwhile, modern web apps have shifted entirely to asynchronous protocols, GraphQL graphs, and real-time WebSockets that blindside legacy scanners.
KittySploit enters this problem space as an open-source penetration testing framework built from the ground up to replace aging architectures. By stitching a Python control layer to an integrated Zig 0.16 compilation core and binding them to a local LLM orchestrator via Ollama, it targets the full attack lifecycle: recon, traffic analysis, payload generation, exploitation, collaboration, and post-exploitation.
[Target Specification]
│
▼
┌──────────────────┐ Local JSON/HTTP ┌────────────────────────┐
│ Ollama Engine │ ◄───────────────────────► │ KittySploit Agent │
│ (Local LLMs) │ │ (HTTP Intel & Planner) │
└──────────────────┘ └──────────┬─────────────┘
│
┌───────────────────────────────────────────────┼───────────────────────────────┐
│ │ │
▼ ▼ ▼
┌──────────────────┐ ┌────────────────────┐ ┌────────────────────┐
│ KittyProxy │ │ Zig 0.16 Core │ │ KittyCollab │
│ (REST/GraphQL/WS)│ │ (x64 Polymorphic) │ │ (Real-Time Editor) │
└──────────────────┘ └────────────────────┘ └────────────────────┘
Architectural Breakdown: Python Agility Meets Zig Systems Execution
Framework maintainability has always been at odds with binary stealth. Python gives security operators rapid scripting capabilities, intuitive module authoring, and simple prototyping. However, Python-generated payloads and memory wrappers are loud, bloated, and easily caught by automated defense systems.
| Component / Layer | Architectural Implementation | Primary Offensive Role |
|---|---|---|
| Control Plane | Python Hybrid Core | Module orchestration, CLI/Web UI, session handling |
| Payload Engine | Zig 0.16 Toolchain | Dependency-free compilation, x64 polymorphic encoding |
| Agentic Core | Ollama Local Endpoint | Autonomous planning, HTTP intelligence, recon parsing |
| Inspection Engine | KittyProxy | Passive/Active capture for REST, GraphQL, and WebSockets |
| Team Operations | KittyCollab | Synchronous state synchronization, real-time shared workspace |
| Transport Layer | Multi-Protocol / Native Tor | Traffic anonymization, distributed session routing |
KittySploit resolves the runtime dilemma by shifting compiled execution to an integrated Zig 0.16 toolchain. Instead of dropping pre-compiled, signature-heavy stubs or relying on massive external compiler dependencies, it produces dependency-free x64 polymorphic encoded payloads directly.
This low-level design is coupled with native multi-protocol session handlers and direct Tor routing out of the box, ensuring that network operations avoid the common telemetry signatures that trip contemporary defenses.
Local AI Orchestration: Decoupling Agents from the Cloud
Most implementations of AI in offensive workflows amount to thin wrappers around hosted APIs. This introduces severe operational security liabilities: targeting data, internal reconnaissance results, and vulnerability states get shipped directly to third-party servers.
KittySploit bypasses this vector entirely by embedding an autonomous agent that interfaces with locally hosted models through an Ollama endpoint.
bash# Pointing the agentic framework at a local inference runtime kittysploit --target target.local --ai-provider ollama --ai-endpoint http://127.0.0.1:11434
The AI layer is structured around distinct planning and caching modules rather than freeform text generation:
- Target Ingestion: The operator supplies a single target identifier.
- Reconnaissance Correlation: The agent processes incoming recon artifacts and runs HTTP intelligence components to isolate active interfaces.
- Module Evaluation: With a library of over 1,150 modules, the planner cross-references identified surfaces with applicable exploits.
- Autonomous Path Construction: The model suggests verified execution chains and payload profiles without manual parameter tweaking, relying on built-in response caching to minimize duplicate compute.
Because execution loops run against local inference parameters, no sensitive target topology leaves the operator's machine.
Traffic-Driven Exploitation: Automated Analysis with KittyProxy
The attack surface of modern targets is rarely a predictable list of static URI routes. Modern architectures run stateful WebSocket streams, deeply nested GraphQL schemas, and dynamic microservice endpoints that standard crawl-and-fuzz tooling misses.
KittySploit includes KittyProxy, an integrated smart interception layer designed to shorten the feedback loop between discovery and weaponization:
[ Client Traffic ] ──► [ KittyProxy Parser ] ──► [ Schema / Route Extraction ]
│
▼
[ Dynamic Module Trigger ] ──► [ Targeted Exploit Execution ]
KittyProxy continuously inspects live HTTP transactions, automatically categorizing traffic into REST APIs, GraphQL queries, and WebSocket channels. Once an endpoint structure is mapped, the proxy directly links that signature against the framework's internal exploit modules. It triggers targeted actions right from observed traffic patterns, eliminating the manual task of re-exporting requests into third-party testing utilities.
Distributed Operators: Shared State via KittyCollab
Complex red-team engagements fall apart when telemetry and session states are siloed across isolated operator terminals. KittySploit addresses team environments through two dedicated operational features:
- KittyCollab Real-Time Editor: A shared workspace allowing operators to coordinate actions, share context, and run joint attack steps simultaneously.
- Modern Web Interface: A browser-based interface for proxy inspection, traffic manipulation, and live session monitoring.
- Modular Ecosystem: A community marketplace engine designed for rapid importing, validating, and sharing of newly authored exploit modules.
By combining low-level systems compilation in Zig, offline local machine intelligence, and dynamic protocol-aware proxying, KittySploit sets a modern baseline for modular penetration testing frameworks.